Hello, my name is Chris Nevin and I work for NCC Group, so this tool is called Carnivore, so that's a Microsoft external attack tool or assessment tool. So the cryptozoologists amongst you might know this, so that spells meet. So that's very amusing. And it's basically a tool to help pentesters find misconfigurations and vulnerabilities in Microsoft on-premises servers. So also apologies if I talk quickly, but there is quite a lot to get through. So the basic outline of the presentation. So I'm going to start with a demonstration just to show what the tool can do and then dive a bit deeper into some of the techniques and the research behind them after that. So now intro demonstration. Okay, so first a quick overview just to give you a taste of what the tool can do. So just before I kick it off, we've selected all services and we're also going to attempt to discover the internal domain information. You might notice that it's a .nev domain, obviously that wouldn't normally be a top level domain, but this is my training lab. So first of all, it's going to look for DNS, sorry, do DNS lookups for subdomains which are normally connected with a particular service. So for example, link discover with Skype, then it verifies there's something there. So it's not just a wildcard resolution. And then it also does some checks to make sure, does it also actually seem to be an exchange or a Skype server? So I've also built in some kind of bailout options. So for example, if we get back a server header saying that it's njinks, it's not even Windows, we don't need to test every possible endpoint just in case one of them is a Skype server. So yes, so that's something that we do. So it also validates the username enumeration and the password spray URL separately. I'll come onto that in a little bit, but basically there are occasions where an organization might have hidden most things, but there'll be one password spray URL kind of hidden away. So we try the most obvious and then if they don't hit, there are other kind of password spray endpoints that are possible. So yes, so hopefully if an organization has something exposed, then we'll be able to find it to report to them. So we also log everything here and you've got export options. If you want to kind of manually export things for some reason. I'll cover Office 365 more at the end, but for this section, if Office 365 is ticked, then it will explicitly check if this has any kind of cloud presence. Even if it's not ticked, then the response to Skype for Business, for example, might come back and say, I'm hosted in the cloud and then we'll still do the standard kind of checks for is it federated and that kind of thing. And then it will add, so say we just did Skype for Business. It says it's in the cloud. It turns out it's federated. We'll get an Office 365 and an ADFS option here. So okay, so we've also got global verbosity here. So you can kind of tweak that up and down depending on what you want to see. Okay, so let me kick this off. Okay, so the other thing with this Discover Internal Domain, then it does the fairly standard blank type one NTLM message and you can see it's called back the internal domain name. So at the moment, it does that individually for each of these services. And that's because Skype might be hosted in Germany and the ADFS server might be in Canada for some reason. And so when you're hitting, when you're spraying that server, then you've got the internal domain information for the particular server that you're hitting. And in fact, even on a job just last week, then these were all different. So it does happen quite frequently. I might add some kind of advanced options. So you can say just assume they're all the same. But like I say, that's maybe a recipe for potential disaster. So okay, we've also got the IP addresses here. So you can obviously check those against your scope. And if you want to, you can kind of run this once, check the IP addresses against your scope, and then do the more active kind of blank until M1 message. So the other thing to mention is for Skype, so link discover is the kind of auto discover service. And that actually points to the real server, which is what we want to hit. So that's why there's two kind of entries for Skype there. So we've now got Skype exchange, ADFS and RD web. So I'm going to show you a quick run through of username enumeration and password spraying just to give you an idea. So smart enumeration, we'll leave it on the defaults. We're also going for password one, just kind of standard. So you see there's quite a lot of usernames to try here as it's going through. We found one of a particular format. So it's now continuing to loop through nine different formats. And you'll see that when we discover the correct format, then this will drop drastically because then we switched to just using usernames of that format. So we've now got two of the same format, so first initial surname. And now we've got three. So you'll see that it's now selected that format of jsmith. So everything we do, oh, sorry, if we left that continuing, it would just be, as you can see here, it's now less usernames and it's just doing usernames of that format. So now I'll quickly show you password spray as well. So I'll use that same format, jsmith. So for the password spray, that will now spray that in the kind of modern style username format. So jsmith.nevtech.nev. And we'll just try summer 2020 just to see if there happens to be a user who might have been daft enough to use that as a password. So here we go. So that's gonna take a second. I'm sure we're not gonna find anyone because of course no one ever uses passwords like this. Who would possibly be that foolish? So here we go. If we give it another couple of seconds, you can see again this is just doing that one username list. So obviously that's the same number of users total that it would be spraying as the smart enumeration was looking at. So it should be around about now. So there you go. So we've now uncovered one user with that password. We've used the RD web service, but obviously we could have sprayed that on any of these other services. And at the moment, looking at the internal domain information, we can probably assume that they're kind of gonna be the same across all of them. Okay, so let's have a look. Let's just do one with Skype. So, here we go. So actually, sorry, I forgot to use Skype. So just to show you, you can also password spray enumerated users. So let's use that same. It was 2019. Okay, so for that option, then we were spraying the users in the legacy format because those are the ones we've already enumerated. And for username enumeration, that's incredibly slow because for every invalid user, you might have to wait something like 20 or 30 seconds. When we're spraying this list of already enumerated users, then we kind of know already that they exist. And actually that's still quite fast even when spraying in legacy format because you're not having to wait for every invalid user. So obviously, we've now got him as well. You can see we've got this access token here. So I'll quickly show you the address book. So we'll choose this user who we've already got the access token for. Again, I'll explain in more detail some of these other settings. But for now, we're just gonna let this go, see what happens. I'm also gonna come back to the meeting snooper later. So this is just to kind of show the address book functionality. Here we go. And so you can see now, all of these other users popping up. So we get the sipusername, the email address, title, department. We can kind of tick these on and off. The default settings that I've got here are basically the ones we can get relatively quickly. So if I actually expand that and choose to pull some of this other information, it can take quite a long time, especially with quite a large domain. So in this instance, we just go for the default. It's fairly quick. Obviously for my test lab, this is quite a small number of users, but there you go. You can see the general gist of what's possible with this tool. Okay, so now for some just general statistics. So first of all, I basically ran a version of this against the Alexa, well, the top 100,000 of the Alexa top a million of those 11.79% were attackable at all. And so this shows that of that 11%, about 11%, so how many had each service? So obviously some could have had more than one service. This started, kind of all started initially as a Skype attacking or assessment tool. So that's secretly my favorite, but you can see it's kind of still getting beaten out by exchange and ADFS. Maybe not by all that much. So one caveat with the kind of cloud element here is that there are some false positives in there because for this assessment, I didn't explicitly check whether they were hosted in Office 365. So this is just listing if when I made a link discover request, did it come back and say it was hosted in the cloud? So actually that number might even be higher if we'd have explicitly asked. And for some of them, it kind of seems to suggest that they're hosted in the cloud, but then maybe everything isn't properly configured and that service isn't there. So I could say the cloud kind of maybe take with a pinch of salt, but the others, that's what was found and what was kind of verified as existing. So the first part, subdomain enumeration, we'll go into that in a little bit more detail. Okay, so as I said before, I split the username enumeration URL and the pass spray or the endpoint validation. Previously it bailed if the username enumeration wasn't there, but then I found multiple times and in fact on that wider kind of mass assessment I did, then quite often you would find that organizations have just one or just the other. So for example, here you can see actually there's 53% had a password spray endpoint over 47% with a username enumeration. So kind of 6% more had a password spray endpoint than had both. There were some that just had username enumeration. And what's interesting about this is that it means that for those organizations with just a kind of weird password spray NTLM authentication endpoint somewhere, then it seems likely that they potentially might not even be aware of that because they've kind of firewalled off or hidden away all of the well-known, the username enumeration, the standard login points, but then they have this one password spray endpoint that kind of seems to have eluded that. So yeah, that's kind of interesting. So kind of all looks for some domains in the order shown here. So these statistics are taken from that 11% of the 100,000. So hopefully it means that we'll do as few requests as possible because obviously we're looking at the one that's highly likely to exist and then only looking at the others if it doesn't. So in future, I might add an option for a kind of, you know, you can choose between light or full enumeration. So maybe you could choose to just look at the top two and then discount it. And yeah, so then again, maybe managing to kind of cut that down even more as to how many requests you need to send. So now username enumeration in a little bit more detail. So we're gonna start with a demonstration. Okay, so we've got various options here that I'm gonna go through. So firstly, smart enumeration that we saw before. So basically that will take these nine different formats of username taken from the top statistically likely username's lists. And it will basically try the top username in each list and then the top of the next list, top of the next list. And essentially, as you saw before, it's looking for three valid usernames of the same format. So that's using the timing-based difference, which is fairly well known for Skype and Exchange. I've added it here for ADFS and RDWeb as well. So we've got this advanced option here as well that if you want, you can kind of pick a format and where you wanna start in that list. Or you can leave it as it is. You can also do an individual username or you can provide your own list. Or there's these pre-built ones. So these are kind of standard and service accounts. And Counts will killer was created by my colleague, Owen Bellas. So that's kind of a list of maybe fairly standard user accounts that might be in there. So you can set the password. So obviously also it works on the timing-based difference and then also if you get the password right, then great. So again, I would just show you, obviously this is fairly similar to what we saw before. One interesting additional point to note is additional information you can get depending on the service. So for Skype, then we can actually determine quite a bit of additional information. So SIP-enabled basically just means, so actually, sorry, some of these will only come up if you get the password right as well. So SIP-enabled would mean you've got the username and the password right and that user is basically set up on Skype. So account disabled, whatever password you give, you would get that if the account is disabled. You should see that in a second. Now that it's switched over. In fact, I might have re-enabled that user.  For Skype, you can also tell if the password's expired and it's possible that you might actually then be able to take that password. And if you found an endpoint, maybe for the VPN, it might be, you can even kind of put that password in and it will ask you to reset it. Obviously on a test, that's probably a little bit too crazy of a thing to do, maybe for a red team or with the kind of technical point of contact, green light. And then for Skype, we can also get this server error, but again, that means you've got the password right. And as I said before, you'll get the access token there if you do. So yeah, username and numeration. Okay, so as you've just seen, smart and numeration will take nine lists of statistically likely usernames and it will go through those until it finds three of the same and then automatically select that format and then carry on. Now, one interesting thing is this difference between legacy and modern format. So legacy is domain slash username. Modern kind of email style is username at domain. So that can match, they can match, but they don't necessarily have to. And again, the modern format could match the email, but doesn't necessarily have to. Now for username and numeration, we can only use the legacy format and that's to get that timing based difference. So one interesting thing is that that causes a little hiccup when rolling over to password spraying. So previously I used username and numeration to discover the format and then just assume that it will be the same for the modern format for when we spray. Now, because technically that might not be the case, I don't do that anymore. The problem is it means on password spraying, if you choose to use the discovered username format, then invalid usernames will still take ages to do. So what I would suggest as a way of doing this, because basically, yes, so username and numeration, every invalid user 30 to 40 seconds. So if you waited for that to finish anyway, that's gonna take the rest of the day, a couple of days. So ideally what you wanna do anyway is use username and numeration to get the potential, the likely format. That might take five minutes, say, then pause that, switch over to password spray and then instead of using the discovered format, which because we've only discovered that in the legacy style, then that will take a long time. So instead, pick the same format and password spray those. Hopefully you should get some credentials or some invalid, sorry, disabled accounts, which give you a point of that is the correct format. But if you don't, then it is possible that the formats don't match and you might need to do a little bit more kind of manual going through different potential formats to discover which it is. So the other thing to say is that, so obviously with username and numeration, we discover a valid username, even if the password is wrong, whereas for password spraying, we only find out anything if we get both correct. So you can, if you want to, stay with the username and numeration, you get a nice list and it takes 48 hours. However, because you will essentially be hitting the same users with the password that you're trying, then actually in terms of progressing the test, then you're not gonna really lose anything by switching over to password spraying, you're gonna be hitting the same users. So you're gonna find the same users that might have password one as their password, just it will take 10 minutes instead of two days. So yeah, so that would be my suggested method. So now I'm gonna show where we get the time-based difference and some other things for ADFS and RD web, because I don't think there's much publicly written about those, whereas there is for Skype and Exchange. So this is maybe more interesting. So this is where we get the time-based difference for ADFS. Now for ADFS, there's this extra kind of interesting extra bit, which is that it needs an MSIS SAML cookie to be sent in the request. So basically in order to get that, I first send the request here, sorry, to the same place, but with this single sign out parameter and basically the response to that will give us the cookie that we need, which we then here include when we make a password guess, as you can see. And then here you'll see the invalid response. So it's just 200 okay. And so that's told us nothing, or with the timing difference, maybe it's told us if the user's valid. And this is a valid response, we get the 302 redirect and it sets this MSIS auth cookie. So for RDWeb, we make a post request like this. So there's the username and the password to this URL. And if it's invalid, then we get the 200 okay again. And for TSWA auth HTTP only cookie, then that either isn't there or it's blank. So again, we can use timing-based difference with the username or if it's completely valid. So the username and password are correct. Again, it's the 302 redirect and that TSWA auth HTTP only cookie now has a value as shown there. Okay, so now password spraying. So as I said before, there's a little hiccup here with the discovered format. So obviously that's up to you if you want to stick with that discovered format or just simply choose it from the list and we'll spray that in the user app domain style instead. So for password spraying, it basically defaults to using that style if possible because it's quicker. And also if you provide a list of user names, you can if you want provide it with domain slash user or user domain and it will use what you've given. So let me have a look. Yep, so also as I said, you can use these pre-built lists if you want to go for that or you can give it a file of your own. And as I've said, if you want to, you can kind of pre-add whatever you want in there and it will use that instead. So another thing to say is that if you want to, you can just go straight to password spraying. You don't have to do the username and enumeration first. So yeah, basically if you've done the sub-domain enumeration, you've got the internal domain information, you can just go straight here. Maybe you've done some OS and you have an idea what the format might be. You can just go straight here and spray it. Okay, so now a little demonstration of password spraying so I can show you that in a bit more detail as well. Okay, so as you can see here, the top option is use discovered username format. So if we'd already done the username enumeration, then we'd be able to basically just tip that here. And as I've said, that will spray it in the legacy format. So you need to be careful. The other choice you've got is that you can just pick what list you want to spray. Again, you can spray these kind of inbuilt lists. You can give it a file of your own and or you can also spray just enumerated users. Which again, we'll use the username that we've already discovered, the format that we've already discovered that user in because obviously we know that that exists. So again, you can put the password in here. That's obviously distinct to the username enumeration password. And then if I click spray, you'll see that this is much quicker because this is able to be multi-threaded. You're not waiting to check that the kind of timing-based information is accurate, which multi-threading the username enumeration can kind of throw that off because you're making it do multiple ones at the same time. And as you can see, so it's gone through the list and as we saw before, it's found this user and access token here. And we've also got one with the disabled account. Okay, so as you saw there, we've got these different columns. So for Office 365 spraying, I'll come onto how we do that at the end. But basically, if we can spray the Microsoft login portal, then we can determine a valid user versus an invalid user and valid credentials versus invalid credentials. And we can also actually tell if you've got the right username and password, but the organization has MFA enabled. So SIP enabled just means that they have Skype access. And then depending on the service, we can tell some additional things. So again, Skype is actually my favorite service to look at because you can actually tell the most from Skype. So we can tell if the account's disabled, you can tell if they're SIP enabled, and you can tell even if the password is expired. So you've got password right, but it's expired. And also this server error, we can still tell that that's a valid username and password. For Exchange and RD web, then we can also still tell if the password is expired or if it's correct, but not some of the additional information. So username and enumeration is timing-based. So I only have one location for each of those where that's possible. But for password spraying, there's multiple places we can kind of spray. So again, from the 100,000 that I looked at, that's where the statistics have come from. So this is the order in the sub-domain enumeration and when we're validating if the password spray endpoint's there, this is the order that kind of all the look for those in. Again, hopefully this will reduce how many requests we need to make. And in the future, again, maybe that advanced option to say, just look at the top two. Obviously you can see here, the top two would actually get the vast majority of, you know, would have found it in the vast majority of cases. And then we've got somewhere is literally just one out of that 11% that had slash web ticket was there. So this is a mix of known end points kind of publicly written about. One's taken from IAS from the server itself and which allow until I'm authentication. So until I'm authentication, I'm gonna go into a bit more detail now. So yeah, so just to mention briefly, when I had a look, there kind of doesn't seem to be that much for until I'm web-based until I'm authentication spraying. It's possible Hydra or something similar might do it, but they didn't seem to be that many tools for it. So here's a little bit of code, very simple for C sharp. So we can literally just create the new network credential, give it the username and password. And then in the response, if it's 401 unauthorized, it's bad. Otherwise you're good to go. So yeah, incredibly simple and Carnivore is able to password spray until I'm off end points. So for those, you can still do the blank type one message, but actually it's part of the protocol is kind of determining and including the domain name. So here, when we're giving the username and password, we can literally just say C Scott password one. And actually as part of this request, it will add the Nevtech element of that. So an interesting thing to note is that, as I said before, when I included some NTLM authentication endpoints with the list of sub-domains that I look at, then there were some quite big organizations where everything else seemed to not be accessible. And then you've got one kind of weird NTLM off endpoint hidden away. And that they're still susceptible to password spraying against the internal domain. Essentially, I mean, this could even be used for denial of service because yes, we hit the normal password lockout policies, but essentially if you purposefully hit that and you've locked out everyone in the domain. So that's obviously something that an organization would want to be aware of because that would be a bad day for them as well. So quick sidetrack into a note on some of these different services, just in case you haven't seen them before. So ADFS is a portal that can be present to allow you to sign into different third party services. Sometimes these might be assumed to be internal. So on past red teams, then this has given access to full job posting applications. So third party applications, they were linked to the company's Twitter and LinkedIn, all of their job postings. So obviously for kind of phishing or ongoing attacks, then having access through ADFS to that company's kind of LinkedIn job postings or even reputational damage could have been fairly troubling. So basically you go to the same URL that I gave earlier and that would give or would normally give a kind of dropdown list where you'll see the different applications that you can authenticate into. So I've also seen internal service desks that you can get into. It was logging all call center queries. So that contained incredibly sensitive customer details and information because it was everyone in their call center putting in this customer with this bank account number and this credit card number has this question and that was basically accessible externally through ADFS and also things like HR, user admin, poor tools. And so one other thing to note there is if it's Office 365 and federated equals win. So basically Office 365's password spraying avoidance and defense mechanisms are fairly brutal but basically if the organization is federated, not just that you can, but that you have to hit the ADFS server and the response to a request I'll show in a bit will tell you where that ADFS server is and basically, yeah, so if that exists it's actually a lot better for us because it means we can avoid Office 365's robust defense mechanisms and we're just hitting ADFS the same as we would before and for RDP, that one's fairly simple. It's literally just remote desktop through the web depending on how that's configured. Maybe you'll be able to RDP into a workstation in the domain, things like that. And yeah, so hopefully you'll have seen Skype and Outlook before. So now post compromise, we're gonna look at the address list pulling first with a quick demonstration. Okay, so just as a reminder, so this is used to pull the address book through the UCWA API, so just to remind you what that looked like. So we had these options here. So if you untick both of those, that means you're just looking for the compromised user. Personal contacts is the personal contacts of that compromised user, so their favorites. That's an interesting one for say ongoing social engineering because then you know, and from the other information you've got here, then you know, okay, my compromised user has this job. His favorites include these people and they have these jobs. So in terms of kind of fashioning a good fishing payload, then obviously that would be incredibly useful. We can kind of run this on the personal contacts first and then add in the full address list just to make that distinction or yes, just pick the full address list. The data here, as I said before, so the ones that are chosen by default, those are the ones that are quicker to get. So for some reason, the way that the UCWA API works, then we get different pieces of information depending on where we've queried that person. So if they're you, you get this information. If they are personal contacts, you get this information. If it's through the people search function, you get that information. So this is kind of the stripped down list of what you get in every case. Then if you want to kind of go on and pull everything back, we can, but that can take numerous additional requests per user. So obviously for a domain of say 6,000 people, that could take an incredibly long amount of time. So what we do is if we kick this off, and then I've just missed the button, that's a good sign. So you'll see, it will pull back the kind of standard information for the users first and then it will kick off some additional threads to pull that additional information. And then as we go, you'll see that start to fill in. And then I'll go over some of these things later and the additional settings here will go over in more detail. Okay, so as you just saw, the information that we can get back through Skype for Business is a bit of a social engineers dream. So you've got the department, you've got the office location they work in, you've got even whether they're online or offline. Additionally, this does say online mobile, online desktop. So I've never fully seen that work in a useful way, but that option's there. So we also get email address phone number and this note here is any status message that they've set. So those quite frequently I've seen people will put on there about annual leave if they're gonna be out of the office. So obviously again, as far as social engineering goes, you know what office they're in, the name, email address, what their job title is, you know they're gonna be out of the office. So quite a lot of information for maybe even being able to turn up and say, you know, oh, I'm supposed to be meeting so-and-so or even impersonating someone and you know they're definitely not gonna be in the office. So as I was saying, the problem is some of this extra information does take a large number of additional requests. So yeah, by all means tick all, but just beware that might take a very long time. And yeah, those are the options you've got. So Carnivore pulls the internal Dressbook back using people search with the UCWA API. So this does mean that we're essentially having to search letter by letter, A through Z. However, there's an upper limit of 100 on the amount of responses it returns and there isn't a next link that we can say, here's the first 100, now go to the next link for the next, you know, however many and so on. So basically what we have to resort to is searching by digraphs and try graphs. So essentially A, B, A, C, A, D, and then even A, B, C, A, B, D, A, B, E. And so basically we can then take either from the top statistically likely usernames list, we can do all of the likely and unique kind of three letters that are there, or you can do all possible two character combinations. So what's interesting and fun about the UCWA API is that there doesn't seem to be much rhyme or reason as to the way that works in terms of what we get back. So to take an example, if we're looking for every pull in the domain, so we know that there's four and we search for P, you get back 150 results. So we're just gonna get the top hundred, there's two pulls in there. So then we search for P, A, we get back 20 results, but this time there's three pulls. So we've got one extra, but for some reason, even though we haven't hit the upper limit, we've still not actually got back every pull who's in the domain. So then we search for P, A, U, and now we get this mysterious rogue fourth pull that we've never seen before. So essentially in the interest of me keeping my sanity, I've stuck with digraphs and try-graphs. It's possible you might wanna go on and do quad-graphs and quink-graphs and whatever else they're called. However, so when I looked at this with the common try-graphs and then with every possible three-character combination, that actually only added an additional, I think it was maybe even one user in a domain of 6,000. And the difference is common does 2,249 requests, whereas every possible was about 17 and a half thousand. So all of that for one additional user that, as I've said, was kind of hiding away and we weren't able to get otherwise. So essentially, hopefully that explains the kind of options on the address list a little bit more. One additional kind of side note. So it's fairly uncommon, but I've seen it where a misconfigured Microsoft web app proxy basically meant that when you auth to the first server and it gives you back the token and then you try and use that against the applications endpoint, then it essentially sends it to the wrong place or you've been off to the wrong box and so it then doesn't like it. That actually also stopped the legitimate Skype client from being able to authenticate to Skype. And however, now Carnival is able to detect that. It re-auths to the correct box and carries on. So basically, Carnival is able to connect and carry on using the API even when the legitimate client actually couldn't. Okay, so now the final post-compromise function which is meeting Snooper. So unfortunately, my lab servers stopped working for this. So we have to make do with screenshots. Okay, so as you can see here, this is the meeting Snooper tab. So once you've compromised the user, if you've got Skype available, so this uses the UCWA API as well, then you can go here and you have to choose, you have to pick the compromised user that you wanna use there. So now we can either choose, basically we can do this for all compromised users or just the selected user. Now one thing to say is that this only picks up currently scheduled meetings, obviously. So basically we can run this throughout the day multiple times or at the start of the day you could run it, see if any new meetings have been added and then kind of keep running it to pull back new information. So first of all, it dumps the standard dial-in information to the output log. So if you've ever had an email inviting you to a Skype meeting, this will look fairly familiar to you. So you've got the internal number you can dial and then a number for each country or city within that country. So now apologies for how utterly rubbish this looks. As I said, my training lab unfortunately kind of packing in at the key moment there. But yeah, so to stress, this isn't an exploit or a zero day, it's basically highlighting what's already possible through kind of weaponization of the UCWA API for attackers. Obviously it does depend on compromise credentials, but basically so far this tool has shown how we can go from external over the internet to kind of complete compromise. And to this point of being able to dump out yet scheduled meetings for compromised users. So one thing to say is that when kind of using this tool on jobs, then often you find if you're gonna get anyone, you probably are gonna get like 50 to 100 users. And obviously in that case, then this becomes more interesting because one user might have one meeting that week, but if you've got 50 users, then maybe you've got someone who's a little bit more interesting. So you can then see here, what happens when you run this tool is that it gives you information for each meeting that compromised user has scheduled. So the conference ID there is the PIN. So basically when you dial in, you dial into the phone number and I asked you for a PIN and that's that conference ID. And basically that conference ID is unique to that user. So when you dial in, you'll be impersonating whoever it is that you've compromised. So for example, this you dial in, you put in the PIN and then you show up as being say Chris Nevin guest. Now obviously if the people in the meeting are kind of using the desktop application, then maybe it would look weird to have multiple Chris Nevin guests there. If everyone's using the phone to dial in, I'm not sure that they would notice this at all. And in fact, even if they did see these two Chris Nevin guests, how likely is it that people are gonna assume, oh, this is someone impersonating and joining in and listening as opposed to, maybe there's some weird bug that's happening. So the information we get here includes the subject of the meeting and the attendees. So obviously these meetings here, I've scheduled just to kind of demonstrate, but obviously this could be a lot more juicy. So for example, you've compromised the user, from their address book, they're the head of financial fraud and this meeting subject shows it's the weekly financial crime investigation update. So obviously you can see why this would be kind of concerning for an organization if this was possible, because again, without any exploit, any need for any further phishing or payloads being executed, you've basically gone from being over the internet to being able to listen in on and even record the sensitive meetings, essentially impersonating that user. So on the right, you can see the lobby bypass enabled. That basically means that if you dial in, does it bypass the lobby? If that's enabled, that means you're not even in a waiting room that someone has to let you in. So the join URL, if you go to that, you can join the meeting and you can basically enter a name of your choice. So obviously one thing you could do is, again, you've dumped the address book, is there a social engineering angle? Maybe you could kind of choose your name based on that. Potentially it might be more likely to get caught, whereas actually just dialing in and there being two of the compromised user is maybe less trouble in. So another thing to say is that the API basically only seems to give the meeting expiry. So that's two weeks after the meeting ends. So Carnivore will take off, it will remove the two weeks for you automatically and then it's kind of, maybe you'll need to do some kind of common sense around that. So for example, you see the top meeting there, all we actually have been able to pull is that the meeting ends at 11.30. Now I've set the subject for that one to be the time while I was troubleshooting. So you can see that actually that meeting starts at 11. As I say, normally you wouldn't get that information because that's the subject. So obviously, yeah, if you apply some common sense to it then you can see, okay, the meeting ends at 11.30, it probably starts at 11 or even 10.30. So yeah, so that's the meeting snooping, what you get back from it basically. So there are a couple of extra points to mention which are that this only seems to be able to pull back self-scheduled meetings. So again, it doesn't fully make sense to me because obviously in Outlook or something you don't just see meetings you've scheduled, you see every meeting that you're scheduled to be a part of. Unfortunately, we're not able to get that through this tool. So yeah, and then also meeting end time only as I said before. Now there are some weird edge cases with that. So for example, I set a recurring meeting and so the only information we get back is that it ends on the 26th of December, 2022, which obviously isn't that useful. Again, maybe you could figure out, okay, that's a Friday, it's a half 10, so maybe it's every Friday. But again, we can't get that back through the API unfortunately. Okay, so Office 365, so I'm not gonna demo this. So what I've been showing so far is basically just my lab. And so yeah, we're not gonna demo Office 365, but I'm gonna talk you through how Carnival works. So for example, sorry, one thing to say is that username enumeration that doesn't require a password guest has been quite widely covered. So there's things like 0365 or 0365 enum. So I'm just gonna quickly kind of get into password spraying and give some key pointers. So as I've said before, federated is a win. So just the usual Active Directory rules will apply to lockouts. But again, that kind of doesn't include the extremely robust Office 365 rules. So as I've said, there's a link that I'm about to show you where you can find out if an organization is federated or not. If it is, you'll get back the ADFS server location and Carnival will add that automatically. So if it's not federated, we can still spray, sorry, we have to spray the Office portal, but then we can also determine if a user and password is valid, even if we have MFA on there. I'm sorry, I should have said again, with federated, if it's federated, you have to spray ADFS and you can't spray the Office portal. You won't get back anything interesting, anything useful. So password spray counter measures for Office 365, so they have things like trusted versus untrusted network have separate bad password counts. So again, if you're from the untrusted side, which presumably you would be from an untrusted network, then your password spray is adding to account of everyone else in the world. So again, lockout is fairly frequent and quick, but from Microsoft side, obviously that's designed so that then the genuine user can still sign in while on their corporate VPN or something like that. So obviously good security measures, but difficult from a red team perspective. So first of all, to find out if the organization is federated, so this is an example request here. So the username itself is irrelevant. It's just the appdomain.com that we're looking for. And the response here, so if they were federated, that would say federated instead of managed. And it can also include some kind of boilerplate text. So for example, is keep me signed in disabled? Obviously that one might be interesting from a red team perspective because maybe it hints that they have fairly good security and they've had the configuration looked at because users can't just stay signed in forever. You also get the Federation brand name there and you can get back logo information and that kind of thing. So also if this said federated, then we would see the location of the ADFS authentication endpoint there as well. So for password spraying, this is how Carnivore does it. So this is the endpoint that we're hitting. There's the username and the password. So the client ID and the scope, obviously that could be tweaked to maybe be a little bit more realistic or representative, but this is what Carnivore uses. So this first one is if there's an invalid password. Now obviously the actual response here says invalid username or password. So obviously that seems like maybe that's gonna be a bit tricky for us. Is it the username or is it the password? We're not fully sure, but then if the username's incorrect, then we get this message back. The user account does not exist in that directory. So obviously from that, we can tell that the previous response means the password's wrong, not the username. And just to also mention there where it says email hidden, I've not added that, that's the actual response. So then this is a valid user and password without NFA. So again, this is specific to the request that I make in Carnivore. So because we gave a client ID that doesn't exist, then if the username and password is correct, you'd get this unauthorized client and a message that that application doesn't exist, because obviously it's not a proper client ID. And again, so if it's valid user and password with NFA, then again, we get this invalid grant, but now it's telling us that it's due to configuration, meaning that you need to supply multi-factor authentication. So again, username and password is correct, but you need NFA. So, outro very briefly. Yes, so almost forgot to put it in, but here's a link to the tool itself. So obviously you can go there and download the latest version and any issues or anything that you wanna bring up there. I'll be happy to try and help wherever I can. So thank you for listening.


My name is Audrey Redford. I've been generously sponsored by Sally von Beren to be here this summer. My name is Jonathan Newman and I was sponsored by the Conant Family Foundation. As a Dawn Prince fellow, I've enjoyed having the opportunity to study here this summer with the guidance of the fellows here at the Institute and the fantastic opportunity to network with other students interested in the ideas of Liberty. Here, the Mises Institute and its generous donors managed to create a very warm and collegial environment for us young academics and it's a great place to create connections, to build relationships, to be inspired by other people's work. My name is Apavolo Amate. I'm a summer fellow sponsored by the Fox Foundation. The opportunity to spend the summer with Mark Thornton, who we share fellow research interests, has been fantastic. I've been working on my research towards a PhD in economics through Auburn University, all thanks to the summer fellowship here at the Mises Institute. As a past fellow, I have benefited tremendously from the Mises Institute, providing me with research facilities and with faculty who have been able to assess, review and improve my research. Thank you for supporting the Mises Institute. Thank you for your support. Thank you. Thank you for supporting the Mises Institute and students like me.


Simon Michelle is joining us live from Fig Securities. Simon thank you so much for joining us now tell us what we've been seeing in the bond market we've been talking about money flowing into safe haven assets you know gold's been in focus the dollar and so forth have we seen bonds tracking? Good afternoon yes and you're certainly seeing that reflected in the bond market also we're seeing good strong demand pushing yields lower that pushes bond prices up and right across the curve as well it's interesting if you look right out to the 30 year and now back below that 3% level that was as high as about 3.18 I think in December so it's really interesting I think people who take some profit I think investors are cautious I mean certainly not seeing an increase in inflation or growth reflected in the bond market unlike what you're seeing in the equity markets recently. That is interesting are you surprised by that? Look not really I think the bond market really wants to see some detail so you know it's it's a much longer dated people are taking much longer views so people tend to look for more certainty and I think that you know as you see some policy movements come out of the US you may see the bond market correct and reflect that but at the moment they're they're sitting pretty quietly. Now obviously you know I've heard a lot overnight on Donald Trump's protectionist policy certainly putting those words into into action and I mean he's only been a few days in office right now. What do we expect going forward in terms of rate increases because a lot of it is coming down to fiscal spending tax cuts and so forth are we seeing the bond market adjusting its view at all in terms of the rate increases we're expecting this year? Yeah well that's interesting as well because we are certainly starting to see some stronger rhetoric from the Fed from board members of the Fed suggesting that we could see a larger number of increases through this year than previously anticipated but the market the futures market still just looking at two two increases for 2017 so it hasn't really adjusted that either it stayed fairly benign through this exuberance I suppose we've had and you'd certainly not seeing any movement so the market it's pretty steady as I said strong demand so investors are still very happy to lock into these levels too you're not seeing a behaviour investors positioning the higher rates anytime soon either so that'll be interesting to see. Yeah absolutely now Aussie yields tell us how they are tracking in those credit spreads I mean they look like they tightening up further. Well this is the thing so credit spreads tightening means people are happy to take on more risk that's positive they're taking on you know more lower ranked bonds but at the same time you're seeing and at the same time I should say you're seeing rates move lower that reflects higher demand pushes bond prices up that's a positive for those people holding bonds so you know I think it's certainly seeing although not reflected in the marketing markets today you are seeing a little bit of profit taking a little bit of moving to that safe haven happening here in Australia as well. Bond issuance tell us more. Look Sanity have really ramped up we had that huge Aussie government bond issuance last week and we've had a number of non Aussie issuance or offshore issuance a lot of state-based issuance come to Australia looking at funding today and we also have Suncorp Metway looking to do a RMBS or a residential mortgage backed security so this is a basically an issue of mortgage backed security to the market as well so we're certainly seeing a larger volume of issuance this week. Just a quick final thought I was reading some commentary this morning investors also seem to be cautious ahead of more bond supply so US Treasury is going to be selling I think it's about 26 billion dollars in two-year notes on Tuesday 34 billion on Wednesday I think about 28 billion in those seven-year notes on on Thursday is this something that you're watching. Look we're certainly keeping an eye on it I mean there's also been a bit of talk by the Fed about when they might start to unwind the holdings that they the Fed's holding as well but look we're just seeing so much demand come up and it's not just not being reflected in the prices look if you start to see investors not stepping up to these these tenders and taking advantage of these bonds then you could certainly see those rates start to drift higher but at the moment you know and this would have affected our own bond issue last week you know we're seeing well over one time spin for these bonds so I don't anticipate we'll see any any volatility in those issuances over the next couple of weeks. All right excellent Simon we'll wrap it up there it's been great having you on as always thank you so much. Afternoon thank you. Simon Michelle.


Good evening aspirants. Welcome to the Hindu news analysis by Shankara IS Academy. The list of articles that has been chosen for today's analysis along with the page numbers of Chennai, Bengaluru, Delhi and Tiruvannantapuram Medicines are provided here. The link for the handwritten notes in the PDF format and the time stamping for the given articles is provided in the description box below and for the benefit of smartphone users the time stamping is also provided in the comment section. Let us move on to the first article analysis. This first news article is about e-cigarettes. This discussion can be linked to the syllabus that is given here for your reference. The news article states that the union cabinet is in favor of approving an ordinance. This ordinance is for prohibiting the manufacturing and sale of e-cigarettes in the country. So now what is an ordinance? An ordinance is a law and it can introduce legislative changes. But we know that the power to make laws is with the legislature. So does the parliament pass an ordinance? No. When parliament is not in session and when some immediate action is needed the president can issue an ordinance. This provision is provided by the constitution. Under article 123 of the constitution the president of India has the power to promulgate or enact ordinances when both the houses of parliament are not in session. Under this article 123 the president can exercise his legislative powers of promulgating ordinance in accordance with the aid and advice of the council of ministers. So now today's article states that the union cabinet is going to approve the ordinance for prohibiting the manufacturing and sale of e-cigarettes in the country. After this the president will promulgate the ordinance if he is satisfied that there are circumstances which makes it necessary for him or her to take immediate action. According to the news sources if the ordinance is promulgated the law would make production, manufacture, import, export, transport, sale, distribution or even advertisements of e-cigarettes as a cognizable offence. So what is a cognizable offence? Cognizable offences are those in which the police can arrest a person without any warrant. These offences are more serious in nature. So by this we can say that the government is planning to make the production of e-cigarettes, manufacturing even advertisements as offences of serious nature. Then according to the news article as per the draft of the ordinance these offences will be punishable with imprisonment up to 1 year or fine up to rupees 1 lakh or both for the first time offenders. And then for repeat offenders the punishment is for imprisonment up to 3 years and fine up to rupees 5 lakh. Under this draft ordinance the storage of e-cigarettes is also punishable. It is punishable with imprisonment up to 6 months or fine up to 50,000 rupees or both. Now this move is welcomed by anti-tobacco health experts and even experts from various fields have welcomed this move and they have urged government to pass the ordinance in the larger interest of public health. But the tobacco industry and its allies state that if this law is enforced then this would be draconian law hitting at the livelihood of many. Here draconian means excessively harsh and severe. By draconian law they mean that the law is extremely severe and it is more than what is right or what is necessary. And they are saying it will be a hitting on the livelihood of many because many are dependent on the production, manufacture, import, export, even transport, sale, distribution and even advertisement of e-cigarettes. If this law is passed then they might have to look for some other job. So, now what is the background behind this ban? If you see in June 2019 the Indian Council of Medical Research or in short ICMR recommended for a complete prohibition on on ends or e-cigarettes in India. Ends is short for electronic nicotine delivery systems and these e-cigarettes fall under the electronic nicotine delivery system or in short ends devices. ICMR recommended for this complete prohibition based on a white paper on electronic nicotine delivery system which was released by it. Now before getting into what the paper stated you should note one point here. Initially ends or e-cigarettes were used as a tobacco control measure. Now keep this in mind. Now the paper stated that the tobacco consumption especially cigarette smoking has shown a decline in India in recent years. This is in response to several tobacco control measures that has already been initiated by our government. So, the paper states at this point marketing of a product like ends or e-cigarettes is unwarranted as a tobacco control measure. The paper states that e-cigarettes benefits have not been proved yet and also it poses a high potential harm due to addiction and health risks and also the adverse population level health impact will outweigh any presumed benefit to individual cigarette smokers. Moreover it can open a gateway for new tobacco addiction also which is a potential threat to the country's tobacco control laws and ongoing tobacco control programs and efforts. So now what are these ends or e-cigarettes? They are battery powered devices used to smoke or vape. Here vape is a word that denotes inhalation and exhalation of the vapor that is produced by an electronic cigarette. The e-cigarettes are made up of a flavored solution which contains a varying concentration of nicotine. The most common type is an e-cigarette that produces an aerosolized mixture of flavored liquids and nicotine and then it is inhaled by the user. Now here nicotine is an addictive chemical that is found in cigarettes and even in other forms of tobacco products. Nicotine is considered as one of the most addictive substances. The potential risk of a person being addicted to nicotine throughout his or her life depends on the rapidity at which nicotine is introduced into the body. That is like at what age they got their first exposure and what dosage is being administered to them. These things decide whether they will be addicted to nicotine or not. These ends or e-cigarettes are manufactured in such a way to resemble traditional tobacco products like cigarettes, pipe cigars and common gadgets like flash drives, flash lights or pens. According to ICMR currently there are more than 460 different e-cigarette brands in the market. They all have a varied design of nicotine delivery. If you see structurally most e-cigarettes contain four different components. The first component is a cartridge or reservoir which holds a liquid solution containing varying amounts of nicotine with flavorings and even other chemicals like e-liquid or e-juice. Then it contains a power source which is usually a battery. Then the next component is heating element and then it also contains a mouthpiece that the person uses to inhale. So now this is the description about ends and e-cigarettes. Now the paper published by ICMR states that the use of e-cigarettes adversely affects almost all the human body systems. The impact is across the life course of a human being that is the impact is from the womb to tomb. These devices contain other ingredients such as flavoring agents and vaporizers which are found to be harmful for health. A typical device contains about as much nicotine as a pack of 20 regular cigarettes. So it can act as a potential source for nicotine addiction. Additionally the amount of nicotine and other chemicals in these products varies widely and thus the consumer remains unaware of the actual contents of the products they use. And the studies on these nicotine solvents have shown a varied degree of release of potential carcinogens such as acetaldehyde, formaldehyde and acetone. We know that carcinogen is a substance which causes cancer and the liquid vaporizing solutions also contain toxic chemicals and metals and they are responsible for several adverse health effects including cancers and diseases of heart, lungs and brain. The e-cigarette use adverse affects the cardiovascular system then it impairs respiratory immune cell function and it also impairs airways in a similar way to normal cigarette smoking and it is also responsible for severe respiratory disease. It also poses a risk to fetal, infant and child brain development. Then ends or e-cigarettes are also harmful to non-users and these non-users have adverse health impacts even when people are exposed to second hand vapors. Second hand vapors are those vapors which are exhaled by a smoker and obviously they contain chemicals and these chemicals are even inhaled by a non-smoker also. So, even though we are not using ends or e-cigarettes by ourselves if we are exposed to those vapors we will be also having adverse health impacts. Then it is also stated that passive exposure to vapors during pregnancy can severely affect the health of both the mother and the fetus. There are also reports of poisoning due to accidental swallowing of ends by children also. These devices can also cause fire and explosion. Then shockingly it was also found that use of ends or e-cigarettes by non-smokers can lead to nicotine addiction and regular smoking also and studies have also found that the young persons who are using ends are more likely to use regular cigarettes later in their life and also these e-cigarettes increase the likelihood to experiment with regular tobacco products and increase the intention to indulge in cigarette smoking. So, now based on all these information and currently available scientific data from multiple streams of research the ICMR recommended for a complete prohibition on ends or e-cigarettes in India. This recommendation is also based on the fact that the magnitude of potential short-term and long-term health risks to the users is not yet determined at the population level for these ends or e-cigarettes. It is not yet determined because the products are recent and they come in diverse forms. And then whether e-cigarettes benefits as a tobacco cessation aid or to which degree benefits as a tobacco cessation aids is not yet definitely established. Here tobacco cessation aid means a product used as a tobacco control measure. So, now based on these ICMR recommended for a complete prohibition. Now you should also know that in India use of nicotine as an ingredient in any food items is prohibited under the food safety and standards prohibition and restriction on sales regulation of 2011. It comes under the Food Safety and Standards Act of 2006. Then nicotine and nicotine sulfate are listed as hazardous chemicals under the Environment Protection Act of 1986 and then it is also listed as hazardous in the manufacturers storage and import of hazardous chemicals rules of 1989. There are also other laws and regulations which are also applicable to ends such as an advisory from the Ministry of Health and Family Welfare Government of India. This advisory was given to all states and union territories. This advisory ensures that ends and similar devices are not sold, manufactured, distributed, traded, imported and advertised in their jurisdictions. Now the proposed ordinance makes all these actions as cognizable offenses. Then there is also a ban on e-cigarettes imported by the Department of Revenue and there is also a ban on e-cigarettes advertisements under the Ministry of Electronics and Information Technology. So now based on these rules regulations and recommendations the government is planning for the ordinance. With this we come to the end of this article discussion. The displayed practice questions will be discussed in the last session. Moving on to the next article discussion which is about National Animal Disease Control Program of the Central Government. The syllabus relevant to the analysis of this news article is given here for your reference. The National Animal Disease Control Program was launched by Prime Minister on 12th September that is yesterday at Mathura in Uttar Pradesh. This scheme has been announced by the Central Government in Union Budget 2019-20. The actual name of the scheme is National Animal Disease Control Program for Foot and Mouth Disease and Brusillosis. So before discussing about this scheme let us discuss these diseases. First let us see about the Foot and Mouth Disease. This Foot and Mouth Disease is an important livestock disease in the world in terms of economic impact. It is a highly contagious viral vesicular disease in livestock. Here contagious means it spreads from one animal to another animal and vesicular means small rashes or blisters. These blisters occur in the mouth, foot and udder or mammary gland of the livestock. We know that livestock includes animals such as cow, buffalo, goat, sheep, pigs, etc. This Foot and Mouth Disease is caused by a virus belonging to Pekorna Verite family of the genus Aptovirus. This Foot and Mouth Disease affects the production of livestock that is it will be tough to produce new generation of livestock. Also the milk production will be heavily affected because it affects the mammary glands and the mammary glands only produce milk. So the milk trade will be affected. This is why we saw that Foot and Mouth Disease is an important livestock disease in the world in terms of economic impact. Then it is a trans-boundary animal disease that is it spreads from one country to another. The disease is endemic and widely prevalent in South Asia. The outbreak of this disease happens at regular intervals in the countries of South Asia. Foot and Mouth Disease can be controlled by mass vaccination of cattle at regular intervals. So vaccination will be given till the incidence of disease comes down to negligible levels. This Foot and Mouth Disease primarily affects cows and buffaloes. So if cows and buffaloes are properly vaccinated then the spread of this disease can be controlled. Now let us see about brucellosis. Brucellosis is also a contagious disease. It is caused by a bacteria which belongs to the genus Bricella. In cows and buffaloes the disease affects the reproductive organs and the udder that is the mammary glands. The bacteria are shed in milk or they are shed via the aborted fetus or via other reproductive tract discharges. So brucellosis is commonly transmitted to other animals by direct contact with affected animals or it is also transmitted in an environment that has been contaminated with discharges from infected animals. Hence we call brucellosis as contagious. Also the milk production will be reduced because of this disease. So we can see that brucellosis is harmful especially to the female animals because both the reproduction and milk production will be affected. Currently vaccination is available for brucellosis to treat the infected animals. Now know that India introduced a special program to tackle the spread of foot and mouth disease. In 2003 the government of India came up with foot and mouth disease control program. This was introduced as one of the component of the scheme named as livestock health and disease control. This livestock health and disease control is a centrally sponsored scheme. This was introduced in a phased manner in many districts across India to prevent the spread of foot and mouth disease. For those districts that were not covered under this program there was another program which is named as assistance to states for control of animal diseases. Under this program need-based vaccination for foot and mouth disease was given. Now in this budget that is in the 2019-20 union budget the central government has announced a new central sector scheme called as national animal disease control program for foot and mouth disease and brucellosis. As announced in the budget the prime minister has launched this program yesterday at Mathura in Uttar Pradesh. Around 500 crore has been allotted for the scheme in the budget. For this the total outlay for the scheme is rupees 12,652 crore from 2019 to 2024. The overall aim of the scheme is to completely control foot and mouth disease by the year 2025 with vaccination. Also foot and mouth disease should be eventually eradicated that is it should be eliminated by the year 2030. We saw that this new program is a central sector scheme. It means that the entire program will be sponsored by the central government. This program will vaccinate over 600 million cows, buffaloes, sheep, goats etc. That is over 60 crore animals in the country will be vaccinated so as to prevent the spread of both foot and mouth disease and brucellosis. The program also aims to vaccinate 36 million that is 3.6 crore female bovine calves that is the young domestic cattle every year for brucellosis disease. So this program will result in increased domestic production and also in increased export of milk and livestock products. I know that this scheme comes under ministry of fisheries, animal husbandry and dairy. Now along with this during the launch of the scheme the prime minister has also mentioned the model that is followed in the country of Ravanda. This program of Ravanda is called as Girinqa program. The word Girinqa is translated as may you have a cow. This word describes a centuries old cultural practice of Ravanda. The practice is that a cow is given by one person to another as a sign of respect and gratitude. This program was started by Ravanda to address the high rate of childhood malnutrition and also to reduce poverty. The program also aimed to integrate the livestock management with crop farming. The program has contributed to an increase in agricultural production in Ravanda especially milk production and products and the program has also reduced malnutrition and it has also increased incomes. In addition to this the program is also aimed at promoting unity and reconciliation among Ravandans based on the cultural principle. It is a cultural practice that we saw that if a cow is given from one person to another it establishes trust and respect between the giver and the beneficiary. So under this scheme a cow is donated to each household. The first calf produced by the cow is then given to the government. Then the government donates it to other villages who do not have a cow. So this works like a chain. This Ravandan model creates a network of employment. This scheme also helped to ensure that cow livestock and milk production became part of the rural economy of Ravanda. Now also remember that in July 2018 our prime minister visited Ravanda. At that time he donated 250 cows to Ravanda as a part of this program. So just remember this Girinaka model. So whenever you are studying about some new country try to know one or more important geographical features of that country. So let us see in brief about Ravanda. Ravanda is a landlocked country. It is situated in Central Africa. This country lies to the south of Equita and also know that the tropic of Capricorn does not pass through Ravanda. Ravanda is bordered by Uganda to the north, Tanzania to the east, Burundi to the south and the Democratic Republic of Congo to the west. Then know that Kigali is the capital of Ravanda. The population is predominantly female. Female are 51.8 percentage of the total population. And whenever you study about Ravanda know about Ravanda genocide of 1994. The population of Ravanda consists of two communities. One is Hutu and other one is Tutsi. Hutus are the majority and Tutsi are in minority. About 85 percentage of Ravandans are Hutus but the Tutsi minority dominated the country for a long time. In the year 1959 the Hutus overthrew the Tutsi minority and many Tutsis fled to neighboring countries including Uganda. Then in the year 1962 Ravanda got independence from Belgium. At the same time Tutsis formed a rebel group called as Ravandan patriotic front. In the year 1992 these rebels fought against Ravanda and a ceasefire agreement was signed between the Hutu majority government and the Tutsi rebels. But the Hutu extremists were not happy. This led to killing of people belonging to Tutsi. It is said that more than 8 lakh people were killed in this mass genocide. After this the Tutsis won the war and they started to rule Ravanda. If you are interested to know more about this Ravandan genocide you can watch a Hollywood movie named Hotel Ravanda which is based on this genocide. With this we have come to the end of this article discussion. The displayed practice question will be discussed in the last session. Moving on to the next article discussion which is based on an editorial about reducing the global greenhouse gas emissions. The discussion can be linked to the syllabus that is given here for your reference. We know that climate change is a global problem. It affects the entire population of the world. So a global problem requires a global solution. It is because even the recent intergovernmental panel on climate change report that is the IPCC report it was stated that humankind has just a decade or more left to limit the global warming. That is we have some 10 or more years to limit global warming. The report says that the total global greenhouse gas emissions need to reduce by 45 percentage from levels and this has to be done by the year 2030 and by the year 2050 the global emissions have to reach net zero. Net zero emission means that all man-made greenhouse gas emissions must be removed from the atmosphere through reduction measures. It means for every ton of carbon dioxide we emit it must be matched by a ton that we have to remove from the atmosphere. The authors of this editorial are saying that there will be disastrous consequences if these targets are not met and the most affected by these disastrous consequences will be the densely populated tropical regions of the world and these regions are mainly concentrated in the global south which has the developing and underdeveloped countries. The global south already have a very high temperature and their low altitudes will make them vulnerable to sea level rising and floods also if these targets are not met. But if you see actually the countries in the global south have contributed very less to global emissions as compared to the global north because the global north consists of most developed industrial countries such as USA. Even at present the per capita carbon emissions of global south are much lesser and smaller in comparison to the countries that are in the global north. So the global south is at the receiving end that is the global south will suffer for the choices that are made by the global north. The authors note that a global consensus on the mitigation or reduction of emissions is still missing. So we need a collective agreement to reduce further damage to the environment. Hence to avoid this global danger both the global north and global south need to contribute based on their self-interest. But the burden of adjusting to climate change cannot be equal between the global north and global south because they have different historical contributions in emissions that is the emissions post industrialization are unequal. This is depicted in the climate injustice funnel that is given in the news article. This picture shows that as the income level increases their per capita emission of carbon dioxide also increases manifold that is it increases in multiples. So the author believes that a just or fair or equitable approach would involve a global sharing of responsibility among the countries according to their respective shares in global emissions. But at present the most accepted mitigating strategy is carbon trading process. According to the authors this process has certain limitations. So the author proposes an alternative. The alternative is the just energy transition or in short jet. Jet is based on a sense of global justice in terms of climatic fallouts that is in terms of bad events and it is based on respective contributions of the countries to global emissions. The authors believes that this would help the resource poor developing countries and underdeveloped countries to make an energy transition and they can make this energy transition without worrying about expenses. The authors discuss certain strategies that would help us to make the planet a better place to live for the future generations without doing injustice to the poor countries. In this first comes the fundamental change in energy infrastructure. It requires massive investments for green energy program across the world. The authors proposes a new global green deal to finance this project. This means countries on the top of the climate injustice funnel can partially support the transition for the countries at the bottom of the funnel. So the countries at the top have to fund their own energy transition and they have to also fund for the energy transition of the countries at the bottom of the funnel. This sharing of burden will help to invert the injustice funnel. According to the authors a successful transition to greener energy program needs countries to spend around 1.5 percentage of their GDP. So they propose financing the global energy transition through a global carbon tax. See according to the authors the total global carbon emissions are 36.1 billion metric tons of carbon dioxide. Now this would amount to a global carbon tax of 46.1 dollars per metric ton. So for imposing this global carbon tax the world countries can be classified into two. One those who emits above the global per capita average emissions and second those who emits below the global per capita average emissions. Those who emits above have to pay for their own transition plus they have to fund part of the energy transition for the countries who emits below. So the sharing of global carbon tax would compensate the climate injustice towards the global south. Because the global south contains the developing and underdeveloped countries who have historically contributed less to the global carbon emissions. If this is implemented on an overall the entire earth would become greener. Now under this method the countries can be divided into payers and beneficiaries. At present the global average of carbon emissions is 4.97 metric ton per capita. So all the countries with emissions above this level are payers who will finance energy transition. In this level there are total 68 countries and the countries which emit below this level are called as beneficiaries and in this there are total 135 countries. They are called as beneficiaries because they will receive funds from the payers. So the amount which will be given by the payers to beneficiaries can be called as a carbon compensation and the author says that the total amount of carbon compensation made by the payer nations is around $570 billion. The payer countries will have to contribute this fund according to their emission levels as compared to the global average. So country with more emission pays more. Then the compensated countries will receive this fund based on how lower their emissions are in comparison to the global average. So low emitting country will get more compensation. So by adding or subtracting the carbon compensation amount to or from the payer and beneficiary country respectively we will get the effective carbon tax for them. According to the authors USA and China are the top two payer countries. This is due to their large amount of emissions. But the author says that despite being a payer country the effective tax rate for China is lower than the possible universal tax that is it is lower than $46.1 per metric ton. According to the authors China's own energy transition by spending 1.5 percentage of its GDP and the global compensation requires China to pay only $34.4 per metric ton which is much lesser than $46.1 per metric ton. Then in terms of the countries who will be compensated that is the beneficiary countries India comes at the top. This is due to the population size of our country and also due to the distance from the global emissions average whichever country has because India has a per capita emission of 1.73 metric tons only. But we saw that global average is 4.97 metric ton per capita. So you can see the difference here that is why India will be at the top to receive the compensation and the authors are saying that most of the beneficiaries are from the global south and in the beneficiary list some northern countries like France, Sweden and Switzerland is also included. It is because these countries have kept their per capita emissions low like the beneficiaries. This means that even high income countries like France, Sweden and Switzerland can be beneficiaries if they lower their per capita emissions if we follow this just policy. So we can say that according to this policy China is in the payer list and some other first world countries are in the beneficiary list. So the policy wants countries to climb down the emission ladder without having to give up their standard of living that is they have to reduce their emissions without giving up their standard of living. So the authors conclude this article by saying that this global carbon tax is a global green robin hood tax because this global carbon tax will take from the rich and it will give it to the needy like the robin hood. With this we have come to the end of this article discussion. Moving on to the next article discussion which is about the report of OPEC. The syllabus relevant to the analysis of this news article is given here for your reference. First know that OPEC is the acronym for Organization of the Petroleum Exporting Countries. It releases a monthly report in the newspaper it is mentioned as World Oil Demand Report but know that the actual report name is Monthly Oil Market Report. In this report there is a chapter on World Oil Demand so it is wrongly mentioned in the newspaper. First let us see the news article and then we will see about OPEC. This report has said that even though India's growth or economic expansion has slowed down there will not be any slowdown in India's demand for oil. It means that India's oil demand will increase this year as well. At present as on July 2019 India's oil consumption is 4.44 million barrels per day. It is projected to rise by 3.21 percentage. So by the end of 2019 India's oil consumption will be 4.88 million barrels per day and in the year 2020 it will again rise by 3.36 percentage. So India will be consuming 5.05 million barrels per day. From this we can see that India's oil demand will only increase and there is no sign of decrease in this. If we see in terms of growth in demand India will be ahead of China since China's oil demand is slightly lower when compared to India. But if you see USA is the largest oil consumer in the world and the second largest oil consumer is China. The report also mentions that the world oil demand is expected to grow by 1.02 million barrels per day in the year 2019. Before this report it was projected that the world oil demand would be expected to grow by 1.1 million barrels per day in the year 2019. So we can see that the present projections have lowered. The present projections are low because the oil demand has reduced in many countries in the first half of the financial year 2019. In addition to this low economic growth is projected in many of the nations. So the oil demand projections have been lowered by OPEC. See even Indian economy is growing slower India's GDP growth slowed down to 5 percentage in the first quarter of the financial year 2019 to 20 that is in the months of April to June. Whereas if you see the growth in the first quarter in the previous financial year that is in the year 2018 to 2019 it was 8 percentage. So we can see that there is an economic slowdown in India. So now let us discuss about OPEC in brief. As we saw earlier OPEC stands for Organization of Petroleum Exporting Countries. It is a permanent intergovernmental organization of 14 oil exporting developing nations. It was created in the year 1960 at the Baghdad conference. It was created by five countries. They are Iran, Iraq, Kuwait, Saudi Arabia and Venezuela. All these five countries are the founding members of OPEC. Now it has 14 members. So the other members are Algeria, Angola, Congo, Ecuador, Equatorial Guinea, Gabon, Libya, Nigeria and United Arab Emirates. If you see before 2019 Qatar was also a member of OPEC but Qatar left OPEC on January 2019. There are also other oil exporting nations. They join OPEC meetings as observers. The main mission of OPEC is that its member countries should act in a coordinated manner to ensure that they remain stable so that there is an efficient economic and regular supply of petroleum to the consumers. Also it will ensure steady income to the oil producers. It will also ensure the business interests of the investors in the petroleum industries. I also remember that the headquarters of OPEC is located in Vienna in Austria. The executive organ of OPEC is the OPEC secretariat. It is also located in Vienna. Recently we saw Vienna in the context of Global Livability Index of 2019. In this Vienna topped the index and it was ranked as the most livable out of the 140 cities that were surveyed. Whenever we study about these kinds of organizations we should also know what are the reports they release. So remember that World Oil Outlook is released by OPEC. With this we have come to the end of this article discussion. The displayed practice question will be discussed in the last session. This news article is about a new species named as cryodrakin boreas. The syllabus relevant to the analysis of this news article is given here for your reference. The news article states that scientists have recently discovered a new species of pterosaur called as cryodrakin boreas. A pterosaur is an extinct flying reptile which has a featherless wing membrane that is extending from the side of the body along the arm. The pterosaurs existed during the late Triassic period throughout the Jurassic period and most of the Cretaceous period. That means they were present in the most of the Mesozoic era because Triassic period was the first period of the Mesozoic era and it occurred between 251 million and 199 million years ago and the Jurassic period was the second segment of the Mesozoic era. It occurred from 199.6 to 145.5 million years ago and the Jurassic period was between the Triassic period and the Cretaceous period. The Cretaceous period was the last and the longest segment of the Mesozoic era. It lasted for approximately 79 million years. So, now a new species of pterosaur has been discovered by the scientists. This cryodrakin boreas were a size of an airplane. This plane-sized reptiles had a wingspan of 10 meter and they weighed around 250 kilograms. Scientists call this discovery as a great discovery because it helped them to identify cryodrakin as being distinct from Quetzalcoatlus. This Quetzalcoatlus is another giant pterosaur and initially the scientists mistook cryodrakin as Quetzalcoatlus. The scientists are saying that cryodrakin boreas ruled over primal or the ancient skies above the T. rex, triceratops and other dinosaurs of the late Cretaceous period. Know that T. rex lived throughout what is now we know as western North America during the Cretaceous period. The scientists are saying that the cryodrakin boreas was hiding in a plain site, meaning that the species was there but they failed to identify it as a separate species. They are saying this because the remains of cryodrakin boreas was first discovered almost 30 years ago in Alberta which is in Canada. So the scientists are saying that even after finding the remains of cryodrakin boreas before 30 years ago itself it did not cause much excitement because of the misclassification. Now after they got a closer look at the fossil remains it helped them to realize that it was a new species. According to the scientists this cryodrakin boreas lived almost 77 million years ago and it had a similar food habit like other winged reptiles which lived during the same period and this cryodrakin boreas was a carnivorous and it probably fed on lizards small mammals and even baby dinosaurs. With this we have come to the end of this news article discussion. Moving on to the last article discussion for the day which is about Mental Health Care Act of 2017. The syllabus relevant to the analysis of this news article is given here for your reference. The mental health care act is in effect since April 2017. It is an act for the persons with mental illness. It will provide mental health care and services to those persons who are suffering from mental illness. This act will also protect promote and fulfill the rights of such persons during the delivery of the mental health care and services. Now also know that the convention on the rights of persons with disabilities was adopted by United Nations on 13th December 2006. This convention entered into force on 3rd May 2008 and India is a signatory to this convention. India ratified this convention on 1st October 2007. As per the article 4 of this convention it is necessary to align and harmonize the existing national laws with the said convention. In accordance with this the Mental Health Care Act of 2017 came into force. In this act the term mental illness has been defined. According to this act mental illness means a substantial disorder of thinking, mood, perception, orientation or disorder in memory of any individual. When there are such disorders it would impair that is it would weaken or damage the judgment behavior and capacity to recognize the reality or it will damage the ability to meet the ordinary demands of that individual's life. And the definition for this mental illness also includes the mental conditions that are associated with the abuse of alcohol and drugs. This act also mentions that mental illness does not include mental retardation. Mental retardation is a condition of arrested or incomplete development of mind of a person. It is specially characterized by subnormality of intelligence that is who are having low IQ levels. So from this definition we can see that mental illness also includes the mental conditions that are associated with the abuse of alcohol and drugs. So now let us come to the news article. In May 2019 around 23 inmates that is those persons who lived in an illegal de-addiction center in Pinjore were rescued by Haryana Police. All of them were addicted to drugs. After being rescued these inmates were shifted to the government de-addiction center so as to treat them for the mental conditions that is associated with the abuse of drugs. The news article mentions that Haryana Police has pioneered or they are the first to start registering a case under Mental Health Care Act of 2017. They have registered a case under section 100 of this act. Section 100 of this act mandates protection and rehabilitation of a person with mental illness who is found wandering or otherwise. This section also explains the duties of the police officer about how they have to deal with the persons with mental illness. Then the subsection 1 clause A of this section states that every police officer who is in charge of a police station shall have a duty to take under protection any person who is found wandering within the limits of the police station. If the police officer has a reason to believe that that particular person has a mental illness and he or she is incapable of taking care of himself or herself. Then subsection 1 clause B of this section states that every officer in charge of the police station shall have a duty to take under protection any person within the limits of the police station if the officer has a reason to believe that the person might be a risk to himself or others by the reason of mental illness. So these are the two conditions under which a police officer can take any person under their protection. Then subsection 4 of section 100 states that such persons shall not be detained in the police lockup or they shall not be detained in prison in any circumstances. And subsection 7 of this section states that in case of a person who has mental illness, if that person is homeless and is found wandering in the community then a first information report that is FIR of a missing person shall be lodged at the concerned police station and the station house officer shall have a duty to trace the family of such person and they have to inform the family about the whereabouts of this particular person. So these are some of the rights with respect to the persons with mental illness. With this we have come to the end of news article discussion session. The respite practice question will be discussed in the next session. We have come to the last session for the day that is the practice questions discussion session. This first question is about e-cigarettes. Three statements have been given and we have to choose the correct statement. If you look at the first statement it can be divided into two parts. The first part is e-cigarettes are battery-powered devices which are used to smoke. Now this part is correct. We saw this during our discussion and the second part says it does not contain nicotine. Now this part is wrong because e-cigarettes are made up of flavored solution which contains a varying concentration of nicotine. So this means statement one is wrong. So you can eliminate option A and option B which contains statement one. Now the second statement is a bit confusing because you may not be sure whether e-cigarettes contain these that is whether it contains acetaldehyde, formaldehyde and acetone and you may not be also sure whether they are carcinogens that is whether they cause cancer or not and we may not always remember every detail about a topic. So in this situation if you see the remaining options C and D in both these options statement two is mentioned and only one option contains statement three. So this means based on this question statement two should be correct and just now we have to say whether statement three is correct or not. The statement three states the use of nicotine as an ingredient in any food item is prohibited under the Food Safety and Standards Act of 2006. Now during discussion we saw that use of nicotine as an ingredient in any food item is prohibited under the Food Safety and Standards prohibition and restrictions on sales regulation of 2011 and this regulation comes under Food Safety and Standards Act of 2006. So this means it is also prohibited under this act so this makes this statement as a correct statement. So finally we can arrive at the option D, two and three as the correct answer to this question but also remember that e-cigarettes contain acetaldehyde, formaldehyde and acetone and all these three are carcinogens that is they are cancer causing elements. If you look at this next question it is about National Animal Disease Control Program. The question asks this program aims to eradicate which of the following diseases in livestock? Three diseases have been given one is foot and mouth disease, second is anthrax and third is brucellosis. Now today during our discussion we saw about foot and mouth disease and brucellosis and here anthrax is an infectious zoonotic disease which means it can be transferred from animals to humans. It is caused by a bacterium called as bacillus anthracis and this anthrax disease is not covered under this National Animal Disease Control Program. So you can eliminate option B and D and we know that foot and mouth disease and brucellosis are included in this program. So the correct answer to this question is option C one and three only. Now the next question asks equator does not pass through which of the following countries? Five countries have been given. We have to choose the correct answer from these codes. Now here first option given is India. We know that equator does not pass through India. India lies north of equator. So this means equator does not pass through India and the question asks for those countries through which equator does not pass through. This means the final answer should contain code one that means we can eliminate C and D directly. From the available options we have to just say that whether through Rwanda equator passes or not. During discussion we also saw that Rwanda lies south of equator. So this means even through Rwanda equator does not pass through. So the correct answer to this question is option B one and two only. Now also know that equator passes through 13 countries. As you can see in this map it passes through equator, Colombia, Brazil, Gabon, Satom and Prinsip, Democratic Republic of Congo, Uganda, Somalia, Kenya, Maldives, Indonesia and Kiribati. Now this next question is based on organization of petroleum exporting countries that is OPEC. The question asks which of the following countries are the members of OPEC. Four countries have been given and we have to choose the correct answer from the code given below. Now in this options India is also given. OPEC is an organization of petroleum exporting countries and we know that India usually imports high quantities of petroleum and is depending on the petroleum exporting nations for its energy needs. So this means we can eliminate India. So this means from the options India can be eliminated. That means the final answer should not contain option three. So we can eliminate options C and D. Now the remaining three options are Saudi Arabia, Qatar and Iran. If you would have answered this question last year then the final correct answer to this question would be option B one, two and four only. But Qatar left OPEC on January 2019. It is not a member currently. So we have to eliminate Qatar also. So the final correct answer to this question is option A one and four only. Also remember that along with Saudi Arabia and Iran Iraq, Kuwait and Venezuela are the founding members and the other members are Algeria, Angola, Congo, Ecuador, Equatorial Guinea, Gabon, Libya, Nigeria and United Arab Emirates. Now in this question two statements have been given and we have to choose the correct statements. First statement states India has a signatory to the Convention on the Rights of Persons with Disabilities. Now this statement is correct. India has not only a signatory but India also ratified this convention in the year 2007 and this convention was adopted by United Nations in the year 2006 and it it came into force in 2008. So this statement is correct. Now the second statement states based on the convention requirements India enacted the Mental Health Care Act of 2017 an act to provide for mental health care and services for persons with mental illness. We know that it is an act which provides for mental health care and services for persons with mental illness. So this part of the question is correct. Now we have to know whether this act was enacted based on this convention. Yes it was enacted based on the article four of this convention because the article four of the convention says that it is necessary to align and harmonize the existing national laws with this convention. So in accordance with this the mental health care act of 2017 came into force. So this means both the statements are correct. So the final correct answer to this question is option C both one and two. With this we have come to the end of today's sessions. If you like the video don't forget to like comment and share and do subscribe to Shankar IAC Academy YouTube channel for more updates on civil service examination preparation.


August is hot, and so are the savings at Appalachian Wireless, where all smartphones are 50% off. Even the 64, 128, and 256-gig models, two-year agreement required. Better service, bigger savings. That's today's Appalachian Wireless, and East Kentucky Network Company. Roughly a month ago, the Pikeville Police Department asked for the public's assistance locating a man wanted for burglarizing several vehicles in the Bulls edition. Almost three weeks later, the Johnson County Sheriff's Office also asked for the community's help in an incident at Cross Creek, similar to the case in Pikeville. Now, both cases are solved and two people are in jail, but they're linked together. 24-year-old Zachary M. Deming of Detroit, Michigan, and 21-year-old Courtney Skylus of Martin County were arrested in Sayodo County, Ohio for a similar incident. Once Deputy Terry Tussys saw their mug shots, he knew they were linked to the case he was working on. During the course of doing an interview with EKB, you had actually told us about the break-ins in Pike County. So we started checking in on that. You gave me the information of the officer I called him, and we started working together on that. Saturday, I received a contact from the sheriff. He had sent me a news article from another agency about these individuals being picked up in Sayodo County, Ohio. Upon looking at the mail, he looked familiar as possibly the same suspect in Pikeville and our case. Deputy Tussys interviewed the two in Sayodo County and told EKB News they admitted to the break-ins in Johnson County. They were also linked to several other crimes in different states. It stems from what I understand from possibly Texas all the way to Michigan. Both agencies are happy the case can come to a rest with some answers. It's a big break in the case, you know. We knew that the individual wasn't from this area because we wouldn't get any kind of tips that was leading to anything. We knew he was probably from another area, and we kept reaching out further, and by as far as we'd made it had been to Ashland, so we were getting close. As of now, the two are only facing charges in Ohio. Charges in Kentucky out of Johnson and Pike counties are pending. In Paintsville, Shelby Still, EKB News. Thank you.