Okay, well, it's a great pleasure for me to be here. Thank you for the invite. I found with discussions with PODL that we have an incredible amount of commonality, lots to talk about, and I hope we can continue the conversation and do some nice work together. Okay, so here's my title, Particle Pulerizabilities in TDF from Lattice QCD. What the heck do particle pulerizabilities in part on distribution functions have to do with one another? Well, let's find out. Here's a little picture. This is just an introductory picture. Here we are. Let's see, how do I do this laser deal? Maybe this one like there. Oh, there we go. Okay. So this is the main technique or device or technology for investigating at a sub-nuclear level, what's going on for mesons, baryons including gluons. And now people are extending this to nuclei. Well, how good is Lattice QCD? Here is a picture. Stole this from Andreas Krohnfeld and it's just a spectrum calculation. Everything from the pion up to omega particle. Not all of these are outputs. Some of them are inputs because you need to know the quark masses, you need to know the gluonic scale. Another thing you notice is that you have air bars. Well, how can you have air bars on a theoretical calculation? Because these are all Monte Carlo calculations. Okay. How does it do with alpha S? Well, it fell off the screen down here. Anyway, this is alpha S strong coupling constant at the Z boson mass. There are seven different techniques here. Here's the Lattice. Here's the overall fit and it's working pretty good. Okay, let's start off with some ancient history. Here's a paper I wrote in 1992 is in the main proceedings for Lattice QCD which used to be paper, nuclear physics proceedings and I was doing what is called charge overlap measurements. So you have particles on either side, time side of your Lattice in between you have charge density operators. By moving these things around, you can measure things. What I found is that you can, when the time separation of these things are large, you can make contact with the elastic limit and you can measure form factors. Okay, but I realized also, before you get to the elastic limit, other things were happening. So let's look at that. All right, so let's go over this in some detail. Here, I'm showing some of the form factors that I got from this method. This is also called a four point function in Lattice QCD. Why do you have, why is it called four point function? Well, you have your two protons or pions on either side and then you have two operators. You have charge densities that goes up to four. Okay, so you can hear, here I'm showing you can get phenomenologically relevant quantities for form factors. This is vector dominance, it works. But let's look at this, okay, structure function. So what do these four point functions have to do a structure function? Well, here's a well-known quantity. It's also a four point function. Okay, so let's look at this. This is the two charge densities. One is at the origin. The other one is at position X. There is a four dimensional. For a transform that's doing the first thing that you can do, there's gonna be two different approaches to this. First, I'll just stay in Minkowski space and then try to put it on a lattice. So here's some of the discretizations you have to do. And you can now, instead of an integral over X, you now have a sum over positions, but you also, what you can do in lattice formalism is insert a complete set of states. So you can do that. When you do that, you find you can do the integral. This is a standard expression. We're still in Minkowski space. You have alpha and beta sort of coefficients associated with the currents, okay. Well, structure functions are contained in there. And so how do you get at that with a lattice calculation? Let's take something similar, but now we're in Euclidean space. Lass QCD works in Euclidean space. It doesn't make any distinctions between space and time. And then your correlation functions are no longer oscillatory, but they become real exponentials. So notice this is a time-ordered product of currents. Let's say that we're working with charged pion. And let's also say that we're going to do a Fourier transform of this thing. Notice I'm summing over both X and R, but this R is a relative position and I'm going to do a Fourier transform of that, okay. So this is what happens. You have a sum of exponentials. You have a product of matrix elements. Well, the connection between nine and seven is the inverse Laplace transform. Okay, so on the right-hand side, you have lattice data. That is measured in Euclidean space. But over here, you have what you want. You have components of structure functions. Notice the I. So this involves an interpretation that you're extracting the imaginary part of this function. So I say you have to do this, but when you extract it, you're actually not doing something that you would expect to do in an experiment or in a presentation. In presentation, you'd expect to get structure functions and things like that is a function of four momentum squared. Here it's the three momentum squared that's actually fixed on the lattice. I talk about that. I talk about ways of fitting it. I talk about kinematic constraints. So here we go. The point is you can either start off with the W's and do a Laplace transform, or you can start off with the Q's and do an inverse Laplace transform. Often you see a silly statement in the literature that you don't have Euclidean data at imaginary times. Well, you simply do analytic continuation. It's a simple procedure. So it actually turns out to be easier to make on-zots is about the structure functions. I do a Laplace transform and see how well that fits the time data. Okay, let's try that again. One more time. Okay, I probably did something wrong. I'm like Pauly when I get near a laboratory. Things don't work out. Okay. Ah, all right. You've got the magic touch. Okay. That guy is very demanding. Okay, I already made this point. The lattice is actually at fixed spatial momentum transfer. Kinematic constraints must be respected. The data should not be well-fit by sum of exponentials. There's a quasi continuum assumption that comes into play here. Whatever time behavior you get, it should not be well-fit by two or three exponentials. Then it is going against your assumptions. And you need large Q, but small A. If you take the lattice form of the momentum Q times A, that quantity should be small compared to one. If it's not, then you have problems with your dispersion relation in lattice. I'll make a point about that later. But you need large Q because you're doing, oops. I stole my thunder here. Okay. You need large Q because you're doing, supposedly doing part-time distribution functions. What that suggests is that you need it, what's called an asymmetric lattice where your spacing in the time direction is very small. Okay. All right, so I got all that in there. Everything is set up. People, I'm expecting people to run and do this. Google citations nine. Okay, so, but if you wait long enough, 28 years later, here's the calculation. So this calculation was done in 2020, it's by the Kentucky group. And so they're using protons, not pions, like I was talking about. And basically you want to extract things in as reliable a manner as possible. So let's see how they did that. Oh, okay, so let me make that point later. Okay, so here are the diagrams that come into play as far as the topology of the diagrams is concerned. So we've got connected pieces and we've got disconnected pieces. Is there a time, okay, 35, okay. So how much time does that mean I have left? Oh, okay, yeah, all right. So I'm doing pretty dang good, okay. So anyway, connected pieces and disconnected pieces, this is a same quark piece. This is a different quark piece. This is called a Z graph. These are disconnected diagrams. This diagram is a special type of disconnected diagram where the two loops are actually merging, but it's still a charge density or current density or something here and another one over there. And I'll come back to this later. The Kentucky group only does A, okay. What you want, if you're going to try to connect to part on distribution functions, you want something that's diagonal in flavor.  Okay, so let's look at that. Okay, so this is their correlation function that they found for proton up. Okay, these are un, these are unpolarized, okay. You can also do polarized distributions, but these are unpolarized. Some of them are final average over initial spin. And this is lattice time down here, okay. So things are falling, you've got your airbars, but it goes up. That's a contamination, okay. What you can show is if you insert a complete set of states in this sort of thing that you, your masses, your physical mass is always positive and your correlation function as a function of lattice time is always exponentially falling. Well, I shouldn't use the word exponentially, it's always falling, okay. So there is some data we can look at, but this data has to be thrown out. And I think the Kentucky group realized that that was contamination. Okay, so it's, okay, same sort of, okay. So here we go, we got down. Notice that down has a slightly smaller positive values here. Here it is as a function of time. We got our contaminations again. All right, so that's what the data looks like. Okay, they do extract some structure functions, okay. They use these two set of results are for U and D. Here it is, U and D, the F1 structure function as a function of the energy parameter new using a method that they call maximum entropy. But they also use another technique called Bayesian reconstruction and you don't get very good agreement between the two types. Okay, here I'll make the point, the important point is that one needs not just small time separation of last points, you also need long time separations of the currents in order to fully characterize these functions, which should not be dominated by a sum of exponentials that should also have algebraic pieces associated with it. You need long time separation. So they had 20 points. There was contamination for at least the last five points. You need 120 points, right? So I would say that this hadronic, this called hadronic tensor approach, I would say that really hasn't been tried seriously yet. Okay, to sort of hammer home that point, let's look at their data. So this is for the up core and all I did was fit these nine data points with nine exponentials, but I required that the coefficient of each one of these exponentials be positive so you can interpret this as physical particles. And so, but I put a constraint on it. The constraint was, yes, the constraint is that all these coefficients have to be positive. So it's not a linear system you're solving, it's a minimum residual system that you're solving. But it understands it well enough to put these at zero. Now, I'm just showing I've, really these should be Dirac deltas, they don't have any wick. I just made it, I give it some width for you to see it. How does it fit? If it's the data, wonderfully. Okay, okay, so here is what they did for F1. This is their maximum entropy fit. Here's the energy. Notice they did not satisfy the kinematical constraints. This over here is the elastic limit. That's x equal to one. It has to go to zero. Or it has to go to some small value that's determined by squares of form factors. So their support is falling outside of the kinematical region. Here's the other higher order, highest value of new that's required. I think it's 3.56 GED for them. Okay, you don't have to do a sophisticated fit. Here is just a simple dispersion model, single resonance. This is a sort of resonance or assumption you would make in a graduate course where you have a dielectric constant and you say you have a single atomic level. Okay, so there's nothing sophisticated about this, but it does as well as they do. And I'm at zero down here. You do not have to be at zero at high new, which would correspond to low x. How well does that fit? It's pretty good. Can I compare it to Kentucky? No, I cannot because they did not give that data. Okay, if you go whole hog and get f2, 2xf1, this is what you get, okay. So this is as a function of a Feynman x, but remember, this is not a traditional PDF because at each value of x, there's an associated q squared. You have your lowest q squared down here, your higher q squareds up here. Okay, so two points. In order to extract these functions, it's important to have as long a time lattice as possible. I've already made that point. But in lattice, if you do that, what's gonna happen, you're gonna traditionally or what you expect with very large correlations with lattice data is that your airbars will go crazy, but they will not if you use the conserved current. The conserved current on the last is exactly conserved. It's up to numerical precision. It will constrain your airbars and will make such a calculation possible. What else is possible? Oh, that's possible. Okay, okay. Really, you need to go to high energies to connect with experimental results. How is this done when lattice dispersion relation is systematically wrong at high energies? With Wilson-like fermions, clover-type fermions, you have a Wilson term or a generalization of a Wilson term. And this thing screws up energy momentum dispersion at high momentums. You do not get E squared is equal to P squared plus M squared. So when you try to do this and you really want to connect to experimental data, you're going to run into a problem. But ask me later. I can tell you how to solve this. All right, here's the real stuff. Here's C-tech. This is at low momentum transfers. So the Q, not the Q squared is two GEV and here the Q is 100. You do see peaking. You do see higher peaking at lower momentum transfer. But this is nothing like that. Here the, this is much too high, but at least this is wrong in the right way. It should be too high because we're too low in energy. Okay, one more time. All right, so anyway, this is the real stuff. And I really enjoyed talking to Pavel about this stuff. Okay, so here we go. Here is a really good review. It just came out last month. I suggest that this is a really good place to start for people who are trying to understand how lattice can calculate these things. And there's not just one method. There's at least five methods that have been published. And basically all of them are trying to get this guy. So this is a particle. You got two charged densities in another particle. One of them is that, you can always assume one of them is at the origin. The other one is located at an arbitrary position Z. And here's the hadronic tensor approach. There's another closely related approach. She calls it Compton amplitude or approach or OPA with that OPE.  You do analytic continuation. It's a beautiful method. If you get enough moments of a function, you can invert that and find the function. And that's some of the ideas that go into that. Current current correlators, pseudo PDF. And this is a method that these authors are pushing large momentum expansion, also called LaMette for large momentum effective theory. So this is a function. They put their particles, they try to make as large momentum as possible, but is diagonal in that large momentum? P infinity here, P infinity there. These W's are Wilson lines. And basically these other techniques replace those current lattice objects with perturbative objects that they can sum over and get moments and then invert things and get functions. So that's an oversimplification that's one way of thinking about it. Okay, so let's see here. Here's an important point. The extraction of such quantities will depend upon the agreement of these various methods. The Adronic Tension Method still has not received enough attention. So it's not gonna be the case that LaMette works and the others don't and everybody depends on that. It's going to be an agreement between different methods that's going to give you confidence that you're really extracting something that's experimentally viable. And so all these methods are going to be important. Okay, so I said PDFs and polarizabilities. Well, actually I said polarizabilities and PDFs in the title. I reversed that in the talk, but now let's move on to particle polarizabilities. What did they have to do with PDFs? Okay, well, here's a paper that I wrote with my colleague, Frank Lee last year towards charge-py on polarizabilities from four-point function. So I'm back on four-point functions again. And actually I put one of my points on the wrong slide. So I'm actually going to try to go back up and pick it up. I know this is bad pedagogy, I don't know who Krista Smith is. Okay, well, it knows I'm doing something non-standard, so it's objecting. Ooh, did you plug your laptop in? Oh goodness gracious. Well, we can plug it in now. Well, we're going to take it. We can plug it in now. Well, we plug it in the back. Okay. We can plug it in now. Yeah, okay, there we go. Plug that little guy in there. I was worried about that. I had 80% on the battery, but I guess maybe I'm talking too much. Well, we also left it sitting here for a while. Yeah, okay. I guess rookie moves. In any case, it's my fault. I may need your help getting this back. Oh, all right. Yeah. Fancy touch file. Every time I try to use that, I break it. Right, okay, let's see if we can get this. Oh, it's not working. I think the power out there comes. Okay, there's something's happening. Hey, okay, it all again. Here we go. Oh, we're away again. It knows it's me. And so it's telling me that no, I don't want to cooperate with you. An interesting set of behaviors from the Mac. Yeah, well, you just have to adapt. Okay, there we go. Okay, all right. Sorry about that. Oh shoot, Walter, we need to reconnect to Zoom. Do you still have your email here? Oh, I can do that. Okay. Wow. Uh-oh. Yeah. Okay, so I should do the Zoom. Right, right. Now, let me try it again. I'm just gonna click on it again. Okay, there we go. There we go. Okay, so it should, I should do this. I should do that. And then it should open up.  Hey, Shan, one of my graduate students. Hey, Shan. You know, shout out. And then that thing down there didn't work. Oh, it should have worked. It is going to work. There it is. Okay, are we actually back? Yes. Okay, hello everyone. Okay, so actually I was trying to go back and pick up a point. Oh, what's it gonna do? Oh, it's actually working. Okay, I was gonna pick up a point that I'd put in the wrong place. Let's see here. I put it in the wrong place. I put it here. Okay, here we go. Okay, here we go. All right. I put this in the wrong place. This is a point I was going to make associated with the polarize abilities. If you have a charged particle in an electric field, what is it going to do? It's going to accelerate. That makes your correlation functions very hard. It can be done. Likewise, if you have a charged particle in a magnetic field, you have Landau levels. That makes measuring polarize abilities because you're looking at things that go like E squared or B squared and both of those phenomenon are going to either add to that or mess it up. But you can do this. These are called external field methods and I've done these things. But what we're trying to do is do the most fundamental calculation possible. We don't want external fields. We wanna go to the effective field theory and measure coefficients using four point functions. So that's what's going on. Now let's go up through this stuff. Okay, all right. So here's CTEC and here's the Parcon stuff and here's my point about agreement of the methods. Now it's on polarize abilities. So what do the polarize, how do you do that? Well, it's actually the same diagrams as for PDFs, structure functions, whatever. Only here we're working with pion. So it's easier to do this for mesons than it is to do this for baryons. But these are the same types of diagrams. Here are my collaborators. So these three are the connected pieces. So connected insertion, different flavor, connected insertion, same flavor, connected insertion. So this is the Z-Graph and these things are disconnected pieces. They're important. Field theory says everything that is not forbidden happens. And so these things happen, they're C quarks that happen. They're not really disconnected. They're connected to, they're all connected by a bunch of glue on lines. But as far as the fermion lines, they're disconnected. And I'll come back to talking about disconnected pieces in a little bit. Okay. So how do you do this? Well, remember how we did this, how I approached the measurement of structure functions previously. I started in Minkowski space and set things up. Then you go to Euclidean space and find the relationship between those two. What you have to do in a little lattice laboratory in order to measure the things that are originally defined in Minkowski space. So what you do is, this is called the Compton tensor and good old time-ordered product of currents. We're using pions here. It's just a simple diagram that looks like this. We always use a laboratory frame. We call it a zero momentum bright frame. So our pions, we choose to be at zero momentum. And then we basically kick it in anti-kick it with these two currents. Here's the kinematics down there. So all this is in traditional Minkowski space, but you have to simulate this. And so you form a normalized distribution function that has reference to times and spatial positions. This is a hadron correlation field. This is another hadron correlation field. It's not just a cork field. And here's our two currents. Notice the normal ordering, not the time ordering. And this is what you need. This is what is necessary to make a connection with that Minkowski guy. So here we go. So I have a times zero, a time one, a time two, time three. If you want to do the same flavor piece, then it looks like this. And this is what you'd expect at leading twist for the diet. It would be the leading diagram at low twist. Okay, Euclidean spacetime, zero momentum bright frame and then do a 4A transform. You do a 4A transform on both the X one and the X two is associated with the two currents and you insert Q on one and minus Q on the other. The large time behavior looks like this and you can pull off the coefficients. The electric and magnetic polarizabilities are defined within this Compton tensor, okay? And you can pull off these coefficients, measure them and this is what you have to do on the lattice in order to measure these things. In each one of these, this is electric polarizability for charge prime. This is magnetic polarizability for the charge prime. In each case, you get a relative charge density squared term, either positive or negative. And then you get, you have to do a time integral which would be a discrete sum on your lattice. This Q zero zero is a correlation of two charge densities. So the zero zero is related to the zero component of this tensor. Oops, okay, oops, man, okay. When you're doing the magnetic polarizability in this Q one squared is the lowest momentum, spatial momentum on lattice, what you're trying to do is simulate a numerical derivative with respect to momentum evaluated at zero momentum. And the best way to do that is to form a quantity that has non-zero momentum, but the lowest momentum possible. Okay, a similar story for the magnetic polarizability, except the one-one means that you're using currents, not charge densities, say in the one direction, you have to choose your momentum in another direction, perpendicular to that. So for the proton, it looks like this. Here's our square of our charge densities. These things can be measured in four point functions as well, so all of this is available in that formalism. There are also references to anomalous magnetic parts and you have the same sort of thing, but now you're working with a proton. And these are the pieces that actually measured and simulated on the lattice, the things that will allow you to extract these quantities. So we're in the process of doing that. I'm sorry, it's anomalous part of magnetic moment. Okay, let's see here, all right, there we go. Okay, like I said, the hard part of doing such calculations are the disconnected parts, okay? And so we have techniques, we specialize in these things at Baylor. What is a disconnected part? Well, here's a proton, it's going its merry way, but if you have a dynamical system, then if you're using dynamical algorithm, hybrid Monte Carlo, then these sorts of things are gonna be incorporated, but sometimes you have external currents that need to be evaluated separately like I was showing you on those diagrams. And then you have to introduce what are called noise methods to evaluate those things. Special techniques, okay. How to measure any quantity on the lattice, noise methods. So here's a bunch of noises, the average of them are zero. You can choose your noise often at Z4. So it's just one minus one, I and minus I. The noises are diagonal. There are, there's a finite number of them. You cannot go to infinity, but you can simulate that. And so any inverse matrix element of the quark matrix can be evaluated that way using that noise method. So that's the good news. The bad news is that you also usually get huge air bars. Huge air bars. So you need ways of suppressing not the Monte Carlo air bars, but the noise air bars. Okay, so here we go. I was doing this bad presentation even when I was practicing. So practicing doesn't get you anywhere. All right, so here we go. So, okay, it turns out that the air bars, the errors come from off diagonal elements of your matrix. If everything was diagonal, you'd have zero errors. And so you need a method that subtracts off diagonal elements of your quark inverse. So there you go, and you'll have smaller air bars. You want your M inverse twiddle to be almost like M inverse. And so you can invent these methods. One thing you would hope is that your M inverse twiddle does, although it has off diagonal parts, that it does not have on diagonal parts. Why? Because then you affect the signal. But that's okay if you just add in those, you subtract it off those diagonal pieces. If you add those back in, then you'll have an unbiased method. One way you can do this is by deflation methods. You can construct any matrix from knowing it's eigenvalues and eigenvectors. And so what you can do, it turns out that nothing is determined by the low eigenvalues in the last QCD, except one thing, and that's air bars. Air bars are almost completely controlled by low eigenvalues and eigenvectors. But there's something important that happens. If you try to remove the eigenvalues and eigenvectors of this non-Hermitian thing, the quark matrix is non-Hermitian, then in fact you'll find that your air bars don't decrease, they increase. And there's a well-known thing that happens in, well, I'm going over time, that's not good.  If you're working with Hermitian system, then all your eigenvalues and eigenvectors are perpendicular one another. But if you have a non-Hermitian system, that's not true, and often you have many, many, many pointing in the same direction, when you remove one of them, it is not removing the influence of that direction. And therefore you can have energy, you can have air bars increasing and not decreasing. However, if you Hermitize your matrix, and what that means for Wilson-like fermions, is you just multiply it by gamma five. It is Hermitian, if you deal with the low eigenvalues and eigenvectors of that system, then it does reduce your noise error bars, okay? In addition, if you use systems, GMR-SDR, the DR stands for deflated, restarted, these are techniques that my colleague at Baylor, Ron Morgan has originated. This is for general systems, so for non-Hermitian, Min-Rez is for Hermitian systems. What happens is these methods also help you speed up your matrix inverses. Here is a system, this is called the deflation knee, and it speeds things up. What's happening there is all the low eigenvalues and eigenvectors of the system have been deflated out, and then you get exponential convergence after that. After you've found those low eigenvalues and eigenvectors, you just reuse those. You actually over-converge on the first right-hand side, and that allows you to amortize that work that you've done over many right-hand sides and speed up your system. The nice thing about deflation is you get a double whammy from it. It gives eigenvalues and eigenvectors that are useful for reducing error bars. It also speeds up the calculation in a calculation sense. Here are some techniques that we've investigated for reducing noise error bars, for termative subtraction, eigenvalue subtraction, emission forced, eigenvalue subtraction, polynomial, and these are combined methods where we're combining perturbative with our Hermitian force. Our Hermitian force just refers to the deflation of the Hermitian system applied to the non-Hermitian system. But the best technique is this technique, polynomial subtraction. We invent polynomials up to some high order. It could be a thousand-order polynomial. That simulates the off-diagonal elements of your matrix. But we combine that with Hermitian deflation and get what we call HF poly. We do a reduction of error bar. This is our best method for reduction of error bars. Okay, so here's a little result. So this is a pretty big lattice, 24 cubed by 32. Here goes the relative standard error. And this is just from polynomial subtraction. We're at order 1,000 here for the polynomial. The polynomials are determined incredibly fast. You do one cycle of GM res and you get the Ritz values and you can form a stable polynomial from that. But then when you deflate, you get an extra kick to the system. The relative standard error is reduced. And here, your error bar is reduced to a tenth. That means that to do this with traditional methods, you'd need 100 times the computer time to do it. Because error bars only decrease like one over the square root of N where N is the number of noises. What happens if you do this for higher and higher polynomials, however, you'll find that these two curves come together. And the reason is because eventually the polynomial method at high enough order is also deflating. It's simulating the low eigenvalues of the system. And so additional deflation doesn't actually help. Additional explicit deflation doesn't actually help. Okay, but how do you complete it now? You've got an order 1,000 polynomial and you're supposed to take the trace of that. Well, you have the same problem as you had with M inverse. It's a very large system. You can't calculate it exactly. You have to simulate it. And we have what we call multi-level trace cascades. So here, I'm just using a traditional method, using noises, looking at a scalar operator, trying to isolate that, need a lot of noises, a lot of matrix vector products and a lot of time. Here, I'm subtracting a seventh order polynomial. Why am I choosing seventh order polynomial? Because at low enough orders, you can do a hopping parameter expansion of your low order polynomial and you can calculate these things exactly. Okay, okay. So that helps you. But the best thing to do is cascades. Let's say, so now we have an order 700 polynomial and I will calculate the trace of M inverse minus that order 700 polynomial. How many noises do I need to do in order to get below a threshold level 10? But then I add the number of noises necessary to get down to this seventh order polynomial. Again, that's because at that point, we can calculate things exactly. How many noises do you need for this? You need more, 350. But look at the times, they're reduced significantly. What we find is that for large systems, this is 12 cubed by 16, not very large. But for large lattice systems, you need more than two levels. We've been investigating some three level systems. Okay, so hopefully I'll have one more thing here. Hopefully, hopefully, hopefully. Thanks for your attention. And please consider how you can help the suffering people in Ukraine. Go re-crain. Okay, thanks, Walter. So we can go ahead for Q and A now. So let's start with the folks online. Does anybody online have a question? You can just raise your hand. I should be able to see it. Okay, how about in the room? Anybody in the room? Yeah, Sally. Yeah. Do you have the holly fitting and then you have HF holly? I think that's the one you're saying was right. And then I just said the number of orders in the polynomial increases they converge. So would the point of using HF holly meaning if you use fewer terms in your polynomial or that you have to find fewer terms? Could you repeat the question to the folks online? Yes, you can reduce the order of the polynomial. If you just use the polynomial method, you'd have to go out to order 10,000 to get down to the level that you get with the HF holly. So in other words, there's a window of applicability. There's a window where you get really nice reduction of error bars. You want to stay as low in polynomial order as you can. Because you're just introducing another problem, another trace that you have to evaluate. Yes. And so the way to do this and other groups are working on this as well is to do a multi-level evaluation. We call it a trace cascade. Again, you need to, it's either a two-level system or a three-level system. And it really works very well. So yeah. Okay. All right, other questions? Yeah. So we'll make to this question. At the beginning, you showed that very few people worked on a concept of showing them the spectrum of masses. What are the comparisons that you have used for the ability to get conditions? Well, you have chiral QCD predictions for these things. You don't necessarily have error bars on your chiral predictions. But it's the thing that is probably the most realistic prediction from QCD right now. You can also compare to external field calculations. Oh, there are plenty of measurements. Yeah, hundreds, hundreds of measurements. So, and there are other things you can do as well. You get these functions when you expand your comp and tensor out to second order in momentums. At third order in momentums, you get other things. You get things called generalized polarizabilities and you also get spin polarizabilities. And those are things that I'm working on with, frankly, trying to isolate those sorts of things. They're done in many places. I'm not an expert on that, but sometimes pretty big error bars. There's a substantial literature on all this. You'd be surprised or maybe not. I'm surprised at the depth of investigation of some of these things. So it's a pretty rich literature on those things. At least, yeah. Sure, yeah. So, but you say that if you look at the relation part of a little much back separation, you are not supposed to, it should not be here like some of the exponentials, it's supposed to perform in the quasi-continue. So why was the physical relation for that? Well, okay, assume the opposite that it is at large time separations that your correlation is falling like a single exponential. It'd be a single particle that's contributing. You just don't expect that for things like that. How masses, you'll have some continuum distribution of masses, I would say. Yes, but that's not how I think of it. Maybe that is an important way of thinking about it. An important way of thinking about it. Maybe you can imagine some effective masses as a function of time position or something like that. But it should be a continuum contribution. It should not be three or four exponentials that fit the whole thing, right? It's a continuum guy. So, and that's hard for lattice to do, right? It's everything is discretized. So at some point, the lattice is going to say, okay, everything is discrete, but hopefully you can do cuts on your correlation functions. You can recognize those things and parameterize them. A lot of these things are only understood after you do the numerics. I remember, for example, going to early lattice conferences where they were trying to get F pi or other quantities like that and they got terrible results. Eventually understood the systematics of the lattice and they could characterize it and they could avoid those problems. The problems are always things like lattice size issues, lattice length issues, lattice momentum issues, things like that. And it's very much like an experimental thing. You have a system, you need to make contact with reality in your laboratory, except now this laboratory is your numerical laboratory on the computer. Any other questions? Okay, I have one, Walter. Okay, yeah. So I'm sorry, I got a little lost here in the last part of this. So you were showing us that these polarizabilities can be extracted from these calculations. And then we talked about speeding computation and reducing errors and things like that. It's the punchline on the polarizabilities. Have you actually calculated? We're in the process. So we're in the process. Right, so that's as far as I can do right now. We have the paper. We're doing the calculation or at least it's being done at George Washington. Our formulas are the background.  So I told Paolo about that. So we can find out what the systematic problems are before they get to it in the big simulation. So how long does that calculation then take? Because it usually- It actually should not take very long at all. I mean, the actual calculation, but it has to be debugged. And that's what we're trying to do right now. One of the things that, but we have many, many tests now because we're using this conserved current and one of the things that we have to do up to numerical precision, when we sum over our currents, we have to have a steady signal. Not just steady, numerically determined, correct to numerical precision. And the numerical precision will come not only from your analysis programs, but before you did that, you did a whole bunch of quark inverses. These things are only done up to a numerical order that's determined by residual vectors.  You'll always get airbars. Those airbars could come from a bug in your program. We simply won't have that. We'll know whether we're spot on or not by using the conserved current. So yeah, and so I actually have kept my programs from long ago when I did these calculations, I did them at NCSA. And all my programs are completely utterly debug. I mean, just totally. And that's why we can, I can do this. Yes, yes, yes. And so that's why I can do the shadow calculation because all my programs are debugged and running. They only run on one processor though. But the thing is, the thing is that I do have many MPI programs, lattice programs. Our package is called QQCD. I work with Randy Lewis who's at York University. And there's a special technique you have to use called sequential source technique that's not in his programs, but are in my programs. So I can put my SST in his MPI program and then I'll have a running fast program to do corp propagators. So that's the plan. All right, well, let's thank the speaker one more time. Yeah, thank you. Thank you.


Although the federal government says it knows highly placed persons financing terrorism, a security expert is of the opinion that the inclusion of six Nigerians in the global terrorism sponsor list implies that a government is not proactive. Mercier Bokbo captures the opinion of security experts in this report. Activities of terrorism are worsening in Nigeria as funding and sponsors of the insurgents remain largely unknown by security agencies, apart from statements from government quarters alleging knowledge of such. A security expert, Yahoze Getso, who was a guest on the breakfasts on Plos TV Africa, believes the government is not doing much in this light. Yes, of course. Nigerian government was a bit relaxed because they have noted in their homework. I did mean they have done their homework. They couldn't have arrested them long before now. And the list could have been shared with the international community, not to wait until the United Arab Emirates sharing the list and declaring them wanted. This is a slap. It's a diplomatic slap. It's a security slap. And it exposes the weakness of our intelligence and it also exposes the weakness of Nigeria's investigation procedure and also it also exposed the weakness of Nigeria's capability. He says the government needs to collaborate with the government of the United Arab Emirates and orders to fight terrorism in Nigeria. It depends on the agreement. The the the memorandum of understanding as far as persecution is concerned of a criminal Nigerian criminal found who committed an offence in UAE or who committed an offence in Nigeria or a UAE indigent that who may be committing an offence in Nigeria. So it all depends on what we have on the memorandum of understanding. Another analyst, Tonio Foyato, says government has the intelligence on terrorists and those funding the activities in Nigeria but needs to be decisive and deliberate. The laws on the president do not go beyond in the territories, go beyond all these things and take decisive action against those that have been enacted, those that have been fingered. Forget about whether they have this very religious attitude. Forget about whether they have this much right with you. Forget about whether they have this very political, political objection. Meanwhile, the Nigerians included in the global terror list by the UAE were arrested in 2017 and prosecuted in 2020 with a 10-year sentence each. Merci beaucoup for Plus TV Africa.


Hello, Blue Team Village at DEFCON 3010Ds. My name is Matt Shear. You may follow me on Twitter at C3RKAH. My talk is called LemmierIRs. A slide deck is available by going to slides.dfirmat.com, which will take you to my GitHub repository. What I do is I work for a big, well-known organization as an assistant vice president of computer security and incident response. However, I have many years of hands-on technical experience, including digital forensics and incident response. I'm also a podcast host for ThreatReel. Where I volunteer is I'm an official hacking is not a crime advocate. I am also a WAMSA, which is the Women's Security Alliance Technical Mentor. Please check out their websites for additional details on those organizations. A quick disclaimer is that, yes, I have a day job. However, opinions expressed are based solely on my own independent security research, and did not express or reflect the views or opinions of my employer. My objectives are to show demo reenactments of real attacks, how these real-world attacks worked, how and why they defeated security solutions, and then show incident responses to these attacks, demo investigation tools and techniques, and discuss lessons learned in key takeaways. Just so we're all starting on the same page, some acronyms that will be used are IOC or IOC, which is an indicator of compromise, IR, which is incident response, and DFIR, which is digital forensics and incident response. Other disclaimers, demos are based on 100% true stories. These demos dutifully recreate actual attacks. However, some details were altered. Also, investigation demos are sped up considerably in the interest of allotted presentation time, and I will be doing demos on a live system. However, please pretend that's a sandbox because one should only perform these techniques in a dedicated and securely isolated and volatile sandbox. My first scenario is called the mystery attachment. Let me preface this scenario by saying there was a news headline from August 17th of 2018, and the headline was MouseBand Campaign targets banks using Microsoft Publisher. This was very unusual. Not that MouseBand campaigns or targeting banks is unusual, but it was the fact that the threat actors were using Microsoft Publisher to deliver their payload. You expect to find those type of payloads in Microsoft Word or Microsoft Excel, things that can have macros. You might even expect to see them within Adobe PDF files, but to see this distributed through Microsoft Publisher was very unusual. The headline was The Fault Amy Rat was part of and occurs botnet is reported by researchers at TrustWave, and there's a link in the slide deck to that article. After that was released, it was picked up by a number of other news agencies. The following week, as I'm sitting at my desk dutifully multitasking on a lot of things, I had somebody run up to my desk and they are very anxious in a frantic manner. They're saying, Matt, help one of our VIPs with access to lots of very sensitive information just got hit in that recent MouseBand campaign targeting banks. It matches the IOCs from reports of that new flawed Amy rat, which is part of the occurs botnet. The recipient attempted to open the Microsoft Publisher attachment on their smartphone. I need you to drop whatever you are doing and investigate this. We'll get you the attachment ASAP. In this instance, I'm not particularly the best mobile forensics person or the best mobile incident responder, but there really wasn't anybody else qualified to look at it. So I agreed that I would be happy to do it. And when they first came up to my desk, I'm really focused on thinking through what I'm gonna do with the investigation because they stood there and continued talking. Really, they sort of got me amped up and worked up because of their anxiety. So to talk through the investigation of this scenario, we're gonna open up the file in the sandbox. Now, in my case, I'm doing this on a live Linux system. I do not have Microsoft Publisher available to me. So I'm gonna open the file inside of Libre Office draw. And for our purposes, we'll just have to pretend that is the professional sandbox that has Microsoft Publisher in it. I'm gonna do a strings demo and then I'm gonna hash the file and show everyone what the search look like. Now that's a very small snippet. I actually spent a lot of time investigating, researching and reading about Flotami, reading about Necurz, looking for indicators to compromise, looking for any details that would help explain what this does and how it works. And then finally, I will take a look at the exit data and demo that as I ponder my next steps. So let's go ahead and take a look at the file. Again, this is inside of Libre Office draw. In Microsoft Publisher, I couldn't actually find where the macros were at and I myself never used Microsoft Publisher. So I was a little lost. What was interesting though is the publisher file itself sort of looked like this. It came up and stated that macros had to be enabled to display the contents of the document. And I had an instruction to click on the enable content button. In my situation, I could never get the enable content button to essentially pop up. I couldn't find the macros in the file. And when the analysis was complete in the sandbox, it actually gave the file a relatively clean bill of health. It did not detect anything malicious about it, which I thought was highly unusual, especially given what I was looking at. So I wanted to do a little bit more research on it. One thing I like to do as well is just to see if there's anything hidden in the file that I don't know about. So what the strings command will do is the strings command will essentially pull human readable text of any particular file. Now what I like to do personally is I like to pipe out the strings command into the less command. That way when I run it, I can essentially arrow up and down and navigate through the file without everything scrolling by past my ability to read it. And at the top, there's some interesting things here. As I did research, I found out these looked very much in place for what you would expect for a genuine Microsoft publisher file. I did arrow down and read through a whole lot of stuff. I didn't find anything particularly interesting about the file I was analyzing. So what I wanted to do next was essentially hash the file. In my case, all of our tools used SHA-256, which is something I was comfortable with gathering and then looking within our security toolkits. When you're looking for malware and looking for known samples, MD5 is probably sufficient. If you have MD5 in your environment and that's the preferred hashing algorithm, that's probably what you wanna use. In our case, it was SHA-256, but you can essentially do that either way. So I run that command. I'm able to get a hash value for the particular file and essentially search on that. If I did wanna run the MD5 sum, I can do that as well and get the results for that. So what I did when I had the hash is I started searching for it. And of course, one of the first go-to places for me personally was VirusTotal. And it may be difficult to read, but in the address field of the browser, you can actually see the hash value in there. In this case, no match is found on VirusTotal, which I thought was unusual because VirusTotal gets an awful lot of samples. JottyMowerScan doesn't have as many scan engines as VirusTotal, but it's a similar type of solution. And when I looked out there, again, I found nothing of interest or value. You can see the hash file there and you can see the hash was not found. So I went into hybrid analysis and again, no results for the engine while querying the hash value. And finally, I just actually did a Google search just to see if anything at all would come back. And it really came back that no documents, nothing was matched. So I wasn't quite sure exactly what I wanted to do next at that point. Again, I spent a lot of time researching things and so forth. And then I'm thinking, well, this mobile device, it's sort of at risk. Is this something that we want to get from the end user? And essentially, what do we do with it? Is it sufficient to do a security wipe on the device and give it back to the user? Do we confiscate this thing? What exactly is a good course of action? I didn't feel that essentially saying, well, the chances Microsoft Publisher infecting an iPhone are small. That just wasn't acceptable level of risk. I also wasn't sure I was even comfortable with the risk of wiping the device and letting the user have it back. In fact, I can tell you that I wasn't comfortable with that at all. And so another thought I had was, let me look into it. This particular user was not due for a device refresh yet but they were very close to it. So I was almost thinking, well, perhaps we can confiscate the device, shut it down and then put it in our forensics lab and then get this individual a new device issued. They were close enough to the date where we definitely could have justified that. As I'm thinking through these and other thoughts and spending time research, I thought, well, this is sort of silly, but I actually have not looked at the exit data for the file. Now, when does that simply right-clicking in the file, going into the properties and drawing into the details to see what you can learn about it? You always have to take exit data with a grain of salt though, because exit data can be spoofed. And so it's not perfectly reliable, but I thought, well, maybe there's another artifact I can find in exit data that will tell me something interesting about the file. So let me go back to my command prompt. Let me go ahead and clear the screen. And in my case, since I'm on Linux, I'm gonna run the plural exit tool on this particular publisher file. And when I do that, some interesting information, I have the file name at the top. I can see the date, timestamps, and so forth. This was interesting, the file type and file extension, FPX, not something I've really seen before, but then again, I'd never really looked at publisher files before. My research told me that those were legitimate things that you expect to find within a publisher file, the MIME type image, vnd.fpx, and then later on you see that it is Microsoft Publisher. I get to the author and it didn't exactly say test fish. It wasn't quite that blatant, but let's go ahead and talk about what it was. Really for me personally, it was a face palm moment, just simply realizing that the email attachment I spent all this time analyzing actually came from our test fishing vendor. Now I said that exit data can be spoofed and that is true. So I didn't just accept that as definitive. What I did do though is I went through and I looked at our email system and I double checked the message headers and they were what I expected. It came from the IP address associated with our test fishing vendor mail servers. Of course, when I'm looking at it, I'm reading, yes, Matt, this really is your test fishing vendor's IP address, you doled. It's okay if you wanna laugh at my pain. This was a definite painful lesson learned in this particular case, but what went wrong in my case is I got caught up in the moment by subconsciously letting somebody else influence my investigation. So their anxiety and bad assumptions wore off on me. One should always start with the message headers when they're conducting an investigation of a fishing email and the contents. And ironically, I've given talks on fishing forensics and I've always, always always stated to start with the message headers, but this one time I got tunnel visioned on the attachment and so I've banned in my own standards this one time by focusing on the attachment first and it really came back to bite me. In this case, there really were no remediation steps as it was what you might consider a false alarm. The road to redemption in this case were painful lessons learned for my reminders to stick to my standard investigative processes and procedures. If I had started my investigation by inspecting the message headers first, I could have closed out the investigation in minutes instead of hours and then in this particular instance, no further technical actions were required. My second scenario is called security scanner evasion. I'd like to preface this scenario by stating that there were identical fishing emails and they started hitting inboxes. We were actually getting wide scale reports of fishing and the link, what was interesting about the link is when I looked at it in a security scanner tool is it appeared that the page was already offline. If that were truly the case, then it might be a situation where it was nothing to worry about. I wasn't quite ready to accept that at face value. So let's go ahead and investigate this and find out. What we're gonna do for our investigation is we're gonna take a look at the email message and the source code. We're gonna note any hyperlinks and then we're gonna check out the landing page with our security scanner and that's something I'm just sort of simulating here. Then we're gonna take a look at the landing page source code and then finally we're gonna open up the fishing page in a sandbox. And again, I'm on my local machine here doing demos. So this is gonna be a simulated pretend sandbox if you will. Let's go ahead and take a look at the email message itself. And so here's a sample email message. And so the from field in this particular one I've called it from evil.scammer at promisewearelegit.com. The subject in this email message is this link is totally safe. And in this case, it's coming to fishing target which is unwitting.victim at randomtarget.org. Email message simply reads hello fishing target. We have a really important message for you to retrieve your message click here and that's not real subtle. It stands out about as much as it could possibly stand out regards spoof sender. Not had a lot of people ask me, Matt have you actually used this as a test fishing template to do fishing testing for user educational purposes? And the answer is no. And part of that is I'm not sure I really wanna know because my deepest fear is there's still gonna be that one person in the organization that's still gonna be gullible enough to actually click on this hyperlink. And so even though there's more red flags in this particular email than Vladimir Putin has in his garage as souvenirs from his old KGB days my fear is somebody would still actually click on it. In this case, a lot of people will tell you to hover over to get the hyperlink in an email message. I don't like to do that for a couple reasons. One is you might accidentally click on the link and two, I'm just sort of leery back in the distant past there used to be some issues with certain mail clients and web mail where JavaScript might run on a mouseover or an on hover, that kind of thing. So I tend to go the extra cautious route and I'm gonna go ahead and come in here into the view menu and pull up the message source. I wanna make this a little bit bigger so it's not such an itch art to try and read. And what I like to do in an email message is if I just do a search, a text search for HTTP I'm generally gonna find what I'm looking for. And in this case, I have one result and it found my hyperlink. And so I'm gonna go ahead and copy this particular link and see what we have. And let me go back to my command line and there's a couple of things that we can do to obtain the source code for this. Before I do that, let me go ahead and show what it actually looks like inside of my test sandbox. So if I open up the page I get what appears to be a normal looking 404 page saying that the file or the directory is not found. If this were truly the case, it could be a situation where this has already been cleaned up and there's nothing to worry about because it would appear that the malicious site is offline. Not wanting to take that at face value there's a couple of ways we can look at the source code for that. One of them is we can use the curl command and we can paste in the address and I can output the results to a file of my choosing. So for output, let me go ahead and call this something like first page. I'm sorry, let me go ahead and call this unknown.html. And it retrieves the file. There's other ways to do this. If you don't have curl available in a system you could always try WGet and see if WGet is installed. And with that, I'm gonna go ahead and repaste the address in here. It's gonna retrieve the file for me. This case, let me clear off this stuff. And so I've retrieved the file a couple of different ways. Forensically, it doesn't gonna make a big difference which way I use to prove that. Let me go ahead and take a look at the HTML files in here. Now we've got different names based on how I output those results. But what we can tell is that roughly we have the same file bite size on these. Now, one thing it's an artifact of demoing this on a local system that's running a local web server is that the WGet actually retains the original date that that was created. That's really just an artifact of the fact that it's on a local system. Typically when you run WGet online you're gonna get the current time when it was retrieved just like my curl output here. But you can see that we definitely have the same file sizes. And again, just to prove that these really are the same file, I'm gonna go ahead and run a SHA-256 sum on all of the HTML files in here. And what we can see is it doesn't matter if we use curl or if we use WGet. These results really are identical. And so what we wanna do is actually take a look at one of these files. So let me just go ahead and pop up one of these inside of a text editor here. And it doesn't really matter which text editor you use. I'm just using something that's simple that I can make bigger that hopefully isn't too difficult to read on screen. Now, whether you can actually read the JavaScript or not, I'm gonna explain how this works. So here at the top, we have our standard HTML file. It's declaring script. And in this case, it's gonna be JavaScript. And what we start seeing is we see an if else loop. And so what it's looking for is user agents. So navigator.userAgent. And so we see things that should be recognizable here. And so this one in particular is Chrome and what we see is it's doing an if if it's Chrome then replace the window location or in other words redirect the traffic to another page. And we have near identical code except down here we're looking at Microsoft Edge. We're looking at Firefox. We're looking at Microsoft Internet Explorer, the Opera web browser and the Safari web browser. And so we have all these different if statements and then down here we have our final else. So if none of these things matched then it should replace the window location with a 404 page. And now that's interesting because these are really all of the common web browsers that most systems would tend to have. So in other words, if a visitor is going to a website using a popular web browser it's going to send the traffic one place. And if it doesn't match any of that it's sending it to this 404 page. And if you remember from our security scanner demo that what we had was in fact a 404 page. And so it's interesting because the result doesn't necessarily match what has been hidden underneath the scenes down here. So this tells us an awful lot. And to give everybody an idea of what this actually looks like if we open up the web page in a browser Google actually tells us, hey this looks so much sketchy and when I pull it up here what I get is what very much appears to be a typical Microsoft Office 365 type of login. So we can actually see what's happening when the site is visited by a common web browser. Well, so let's go ahead and talk about this a little bit. We looked at the browser user agent string redirection. Sort of explained how that works. Taking this a step further in this case I got lucky because the threat actors had used JavaScript. So I could tell there were redirects happening and I could tell exactly how they were happening if the threat actors had used a server side language and there's certainly a number of them here including PHP, Python and several others I have listed by no means is that an all-inclusive list but those are very common to find as server side languages. What's interesting is you can't view source code on server side languages and is standard properly secured web server configuration. What is also interesting is that if let's say, for example, the threat actors had a payload that only worked within the Firefox web browser, for example, they could actually target the payload based on a specific web browser so that it would only round robin execute a malicious download. For example, when people using the Firefox web browser might visit a particular page, those same code snippets I showed could be further targeting specific browser versions within those brands. So for example, if we had a version of an exploit that worked only on certain browsers below a certain version number, those checks could be baked into the code and they would be very hard to sort of analyze then but also typically that round robin could redirect a user so fast that they wouldn't even notice that the page took time to load but it would also make it very tricky to analyze. So those are sort of things that threat actors could do to make this worse. And honestly, I think I've sort of seen some of these type of things in the wild. It's just very hard if you don't have direct control or access to a web server to know for certain. In this case, our remediation steps were, we determine the actual phishing landing page and we blocked it through web content filtering. We also worked with our secure email gateway vendor to block the active phishing campaign. My second scenario is called security scanner evasion. I'd like to preface this scenario by stating that there were identical phishing emails and they started hitting inboxes. We were actually getting wide scale reports of phishing and the link, what was interesting about the link is when I looked at it in a security scanner tool is it appeared that the page was already offline. If that were truly the case, then it might be a situation where it was nothing to worry about. I wasn't quite ready to accept that at face value so let's go ahead and investigate this and find out. What we're gonna do for our investigation is we're gonna take a look at the email message and the source code. We're gonna note any hyperlinks and then we're gonna check out the landing page with our security scanner and that's something I'm just sort of simulating here. Then we're gonna take a look at the landing page source code and then finally we're gonna open up the phishing page in a sandbox. And again, I'm on my local machine here doing demos. So this is gonna be a simulated pretend sandbox if you will. Let's go ahead and take a look at the email message itself. And so here's a sample email message. And so the from field in this particular one I've called it from evil.scammer at promisewearelegit.com. The subject in this email message is this link is totally safe. And in this case, it's coming to phishing target which is unwitting.victim at randomtarget.org. Email message simply reads hello phishing target. We have a really important message for you. To retrieve your message, click here and that's not real subtle. It stands out about as much as it could possibly stand out regards spoof sender. Not had a lot of people ask me, Matt, have you actually used this as a test phishing template to do phishing testing for user educational purposes? And the answer is no. And part of that is I'm not sure I really wanna know because my deepest fear is there's still gonna be that one person in the organization that's still gonna be gullible enough to actually click on this hyperlink. And so even though there's more red flags in this particular email than Vladimir Putin has in his garage as souvenirs from his old KGB days my fear is somebody would still actually click on it. In this case, a lot of people will tell you to hover over to get the hyperlink in an email message. I don't like to do that for a couple of reasons. One is you might accidentally click on the link and two, I'm just sort of leery back in the distant past there used to be some issues with certain mail clients and web mail where JavaScript might run on a mouseover or an on hover, that kind of thing. So I tend to go the extra cautious route and I'm gonna go ahead and come in here into the view menu and pull up the message source. I wanna make this a little bit bigger so it's not such an it chart to try and read. And what I like to do in an email message is if I just do a search, a text search for HTTP I'm generally gonna find what I'm looking for. And in this case, I have one result and it found my hyperlink. And so I'm gonna go ahead and copy this particular link and see what we have. And let me go back to my command line and there's a couple of things that we can do to obtain the source code for this. Before I do that, let me go ahead and show what it actually looks like inside of my test sandbox. So if I open up the page I get what appears to be a normal looking 404 page saying that the file or the directory is not found. If this were truly the case, it could be a situation where this has already been cleaned up and there's nothing to worry about because it would appear that the malicious site is offline. Not wanting to take that at face value there's a couple of ways we can look at the source code for that. One of them is we can use the curl command and we can paste in the address and I can output the results to a file of my choosing. So for output, let me go ahead and call this something like first page. I'm sorry, let me go ahead and call this unknown.html and it retrieves the file. There's other ways to do this. If you don't have curl available in a system you could always try WGet and see if WGet is installed. And with that, I'm gonna go ahead and repaste the address in here. It's gonna retrieve the file for me. This case, let me clear off this stuff. And so I've retrieved the file a couple of different ways. Forensically, it doesn't gonna make a big difference which way I use to prove that. Let me go ahead and take a look at the HTML files in here. Now we've got different names based on how I am output those results. But what we can tell is that roughly we have the same file bite size on these. Now one thing it's an artifact of demoing this on a local system that's running a local web server is that the WGet actually retains the original date that that was created. That's really just an artifact of the fact that it's on a local system. Typically when you run WGet online you're gonna get the current time when it was retrieved just like my curl output here. But you can see that we definitely have the same file sizes. And again, just to prove that these really are the same file, I'm gonna go ahead and run a SHA-256 sum on all of the HTML files in here. And what we can see is it doesn't matter if we use curl or if we use WGet. These results really are identical. And so what we wanna do is actually take a look at one of these files. So let me just go ahead and pop up one of these inside of a text editor here. And it doesn't really matter which text editor you use. I'm just using something that's simple that I can make bigger that hopefully isn't too difficult to read on screen. Now whether you can actually read the JavaScript or not I'm gonna explain how this works. So here at the top we have our standard HTML file. It's declaring script and in this case it's gonna be JavaScript. And what we start seeing is we see an if else loop. And so what it's looking for is user agents. So navigator.useragent. And so we see things that should be recognizable here. And so this one in particular is Chrome and what we see is it's doing an if if it's Chrome then replace the window location or in other words redirect the traffic to another page. And we have near identical code except down here we're looking at Microsoft Edge. We're looking at Firefox. We're looking at Microsoft Internet Explorer the Opera web browser and the Safari web browser. And so we have all these different if statements and then down here we have our final else. So if none of these things matched then it should replace the window location with a 404 page. And now that's interesting because these are really all of the common web browsers that most systems would tend to have. So in other words, if a visitor is going to a website using a popular web browser it's going to send the traffic one place. And if it doesn't match any of that it's sending it to this 404 page. And if you remember from our security scanner demo that what we had was in fact a 404 page. And so it's interesting because the result doesn't necessarily match what has been hidden underneath the scenes down here. So this tells us an awful lot and to give everybody an idea of what this actually looks like if we open up the web page in a browser Google actually tells us, hey this looks somewhat sketchy. And when I pull it up here what I get is what very much appears to be a typical Microsoft Office 365 type of login so we can actually see what's happening when the site is visited by a common web browser. So let's go ahead and talk about this a little bit. We looked at the browser user agent string redirection sort of explained how that works taking this a step further. In this case I got lucky because the threat actors had used JavaScript. So I could tell there were redirects happening and I could tell exactly how they were happening if the threat actors had used a server side language and there's certainly a number of them here including PHP, Python and several others I have listed by no means is that an all-inclusive list but those are very common to find as server side languages. What's interesting is you can't view source code on server side languages and is standard properly secured web server configuration. What is also interesting is that if, let's say for example, the threat actors had a payload that only worked within the Firefox web browser for example they could actually target the payload based on a specific web browser so that it would only round robin execute a malicious download for example when people using the Firefox web browser might visit a particular page. Those same code snippets I showed could be further targeting specific browser versions within those brands. So for example, if we had a version of an exploit that worked only on certain browsers below a certain version number those checks could be baked into the code and they would be very hard to sort of analyze then but also typically that round robin could redirect a user so fast that they wouldn't even notice that the page took time to load but it would also make it very tricky to analyze. So those are sort of things that threat actors could do to make this worse. And honestly, I think I've sort of seen some of these type of things in the wild. It's just very hard if you don't have direct control or access to a web server to know for certain. In this case, our remediation steps were we determine the actual phishing landing page and we blocked it through web content filtering. We also worked with our secure email gateway vendor to block the active phishing campaign. My third scenario is called the rabbit hole. I wanna preface this scenario by saying that I received a request from a user to investigate email message. They received to determine if it was legitimate or not. The email appeared fishy at first glance but I had to ask, is it just suspicious or is it malicious? For the investigation, I can tell from the message headers that the source IP address was a mismatch from the sender's domain. However, the message source was particularly interesting because the link text did not match the hyperlink destination. And we're gonna do a quick demo of that and then the malicious threat actors objective appeared to be credential harvesting for the purposes of account takeover. So let's go ahead and take a look at the email message and then also take a look at the hyperlink. So here's our email message. And so it comes from PayPal support but the address is ppsupportatpwned-server.org. The subject is PayPal bank account change confirmation and it's to phishing target which again is our unwitting.victim at randomtarget.org. The email simply reads, dear PayPal customer, we received a request to update your bank account on file. This process will complete in the next four hours. If you did not request these changes to your PayPal account, please log in to reject the pending activity. And here is a link that would actually take you to PayPal's actual login page if that is where you are being sent. And then in this case, sincerely PayPal support. And I mentioned in there that the link text reads one thing but the actual hyperlink can go somewhere quite a bit different. So let's go ahead and take a look at the message source code here. So I'm gonna go into the view menu, pull up the message source and make this a little more readable for everyone. And so if I search on HTTP, it will find HTTP, HTTPS traffic. And so here we have the PayPal sign in address that we just looked at moment ago in the live email message. But what gets interesting is when we see the actual hyperlink in the source code it's actually going somewhere completely different. So I'm gonna go ahead and copy that address and have that here so we can do some analysis on this. Let's go ahead and see what this looks like on a live website. And so again, this would be something you would typically do in your sandbox environment to see what's going on here. And it certainly has the look and feel for a PayPal login page when we go there. But what we wanna do is understand what is actually happening behind the scenes when we investigate this. So we've taken a look at the link text. We see that the hyperlink is going somewhere else. We know the threat actors are trying to harvest user names and passwords for PayPal so that they can log in as the user and deplete the account of funds, maybe make fake purchases, essentially committing financial fraud. So what we're gonna do is we're taking a look at the first destination. And we took a look at the source code just a moment ago and we know it's going to a web host in a foreign country. But we're gonna go ahead and take a look at that. So let's do that now. I'm going to go ahead and run curl and I'm gonna paste in the address I copied moment tarot ago. And I'm gonna output this and I'm gonna call it something like firstpage.html, retrieve that. And so I wanna take a look at this file and see what it actually looks like so I can understand the source code of the page and what's happening. And again, what we see in the address here is a dot BE top level domain which we know is the country of Belgium. Certainly if we're an American customer on PayPal we shouldn't be going to a Belgium domain and everything in that phishing email essentially tells the user, hey, you have four hours to essentially save your account information. So people will unfortunately maybe fall for that lure and think that they're acting in good faith to protect their account when the reality is they're actually handing over all of their credentials to the threat actors. So let's go ahead and take a look at this source code and see what it looks like. Yeah, I'll make this just a little bit bigger here. For an active webpage, this doesn't look like it has a whole lot of information in here. We see it as a conventional HTML file and we see, you know, title, please log in. What's interesting down here is we have this HTTP equiv equals refresh inside of this meta tag. This is a meta redirect and content equals zero means it's going to happen instantaneously. In other words, it's not gonna be a five second delay. It's going to do it immediately. And what we see here based on the source code is it's not going to PayPal, certainly. It's not even staying in the Belgium domain. Here we have a .de domain, which we know is in Germany. And this is certainly highly unusual because now we have something where the link text did not match the hyperlink which went to Belgium. Now we have a webpage being served up, we believe in Germany. And these are all very likely compromised web servers in these foreign countries. So, now that we have copied the second destination address, the landing page appears to be a compromised web host in a foreign country, but we're going to take a look at this, get the source code and figure out how this looks behind the scenes. So, similar to what we did before, I'm going to run curl, I'm going to go ahead and paste in the address for our second destination. And this time I'm going to output it to something called second page that HTML. And this, again, will retrieve the source code from the second web page. And we want to take a look at this and understand what's happening. So, let's go ahead and run gedit again. And in this case, I'm going to go ahead and pull up second page. And you can certainly use whatever preferred editor. Again, I'm just doing demos here and trying to make this somewhat easy. The ampersand should just open in a disassociated process and return the terminal back to normal. Let me go ahead and make this bigger. Now, this is not the same thing that we had for our redirect before. This looks just a little bit different. One, you can tell it's obviously a little bit bigger HTML file. We have HTTP meta information, but not a refresh here. What's interesting is there is a declared title on the page of log into your PayPal account, which will be something that would pop up and appear within the web browser. What's different this time, though, is we have an iframe. And the iframe has another web address in it. So, this is actually not serving up the web page we saw. This is actually serving up in an iframe. And what we can tell here with absolute positioning and 100% width and height and no border that it's a seamless iframe. So, in other words, when somebody visits this particular page, it won't look any different that they went to, but the reality is it's actually serving up content from this different address. So, this is definitely getting very interesting very quickly. Let's go ahead and take a look at the third destination address. And so, again, we have, if we look at the where this is going, we can tell that very soon that we have .nl as our top level domain. So, that is something in the Netherlands. So, we're going ahead and curling this page. We're going to go ahead and output this and we'll call it thirdpage.html and we'll get that. And so, before we've looked at these different kinds of files and we've retrieved them, we'll go ahead and do the same here. And so, I'm going to do my editor. We'll start typing in third page, do an ampersand. And what we get this time isn't the nice source code that we've looked at recently. We have really what is not human readable Govity Gooke. And if we scroll through here, there's really very little other than the script tag down here that tells us much of anything. We know based on the top that it is JavaScript. And what's interesting here is we have something called an unescape. And I'm going to explain this a little bit. So, this is an unescape sequence. And then what we have down here, we have something that's DF. Believe it or not, I actually made this a little more human readable and you might be thinking, Matt, this is not readable at all. And that's true, but bear in mind when you see this stuff in real life, there may be no white spacing at all to separate out what this is. Now, if I come here at the very end of the first lines, you know, we can see here at the end our unescape sequence based on what's happening here. I'm going to go ahead and guess that this might be some sort of a function. It's certainly not human readable. And back in the old days to understand what was happening here, we would actually have to get the unescape sequence. And then we would have to feed the function back into our unescape sequence to translate this into something that we might be able to read. Let's go back to our slide deck real quick. We've got our source code, we've perused it. And so what we can tell again is that the threat actors use JavaScript and coding to avoid analysis and detection while also hiding the page source. So we're going to take a look at decoding the page source using the built-in browser developer tools. The important thing to remember here is that anything that can be rendered in a web browser has to be something that can be decoded in order to serve up the page. So in other words, it somewhere has to be readable. Here we actually have the destination from the iframe itself. Let's go ahead and pull up the browser developer tools and we can actually leverage those as a faster method to actually understand what the source of the page is doing. Let me come back in here and do a quick refresh. And what we have when we look at this is on the network tab inside of our browser developer tools. Right now we're looking at everything and we're going to see headers. And so here we have our web page and we can see what the headers look like and that sort of thing and a little bit of the source code but we really don't see a whole heck of a lot here. If I come back into the elements tab, I've got some code here but it doesn't really break down a whole lot of detail. In other words, what I'm seeing on the screen I'm not really seeing a whole lot of code for. And what I mentioned before, the good thing is that this stuff has to be decodable or else the web page itself would never render and the threat actors would not be able to do account takeovers. So if I do it edited HTML, this starts to look very similar to what we had before and we have again our unescape sequence here. It's same stuff we were just looking at but what gets really nice is once we get past this blob of JavaScript encoded stuff that isn't human readable in our browser developer tools we actually do get to a point where we get to actual source code and here we can actually see the unescape sequence in here. It's already done the heavy lifting for us. And again, I was just guessing based on how the code looked that that might be a function. And sure enough here, we see that it is trying to do some sort of a function call based on the unescape sequence. And what we notice here is that this is readable code for the most part. We see the title login to your PayPal account. What gets really weird though is that we have more stuff that isn't exactly human readable when we get around to this section. And what it tells us here is a shortcut icon and we look at the MIME type. It's data image X icon base 64. So I'm gonna go ahead and guess that this is likely some sort of base 64 encoded content. And we'll go ahead and kind of scroll past that stuff a little bit based on what we see here. It might even be an icon file of some sort. We'll go ahead and go back down and here again, we actually start seeing our HTML coding that we can actually now read. What gets interesting is that we get down here, we've got a table item and this would appear to likely be an image source. And here again, potentially base 64 encoded, probably base 64 encoded based on the MIME type and how that's defined in here. We have data image. So I'm gonna guess that this is an image file. And if we scroll through quite a ways, takes us a little while before we get back to the actual content. Now this is something that's actually relatively simple to analyze here within the developer tools. We go back to our network tab and we look at some of what's in here. Let me make that just a little bit smaller. Here we see what was retrieved. We have an image file that is a JPEG and we have base 64 encoding. And if we were to go back and look, it's gonna be the same code that we looked at in that second file that was base 64 encoded. And what is really nice is they have a preview tab here. That actually shows us what the file looks like. We bounce back to our webpage where we loaded this again in our pretend sandbox. Here's the logo file itself for PayPal in this particular location. So we've done this with the browser developer tools and we've seen that this is indeed all part of this single file that we've looked at the source code for. But what you might recall is that there were two base 64 encoded things in here. And so again, I'll have to go ahead and click edit as HTML. And if I scroll past the encoded parts it'll actually give me the decoded version of the webpage. And here again, I'm guessing that it's an icon file in all likelihood. What I wanna do to manually do this and what I wanna show is how you manually decode base 64 items. And so I'm gonna go ahead and copy this whole blob of stuff. I'm going to open up a new tab here. And I wanna go ahead and paste this in here. And what we have is this big base 64 encoded data. And I wanna go ahead and save this particular data. And I'm gonna go ahead and call it unknown.txt. That's essentially what we have. We have text, we can see what's here but it's not necessarily human readable. And what we wanna do with this is show how we would manually decode base 64 content. So let me go ahead and list out my text file here. And here I have it unknown.txt. Let me go ahead and clear this again. And so what we wanna try and do here is base 64 for the command. We'll do a dash I just to sort of ignore any warnings or errors or that kind of thing. We'll do a dash D for decode. And let me go ahead and pull unknown.txt. And what I'm gonna do is redirect the output. And what I'm gonna redirect the output to is fave icon.ico. Hit enter. And now if I do an LSL, start.ico, I should see that I have a fave icon.ico file. So this is great. It appears like we may have decoded this thing successfully. And here's my fave icon.ico file. If I double click on this, open it up in an image viewer and I make this much bigger than the default. Here we can see what would appear to be a fave icon within PayPal. Now this is gonna be somewhat tricky to see here but in the browser at the top, we see our fave icon file up here. This is all interesting stuff. What we've observed through this is that we've seen encoded elements. And I'm not sure whether the Thread Actor used encoded elements to avoid analysis and detection or they simply wanted to keep the entire site as a single page file, but they use base 64 encoded elements inside of their JavaScript encoded page. And we've looked at demos for that. We've also seen how to decode the base 64 using the built-in browser developer tools. And we've also walked through how to decode those elements by hand. In this case, the remediation steps were that we determined the final phishing landing page and we blocked through web content filtering. We also went ahead and blocked intermediary, compromised web servers through content filtering since we had identified numerous compromised web hosts in foreign countries. And then we reported the compromised websites to domain owners and hosting companies through their who is contact records. That's a little bit of a leap of faith now because everything is privatized. So hopefully the privacy email address is forwarding somewhere that's being actively monitored. We can only control so much on our end, but those are the remediation steps we took in this case. That's all I have for this presentation. I'd like to thank everyone for tuning in. As you see me hanging out on Discord or at Defconn, please share your own DFIR stories. Friends, Romans, Defconn attendees, lend me your IRs. And with that, I will be hanging out on the Discord to answer any questions. Please feel free to reach out to me there. And I wanna thank everybody for tuning in and hope everybody enjoys the rest of their conference.


Trick-or-treat! Oh, aren't you so cute. A skeleton, a Republican mermaid, and a criminal. I'm an astronaut. I know what I said. It's a federal crime to use the NASA insignia without permission. Got it! Yes! Hmm, hmm, hmm, hmm, hmm. I saw your signal. You sure you want to hear this? It's Pop Secret. Don't you mean Top Secret? Pop Secret. Charlie Time. Rittenbocker. Everybody. I don't get it. Follow the butter. Taser, taser! It's a federal crime for an employee of the U.S. Popcorn Board to leak confidential popcorn information. Got it. Yes! Get her. I'm already in custody. Oh! It's a federal crime to sell canned, unpitted cherries if the largest cherry is more than twice as heavy as the smallest. Got it. Yes!


Right now, young blue man, young blue, you really f***ing up the MOT3 album right now because you know, whatever you got going on with them, you know who you were signed to before you signed to them people. You know what I'm saying? You got two of my favorite people in the world into it. He got Bootsy and who? Gazi. Gazi into it. Yeah. So you don't appreciate them doing that. You know who you were signed to? Yeah, we on Boss Talk 101. Yeah, we gonna talk. Yeah, yeah. I still got albums coming out. I still got movies coming out. So my base concern is MOT3 to tell a story of my partner Roy Lee. But you know, on the side, I'm still going to give people chicks. You know what I'm saying? I'm still going to help people out and give people chicks. I'm still going to do it. The way I'm putting out this nigga MOT3 album right now, every video is a short movie. Yeah, you keep teasing everybody because that's why everybody being in them comments trying to say, hey, when is it coming? It's not me though. I'm just giving people hope. I'm letting people stare, it's not me though.  Cause you know, whatever you got going on with them, you know who you were signed to before you signed to them people. You know what I'm saying? You got two of my favorite people in the world in two. He got Boots in who? Gazi. Gazi in two. Yeah. So you don't appreciate him doing that. Young blue, you know who you were signed to? What did he, okay. And you think that, and that's pretty much causing some, the waves to flow different at the whole late. Yeah man, you know. At the empire. This is coming from a person who don't really know what's going on with us, okay? I don't know. Young blue, what did young blue do? Ain't that Boots's brother or something, cousin? Nah, you know, it was an artist. Okay, yeah, I thought it was, yeah, I know it was an artist, but I thought they were family. They're not family. No, it's brother or something when it signed them all for something. Yeah, I don't know. Cause you say you don't appreciate what he did. That's what he's talking about. They all under the same, you know, like a brother. It's in the, it's in the, it's, it's a friction. It's a friction right now. Okay. Because now you know, we need Boots to keep on doing songs in mode three. People want to hear Boots in mode three. We still getting plants after that combination. Yeah, I'm not sure.  I don't know, they can't wait for a Boots in mode three song to come out. No, I can't, I love it. You know what I'm saying?  We could, we could. I didn't even think of it anyway. I get what you're going for. So that's holding up now. Well, it ain't just holding up. The album is holding up the way that, like if he's trying to deal with Bootsy. Yeah. I need them talking. He need them to be able to tell what they're into. Yeah, we shoot, they need to shoot videos. They got a song called Way in the Water, Path of Motherfucker. We could have, y'all, we could have picked up, they could have picked up the option, had another mode three and Bootsy, another album, Badass to mode three, too.  Yeah. Because at the end of the day, you know, when the last album came out, I called Bootsy, Bootsy helped me promote it. You know, Bootsy got them songs on there. Bootsy riding around tour, you know, Bootsy's a big part of mode three career. Yeah, you know what I'm saying? So when he not happy, then he put me in the middle, then you got a person that sit there and took a chance to change mode three live and they into it, man, they make a whole bunch of, the situation's kind of sticky.  Huh? You think it'll ever be resolved? I try to stay out of, I don't care who did what, how they did that. But at the end of the day, those two are my favorite people in the industry right now. Well, let me ask you this. Bootsy came off about Kodak Black and 6ix9ine doing a song together.  I wonder how all of them souls feel, though.  Did you feel like you, you know, if 6ix9ine was the one that do something with Bumpy or would you do it?  I wonder how all of them souls feel, though. For a million dollars? Yeah, Bumpy over city, Bumpy ain't no gangster. So he ain't into that? Yeah, nah, he better not be. So that mean you could do, you could do, you could work, you could make it happen and you wouldn't have a problem with it because you ain't in that lifestyle.  Go get that money. Get that money. I don't know how the better changing your family life. But when you was raised by them ruse. Yeah. Ain't no turning back from that. Yeah.  You know what I'm sayin'?  I remember when Lil Tim with Vaughn posted me doin' a song with 6ix9ine, everybody in the world talkin' about him bad. You know what I'm sayin'? So, when you live by them gangster clothes, them street clothes, 6ix9ine, you can't even have conversation with 6ix9ine. You know, if 6ix9ine and Gunna did a song together, niggas would go crazy. But like I said, in the world right now, snitchin' is not bad to some people. They don't care. To the industry now, you know, they catch niggas every day by snitchin'. People still go listen to them. Yeah. You know what I'm sayin'? So, you know. Do you, okay, so? Cause you remember snitchin', what's the difference to bein', and that don't matter no more. What's the difference in havin' a gay homeboy or a snitch homeboy? That's a weird question, Ray.   That's a crazy question, Ray. You know?  A snitch is somethin' you can violate the code on.  And you find that your main partner's undercover. Okay, let me answer that question. The difference is your main partner that's undercover, whatever. He not bringin' it to you.  That's his business. But when you have a homeboy that's a snitch, he could be snitchin' on you and you don't even know. That's the difference. But yeah, you're right about that. But in the culture we live in now, it all don't matter. Why do you think, why haven't Boosty been back on Vlad since he came home? He was screamin', he was gon' go back, but he ain't went back. I've been waitin' on that. He oughta been back a month. But still, he said when he got out, I'm on my way, Vlad! You know, they probably did, they probably held him. Just holdin' it back. Yeah, yeah. Yeah, we on Boss Talk 101, 101. Yeah, we gon' talk.


Listen, you have a spiritual gift. It may not seem like it or feel like it. You may sometimes doubt that God has placed a gift in you.  Here's what the Bible says. A spiritual gift is given to each of us so we can help each other.  God has given you a spiritual gift. Don't forget to subscribe.