The largest carbonate condensate field in China was discovered in the Darim Basin, located in the Central Asian country. It is believed that the Ordovician carbonate reservoirs were formed from reef shoals along a platform margin. However, recent success in producing oil and gas from these reservoirs has been attributed to the presence of strike, slip faults which intersect the platform margin. These faults have caused the formation of fractures in the reservoirs, increasing their porosity and permeability. Additionally, these fracture zones are thought to be the most productive areas within the reservoirs, suggesting that they should be targeted for further exploration and production. This article was authored by Yan Xiao, Guanghui Wu, Yintaoshang, and others.


The floor may not be in your old box. Ever since my previous attempts at horror stories in the past, I felt that I was finally freed from this chain of torture. But I soon found out that I was wrong. I'm explaining this because of something that I had discovered. Something, rarely evil. It all started when my family and I went out for a Sunday drive across the country. We had been on the road for a few minutes, and we decided to stop at a local picnic area for a break, before we headed home for the afternoon. That was when I first discovered it, the thing that still haunts me to this day. At the picnic area where I was looking over the most beautiful lake I have ever seen. I soon noticed something among the corner of rocks, where the lake streamed forward. I approached the rocky corner, and saw something that has always been part of my nostalgic souvenirs, a VHS video home system. I was so excited when I found this. I picked it up and examined it. It was like the other videos that I collected, but it was different as well. This VHS was covered in bits of blood, which both confused me and made me cringe. I looked at the label on the side. The label read, Happy's garden, all about nature, and it was written in the most unfamiliar handwriting that I have ever seen. Almost like it was written by someone with strange but neat handwriting. I was a bit confused. How would a VHS with child-friendly content have a little amount of blood over it? I asked myself. I decided to take it home with me so I could examine it more. When I showed the VHS to my parents, they were glad that I managed to find something rare, but they were also disgusted by the bits of blood covering the tape. And on the way home, I was looking at the VHS, and wondered if it would still work in my VCR, if it has blood on it. When we got home, my parents had to go out to get some errands done, and my brother went to go play Plants vs. Zombies Garden Warfare. I decided to check out my new VHS. So I went into the best room where the VCR was held. I turned both the TV and the VCR on, and once that was done, I put the bit of blood covered VHS into the VCR, and began to watch it. As the VHS began, a splatter of TV static was the first thing I saw, then a quick clip of an Australian rules football tournament, and then a quick clip of a sitcom, featuring a businessman and his wife, talking about something that involved chicken burgers. It then showed me a logo for a TV film studio that I hadn't seen before. The logo read, Bright Lane's Entertainment. I knew that this was going to be something interesting, or so I thought. The opening to Happy's Garden began, which shown an animated version of a character named Happy, and some animated children, all of them were singing and dancing around the garden, which had animated singing and dancing plants, who were singing along with Happy's theme song. And just as the song ended, I soon saw the title, Happy's Garden, and below it was the same title, that was on the label of the VHS, all about nature. I was about to begin the biggest, and maybe scariest, moment of my life. After the opening theme song, I soon saw a live action version of Happy, who appears to be tending his garden, when he notices the audience. He smiles at the camera and says, Hi kids, welcome to my garden, and today we are sure gonna have a lot of fun. Because we are going to learn all about nature. I soon heard children cheering off-screen, as Happy laughed wildly. This seems okay to me, I thought to myself. But I was still cringing over the bits of blood that covered the tape. I knew something bad was about to happen soon. Now then, kids. Happy then continued, as the children stopped cheering for Happy to speak. The first thing that you need to know when you're in nature, is how to take care of it. Just follow my lead. Happy then demonstrated how to plant a flower using seeds, dirt and water. But then I saw something that I hadn't noticed before. There was a burned head of a corpse behind a rose, while Happy was explaining how to plant the flower. I started to wonder how it got there, until a stagehand quickly took the head away, before Happy was finished with his planting explanation. And the final thing we have to do now, is wait until this seed grows into a beautiful flower. Happy said, as he finishes his planting explanation. He then stands up to face the camera and says, While we wait, how about we go somewhere where we can see more plants being planted? The off-screen children cheer in excitement, as Happy smiles in appreciation. Then let's go. Happy said, as he then walked off-screen. I then saw the stagehand holding the bird's head, but then moves out of the way when he notices the camera. That was weird, but almost terrifying, I thought to myself, but I continued watching the rest of the tape. The screen then transitioned, in a cartoonish way, to a different location. It was located somewhere in a plant factory, where a bunch of plants were being created. Happy then walked back on screen, and turned to face the camera, and smiled. Here we are at my plant factory. This is where most plants that I grow in my garden, are created from the seeds I recently found from most plant shops, into fully grown plants. Happy said, as he showed the person watching, meaning only me, the plant factory and how the people there made plants from planting seeds. I thought that this was a pretty useless explanation. I mean, he did show how to plant the flowers, but does he really need a factory to help him, with the easiest thing to do in life? This question still confuses me to this day. As Happy's factory explanation was still going on, I could see that the tape was going berserk, because of the short white lines appearing over the screen. At first, I thought that the tape was filthy, so I took it out of the VCR, stopping the show, and began blowing on the metallic-like tape strip to dust off the tape. I think some of the blood on it got on my fingers as well. After cleaning it, I then put the VHS back in the VCR, and continued to watch it. It continued normally with the tour of Happy's plant factory. Soon, just as the camera cut to a poster featuring Happy, and a few children planting, the screen then went berserk a bit more, and it then showed something that freaked me out. It was a quick cut of Happy bashing one of the children's head with a shovel, as blood started spewing out of the child's head. But after the screen went berserk again, the post returned to normal. I could not believe what I just saw, so I decided to rewind to the exact spot where I saw the quick jump scare. When I got there, I saw the quick jump scare again for a split second, but I was lucky enough to pause it. I examined it with a bit of cringe and disgust in me, and I thought to myself, how the hell did they managed to get away with this one? I shrugged it off, and continued the tape as normal, so that I could further examine it. As the tour of the plant factory ended, the screen then transitioned back to Happy's garden. Happy walked back onto the screen, and turned to smile at the camera once again. Well no, wasn't that a great tour of my plant factory children? He asked. Yes, Happy. The off-screen children said all together. Happy smiled, and turned to see that his flower has grown perfectly. He smiles in appreciation, and turns back to the camera. And will you look at that? My flower has taken its time to grow, and now looks pretty and happy. He continued saying. But don't go away just yet, children, because we still have a lot of fantastic things to learn about nature today. Just follow my lead and you will see how great gardening can be. Happy then smiled as the off-screen children cheered again. But then, in a split second of the tape, I saw another grisly image. As the screen went berserk again, I saw Happy holding a knife and covered in blood. He is still smiling, but now with a hint of evil in his eyes. I also heard the sounds of the off-screen children screaming and crying, no longer cheering happily. I could not believe what I was watching here. I didn't even took the chance to watch the rest of the tape, as I had a fear of experiencing more frightening ways of happy. So I stopped the tape and took it out of the VCR. I then sighed in relief as I was now safe from Happy. And at the same time, my parents came home. I quickly approached them and explained to them the tape that I discovered during our Sunday drive. I showed them the tape, and they believed me. We then decided to call the police about this tape, and they told us all about it. From what I could remember from the police officer's speech, he said that Bright Lane's entertainment used to work for Adult Swim, while also producing a few shows for kids. Until a misunderstanding occurred when Bright Lane's combined their horror elements from their Adult Swim shows into their children's content. The Happiest Garden episode that I watched was the only thing that they had shown on TV before their shutdown. It was also a pilot episode, which didn't go anywhere since the kids' test audiences were frightened by it, and afterwards, Bright Lane's entertainment shut down. They then explained that somebody must have recorded the episode, hit it by the rocks near the lake at the picnic area where I found it, and then killed themselves after viewing such a creepy disturbance, which might explain the bits of blood on the tape. They also said that the guy, who played Happy in that episode, was a serial killer who tried to reform after a few years in jail. Bright Lane's entertainment actually hired someone dangerous as a children's TV character. I was instantly freaked out by this. The police then agreed to take the Happiest Garden tape away from us and burn it before anyone else could get their hands on it and experience the same fate as I and that other person who recorded it did. Although I am now safe from that evil psychopath Happy, I am still haunted by the memories of that tape, along with my other horror story experiences shall remain in the back of my mind forever.


focus is a state that we get ourselves into and we are very very very very very very very focused on completing one thing or doing one thing. People do get into these states we call it like the flow state but for autistic people we do have a tendency of taking a little bit of time to get into doing something new. It's kind of like the idea of inertia like it takes us a while for our train to kind of start moving but once we get to a point where we have been doing it it kind of goes on and on and on we spend more hours we concentrate harder as time goes by it gets more and more and more intense the train gets a little bit too fast you know the train gets like hey guys um been working for like 10 hours probably need to gel and so you have to break slowly you can't just grind immediately to a halt by putting the break on


President of the United States and the Prime Minister of Domenica. He will be joined, as we've said, as the President is just about to come out, and speaking with Congressional leaders for about an hour now, we're told that the decision probably came yesterday to involve what nations we had been told Britain was involved, also Jamaica, also one nation. Here is the Prime Minister and also the President of the United States. May I make a statement and then I shall present you. Ladies and gentlemen, on Sunday, October 23rd, the United States received an urgent formal request from the five member nations of the Organization of Eastern Caribbean States to assist in a joint effort to restore order and democracy on the island of Grenada. We acceded to the request to become part of a multinational effort with contingents from Antigua, Barbados, Domenica, Jamaica, San Lucia, St. Vincent, and the United States. I might add that two of those, Barbados and Jamaica, are not members of the Organization, but were first approached, as we later were, by the OECS and asked to join in that undertaking and then all of them joined unanimously in asking us to participate. Early this morning, forces from six Caribbean democracies and the United States began a landing or landings on the island of Grenada in the Eastern Caribbean. We have taken this decisive action for three reasons. First, and overriding importance to protect innocent lives, including up to a thousand Americans whose personal safety is, of course, my paramount concern. Second, to forestall further chaos. And third, to assist in the restoration of conditions of law and order and of governmental institutions to the island of Grenada, where a brutal group of leftist thugs violently seized power, killing the Prime Minister, three cabinet members, two labor leaders, and other civilians, including children. Let there be no misunderstanding, this collective action has been forced on us by events that have no precedent in the Eastern Caribbean and no place in any civilized society. American lives are at stake. We've been following the situation as closely as possible. Between 800 and 1,000 Americans, including many medical students and senior citizens, make up the largest single group of foreign residents in Grenada. From the start, we have consciously sought to calm fears. We were determined not to make an already bad situation worse and increase the risks our citizens faced. But when I received reports that a large number of our citizens were seeking to escape the island, thereby exposing themselves to great danger, and after receiving a formal request for help, a unanimous request from our neighboring states, I concluded the United States had no choice but to act strongly and decisively. Let me repeat, the United States objectives are clear. To protect our own citizens, to facilitate the evacuation of those who want to leave, and to help in the restoration of democratic institutions in Grenada. I understand that several Caribbean states are asking that the Organization of American States consider the situation in Grenada. Our diplomatic efforts will be in close cooperation with the Organization of Eastern Caribbean States and the other countries participating in this multinational effort. And now I am very happy and proud to present to you the Chairman of the Organization of Eastern Caribbean States and the Prime Minister of Dominica, Prime Minister Charles. I think we were all very horrified that the events which took place recently in Grenada. We as part of the Organization of East Caribbean States realizing that we are, of course, one region. We belong to each other, our kith and kin. We all have members of our state living in Grenada. We're very concerned that this event should take place again. It is true that we have managed to live with the regime since March 79, and we felt quite clearly and we had good reason to believe that the Bishop regime was seeing it our way and was on the way to have elections. And we think this is the reason why himself and his cabinet were destroyed, because he realized that the pressure we put on him to have elections was worthwhile, was right, and he begun to see that the democratic institutions must be put in place in any of these small countries. It is even more important in a small island state, poor island state, to have the democratic institutions. And this we have had for a long time and we've continued it and we wish to continue it. Grenada was an aberration in this respect. But these men who had for all these years accepted the Bishop regime should then, for their own reasons, and I think the power-hungry reasons, decide to destroy the persons whom they had accepted as their leaders for so long, made us realize that this sort of assassination must not be allowed to continue in our country. It means that our people, they are not safe. It means that Grenadians are never being given the chance to choose for themselves the country that they want. And therefore, it is necessary for us to see to it that they have the opportunity to do so. To do this, we have to isolate the persons who have committed the acts that they did last week in killing off most of the cabinet. And we have to ensure that, in fact, an interim government of persons of not political greed, but persons who are good administrators and who are Grenadians, who can run the country for a few months for the pure purpose of putting the country back on the democratic status so that elections can take place as soon as possible. This is what we want to do so that Grenadians can choose for themselves the government they want and not have every few years have governments imposed on them by persons will otherwise than they would. Did you have an explanation that the Soviets and the Cubans were behind this takeover of Grenada? Did the Joint Chiefs tell you that yesterday afternoon? Do you want me to answer this? Yes, we do have this information. I can't give you all the details because it's a safety of people concerned. But we noted with grit, this demerit in the two weeks before the session it took place, the movements between the Soviet embassies and known activists, and the activists returned to Grenada, obviously a conduit between some of these Russians and some of these... Mr. Grillo, can you tell us, are all the Americans safe, sir? Can you tell us that and how long will the American forces be on the ground there? What is their role? Well, we don't know how long that will be. We want to be out as quickly as possible because our purpose in being there is only for them to enable to take over their own affairs. As far as we know, the citizens are safe. We have been monitoring that very closely and one of our prime objectives in the actual invasion that was almost instantly done was the securing of that St. George Medical College where the several hundred of the students were. Mr. President, as late as yesterday, your own spokesman said that Americans on Grenada were in no danger. Did you have information that things had changed? They were in no danger in the sense of that right now anything was being done to them. But we know that there was concern in the part of those because already we'd been informed of several hundred who wanted to leave. But the airports were closed. There was no way of leaving. This was a case of not waiting until something actually happened to them. But we did manage to get some intelligence information on this and that the tenuous situation was, as I said, the only authority that you could say in a governmental nature in that island was a 24-hour curfew with orders to shoot on sight. Anyone found moving in those 24 hours. What is the military situation now, sir? Can you tell us? I can only tell you that we have secured both the airports and the landings have been completed. But we are yielding to the influence of General Vessie and that we don't think in these early hours of that landing that we should be on the horn asking the commanders to stop and give us detailed reports. I don't think that the United States has the right to invade another country to change its government. But I don't think it's an invasion if I may answer that question. This is a question of our asking for support. We are one region. Grenada is part and parcel of us an organization and we don't have the capacity ourselves to see to it that Grenadians get the freedom that they require to have to choose their own government. Wait one second here. No, we're not spread too thin. Let me augment what the Prime Minister just said. Once these nations, once British colonies were freed, they themselves had a treaty and their treaty was one of mutual support. And Grenada is one of the countries and signatories to that treaty and observed that treaty at one time when they had a democratic government and a constitutional government, a constitution that was left to them by the British. So this action that is being taken is being taken under the umbrella of an existing treaty. Mr. Redar, a helicopter has been shot down. A U.S. helicopter has been shot down at Grenada. Do you have any information of any U.S. casualties on the islands? This is the last question and we'll cut off after this. Do we have any information of any U.S. casualties on the islands, sir? No, I have been in meetings and both have been busy since we arrived here and I've only had the first report of our landings and so forth, so I don't know whether that's true or not. Thank you, sir. What reports have you received on the success of the U.S. Caribbean operation? What reports have you received of the success of the operation? The initial operation of landings, securing the immediate targets, taking control of the airports, completely successful. Now the Prime Minister and I are going to depart, I'm going to be going to be a lot more technical questions of that kind and Ambassador Motley is here and I'm going to put him before you to ask all of the technical questions you may have. I'm sorry, that's the last question. Well, I'm not... I see it. Could you rest a little bit, sir? The President said that's the last question. Do you want a filing break for this? Okay, we'll take 10 minutes filing break and we'll be back.


Hello and thank you for joining us today. My name is Ty Davis. I'm a technical marketing manager here at kit lab Today I'm going to be talking to you about agile project management using kit lab We'll also be touching a little bit on safe scaled agile framework and how you can set up the structure I see organizations looking to align themselves with the safe framework We'll touch on a few slides here first before getting into the demo and then once we get into the demo we'll start looking at how We've built on agile structure with our a mock organization health care provider incorporated When we take a look at the structure of get lab we have groups and projects groups will be at the highest Level so you can look at a group as you'll have one group as the parent group or the umbrella group and then they'll be Subgroups that can fall underneath that there could be subgroups under those subgroups, but When we're looking to do agile at this top layer at this group level We have the ability to have access to epics milestones Which is a time box and get lab terminology so you can build out sprints You can build that releases using the milestones feature. There's a roadmap which is going to show you a compilation of all the epics and the timelines associated with them and then you have the ability to create labels boards and Projects that fall underneath those groups or subgroups So we see here when we're talking projects that project resides within that group Level or layer That that project there could be a project associated with one group And then there could be a subgroup underneath that group and that can have its own projects as well So once I have a project you see that there's your gift repository Issues and discussion can happen at that project level labels are also Built into that project so you can have specific labels for that project where maybe that team is using Identify all or a specific naming convention for those labels and they can build out their own boards as well Create milestones which may maybe associate that with a sprint and doing scrum Or just a a release a start and an end date and then as well You have a cycle analytics that can give you insight on that project When we're talking agile in the way that that git lab has its Its names for for what we've built inside of our tool We call issues Or we call User stories issues or for people that are familiar with issues are ready You could just keep moving along with issues But some people are familiar with user stories We call that an issue again re-itering what I said earlier about milestones Is that something that you could build out of time box in this particular case for if we do a scrum? We built out sprints using that milestone capability So within that project you have a repository the repository is a very powerful capability as part of git lab It's something that we're very well known for Inside that repository you have the ability to do Merge request you can make changes you can have reviews and discussions around those MRs You could do approvals you have visibility into your CIC pipeline So if we're looking to have visibility along the end-end DevOps we can see the status of Co-change when it comes to quality when it comes to Security when it comes to performance you have that capability Inside of the repository and and specifically with merge request and identifying Pipelines that associate with that merge request You also have the ability to do a review app so once you've added that code you can review the app before it goes live to production and Like I mentioned you have security scans That give full reports back on any vulnerabilities that are detected whether they're me like medium or severe You'll have that Review and report given to you around that merge request When we look at git lab and scale the agile framework the organizations looking to move towards safe You Are going to be able to align via what we just talked about the groups and the projects How we look at it is for that Maybe that if we're looking at portfolio safe and we're looking at that portfolio level That that high group that top parent group or umbrella group is going to be at the portfolio level There's going to be a subgroup that aligns with the value stream and then a second subgroup that aligns with the program And then we could see that You know there's possibly depending on how large the agile teams are that are contributing towards that agile release train and there could be a third subgroup if it's just a couple of Scrub teams that are all added together that contribute to an agile team as a whole that's contributing towards that agile release team But a lot of that work is going to be done at the project level we could see here That's where we consider the team level. That's where you're going to create many boards issues User stories are be created in there, and that's we're going to have a lot of our our dev work and testing done Breaking it down a little bit more. We look at that portfolio level. So we're looking at that Top group level. Maybe it's the Maybe it's an application. That's part of an organization. Maybe it's the whole organization That's at that group level. We'll see in the demo here the healthcare provider It's a smaller healthcare provider organization But the the enterprise is represented at that portfolio level and they're going to build out value streams that align With where they want their healthcare organization to be headed towards So we look at the portfolio level and doing safe We create those portfolio epics at that group level. We create levels The way we look at strategic themes is that when your business leaders are deciding what are the strategic themes that are going to drive this Organization that's going to be done via group labels. So in the case of this healthcare organization, maybe it's satisfied patients satisfied employees Modernizing technology or being innovative and they're going to create those strategic themes via labels And then when we create those portfolio epics, we're going to are going to tag those strategic themes that align with that portfolio epic You can create a project on that high that that portfolio group level so that you could create Maybe non-functional user storage issues. There could be discussion around those. That's going to drive that backlog that's going to drive The the epics that we are moving into progress at that portfolio level a Subgroup will be created at this portfolio level. That's going to align with a value stream We'll see again in the demo and there's six value streams that the the business leaders decided would drive the organization and those are created in subgroups So looking at that subgroup that value stream you have milestones. We talked about time box, which you can set the dates and time Start and end dates for that solution train that could be tracked via milestone labels as well Anything that aligns with that value stream You'll you'll create the labels that align with that. We'll see how that's done once we get into The demo here again, there's You can always have a project at a group level It's not isolated to that the lowest subgroup. It could be at different levels It could be at the highest group level serve group of that create project and what this does is it allows you to have a Board that is specific to that that group level That will you know if we have that portfolio board now we have this value stream board maybe moving into that program Level you can have your Kanban board there moving features and labels along that have been broken down from those portfolio epics And we can see that here at the program level there's Subgroups that are are making off of those value streams These are made up of a series of agile teams that are contributing towards an agile release train Maybe several scrum teams that make up for that agile team that are all working together to push Releases out at a regular and frequent cadence on that agile release train Pushing out working software making sure that they all work together Something that can be done at that subgroup to our subgroup level where we have an agile team as a whole that that may have another subgroup of Scrub teams that are contributing towards making that agile release train go Now we get to the team Team layer of safe. This is where we're gonna have Probably significant more amount of projects that are specific towards Dev and testing This is where your functional items are gonna be worked on. You're gonna have Issues and discussion here gonna have many many issues Specific around functionality building out Code and this is where we're gonna compile that all here at the project level. We'll be able to do backlog management We'll be able to do Our PI planning. I'm actually we'll do our PI planning at the program level and this is where From that PI planning will take our PI objectives break those down into issues and then and then start working on on those issues You have visibility into The boards when it comes to seeing, you know, what's in progress what's being worked on what's done. I could create Team boards saying who's working on what you can create that that PI objective board and start assigning Issues to sprints or doing our sprint planning or taking it from the product backlog moving it to the appropriate sprint and then doing that assignment of issues to That sprint where either if you have a self-organizing team they could pull those issues off they can assign them to themselves Or maybe you're an organization that has a scrum master or a product manager. That's doing the signing They can do that as well. This is where that repository we talked about it's gonna reside inside those projects That's where our merge requests can be done. You're gonna see changes You're gonna have reviews of discussion done at that so that collaboration piece is gonna be done here Where I have visibility into the changes that you've made the code I can comment on them We can collaborate and say hey, this looks good, but you know, this doesn't look good. What'd you do here? What I do here and it gives us that tie-in Around collaboration around all these code changes that we're making we could see The pipeline pass or failed. We can also collaborate on that Hey, this is what I saw on the coast why it failed and if you want to change that and then we have visibility again into the security part of the performance of Those pipelines and then you have a review app. You can see the changes and see how it looks on Your application before it goes to production something else that along the collaboration piece via email via Slack via what matter most You can also collaborate using those tools and add issues to the backlogs This is a very detailed View at at GitLab safe and you could see there's different At the highest level the portfolio group. It's a subgroup the program agile teams that are following as another subgroup of those value streams each each level has its own project where Issues can be created whether they're non-functional or functional More once you get towards the the team subgroups, this is where your projects are going to have more functional items that are being driven More along the functionality of the applications of the software that's being created This is just another quick snapshot into the portfolio looking at the value streams. It could be associated with it So now moving on This is the end of the slides real quick I hope I got through them pretty quickly here for you And we're gonna go ahead and jump into the demo and start looking at how you could structure your organizations agile planning or a scaled agile framework using GitLab I'm gonna go ahead and jump in here and if There are any questions Feel free to ask at the end of this or put it in the comment section of YouTube and we will be sure to respond as quickly as possible around any questions that you may have So what we're doing here is we're taking a look at What's a mock organization a mock company? We've created its healthcare provider incorporated This is a healthcare company that has different parts or different Value streams and safe terminology that make up the organization in this case. There may be a newer Healthcare provider once you see some of the issues that are built around but this is just for demo purposes but healthcare provider they are a very Experienced or they are experienced in agile. They are doing scrum planning Pardon me. They're doing scrum. They're using The GitLab backlog to do their backlog management and they've just started looking into Scaled agile framework are doing safe and they are now structuring The organization around the scaled agile framework for this Organization when they're going towards safe What they've done is you have a business leaders that agreed At a high level what these strategic themes are for that organization and those strategic themes for this hospital Or excuse me this healthcare organization is patient satisfaction revenue growth staff satisfaction and technology advancements And they've done this using labels with GitLab. So when I'm creating my portfolio epics or I'm creating my value streams They Pardon when I'm creating my portfolio epics. I can tie that to a strategic thing so if I were to go over and Take a look at the epics that were created from those strategic themes at the portfolio level I I'm going to be able to see that I've tagged using the strategic theme or using the specific strategic theme That's been assigned to them that we came up these six different portfolio epics at that pro at that portfolio level that we believe will drive Organization on what will happen is these portfolio epics being taken and breaking and broken down into Features or enablers and then thus broken down more into issues from there. They can be part of PI planning where we take those Features enablers we break them down like I just mentioned into issues and then we create PI objectives out of those Now again, this is just demo data So we have only a few listed here But if we were to look at a real organization to be probably quite a few more portfolio epics Going back and looking at the healthcare provider Organization instead of get lab we have groups and projects. That's how we structure So this is at the highest group level I could call this the parent group or the umbrella group the highest level where the health care provider Organization or enterprise sits and then following underneath those is a subgroup. So you have six different subgroups in this particular case These are what we consider value streams for a scaled agile framework These were determined by the leadership that these are the value streams that are going to drive this organization So we have primary care online experience specialist laboratory pharmacy in hospital The portfolio management piece. That's just a project that sits at that portfolio level So I can create some issues at that portfolio level that may be specific to that portfolio management Possibly non-functional items or issues that need to be created Diving a little bit more into one of the value streams here So we dive into the hospital value stream We can see that's a minute of a six different agile groups These are groups that are contributing towards that agile release train. That's part of that value stream for that hospital value stream these six groups or six agile teams all have scrum teams underneath them that are Contributing or working together Extribute towards that agile team. That's part of the agile release train And so we could look at billing here and see that we have several different scrum teams that we've put together Around employee payroll patient billing vendor billing and 501c3 billing and these are all groups that are working together to build out that that feature and capabilities around billing that are all going to combine together with the different ones that you see here inbound patient records staff scheduling and outbound When we go into billing I Could take a look at the epics that are part of billing and I could see that what we call Epics that get lab or these would be considered sub-epics because you've already seen those portfolio epics that sat at that healthcare provider Parent level these are sub-epics interchangeable with the feature terminology or enablers for our scale the agile framework framework But these are what we broke down from those portfolio epics and so you could see here that some of them are broken down into specific Insurance companies their specific Features their sub-epics around billing statements and adding payment methods and these are where you're going to have Groups take a look at these features these enablers And they're going to go into their PI planning sessions. They're going to break these downs They're going to get them they're going to get PI objectives out of these which are going to be Made up of issues or user stories if that's the terminology you're using inside of get lab we go by issues and so that will be part of that PI objective that is taken out of the PI planning sessions and When those those individuals that are Associated or part of that PI planning session are taking a look at these these features at the billing level From here, we can go over to issues and this is where we'll see issues that were determined from that that PI planning session That's part of us, you know specific PI objectives We have a running list here of the issues that were created. I can go to the board view and this is where I'm going to be able to see that there is a product backlog here or a PI Backlog that has been created with issues I have the ability to do rankings so I can drag and drop and this will rank these issues As part of this board as a higher priority if we went to a different board and want to see all the opens It would retain that that ranking system We also have technical risks that have been assigned to these So I do have a technical risk board that I could take a look at the high and medium low risk issues that have been determined and this would populate those based off of Which issues have which label shows associated with them This has a filter on it now for sprint one So we don't actually see any yet until we do go Assign issues to sprint one. Sorry. That's a scrum team board. I'll go back to the objective So that's where I can have a a product owner or product manager or scrum master They start assigning the specific and issues towards the sprints that they think are Excuse me towards that sprint that they believe it should be prioritized in this case We have a couple different issues that I want to put over to Sprint one These were created organically from get lab itself down here We could see we have a couple different issues that were created one was via a service desk so someone submitted a ticket verse with a service desk that's built into a get lab and a couple others one was done via maybe slack or Done via matter most and those issues appear on the backlog So as I'm assigning these issues here, it's moving over to sprint one These are all the priority or the issues that I think are top priority for sprint one I now have that sprint back log planned and I can go over to my dev board and Begin moving issues into progress and either Assigning those to individuals if you're an organization that's doing, you know product manager or a scrum master That's doing the assigning of issues or user stories that could be done or if you have a self-organizing team Doing scrum they can come in here and they could pick issues that they want to work on so if I were to come in here Probably as a patient I can view my billing statement. That's very important in order for someone to pay for that that bill that they have I'm gonna sign this to myself. So I've assigned it to myself and I knew move it to in progress and now I'm working on that Same could be done for a couple of years. Maybe Dan came in here. He assigned this to himself. He moves that to in progress Same thing for John Jeremiah. He now assigns that to himself and Moves that to in progress Built-in is though you have weights that you can associate with those Issues and so you can see here. There's a couple different weights 15 and 15 both for these issues that Dan and John have I have a as part of my weight For you know in terms of story points, maybe you're using a Fibronacci scale Or you have your own system built into your organization that you could do that using issues as part of Sorry, you could do that using weights as part of these issues and then later on We'll see that you could take out and a burn down chart where you are progressing with that issue weight and issues and Look at the anticipated Projection for what you were looking to have done as part of that that specific sprint Or time box, whatever you may call it So I'm working on this You know, I complete the I build up my code around my code as a patient. I could view a billing statement I think it's good for review now. You may be able to or your organization may Use different terminology around what stages should it should move in maybe there's an end testing You can build that out using labels and then edit these boards and Organize these boards using those labels for us. It's review. I've moved to review. There's a close over here Maybe my review it needs to have a successful pipeline and needs to pass, you know, certain tests Certain quality tests certain security tests or performance tests before it can be moved to closed But in the meantime, you know, we are an agile team So I should hopefully get that feedback rather quickly But I want to go ahead and just take another item or another issue off of that backlog That was assigned to sprint one assign that to myself and then I could begin that Work on that issue and it moves in in progress and progress tag is added there So maybe as a scrum master or product manager, I want a high-level view of What's going on the team or who's you who's working on what I can come over here to this team board view I could see what Dan's working on with John's working on I can see what ties Work on on he has one in review. He has one in progress. That's good. He doesn't have to in progress We rather have tie working on one Item in progress and not working on multiple. So that's in review and hopefully that moves to close We can now look at that technical risk board We could see that because I had a filter around sprint one and we did the assigning of these issues to sprint one I could see what is a high risk? What is a medium risk? We have no low risk in sprint one It just gives me a snapshot here based on that risk level that we've created via labels So heading over to milestones here This is where we get lab to find our time box and this particular case You know, I'm trying to look towards aligning towards the scale that don't framework So I've created four sprints in an event innovation and planning sprint as my fifth sprint Over two week increments. So adding up to 10 total sprints as part of a PI objective that we're working on And so you have the ability to change these names based on what your organization does And in the time box that you're labeling those but we do call these milestones at get lab That's a terminology that we use when you have that option available here on the left. I Could pop into sprint one. This is where I'm gonna have visibility into a burn down chart Because this is demo data and I've been moving stuff back and forth. It's gonna have a a little bit of a strange Graph to it line to it right now I can see the issues that I've created the issue weight that comes along with that I'm what I'm gonna do though is I'm just gonna cut over and we'll take an actual look into a real Real-life Burn down chart and board that our own dev team around verifies doing so we could see here the open and deliverable on close That's the way that they go about doing agile is using those are that terminology And I can go to the milestone here and see for the milestone of 11.7 What they've been doing and this one just ended but we could see that there's a certain amount of issues created We could see with the issue weight and the burn down chart that they've gone along with that a little bit of flatlining here but the ability to use burn down charts inside a get lab based around that that sprint or The milestone that you create and get lab so coming back here to the board view inside of issues Just want to kind of show that you can Maybe from the dev board even though we've probably hopefully worked out what issues are part of this Sprint backlog or what's part of this PI objective? Excuse me and I Can I can go ahead and just if I'm if for some reason I needed to add a new issue I can do that in line here or if I needed to add an issue I'd head over to the Project within billing so I'd find the different scrum groups probably inside of patient billing is what we're looking at I could see that there's two projects here Projects fall at any point could fall underneath the group and the way that we've set it up those projects That's a container for where the dev works being done This is showing that the billing statements and credit card payments those are two different projects at the scrum team around patient Billing is working on so I can go into billing statements here get inside that project take a look at the issues Go to the board See what issues are associated here. I can add an issue from this area Oops I Can add an issue Here from the list view and what's going to do it's going to take me over To the new issue creation page and this is where I can add a test I can give it a description I can assign to myself or I can assign it to a certain member That's part of the team assign it to a milestone. You can see several different sprints here and I can also Give it a label, you know if it's associated with an agile release multiple trains in progress Which you probably want to do unless you're moving that into progress on the board But you can see the different tags that are associated with there give it a wait And then also if you wanted to give it a due date you can do that as well Markdown and quick actions are supported inside of these so Which I click on to mark down it takes me a nice little kit lab help mark down area But you can do mark down inside of this description. There's a lot of different options and choices Available for doing markdown. You're just adding maybe an issue to an epic or Associating two issues together just using markdown that possibility is here I'm not going to submit an issue in this particular case so now we're here on The page of issues that are specific to the billing statements group what I'm going to do I'm going to see the next step and As moving along that agile planning of smoothing this issue that is maybe a problem or it's an answer request Something that we've created as an issue and now we're going to have That that dev team members begin working on it. They're going to create a merge request around this They're going to check out a branch to work on from the master branch. And so what they're going to do is they're going to go in and they're going to Create a merge request we can see that I've already created a merge request as part of this issue and They simply just create a merge request From that issue inside that issue. It's going to put the related merge request for that issue I'm going to click into this one that I've already created And it's going to show me a couple of different things here that I get along once they've created this merge request now I'm just going to give a quick high level view of merge request and the DevOps Pipeline there's many demos that we've created that dive a little bit deeper into How this pipeline works or maybe specific around the security or specific around Performance and those can be found on our YouTube channel But I'm just going to give a quick view as we started with agile planning. We've created those issues We've assigned them and what we're doing now is we have that dev person working on the Correcting the code or creating code. They've created that merge request taking a branch off of master and now in this particular case the Changes have already been pushed in this one They've been pushed. Sorry not pushed but these changes have been made and now we're running a pipeline and The pipeline is doing its Checks on these different stages. So it just did the build and pass and now it's doing a test We can see the different stages that are correlated with that. We'll dive in this and a little bit more here in a second Down here we can go and actually see what changes were made In this particular case, there's some text that was changed around the just the header there This is a very very very simple demo So Once we go in this pipeline We can now see laid out in front of us all the different checkpoints as part of these stages I can see code call code quality Container scanning dependency scanning license management Static security testing and then maybe just a unit or quality testing that we built in there Review app be built out So we'll be able to see the changes that were made before we push that to the master branch There's dynamic security that we have along with us a performance stage and then a cleanup at the end So this pipeline is going to take a few minutes to run here as it's doing all of its checkpoints Something that's going to happen, you know once once that hopefully passes if it fails it will have the ability to go in and see Why it failed it'll give us a Failed pipeline area where we could see Specifically what part of that pipeline failed that we can address that from there But if this does pass and I'm hoping it does It's going to give me that capability to merge into master branch in this particular case I have the Capability or the rights to do that merge myself if I needed approval I could add Or that maintain or someone can make sure that an approval is required before it's merged into master This if it passes, I'll be able to Resolve that work in progress and that will give me the capability to merge so What I'm going to do I'm actually going to go over we're going to check out a An open merge request actually not an open or I got one that was just merged and That is the one I did just a little bit ago updated the text color for the title page We could see that the pipeline passed. It gives me a pass on all the stages It gave me a security analysis. I get a view. I could view the full report of all the new vulnerabilities Again dive that deeper in a different demo. It gives me a full report on licensed management This one show who it was merged by the changes will merge into master and it gives me it gives me a Quick snapshot of what was done around this merge request in this pipeline. I've already clicked merging it You could see it's still working on deploying that to production right now So it's going to again go and run that pipeline and push that To that that master branch It should give me the result of Changing this title here to get lab purple on top of this already purple background If I wanted to see the changes that were made with this again, I could take take a look here I could see that there was a color change around the header from orange to purple Not the best choice. I may put again. This is the the most basic app How we can do just just for demo purposes so this Demo basically has gone through it's it started off with talking about agile planning. We've talked about How a company can use GitLab to do that agile planning how they can start aligning to that skilled agile framework Structure what we did here is we created issues. We did a lot of backlog management or PI debt PI objective Planning we did our sprint backlogs our PI objective backlogs and we assigned those to Members on the team that began working on those they went inside these issues They created merge requests around the code that they've either changed or added and then we see via these Pipelines that that code's getting tested. It's getting security testing down around. It's gonna be performance tested We're checking the licenses that are associated With that that branch is being committed and we're seeing several different things as part of that that DevOps pipeline if you have any questions, please feel free again to Go ahead and list them down in the YouTube channel comments there We'll get back to you. I appreciate you taking the time to take a look at GitLab and how you can apply this agile methodology or apply it safe using the GitLab tool


Now, the first thing that we need to understand is that every business transaction has at least two entities involved in it, one of the entities generating revenue for goods or services that they provide, the other entity generating an expense, which possibly could be a deduction for goods or services that they paid for. So in our case, we've got like a lawyer on the lawyer. Providing legal services, let's say the small business on the right-hand side is paying for those legal services. So then the question is, well, how does the IRS, how do taxes fit into the situation? What might the IRS's concerns be if you were, for example, the IRS? From the IRS perspective, we have an income tax. Therefore, the person that is generating revenue, the person getting paid for the goods and services that they are doing, the IRS is going to want to make sure that they report that income on the taxes so that they're going to have to pay taxes on it. The one that's paying for the goods and services, the IRS might be concerned that they overstate possibly the expense. Now, from a tax standpoint, who's the one that's actually benefiting from a tax standpoint? You call this a tax return? On this transaction, the one that's actually paying is the one that gets a tax benefit. The one that's getting paid, of course, is making money generating revenue. That's good for them. But for taxes, remember, everything is flipped on its head. It's actually bad for taxes because they're going to report that as taxable income, most likely, and pay taxes on it. Taxes?  The one that's paying gets to report it as an expense for taxes. Expenses are normally good, but for tax, I mean, normally bad, but for taxes, they're good. So the IRS actually has the leverage more on the person that is paying. So they might go to the person that is paying then and be able to say, hey, look, if you want that deduction on your taxes, my tax deductions are crying. What we want from you is to tell us who you paid. So you can see with the tax law and where the IRS starts to insert themselves, where they have leverage on the payer, the one that might get a benefit from the deduction. So how might that look, of course? Well, then you'd say, well, if this person was employer of the employee, and the IRS might actually kind of force this situation to happen, they're going to say, hey, look, this lawyer is working exclusively for you and you're telling them exactly what to do or something like that. Therefore, we think that they are characterized as an employee, not a contractor. So starting now, I'm an employee. So you might not have a whole choice on that. But if they are an employee, then of course the IRS has like a lot of leverage on the person that's paying the employee. They want you not only to report the income that you paid to the employee, but they also want you to withhold that money and not ever even give it to the employee, but instead give it directly to the government, directly to the IRS. And of course, they want you to report the W2 income, which shows the gross pay as well as the withholdings, giving that form not only to the employee, but also to the government. Remember, that's the key point. The government really is the one that wants the W2 form. So obviously from an IRS standpoint, they're going to frame it as though they're forcing the employer to be nice and give the employee the information that they need to file their taxes, just because the government's trying to look out for you. But obviously, what really the government wants is for the employer to do the job of being the tax collector and the one that's reporting the income and actually take the income and report it on their behalf. So that's where there's kind of the most leverage, and that's our most normal form that we expect to see, that of course, being the W2 form. Now, what if there's a situation where the person on the left is a contractor and the person on the right is paying them as a contractor? Well, then there's less leverage, but you have a similar situation. And the choice as to whether someone is a contractor or an employee is not totally freely up to these two individuals, right? You have to see if you qualify as a contractor or an employee. But let's say that they're a contractor, and so now the IRS would still have the leverage on the person on the right.  And when the person on the left then filed their taxes, if they don't record income, stay on a schedule C, that is at least equivalent to the 1099 reportings, then they will most certainly get some kind of letter saying from the IRS saying that they have under reported. So that's where the leverage is. That's the general idea. That's why the businesses basically are doing what they do. That's where we get these major forms that we use to construct our taxes. The IRS is putting the leverage where they have the leverage on the payer side of the transaction to get those forms, not only to you, but principally in their mind, of course, from the IRS's perspective to them, so that they have the information. Now you can imagine a situation where this system doesn't work for the IRS to kind of be able to double check the income of a business. So for example, if this person on the right was not a business, but an individual that was hiring a lawyer for their personal purposes, then the IRS is not going to have that same kind of leverage to force this individual to give the lawyer sole proprietor, for example, a 1099 in that case, because they're hiring the lawyer for personal purposes and therefore they wouldn't get any deduction for it. So the IRS wouldn't have any leverage. And many businesses that are like cashed based, you have the same kind of problem. You've got the hair salons, you've got restaurants, you've got nail salons and those types of businesses where the end person is going to be the actual customer paying for personal goods and services. Then the IRS cannot go to the person that got their haircut or something like that, for example, and say, hey, look, we want you to give us a 1099 for the person, the sole proprietor, the contractor that cuts your hair. Why? Because the IRS has no leverage in that situation because you don't get a deduction for getting your haircut. And more recently we see businesses that are going to be in the gig economy where we have similar kind of situations where a platform is linking people together so that you have these small businesses that we couldn't have before. It's kind of like a new silk road where now you have people that want goods and services and people that can create a business providing the goods and services by having this silk road, this new technology connecting the two together, which are these basically platforms that can connect people together. You can see how the IRS would be skeptical of that situation because once again, they have no place to say, I want someone to issue me the 1099. I want someone as the IRS would be saying to give me the withholdings in this transaction. And you can see what they're going to try to possibly do in those kinds of cases. They might try to make the platforms hire the people that are using the platforms as employees instead of having letting them create their own business, or they might go to the payment processors, the pay pals of the worlds and the credit card companies and force them to somehow issue the 1099. And this is like a big issue going forward that I think a lot of people aren't very well aware of because the income tax system used to be something that was checked and verified through more like random audits. So you were basically filling out your tax return and it would be similar to a situation legally as you driving on the freeway. The cop, the policeman could pull you over on the freeway for speeding, but that would probably only happen like one out of 20 times that you're speeding. But you know that if you get a ticket, it's going to be quite a costly experience. Therefore you don't speed. That was the general concept with regards to the tax code as well. You file your own taxes, you get audited from time to time. If you get caught in an audit not doing what you're supposed to do with filing the taxes, then you get hit in the audit.


Welcome to my analysis for Hedgehogs. The last technical video has been quite a while ago, the reason being that we did this podcast in between. But I think for change and we should do another technical video. Although we are still not done with the podcast, there's still one more episode to go. But let's start with another technical video. This time about SPORA, the shotgun worm that is also ransomware. Or more specifically, I want to talk to you about how you can use MAVA analysts articles to help you learn about MAVA analysis. Now, these articles are not made for people who want to learn analysis. They are made rather for other analysts so they can benefit from the research results. So they don't show you how you get to these results, but they show you what the analysts found out about a certain ransomware or malware family. Now, how can you use it to learn? First off, you should get the exact same sample that's referenced in such an article. Usually these articles will present you the hashes of the samples that they used as a basis. And every proper article would do that because otherwise your claims cannot be verified, or the claims of the author here in this article cannot be verified. So proper blog articles will provide the file hashes. In our case, the starting point is an HTA application. HTA is an HTML application. So it's an HTML file with some executable code in it written in VB script or in J script or something similar. And that's the original file that drops then another dropper which drops spore sample in the Word document. So we will be starting from that. You might already have problems here. You might ask yourself, how do I get the exact same sample? Well, I will provide some links in the description below so you can links to sharing sites, links to forums where you can request samples, links to, for example, virusshare.com. Those are databases where you can search for samples via the hash. But for new samples, these databases might not be up to date. So you can always try to ask people who have access to virus or ask the analysts to wrote the article. I think a lot of them are happy to help you out. If you say you want to learn analysis, they will probably help you. Okay, so let's start with that. And the advantage of using these articles is if you are fairly new to malware analysis and you have an unknown sample, you really have the problem that you don't know what there is in front of you. Like you will see something, you don't know what it is, you don't know how to interpret it. And that's something, if you read the article, you already know the direction it's going to. And if you read the article and know what's happening in detail there, you can also just try to verify what's written there and see if you find out the same things and if you interpret the things the correct way that you found out. So it's really an advantage if you already know what you are looking at. But you have yourself, you have to work yourself to find out how you get to these results. Sometimes the articles will provide addresses, you can use them. So this is an aid already. Sometimes they don't provide addresses, but you can see certain addresses in the screenshots. Like in this case you see, yeah, I'm not connected to the internet. In this case, you can see an address right here in the jump call. So you can use these addresses to find the reference functions. Or here, similar, there is if the person using IDID not rename parts of the file, like sub functions or sub procedures, they will also have the address in this label on this name, which you can use. All right. Now, what we want to do today is look at one part of the encryption procedure of Spora. The whole encryption procedure is fairly complicated. We kind of do all of that in today. But let's just take a look at one part of it, namely the .key file and how this .key file is being encrypted using AES. Like it's written in here, the .key file contains some information, statistical information about how many files have been encrypted on the system, and some other information, the locale, the username, the campaign ID, and then RSA key. And this file is being encrypted using a newly generated AES key. And this key is then appended also in encrypted form to the .key file after that. So let's just find this AES key, see if it's indeed AES 256-bit, and see if that's being used to encrypt the .key file content. So just that, and let's go from there. Now, our starting point is this HTA application. The HTA application drops another file, a Jscript file into the temp folder, and the Jscript file drops a P file. That's the Spora sample that we want to have. So this is our goal, and it would drop a corrupt Word document. So let's just get this file here. That's what we want to have to get to the encryption function, finally. So here's our dropper sample, our HTA. And we will be using process monitor and process explorer before we can wrap the samples. Yes. Let's try to kill the sample before it's done with encryption. For process monitor, you need to set certain filters. First, for the process name, one should be mshta.exe because that file is being used to execute HTA files. Secondly, the close.js file is executed with wscript.exe. So you send this as a process name. In this case, I said it should contain script. So wscript.exe will be shown. And thirdly, the category should be write. So we see the write actions or write operations by these files and can see where the drop files are being written to. So that's all we do. And we use process explorer to watch the processes appear and kill the file when we don't need it anymore. Kill the process. I mean, all right, execute that. And as expected, the Word file opens. We kill this.  Right. And now we see, okay, that's exactly what's described in the article. Close.js is dropped to temp. The p files dropped to temp with the exact same name on the Word document. Now, this is not a random name. The article describes as well that this is hardcoded in the dropper in the JS file. If you de-apposcaded, you can see that too. And you can also see in VirusTotal that uploads to, in the additional information tab, that uploads of spora, of the spora assembles use that name alongside other names. Like this is dropped by the JS, CloseJS, whereas names like these are being copies of this one. Like this file will copy itself into a certain location and then use names with this pattern. And there's always different, depending on the machine. So, and then there you have files, they always files like these, where the name is just the hash, those were being uploaded by malware analysts usually, as they like to use the hashes for the sample names. Okay, so we have the sample right here. So let's just go there and drag and drop it to the desktop. Before we can disassemble, we need to unpack the file because that's UPX packed file. Yes, that's been UPX. Good thing about UPX is that unpacking is pretty easy. And we will just do that. If you execute UPX.exe will show you which switches you can use, the minus these for decompressing, it will decompress the file in place unless you give a minus error option to write to give it a different location for that. So, let's do that because we might want to keep the original file decompressed. And the original one was this. Now it unpacked this successfully. And we can analyze that using ITER. Again, I will use the free version of ITER, which is pretty old, it's 5.0. But this is because you can use that too without paying anything on the commercial version is pretty, pretty expensive. So it's not for everyone. The ITER is now analyzing the file, which takes a while. And then when this graph appears, we are done. And I recommend that you try to find yourself through this code and just take the article as a help if you don't get anywhere further. In this case, if you scroll down a bit, you see already here some functions related to encryption and cryptic wire context. And so after that cryptic wire context, or I would suspect there's more encryption going on, so I will probably analyze these subcalls here and see what they do or sub processes. All right. And what is this doing, the script acquire context, it's used to acquire a handle to a particular key container within a particular cryptographic service provider. So it is used in calls to the crypto API. And that's kind of the beginning for some encryption stuff right here. And here's a key cryptus Troy key. So basically, I would search in between those two calls for more, for more stuff that's happening with the encryption in Spora. But if you don't get anywhere with this, just as I said, use the screenshots as a hint where these functions you're searching for might be. Today, I would like to verify just one small thing, the encryption procedure of Spora is quite complicated. So let's just verify a small thing about that. And that's this one. There's a key file in Spora. And the in Spora, Spora writes a key file. This key file saves information about some statistical information, how many files of which category have been encrypted by Spora. And what's the username and what's the locale of the system. And also it saves an RSA key in the key file. And these contents are encrypted with AES 256 bit. So let's just verify this small fact that this AES key 256 bit is being used to encrypt the key file. Not more. And if you don't get along finding that, just use this hint here, 4041d7 or 4041e0. In the screenshot, the jump location that will bring you into the right area where you can find the code that you're looking for. So we will jump to this address 4041e0. And that should be about the right area of the code you're looking for. That looks correct. Something with the key file is being done here. And we go back to the beginning. We will rename this function. So we know that it's doing something to the key file. Do well, or let's say key file function, some key file function. We don't know yet what it does, but we can rename it when we know more. So rename it again. And right in the beginning of that function, we see a crypt can key call. What is that doing? Again, visit the documentation. Crypt can key generates a random cryptographic session key or public private key pair. So probably depending on the algorithm handle to the key is returned. And this handle can be used as needed with any crypto API functions that require the key handle. The calling application must specify the algorithm when calling this function because this type is kept bundled with the key. So that's important. Like the key determines the algorithm. And it's, well, the information what algorithms used is bundled with the key. So this function crypt can key already determines which algorithm is being used. And that's in this parameter of the function the ALGID algorithm ID that identifies the algorithm. Clicking on that, you get to this page that describes the algorithm ID and the values here. So use that value to see what algorithm is being used with that key. And taking a look here, the algorithm ID is 6610 in hex. Compare that. And you find out that this is indeed AES 256. Yeah, so we are on the right track. We know that this is being used. And the key that is being generated is written to that address that is pushed here onto the stack. And what is in EAX at this point, it's the address that is a that is a local variable called hkey. I don't name that hkey because it's being used as hkey. But we already know more about it. We know it's an AES key. So let's just write it in here and rename that. And then we know when it's being used again that this is an AES key, 256 bit. And indeed, it's being used later on with the script export key function. So it kind of converts this key to something else to that buffer here. Converted AES key. All right. And if you look down a bit, there is a call to crypt and crypt, which is used to encrypt some data. And crypt encrypt it encrypts data. The algorithm used is designated by the key held by the CSP module and is referenced by the hkey parameter. So the hkey parameter here will determine the algorithm that's being used by crypt encrypt. Whereas PB data, that's this, it's a pointer to the buffer that contains the plain text to be encrypted. So if you debug it, you can see in this what kind of data is being encrypted. But we already know that it's the AES key that's being encrypted right here. Yes, the key is being encrypted using another key. And that's being pushed onto this deck here. If you follow that, it's in the text section, it's a value in the text section. And this address is being referenced by another function, like it's referenced by our function, of course, but also by another one. And if you click on that, you get here into this function, you would have to analyze this function to know where this key is coming from. But just look at the calls right here. Some object is being decoded. And later on, there's some crypt import public key info. So a key is public key is imported. So it looks like the key we will be we were looking for this hkey is a an RSA key public RSA key. So let's rename that to public RSA key. Okay, go back to the key file function where it's been used. So public RSA key is being used to encrypt this exported RES AES key. Good. But this is not what we wanted to see, but you can you will know from the text here that this is indeed the case, this newly generated AES key is being encrypted with the attacker's public RSA key, right? Okay, but is this AES key now also used to encrypt the key file content? Probably. Let's take a look. Here's another call to crypt encrypt. And this time hkey is the AES key, the original one, not the encrypted one. And PB data is in this buffer. So here's the plain text that's being encrypted. And what you would have to do is look for for where this comes from. So this is a parameter to the key file function. That means if you debug this file and just look into the contents of this buffer, you might see what's inside. You might see that this is indeed the key file content, which is probably created before this key file function is called. So yeah, if you look down below, you will see some calls to create file and write file. And this pattern with this dot key in the end. So this will be creating the actual key file and writing the encrypted contents to disk. And that's the right function here. We were looking at using AES 256 bit encrypting this key file content. So let's rename it maybe key file content. You would have to verify this that this is indeed the content. But I think I think you get the hang of it now. Of course. That's the cool thing about renaming it. If it's used later, you can see what is being done. We have this name here of the key file. And then there's a write file operation with this content. Makes sense, I think. Okay. And that's it for today. I don't want to make this any longer. I'm also a bit exhausted by now. Yeah. And I hope to see you next time. I think the next video will be the podcast again. So stay tuned and thank you for watching. We will be continuing and please see that as well. So see you next time.


Universal Composition with Responsive Environments by Ian Kaminich, Robert Underline, Stephen Crane, Halvküsters and Daniel Roche, who is giving the talk. Thank you very much for the introduction. Today I'm happy to present you our work on universal composition with responsive environments and I want to start my talk with a very brief recap of universal composability models so everyone here is on the same page. Universal composability models use simulability to define security, which essentially works as follows. We have some real protocol P, which we want to analyze and we have an ideal protocol or ideal functionality, which perfectly defines some task in a secure way. For example, we might have an ideal functionality for key exchanges. Now, P realizes this functionality or P is secure. If for all possible adversaries that try to attack P on the network, we can find an ideal adversary or simulator that attacks F on the network such that no environment can distinguish both settings. Or in other words, it does not matter whether we attack P on the network, we might as well attack F instead and get the same kind of information. The main feature of these models is their modularity, which allows for reusing security results. This works roughly as follows. Let's suppose we have already shown that some real protocol P realizes an ideal functionality F. For example, we have already shown that we have a key exchange protocol. We might now want to build another protocol, Q, which serves a different purpose. Say for example, we might now want to build a secure channel protocol and this protocol Q can reuse the ideal functionality F for this purpose to show that it is possible to realize a secure channel. Once we have shown this, we can use the composition theorems from these frameworks to automatically conclude that even if we replace F with its realization P, the resulting protocol will still be a secure channel. Of course, we can iterate this. For example, we can now build a protocol on top of F' which uses the secure channel and once we are done with analyzing this protocol, we can replace F' with its realization Q and P. There are lots of different models that use this approach. However, our work is model-independent. We have exemplified this by applying it to these three major models. So what exactly is the problem that we addressed with our work? In the following, I am going to explain what urgent requests are and why they cause what we call the non-responsiveness problem and then I am showing how we solve this problem entirely by proposing responsive environments. So when we model a protocol in the universal composability models, we often have to exchange some purely modeling-related meta-information with the adversary. There are several possible examples for this. Protocols often ask the adversary to provide a corruption status for the protocol to model that the protocol is secure both when running in an honest environment and both when running with corrupted protocol participants. Many protocols also allow the adversary to choose or provide some cryptographic material. For example, this is often done by ideal protocols which might ask the adversary to provide some keys to model that they are secure even in a setting where the key distribution is arbitrary. Sometimes we want to leak information to the adversary, for example, to model honest but curious corruption. In this case, the adversary gets to see the entire internal state of a protocol without being able to influence the actual protocol run and sometimes it's necessary to signal that some event occurred. For example, we might want to tell the adversary that a new protocol instance was created. All of this is easily done by just sending a simple message over the network to the adversary and these messages are what we call urgent requests. Urgent requests have one important property, namely they do not model any real network traffic. If we were to look at an implementation of this protocol P in reality, this message would simply not exist. A real protocol does not ask, am I corrupted on the network? It also does not ask the network to provide some algorithms to use. So instead, the protocol run would continue without giving a real adversary any way to interfere with this protocol run. So if we go back to our security model, it would be natural to require the same from our adversary in the security model. He should also allow the protocol to continue its run without interfering in any way by simply providing the expected answer. The adversary should just tell, for example, whether the protocol is corrupted or not. It should just provide the keys that it was asked for. It should just return control if, for example, the protocol signaled that some event occurred. While this is quite natural, this is actually not the case in any of the current universal composability models. Instead, our adversary in these models is actually much more powerful than any real adversary as he can abuse these urgent requests to mount distinguishing attacks. For example, the adversary might choose to activate the protocol in an unexpected way instead of answering an urgent request. So this might look as follows. Once he receives the urgent request, he sends a message to the environment, and the environment, in turn, can now send some IO input to the protocol, which the protocol might not even be able to process as it is still waiting for response from the adversary. The adversary could also try and change the state of other parts of the protocol in between, which might look as follows. Here we have a protocol P, which has a subroutine F, and the adversary is free to interact with F in arbitrary ways before it returns control to the protocol P. So every real protocol has to keep this in mind that other parts of the protocol stack might have changed the state before receiving a response. And even worse, there are even cases where the adversary can block parts of a protocol entirely. For example, if the subroutine needs some algorithms to perform its task, it might ask the adversary for these algorithms, and by simply never providing the expected algorithms, we now have a situation where F cannot do anything anymore. It's effectively blocked. If the adversary now activates P instead, P has to deal with a blocked subroutine. Altogether, we are in a situation where protocol designers have to deal with a lot of unintended adversarial behavior, which importantly does not relate to any attacks in reality. Dealing with this is quite difficult. In some cases, it might not be possible at all, and if it's possible, it complicates protocol specifications and proves quite a lot. Also, because it's so very unnatural to think about these artificial attacks that do not relate to anything in reality, it's often forgotten in the literature, which in turn leads to under-specified protocols, flawed security proofs, where the composition theorem can no longer be used, and functionalities that cannot be reused to build new protocols on top of it. This was quite theoretical. I want to illustrate the use of urgent requests by showing you some examples from the literature and showing you what exactly can go wrong. In the following examples, it's not so important to understand every detail of these functionalities. I've highlighted the sections where urgent requests occur, so please look at the highlighted parts. Here we have an ideal functionality for non-interactive key exchanges, and this functionality, in case one of the participants is corrupted, sends an init request to the adversary and expects a session key in response. This is a very natural system. If the session is corrupted, then the adversary should be able to choose the session key of the key exchange. However, by using this system, we actually end up in a situation where f9 no longer is non-interactive. The adversary gets activated, so a higher level protocol that has just called this functionality to provide a key now has to deal with activations by the adversary. Even the authors acknowledge that this is quite unsatisfying, but at the same time it's really the best one can do in current models if we want to allow the adversary to choose the session key. Here's another example, an ideal functionality for signatures of knowledge. This functionality has a setup phase where it sends a setup request to the adversary and expects to receive several algorithms in return. However, the adversary is of course free to never provide these algorithms in which case the functionality has to operate on undefined algorithms which can lead to problems if we want to reuse this functionality in another realization. We might end up with a distinguishing attack based on this. This is an ideal functionality for certificates and this functionality contacts the adversary to verify certificates. It expects some value in response which is then used in case the signer of the certificate is corrupted. So essentially once the signer is corrupted the adversary may choose freely whether a certificate is accepted or not. However, by activating the adversary the adversary is free to quickly corrupt an honest signer before returning control which in turn allows an adversary to accept invalid signatures even though they should have been rejected. The authors also provide the realization of this functionality which is a nice example to illustrate two other aspects of the non-responsiveness problem. This realization uses an ideal subroutine called fsig to sign messages and of course it expects an immediate response from the subroutine. Signing is some local operation so it should just return the signature immediately. However, this is actually not the case fsig uses urgent requests for signing messages so once it receives the sign request the adversary gains control and is now free to mount one of these distinguishing attacks on the protocol. This illustrates that the problem propagates throughout the whole protocol stack there is at least one subroutine using urgent requests then all higher level protocols have to deal with unintended adversary behavior they have to specify in particular what happens if they send a message to a subroutine as they're waiting for response and for example receive some message on the network or on the IO interface in between. Sadly, this is not done in this realization as you can see here this realization simply assumes that it immediately receives a signature from the subroutine it does not state what happens for example if it now receives a message on the network instead. I can illustrate another aspect of the problem using this example suppose for a moment that we did not build this realization using the ideal functionality fsig but instead try to build it directly on the realization of fsig called psig of course this goes against the spirit of universal composability models we want to use ideal functionalities to simplify our analysis they are conceptually very simple and then we want to get the replacement with their realization for free using the composition theorem however if we had defined the whole realization like this then p would actually be well defined because psig indeed immediately answer signing requests there are no urgent requests involved anymore so p does not have to deal with any activations by the adversary or environment in between. All together we have a situation here that shows that idealizations cannot express certain properties that might be present in realizations we could end up in a situation where we can prove the protocol secure using a realization but we cannot prove it secure if we had used an ideal sub-poutine instead which is really undesirable and goes against the whole spirit of the universal composability frameworks which try to replace parts of a protocol iteratively with ideal functionalities so as we have seen in these examples it's very important that protocol designer specify what happens if a protocol is still waiting for a response from the adversary or sub-poutine but receives a message on the network from the adversary or an unexpected message on the IO interface instead. There are several possible work-arounds that one can try to apply to get a full specification for these cases perhaps the most intuitive one is just to say I'm still waiting for a response so I will drop all other messages that I receive I will just block them. Alternatively we might also be so nice and just return an error message that tells other protocol parts that we still waiting for some response from the adversary. Maybe we could try to queue new requests and process them later on once the adversary was so nice to answer our urgent request. We could also try to reduce of urgent requests by using code upload constructs or in some cases it is possible to resort to a default. For example if we wanted to receive some algorithms from the adversary and the adversary does not provide these algorithms in time then we could use a default algorithm. However we have shown in our paper that none of these work-arounds is generally applicable instead protocol designers always provide solutions that are specifically tailored to both the realization and idealization they are currently analyzing and in any case these solutions just unnecessarily complicate both the protocol specification and in turn also the security proofs. Furthermore even if we have gotten a full specification we still have to deal with the unintended state changes the idea certification functionality led to a situation where it accepts invalid signatures or certificates and the limited expressivity of UC models. So how did we solve this mess? We propose responsive environments and responsive adversaries which essentially behave just as one would expect. So in our framework a protocol can specify that some message M on the network is actually an urgent request by simply adding a prefix to this message. Once the adversary receives such a message he is still free to communicate with the environment in arbitrary ways. However we have blocked all unintended communication path to the protocol until the adversary provides the expected response. Afterwards the protocol run can just continue as expected. So if we go back to the previous slide where I introduced a non-responsiveness problem and showed you several types of possible distinguishing attacks then we can see that using our framework none of these attacks work anymore but the adversary Raza behaves as a real adversary he is no longer more powerful than any real adversary. So our framework provides a very natural solution to the entire problem and at the same time it's quite simple it's really just adding a tag to a message to get an immediate response and it does not involve any additional complications that one has to show during security proofs. It can even be applied retroactively to the literature so for example if we have some functionality from the literature which is formally under specified we can use this framework to make sure that the specification actually is formally correct and it is model independent we have exemplified this by applying it to the three major models of the UC model the IITM model and the GNUC model. In case of the IITM model we also provide full details including formal definitions of urgent requests, responsive environments and responsive adversaries we define various security notions from the literature in this framework and show that all of them are still equivalent which serves as an important sanity check for our framework of course all security notions are still reflexive and transitive and perhaps most importantly we have shown that even though we reduced the power of environments and adversaries they are still strong enough to show all composition theorems of UC frameworks. So let's go back to the examples from the literature and see what our framework can do for them. Here we have the ideal functionality for non-interactive key exchanges again and this functionality uses an inert request to receive a session key if we simply add this single tag to the inert request we are now indeed guaranteed that the next message that it receives will be the session key so from the point of view of a higher level protocol the adversary is no longer able to interact with any higher level protocols that use f9 to generate a key so from the point of view of a higher level protocol this functionality now is indeed non-interactive. In case of the ideal functionality for signatures of knowledge if we add this respond tag to the setup requests we are now guaranteed that we will receive all algorithms immediately the adversary is no longer able to let this functionality operate with undefined algorithms in case of the ideal functionality for certificates by adding this respond tag to the verify request we make sure that the adversary cannot change state of the signer anymore so in particular it also cannot let the functionality accept invalid certificates of course we can also apply our framework to the realization of this ideal functionality in this case we change the urgent requests of fsig and now fsig can indeed provide an immediate response to signature requests the adversary can no longer interact with the protocol in between and fsig can now model properties that are present in its realization so to summarize my talk protocols very often use urgent requests to exchange some purely modeling related meter information and because these urgent requests do not exist in reality so a real adversary cannot abuse them for any attacks it would be very natural to also require the same from our adversaries in the security model however they are in fact more powerful they can abuse these requests to try and distinguish the real from the ideal protocol this dealing with this problem leads to complex protocol specifications and security proofs there is no simple and general solution that can just be plugged into the protocol specifications to deal with this problem it limits the expressiveness of UC models and perhaps most importantly because it's so very unnatural to think about this stuff it has often been ignored in the literature leading to under specified protocols, flawed proofs for other real protocols we provide responsive environments to solve this problem entirely they are very easy to use they really just involve the single tech that you can use to prefix messages and then everything works as expected and they can even be applied to literature retroactively where problems are we want to encourage you to use our framework it just makes your life so much easier by bringing an adversary from our security model to the level of a real adversary thank you very much for your attention is there any question? if there is no question let's thank Daniel again


With forward pay from Appalachian Wireless, you'll avoid contracts and credit checks while taking advantage of some awesome perks like unlimited talk text and three gigs of data for just $44.99, or with five gigs for a mere $59.99. Forward pay, that's today's Appalachian Wireless. After a federal judge said a president Wednesday by ruling that the rights of a former client of Stanville disability attorney Eric Seacon were violated by the Social Security Administration, Prestonsburg attorney Ned Pillarsdorf, who represents many of Khan's former clients, held an informational meeting today in Prestonsburg to inform the former clients of Khan exactly what Wednesday's ruling means for them. Before today we were behind. I think we have taken the lead. There's 10 seconds to go in the game. We should be able to hold this lead. Yesterday when we looked back, maybe the most significant moment when a well-respected federal judge said these people were treated worse than terrorists. To get a U.S. district judge to say that, and boy did he say that in 33 pages, is a big deal. I predict we'll eventually win. I think people will look back and say yesterday was the turning point when the sun finally came out. It took 15 months, but the sun finally came out. If there's one thing the former clients of attorney Eric C. Khan have taken from Wednesday's ruling and today's meeting, it's hope.  I mean, we know we're supposed to be presumed innocent. We're innocent until proven guilty, but it seems like we resolved not to guilty. It's either side. I mean, it's like something inside eating that is, you know, it's a prayer every day if something will work out. The Social Security Administration is expected to appeal Wednesday's ruling. Reporting from Prestonsburg for EKB News, I'm Sean Allen.