All right friends, welcome to Shankara's Academy of Indian News Analysis. Today's date is 12th August 2021. The list of topic is displayed on the screen. In today's discussion, we are going to solve four past preliminary questions. In article discussion, we are going to discuss about myopia, we are going to discuss about Kasi Ranga National Park, we are going to discuss about cooperative bands and finally, we are going to discuss about democracy summit. After discussing the articles, we will practice few preliminary questions and after preliminary question, we will see about the main question. So, we have wonderful collection of topics, we have topics from environment, we have topic from science, we have topic from international phase and we have topic from economics. Now, let us begin the discussion. Now, let us solve some past preliminary questions. See, report and indices are important topic from preliminary perspective. Now, look at this 2016 question. Now, look at this 2017 question, look at this 2018 question and look at this 2019 question. All these questions were asked from reports and indices. So, we can see the reports and indices are favorite topic of UPSC, they are being repeatedly asked. With this information in mind, let us solve these questions. First, take 2016 question. Global financial stability report is prepared by the A European Central Bank, B International Monetary Fund, C International Bank for Reconstruction and Development, D Organization for Economic Cooperation and Development. See, the correct answer is option B, International Monetary Fund. International Monetary Fund publishes a report called Global Financial Stability Report. Now, let us move on to the 2017 question. Which of the following gives Global Gender Gap Index Ranking to the Countries of the World? Option A, World Economic Forum. Option B, UN Human Rights Council. Option C, UN Women. Option D, World Health Organization. The correct answer is Option A, World Economic Forum. World Economic Forum gives an index called Global Gender Gap Index. This index ranks the countries based on gender progressiveness. Now, let us move on to 2018 question. Rule of Law Index is released by which of the following? Option A, Amnesty International. Option B, International Court of Justice. Option C, Office of UN Commissioner for Human Rights. Option D, World Justice Project. See, the correct answer is Option D, World Justice Project. See, World Justice Project, WJP, is an American Independent Multidisciplinary Organization. The main mission of this project is to advance rule of law around the world. It also releases an index called Rule of Law Index. So, the correct answer is Option D, World Justice Project. Now, take 2019 question. The Global Competitiveness Report is published by Option A, International Monetary Fund. Option B, United Nations Conference on Trade and Development. Option C, World Economic Forum. Option D, World Bank. See, the correct answer is World Economic Forum. Option C. The Global Competitiveness Report in GCR is published by World Economic Forum. It is a yearly publication. It is published since 2004. It tracks countries based on Global Competitive Index. Ranks country based on Global Competitiveness Index. So, the correct answer is Option C, World Economic Forum. See, there is a reason why I have chosen these questions. See, whenever you come across reports and indices in current affairs, make sure you give high priority to those reports and index. And whenever you can find time, go to important organizations and read about their reports. Know at least basic information regarding those reports and indexes. It will help you in elimination. It will boost your score. Another good thing is when you learn about report and indices, learn about India's ranking, India's score, you can use it as value addition in your mains answer. So, it will be helpful in prylums as well as mains perspective. In prylums, you can expect a direct question. In mains, you can use it as value addition. For example, in your mains answer, you can write the rank of India from a report in the intro itself. It will differentiate your answer. If the question is about gender issues in India, you can start the answer by writing India's rank in Global Gender Gap Report. Such kind of information will play an important value addition. It will differentiate your answer. It will give credibility to your answer. It will boost your score. Now, let us move on to article discussion. Now, look at this article. This article is regarding a medical condition called myopia. See, currently we are facing coronavirus pandemic. Because of this pandemic, we are facing lockdown at many places. And because of these lockdowns, many of the schools remain closed. Now, we are providing education through online mode. So, students are stuck in their room. They lack physical activity. They are less exposed to sunlight. And because of the online mode of education, they are overexposed to mobile phones. So, because of these reasons, there has been a sharp price in myopia in children last year. This is the gist of this article. The coronavirus pandemic has indirectly increased the myopia in children. So, in this context, let us discuss in brief about myopia. First, what is myopia? See, myopia is the medical condition name. It has a common name. The common name is nearsightedness. It is also called as shortsightedness. See, this is a common eye condition. Many of us have this condition. We have aspectacles. So, this condition is myopia. What does this condition do? It causes distant objects to appear blurred. See, as I already said, the common name of myopia is nearsightedness. So, as the name clearly says, the person with myopia or nearsightedness can see objects which are nearer to them. But when the object is far away from him, it appears blurred. This is why it is called as nearsightedness or shortsightedness. The person can only see the near objects or objects at short distance clearly. When the object is far away, it appears blurred. I hope this basic concept is clear. Now, let us discuss the symptoms of myopia. Previously, we saw about myopia. Now, let us discuss the symptoms of myopia. As I already said, myopia causes distant objects to appear blurred. This is the first symptom. It causes squinting of eyes. Because of the squinting, a person will also experience eye strain. It will cause headaches. And in the long run, it can also cause significant visual impairment. So, in order to avoid visual impairment in the long run, treatment of myopia is essential. How can we treat myopia? The common treatment is prescription glasses. We wear spectacles, right? That is the common treatment. There is also contact lens and there is also laser surgery. So, these are the common treatment methods of myopia. Now, we have a question. What causes myopia? What causes nearsightedness or shortsightedness? Let me explain the cause. Have a look at this figure. The right side of the figure displays the normal vision. Now, look at the right side of the figure. We can see the light entering the eye. It passes through the cornea and lens. See, cornea is the clear layer in front of the eye. And as you can see from the image, the light passes through cornea and lens. The light gets bent as it passes through the cornea and lens. We can see it is getting bended, right? It is getting focused. And as you can see from the figure, in the normal vision, the light is brought into focus right on the retina. See, retina is a layer at the back of the eye. And we can see the light is brought into focus right on the retina. It is falling right on the retina. So, this is a normal vision. Now, come to the left side of the image. This is eyeball with myopia condition or shortsightedness condition. In this image, you can see the light entering the cornea and lens. It is getting bended, but it is not falling right on the retina. The light is not brought into focus right on the retina.  See, the focal point is right in front of the retina. So, this is the reason for myopia. The light rays, instead of falling right on the retina, it is focused in front of the retina. This is the cause for myopia. I hope this concept is clear. Now, we have a question. What causes this defect? Why some people develop this condition and why some people do not develop this condition? See, according to medical experts, myopia in most cases is inherited from your parents. So, myopia is caused by genetic condition in most cases. If your parents have myopia, then the chances of you developing myopia is very high. And according to the medical expert, almost 200 genes are involved in myopia conditions. So, to put it in simple words, myopia in many cases is caused by genetic factors. It simply means a child can inherit short-sightedness from his or her parent. So, the first cause is genetic. Now, let us move on to the next causes. See, myopia can also be caused by environmental and lifestyle factors. In addition to the genetic factors, it can also be caused by environmental and lifestyle factors. This is the second important cause. For example, less exposure to sunlight, increased stress, increased eye strain, overexposure to mobile screens, overexposure to computer screens, overexposure to TV, lack of physical activity. All these environmental and lifestyle factors contribute to myopia. And as I already said, the lifestyle of children have been severely affected by the pandemic. And because of these changes in environmental and lifestyle factors, many children are now developing myopia conditions. So, so far I have discussed about myopia, symptoms of myopia and causes of myopia. Now, let us come to the final topic, the treatment for myopia. The treatment for short-sightedness or nearsightedness. The most common treatment is prescription glasses. See, the prescription glasses have lenses. These lenses corrects the light entering the eye and it makes sure the right focus is correctly on retina. This is how prescription glass corrects myopia condition. Okay. In addition to prescription glasses, contact lenses are also available. Contact lens also does the same job. It corrects the light entering there and it makes sure the light falls correctly on the retina. See, in addition to prescription glasses and contact lenses, laser refractive eye surgery is also available. It is also commonly called as LASIC. See, but it is important to note that contact lenses and laser refractive surgery are usually suggested for adults. They are only appropriate for adults. The children are usually given prescription glasses. They are not given contact lenses or laser refractive eye surgery. Contact lenses and laser refractive eye surgery are appropriate only for adults, not children. See, I want to give you some additional information regarding LASIC. Okay. That is laser refractive eye surgery. I want to tell you how LASIC surgery works. See, if a person has myopia condition, during the laser refractive eye surgery, the thickness of the cornea is decreased. So, the eye surgeon using the technology of laser reduces the thickness of cornea. By reducing the thickness of the cornea, the doctors ensure that the light is properly focused on the retina. This is how LASIC surgery works. I hope these informations are helpful. So, with this, we have come to the end of the discussion. In this discussion, we have discussed about myopia, symptoms of myopia, causes of myopia and treatment for myopia. Now, let us move on to the next topic. Now, take a look at this article. This article is regarding Kasi Ranga National Park. See, according to this article, satellite phones have been given to the forest guards of Kasi Ranga National Park. See, in the past few years, the poaching of rhinos has increased in the Kasi Ranga National Park. So, in order to control the poaching of rhinos, satellite phones have been given to the forest guards of Kasi Ranga National Park. This is the gist of this article. So, in this context, we will be discussing about Kasi Ranga National Park from a prillium's perspective. See, in prilliums, national park and wildlife sanctuaries are an important topic. For example, take 2020 prillium's question paper. Almost four questions were asked from national parks and wildlife sanctuaries. So, imagine out of 100 questions, four questions were asked from national park. So, it is a high priority topic.  Kasi Ranga National Park. Have a look at this map for better understanding. See, as you can see from the map, Kasi Ranga National Park is located in Assam. Look at the map. We can see the Brahmaputra River flowing along the edges of the national park. So, we can say Kasi Ranga National Park is situated in the southern banks of Brahmaputra. And when we are talking about rivers, River Diplu, T-I-P-H-L-U, this river flows right through the Kasi Ranga National Park. This point is very important. In the past, UPSC has asked about the rivers passing through national park. So, make sure you know this point. River Diplu passes right through Kasi Ranga National Park. See, to the south of the Kasi Ranga National Park lies the Karbi Anglong Plateau. We all know about Karbi Anglong Plateau. It is an important plateau in the north-eastern region and this plateau lies in the southern part of Kasi Ranga National Park. It lies to the south. See, Kasi Ranga National Park is 500 square kilometers huge. It is a vast place. It has a unique habitat. Most of this national park lies in the flat plains of the Brahmaputra River. So, it has a lot of wet grasslands. It also has a lot of oxbow lakes. These oxbow lakes are locally known as Beals, B-H-W-L-S. So, these are the unique characteristics of this national park. See, as I already said, Kasi Ranga National Park lies in the flat plains of Brahmaputra River. So, it experiences a lot of flood. Then how animals survive in this national park? See, the animals use Chappuris to survive in this national park during the flooding. What are Chappuris? Chappuris are elevated flat plains. So, during the flooding, animals will move to this Chappuris and when the flooding retreats, they will go back to their habitat. See, Kasi Ranga National Park has a lot of Chappuris. It has a lot of elevated flat plains. These Chappuris are both man-made as well as natural. The man-made ones were built by Indian Army to protect animals during the flooding. So, Brahmaputra River, River Diplu, flood plains of the Brahmaputra, wet grasslands, Oxbow Lake, Oxbow Lakes are also called as Beals, Chappuris. So, these are the basic information regarding the unique habitat of Kasi Ranga National Park. I hope the information is clear. Now, let us move on to the protection status of this national park. See, Kasi Ranga National Park is one of the most protected areas of the world. It was first established as a reserve forest in the year 1908. Later, it was made into wildlife sanctuary in 1950. 1908, reserve forest, 1950, wildlife sanctuary. See, later, Azam National Park Act of 1968 was passed. And because of this act, Kasi Ranga became a national park in 1974. It also became a UNESCO World Heritage Site in 1985. Now, it is also Tiger Reserve since 2006. So, we can see, it is one of the most protected areas of the world. First, it was a reserve forest, then it became a wildlife sanctuary, it became a national park, it became a UNESCO World Heritage Site and now it is also Tiger Reserve. This is why this national park is very important. In addition to all this, Kasi Ranga National Park is also an important bird area. This designation was given by Bird Life International. Bird Life International has declared Kasi Ranga as an important bird area. In addition to all this, it is also protected by domestic laws like Asam Forest Regulation Act, 1991, Biodiversity Conservation Act of 2002. These domestic laws also protect Kasi Ranga National Park. So, it is one of the most protected areas of the world. Now, let us look at the fawn of this place. The animals which are found in Kasi Ranga National Park. See, Kasi Ranga National Park is known for the big fight. What are these big fight? One-on rhinos, elephants, Bengal tigers, Asiatic water buffaloes, swamp deer. These five animals are called as big fight and they are found in Kasi Ranga National Park. See, of the big fight, Kasi Ranga National Park is known for the one-on rhinoceros. This national park almost has two-thirds of the world one-on rhinoceros. This is why this national park is very important. In addition to these animals, it also has tigers, leopards, panthers, bears, wild pigs, org, deer, pelicans, storks and other water fowl. It has a diverse species of animals and birds. See, when we are talking about Kasi Ranga, we should also talk about oolok gibbons. This topic is very important. See, oolok gibbons are the only ape species in India. And also according to IUCN Red List, it is also an endangered species. These oolok gibbons are found in Kasi Ranga. So, we can see the significance of this national park. It is a glory to our country. It is glory to our environment. So, these are the basic points regarding Kasi Ranga National Park from Prillam's perspective. In this discussion, we saw about the geography of Kasi Ranga National Park. We saw about the protection status of Kasi Ranga National Park. We also saw about the fauna of this place. And finally, we saw about oolok gibbons. Now, let us move on to the next discussion. Now, look at this article. This article is regarding a loan scam in a cooperative bank in Kerala. The amount of this scam is over 100 crores. And because of this loan scam, several bank officials have been suspended. This is the gist of this article. So, in this context, let us see about cooperative banks. The relevant syllabus is displayed on the screen. Interested aspirants can go through it. See, in order to fully understand about cooperative banks, first we have to understand about cooperative societies. See, cooperative societies are institutions which carry the state programs to people. So, they get the state support. See, cooperative societies have both social and economic objectives. They are value-based and community-based. And they are also people-oriented. See, these cooperative societies came into existence formally after the passing of Cooperative Societies Act 1904. So, this act gave the formal existence to cooperative societies. It initiated a formal cooperative movement in India. See, the cooperative movement in India was primarily started to deal with problems of rural credits. This movement wanted to encourage self-help and cooperation among agriculturist, artisan, and people of limited means. This was the primary objective of cooperative movement in India. And cooperative societies came into formal existence after passing of Cooperative Societies Act 1904. I hope aspirants can follow. Now, let us come to the most important point. See, the cooperative societies were given constitutional status and protection by the 97th Constitutional Amendment Act. Very, very important point. This amendment act was passed in 2011 and this act gave the cooperative societies constitutional status and protection. This amendment made the right to form cooperative society as a fundamental right under the article 191c. This is the most important point. This constitutional amendment also added a part 9b in the constitution. This part contains the principles to be adopted by all cooperatives. For example, principles of voluntary formation, democratic member control, member economic participation, and autonomous functioning. These are some of the examples of principles included in part 9b of the constitution. See, the important principles to be followed by the cooperative society is this idea. Interested aspirants can go through it. You can use it as value addition in your answer. Now, coming back to cooperative societies. See, the 97th Constitutional Amendment also provided for MSCS. MSCS stands for Multistate Cooperative Society. What does multistate cooperative society means? It means a cooperative society which is not confined to one state. This point is important. We'll discuss about MSCS again for time being. Let us see about cooperative societies. See, cooperative society is a state subject. It is under the Southern Schedule of Constitution of India. So, these are the basic information regarding cooperative societies. Without studying about cooperative societies, we can't study about cooperative bank. That is why I have explained about cooperative society in detail. Now, coming to cooperative bank. See, MSCS Act was passed in 2002. As I already said, MSCS stands for Multistate Cooperative Society. So, according to this Act, cooperative bank is a MSCS which undertakes banking business. See, according to this Act, cooperative bank is a MSCS. It is a Multistate Cooperative Society which undertakes banking business. This is the official definition of cooperative bank according to this Act. I hope aspirants can follow. So, to put it in simple words, a cooperative society which is a MSCS, if it undertakes banking business, it becomes a cooperative bank, okay? Now, who is the regulator for cooperative banks? See, RBI is the regulatory body for the Indian cooperative banking industry. Another important point. See, cooperative banks are co-operative credit institution working in India. These credit institutions can be classified into two broad categories. Another important topic. What are these categories? Urban cooperative banks and rural cooperative banks. So, these are the two broad categories. First, let us see about rural cooperative banks. It is also called as rural cooperative credit system, okay? See, rural cooperative banks consist of agricultural credit institutions. The primary mandate of rural cooperative banks is to ensure flow of credit to the agriculture sector. So, they provide money at cheaper rates to agriculturalist in rural areas. This is the primary mandate. Now, we have another class equation. See, the credit or the money which is given by these banks are classified into two types. They are classified as short term and long term. First, let us see about short term financial needs. See, the short term financial needs of agriculturalist are fulfilled by three entire federal structures. See, let me brief the train of thoughts. Cooperative banks are divided into two types, urban cooperative banks and rural cooperative banks. Now, first, we are talking about rural cooperative banks. Rural cooperative banks gives two types of credits. One is short term credits, another is a long term credit. First, we are going to discuss about short term credit. The short term credit is given by three type federal structure. I hope aspirants can follow. First, let us see about the apex level, the first tier. The apex level is the state cooperative bank in each state. It is generally located at the state capital. The state cooperative bank controls, coordinates and finances all cooperative banks in the state. I hope aspirants can follow. So, this is the first tier. Now, let us move on to the second tier. The second tier is the central cooperative banks. They are located at district level. First one is state cooperative bank. Second one is central cooperative bank. It is also known as district central cooperative banks, DCCB. These banks operate in a specified area, usually district. Now, let us go to the third tier. Primary agricultural credit societies, PACS. This is the third tier. It is located at village level. It directly deals with rural people. It accepts deposits from agriculturalist. It encourages agriculturalist to save money. It also gives loans to needy borrowers and it also collects repayments. This is why PACS are very important. They directly deal with rural people. PACS serves as a last link between the rural people and RV. Let me repeat, state capital, state cooperative bank, district level, district central cooperative bank, village level, primary agricultural credit societies. PACS, that is primary agricultural credit societies, are outside the purview of banking regulation act 1949. This point is very important. So, they are not regulated by RBI, but the state cooperative bank and district central cooperative banks are regulated by RBI. The state cooperative banks and district cooperative banks are also registered under the provision of state cooperative societies act of the consent state. However, passports can follow. The most important point is PACS are outside the purview of banking regulation act 1949. So, they are not regulated by RV. Now, let us come to the long term agricultural credit. So far, we saw about the short term credit. Now, let us come to the long term credit. The long term credit is provided by land development banks. So, these are the important points regarding rural cooperative banks. Now, let us move on to urban cooperative banks. See urban cooperative banks are also known as UCBs. They are also known as primary cooperative banks. There is no formal definition to UCBs. But according to RBI, cooperative banks which are located in urban and semi urban areas are called as urban cooperative banks. The UCBs are primarily registered as cooperative societies under the provision of state cooperative societies act of the state consent. See every state has a state cooperative societies act and under this act, UCBs are registered as cooperative societies. See, if a UCB serves more than one state, it is also registered under MSCS act 2002. Multistate cooperative society act 2002. I hope aspirants can follow. See, till 1996 urban cooperative banks were allowed to lend money only for non-agricultural purposes. But currently the scenario has changed. These banks are lending for agricultural purposes also. So, these are the important points regarding urban cooperative banks. See, overall we should remember an important point. The cooperative banks enjoy duality of control. They are controlled by both RBI and by the respective state government or central government. This is the duality of control. For example, take banking related functions. The banking related functions of cooperative banks are regulated by RBI. Now, take the management related functions. The management related functions of cooperative banks are regulated by respective state government or central government. So, this is the duality of control. And this point is very important from the problem's perspective. Now, coming to the issue. See, in recent times cooperative banks are surrounded by a lot of issues. So, this has weakened their structural mechanism. What are the issues? Corruption, administrative failure, huge amount of NPAs, that is non-performing assets. These issues are plaguing the cooperative banks.  How can we forget the Punjab Maharashtra cooperative bank scam? Because of these issues, cooperative banks are suffering. So, what is the way forward? See, the way forward is cooperative banks should be completely brought under the regulation of RBI. It needs stronger supervision and control. Only RBI can provide such stronger supervision and control. So, finally, in 2020, in order to address this issue, government has announced to bring UCBs and MSCS under the Direct Stringent Supervisory Control of RBI. Our government is taking the necessary steps. It has brought urban cooperative banks and multi-state cooperative societies under the Supervisory Control of RBI. RBI is now imposing Direct Stringent Supervisory Control on these cooperative banks. I hope aspirants understood this topic. With this, we have come to the end of the discussion. In this discussion, we saw about cooperative societies. We discussed about cooperative banks. We discussed about rural cooperative banks, the short-term and long-term funding of rural cooperative banks. We also discussed about urban cooperative banks. And finally, we discussed about the issues surrounding the cooperative banks. Now, let us move on to the next discussion. Now, take a look at this article. This article is regarding Summit for Democracy. See, this Summit for Democracy will be held virtually on December 9th and 10th of 2021. So, it will be held virtually this year end. This summit will be hosted by US President Joe Biden. Now, we have a question. What is this Summit for Democracy? Why do we need a Summit for Democracy? These kind of questions comes to our mind. See, in the past few years, democracy and human rights are facing serious threats around the world. Many democratic institutions are facing serious challenges from within and outside their country. The public are also losing trust in democracy. So, this has fuelled political polarization. And using this situation, many global leaders are now undermining democratic norms and institutions. There has been an increasing trend of authoritarianism in global order. Now, many global leaders are undermining democracy. They are targeting journalists. They are targeting human rights defenders. They are meddling in elections. They are also manipulating digital information and spreading disinformation to weakened democratic institutions. So, we can see the weakening of democracy all over the world. So, this is why this Summit has been created. This Summit is aiming to rebuild democracy. It aims to promote global alliance. It wants to lay strong foundation for US foreign diplomacy. It also wants to counter growing Chinese influence. I hope this information is clear. Now, we have a question. Who can participate in this Summit? See, this Summit is open to all stakeholders. The only condition is, these stakeholders must believe in democratic values and should promote democratic values. This is the only condition. So, leaders from governments, experts from governments, civil societies, multilateral organizations and even private sectors can participate in this Summit provided they believe and promote democratic values. Now, coming to the themes of this Summit. See, this Summit has three important themes. First one is defending against authoritarianism. Second, addressing and fighting corruption. Third, advancing respect for human rights. These are the three important themes of Democracy Summit. See, this Summit is planned to be held in two phases. The first phase of the Summit will be held this year. It will be held on December 9th and 10th of 2020. It will be a virtual Summit due to coronavirus pandemic. This first Summit will provide a platform for leaders to make both individual and collective commitments to different democracy and human rights. This is the main aim of first Summit to provide a platform for leaders to make individual and collective commitments to different democracy and human rights. This is the key point. Now, let us move on to the second phase of Democracy Summit. See, the second phase of this Summit will be held after one year. The second phase will also be hosted by President Joe Biden. Now, we have a question. What is the aim of second phase of this Summit? See, the second phase of this Summit will focus on the progress made so far and it will also focus on the common path ahead. This will be the main aim of second phase of Democracy Summit. Let me repeat, the first phase of the Summit will take individual and collective commitments of global leaders. The second phase of the Summit will focus on the progress made so far. It will assess the progress made on those commitments. So, these are the basic information regarding Summit for Democracy. See, in this discussion, we discussed about Summit for Democracy, why we need this Summit, who can participate in the Summit. We also discussed about the themes of the Summit and the phases of the Summit. With this, we have come to the end of this discussion. Let us see about this Summit in detail once the Summit actually happens. Now, let us move on to the next topic. Practice Problems Question. First question. See, this question is like a story. One walking through this place while encountering the lush green tall grasses of flat plains also come across oxbowl eggs. The oolock gibbons play on the trees as one passes by. One non rhinos that had survived the floods from Brahmabutra had been seen roaming freely and drinking from river Diplu. The passage is the closest description of which of the following. Option A, Kasi Ranga National Park. Option B, Latsingham National Park. Option C, Manas National Park. Option D, none of the above. See, the correct answer is Option A, Kasi Ranga National Park. Kasi Ranga National Park is near the flat plains of Brahmabutra. It also has the river Diplu. It also owes to oolock gibbons. So, this is the closest option. Option A, Kasi Ranga National Park. It also has a lot of oxbowl eggs. When you are talking about Datshingham National Park, it is located in Jammu and Kashmir. We do not have Brahmabutra either. So, Option B is wrong. When you take Manas National Park, it does not have river Diplu. So, we can eliminate Option C also. The correct answer is Option A, Kasi Ranga National Park. Now, let us move on to the second question. Consider the following statements regarding Myopia. First statement, Myopia is a refractive error that makes nearby objects look blurry. Second statement, if you have Myopia, the light waves from distant objects focus in front of your eyes retina. Which of the statements given above are incorrect? Option A, one only. Option B, two only. Option C, both one and two. Option D, neither one nor two. See, first statement is incorrect. Myopia is not the refractive error that makes the nearby objects look blurry. It is Hyperopia or Farsightedness. Myopia makes the distant objects look blurry. Only Hyperopia or Farsightedness make the nearby objects look blurry. So, first statement is incorrect. Now, moving on to the second statement. See, from the discussion of the article we know, second statement is correct. If you have Myopia, the light waves from the distant objects focus in front of your eyes retina. So, this statement is correct. But the question is asking incorrect statements. Only first statement is incorrect. So, the answer is option A, one only. Main practice questions are displayed on the screen. Interested aspirants can write the answer and post it in the comment section below. If you like this video, click like button. If you want to post a video, post it in the comment section below. And please subscribe to Shankar Ayazakirti channel. Thank you. Have a good day.


Good afternoon, I'm Steve Jobs, and this is the new iPod. It's wafer-thin. OK, that was a lame joke. Anyway, hi, I'm Strom Carlson, and this talk is called Hacking FedEx Kinkos, How Not to Implement Stored Value Smart Cards. So just by a show of hands, how many of you have seen some version of this talk before? OK, how many of you have seen the video that went around on the internet? How many of you work for FedEx and or Kinkos? OK, how many of you who I know, who I don't know? All right, two chicken to say hello. Anyway, so first off, let's get into some theory.   Well, basically, a smart card is a small plastic card. Typically, it's credit card size, and it has a little microchip on it. There's several different types of smart cards. They can use a contact pad, a built-in antenna to communicate with a computer, or both. There's something called a Combi card, where instead of this contact pad, you have the contact pad, and you have the little antenna. So you see those in applications where, for example, I've seen them in transit applications, where you refill the card by putting it into a kiosk. And then when you get on the train, you just have the card in your wallet or whatever.  So they're called smart cards because they're more intelligent, more versatile than the MagStripe cards. How many of you stayed for major's MagStripe talk? Cool, so similar interest. So they're a bit smarter than MagStripe cards, and they're actually almost smarter than a lot of script kitties. There's two varieties of smart cards. Not all smart cards are created equal. The first one is a microprocessor card. And these typically include a small microprocessor, some random access memory, some ROM. They're often optimized for cryptographic functions. And one example are the SIM card and GSM phone. And the way these work is to authenticate your phone, what happens is the network, your phone powers up and it says, hi, I'm a phone. And the network says, OK, if you're claiming to be this phone, here's a challenge. And the SIM card computer responds and sends it back to the network. And the network says, OK, it seems that you've gotten the challenge right, so I'm going to assume it's you. Then there is memory cards, which are simple double E problems. They sometimes have a microcontroller for some logic on them. But typically, they're just basic simple memory cards. And they can sometimes perform some basic security functions like locking you out from writing the card unless you present a simple code to the chip itself. So meet this chip, which is going to be the subject of our talk called the SLE 4442. And actually, this chip, from what I understand, has been discontinued and replaced with the SLE 4542, which is essentially the same chip only in a different casing. It operates exactly the same for, so for all intents and purposes, it doesn't make a difference. There's only 256 bytes of storage space on this chip. And the first 32 bytes can be irrevocably right protected. So the first 32 bytes simply contain a header for the manufacturer of the card, the specific application of the card, and so on and so forth. And the other 224 bytes are changeable at any time. And I think they can be right protected, but I'm not sure. But for the most part, the other 224 bytes are for applications. The whole thing is readable at any time. There's no security against reading the card. And you can only write to the card after presenting a specific three byte code to the microcontroller on the card. If you present the wrong code three times with this microcontroller, the card becomes unwriteable and it's pretty much dead. But I mean, the card's cheap, so it doesn't really make that much of a difference if you screw one up. And if you're willing to get to burn up a lot of cards and you want to brute force this code, and you've got 5.6 million cards lying around, you can do it. If you've got lots of time, stick in the reader. This is a chip I took off of one of the cards. I took it apart and pulled the chip off from the back of the contact pad. And that's it. It's this little tiny, there's a dime for comparison, so a little teeny chip. Now, why use this chip? It's really cheap. In quantities of $200,000 I did a search in April or so, 36 cents each. And if you're buying them, the kind of quantities that say FedEx can go as buying them, which is greater than $200,000, they're probably a quarter each, maybe, probably less. The security function does prevent the casual attacker from altering the data. And they tend to be more durable and secure than a Magstripe card, so for example, you can kind of imagine this as a Magstripe on a chip rather than a Magstripe, so you will never have that problem with, oh, I accidentally put it next to a magnet and now my credit card doesn't work anymore. So, obviously, FedEx Kinko's uses this chip. How many of you have been into a FedEx Kinko's recently? Okay, how many of you are familiar with the way their system works? Okay, so basically, when you walk into a FedEx Kinko's, you're issued a little card like this. You walk up to a kiosk and you press a button on the screen and it spits this card out at you. And you stick the card back into the machine and it says, your balance is $0, please insert money. So you put cash in and once you put it in as much as you want, you up to $100, you press another button, the card comes back out at you, and then you take this card and you walk around the store and stick it in the machines and you can use to make Xeroxes or you can use the computers and debit the amount off the card. And so it's a basic stored value function. There's nothing fancy going on. It's not storing any personalized data and you can add value to the card again.  So pretty simple stuff. It wasn't developed by Kinko's, it was developed by this little company in Toronto called N-Track Technologies. Seems to be a little tiny company that have like this one product. That's it. And Kinko started playing with this five years ago and I think it went system wide in 2003 or 2004 or so. So after going to Kinko's a couple of times and making some Xeroxes, I had some questions. My first question was, is there any personally identifiable information stored on the card? Because, I mean, okay, it's cash, so there shouldn't be, but I thought maybe there was. Is there a transaction history stored on the card?  It'll print up a receipt of everything you've done at the store right at the kiosk.  So that leads me to the question, well, is this stuff stored on the card or is it stored on a backend system of some such? And how secure is the data stored on the card? The card offers no cryptographic function built into it and they could theoretically encrypt the data before storing it on the card and that would, it wouldn't prevent people from figuring out what's on the card, but it would certainly take the random curious person who just buys a card reader and sticks the card in and looks at a dozen of them or so from figuring out what the patterns are. And is value even stored on the card? I mean, it could be that because all these things are networked and you can get a receipt, if the receipt step is stored on the backend, then maybe the value is stored backend as well. And so it could just be like a serial number token. It could be the illusion of something cool and wonderful and fantastic, but it's just serial numbers on microchips. And what else is stored on the card? There are 206 bytes and a dollar value is not that big a deal. So maybe there's extra space, what are they doing with it? So there's some ISO standards when you're dealing with smart cards that you have to deal with. The first, it's the ISO 7816 group of standards. And the basic standard for the microprocessor cards is up to and including 7816-4. So dash one is the physical characteristics, the shape, the thickness, the durability. 7816-2 is the dimension and locations of the contact points on the card. 7816-3 are the electrical characteristics and class indication and basically just tells how the cards are supposed to act under certain voltage conditions. And these cards conform to those standards. They don't conform to ISO 7816-4. And this is actually a set of standards for interfacing with the card. So command response contents, data structures, applications, retrieval of data, access methods, security, and so on and so on and so on. So the protocol for these cards is proprietary. And most of the card readers that you get will pretty much any card reader you get will read the 7816-4 cards, but a lot of them won't read anything else. So sometimes it's a bit of a pain to find one that works with these cards. Do any of you remember the American Express smart card readers that they sent out to anyone who asked a while back? How many of you got those? Okay, a few people. I had one as well, and I was trying to get it to read these cards, and those will not read these cards for love of money. So I had to go out and find one that does work with these cards. Here, so I bought one of these. This is the ACR30U. I've got one of these here. It's a cheap little thing, 30 bucks. Smartcardsupply.com is where I got mine. And it works under Windows, and supposedly it works under Linux, but there's a Windows application that comes with the reader to read and write these cards, and I figured, well, why reinvent the wheel when I've just got this application I can work with? So, all right, I went to Kinko's, and I got a bunch of cards, and I noted their values and took them home with me, and started reading the cards. And so this is a dump of a standard Kinko's Express Bay cash card. Simple 256 bytes. The important bits on the regular cards I've highlighted in red, the rest are incidental data. The change is a little bit, but for the most part they're unimportant. So, first off, there's this 32 byte header. It's the same across all cards. It's right protected. You can't change it. This pretty much just identifies it at the system as a Kinko's card. Because every, and I'm not sure on the specific data structure of this header, but there's, part of this is like this says, this is an SLE 4442 type chip. And then the rest of it says, this is the specific application of that chip. This is where the dollar value is stored. And this one I think is a $1 card. And so I first looked at this, I couldn't figure out what the dollar value was. I'll get to that in a minute. The next one is the date and time the card was first issued. So, this bit, I'm not sure whether this byte is important, the two zero at the beginning of the date. Because on some cards I ran across, that byte was set to zero zero. And it didn't seem to make any difference at all. So, but this is the date and time the card was first issued. And you'll see it's also down here at the bottom. And this does not change through the life of the card. So, it doesn't seem to be used for anything on the regular cash cards. There's a serial number stored on the card, which it consists of the four digit store number the card was issued at. And then the cards are just sequentially numbered after that. So, this is I think 1163 is a store in West Los Angeles somewhere and this is 32309. And there's another timestamp down at the bottom there. And it seems to be a duplicate of the other one. I'm not sure why there are two timestamps. They don't seem to be used. There's also this byte, which I discovered later is the type of card. There's three types of card. There's these regular cash cards. There's the blue ones, which are these convenience cards, where I haven't seen them used in the California stores, but someone in a different state, and I'll be kind of vague about this, who works for FedEx Kinko said, saw the video and said, hey, I'll send you some cards. So, they sent me some cards and I got the convenience cards and the employee cards. So, what the convenience cards are, they have either 10 or 25 copies on them. And these are, I'm not sure what they're used for, but I'm pretty sure they're the kind of thing that the customer has trouble or whatever, or they, for whatever reason, the store wants to give them some copy value. They can just give them one of these cards and say, hey, here's 10 copies and here's 25 copies. So, that's a different type of card. And then there's the employee cards, which the way I'm told they work is an employee gets this card and sets it up at the beginning of the day, and they work for 24 hours for unlimited use of the services. So, unlimited copies, unlimited use of the internet kiosks, and so on and so forth. Did you have a question? Okay. So, this is a convenience card and if you can see this, this by changes to zero, one. The convenience card. It's pretty bear, there's a serial number, there's no date stamp at all. Actually, there is the date stamp over here, but the date stamp on this part of the card goes away. And there's only a few significant bytes. There's this byte, which is the number of copies available with the card in hex. So, this is 10. And then this one is the number of copies that you've made on the cards. This is one copy used on the card. And this is the employee card. So, as you can see this byte over here changes from one to two. That right there. And the employee ID number is stored on these cards. In this case, this is, I think, RR555555. No, this is not any real employee I made this person up. To protect the innocent, supposedly. And so, there's the employee ID number and there's the date stamp, which is important. Yeah, there's the state stamp and the card only works for 24 hours after the state stamp. But, as I'll get into later, it turns out that you can modify this really easily and there's no checking of any source. So, getting back to the value, right? So, here's a $1 card. And all of the stuff is really easy because now, you know, 2005, September 21, you know, 1605 and 45 seconds in the afternoon. And here's the sort of number 1163, you know, 0332309. And these are really simple just to look at and go, oh, okay, that makes sense because they print the serial number right there on the receipt, for example. But, the dollar value, I couldn't figure out. I mean, it's F03F, what is that? That's not one, that doesn't make any sense to me. So, it turns out that this is like the one part of the system that's over engineered because, so like, here's some values. You know, here's $1, one cent, five cents, 20 bucks. So, I mean, looking at it basically, I couldn't figure it out. I went to friends, I'm like, does this look like anything to you? I spent months racking my brain over what could this possibly be?  And I took, I think it was the $1 value and I plugged it into Google. And it turns out that, oh, it's IEEE 754, double precision floating point format. Yeah, why they're using double precision floating point values for dollar amounts is beyond me when it's just integers. But supposedly, you can store 99, what is this? 99,000 centillion, $100,000 centillion is what this is.  And so there's, I don't think there's a Google of subatomic particles in their own universe, but you can store more than that in dollars on this card. Yeah. When you try to cash that out, I guess maybe they'll look at you kind of a scans like, I don't know, maybe you're the Nigerian government or something, trying to cash this out.  So yeah, 308 decimal places. In practice, of course, this is totally useless, but yeah, this is the one part of the system that is completely over-engineered. Everything else is not. I'm sorry? Repeat the question? The question is, could this have been reused from something else the company created? It's possible. The company's been around a little longer than this system, but based on the fact that this is now their only product, I don't think so. Who knows, maybe. How many copies this is? Well, okay, it would probably overrun the entire city with paper, burying it in paper. All of the copies, yes. Asterisk copies. So the card itself, the data on the card is protected by a three-byte security code, 24 bits of code. And so there's 16.7 million possible combinations and my basic research led me to believe that all of the Kinko's cards probably have the same code because the blank cards from the kiosk don't have the manufacturer's default code, which is I think six Fs all in a row. And the code could theoretically be derived from changeable data on the card, but if somehow that data got corrupted, then you wouldn't be able to derive the security code and the customer would be stuck with whatever money was left on the card. 20 bucks, angry customer, that's not worth it. And everything about this card is just really simple anyway, so why would they bother? So now comes the time to start formulating an attack. The security code can only be read once the correct code has been written to the card. So you can't just stick the card in the reader and say, tell me the security code because it's gonna go, no. So this is the, this graphic is from the spec sheet for the chip. This isn't the exact graphic, I just redrew it in the slideshow program, but this is pretty much the block diagram of how you read and write to this chip. All writes have to go through the security logic. And there's an error counter to count how many times you got it wrong and the security code is stored in there, but it won't read that back to you. You can't read this back out unless you've written the correct code to it. So how do we do this? Well, the first possible attack is a social engineering attack on the company that makes the system. The second one is to emulate the card somehow. The third, you intercept the code during transmission between the reader and the card, or you can read the memory directly. And these are all feasible somehow. The social engineering attack in theory, you contact N-Track and pretend to be someone, you extract the code from some unsuspecting employee. So obviously the pros requires at least technical jiggery pokery just to pick up your phone and be a good talker. The problem is that the code might theoretically be so secret that no one but the N-Track engineers know about it. I mean, they seem to put all their eggs in this one 24-bit code, so maybe, right, could be under in a safe somewhere. And the safe combination is that code, right? It's tough to repeat this attack if the code has changed because then, you know, we'll wait a second. Every time we change the code, the same person calls back and says, hey, I need to know the code. And there's no technical challenge. It's just, you know, talking on the phone. And we all do that, right? You could emulate the SLE-4442. When they sell development kits for smart cards, they sell a dongle that you connect to your computer and on the end of it is this thing with contact points on it and pretends to be a chip. So it's fairly foolproof and you can figure everything out and you can have your computer say, oh, that's what it's thinking the code is. Okay, well, there we go. The emulator dongles are kind of bulky and the problem is that Kinko's uses this motorized card transport where the card goes like an inch or two into the reader. So unless you've got a really flat ribbon cable coming off the back of it, it's kind of tough to use with this motorized transport. And the second problem is that because these are typically for microprocessor cards, more complex chips, the emulation software for this really simple chip might not exist at all. The other option for the emulation attack is to find a microprocessor based smart card that can behave just like the SLE 4442.  I've got a laundry card that's also a smart card that's also just a plain white card. It's got text on the back that says, treat this card just like cash. Disclaimer, disclaimer, disclaimer. But other than that, it's plain white. So I mean, the average person might stick any random card in the reader, so why not you?  But unfortunately, and it's really elegant because any system that uses this type of chip would be vulnerable because by design, if you want to write to the card, you've got to present that code and you can't, and so any, like this chip isn't used, just using Kinko's, it's used in loyalty card programs and I think for a time, like the German government's healthcare system used this card, I hope they've changed something better, I don't know for sure, for sure. Anyone from Germany can confirm it or deny that? Yeah? Okay, thanks, thank. And the problem with this is every micro-processor card I've looked at follows the ISO 7816-4 standard and not the SLE 4442 communication protocol. So you'd have to either find one that can do it or you'd have to be a really, really awesome FPGA or whatever the type of chip you use and I'm not that good a coder. So you could intercept the security code by using a logic analyzer and wiring some wires up to the card. The easy part about this is that the logic analyzers are small and transportable. The logic analyzer that I bought is about as big as this little remote that I'm using. It's a little bulkier, but for the most part, it can fit easily in a pocket or a laptop bag and you can hide the wiring really easily. So there's a little chance of card rejection because you're using the actual card. You're not using some emulation chip or whatever. And the problem is unless you have a lot of cards, it's easy to screw up if you're not good with a soldering iron and I'm kind of klutzy with a soldering iron, so I managed to screw up a few cards. Or you could do the really, really expensive thing and burn the epoxy off the back of the chip and read the security memory directly if you've got an electron microscope, et cetera, et cetera, et cetera. So let's get to the attack. So the logic analyzer attack is the one I picked. In a perfect world, I would use something similar to this, which this is a picture I took today. There's a vendor in the vendor area who has these who make prefab boards of any kind whatsoever. And one of the examples they have is the smart card board. So this would be really awesome because you can't see it too well in the picture, but there's these contact points here and there's these leads going back to contact points on the back of the card that you can connect the logic analyzer to.  That's really clean, really elegant way to do it. But this is not a perfect world, not a half that. So I resorted to soldering wires to the card and making this really ghetto, do-it-yourself ribbon cable thing coming off the back of the card. If you look at my awesome 31,337 soldering skills, you can see that I got the solder all over the place and it's like de-soldered little bits. I blow at soldering. Just to give you a little more detail of how this works, this is a test card that I have with me here. And I used like really thin bits of transformer wire. And I think this was one of the tests I did. Like, because the solder increases the thickness of the card, I wasn't sure whether this would just jam in the reader. So there were a number of tests I did where I'd like just taped a piece of wire to the card and went to Kinko's and stuck it in the reader. Or I just soldered, put some solder on one of the contacts and went to Kinko's and put it in the reader and tried to see whether it would work or not. And I figured, well, if these get stuck, I can just walk off and never go to that Kinko's again. But fortunately, because the card readers use a landing type contact where basically the card goes into the reader and then once it's fully in the contact points are lowered onto the card, this worked just fine. So I got all the cards back and nothing got stuck. So what I did was I took my little thing to Kinko's and I've got my, if you can imagine my laptop and I've got the wire going, the USB cable going from the laptop to the logic analyzer which is hidden in the bag and then I've got this wires running from the logic analyzer to this pin header on the back of the thing and then I've got the card that I'm sticking into the kiosk. And fortunately for me, Kinko's has this section where you can sit down with your laptop and plug their stuff into it and you get to use their internet connection for like, I think 25 cents a minute or something like that.  Like AT&T long distance rates from 1978 rates. Oh, there's cameras. There's cameras, but if you look where the camera is, you know, it's kind of, there's only, it's not like they have cameras at every station.  So you set your logic analyzer to read the data and you stick the card into the thing and it reads and spits it back out at you. Then you stick the card in the thing, it reads and spits it back out at you. You do it a couple times just to be sure.  And so you walk home and you pull the data out of the logic analyzer and you get this. Just a stream at binary digits, ones and zeros and ones and zeros and ones and zeros. So on their own, this doesn't really, the problem is this doesn't really chop up cleanly into individual bytes because there's a lot of things where it'll read ones where the card is processing and the card will just process and process and process and it'll go okay, I'm done, but it won't actually be on any divisible number by eight. So you've got to actually manually step through this and figure out where the codes are and what's happening. So you've got to have a little patience. There, if you look at the spec sheet for this card, these are the commands to operate the card. Read the main memory, update the memory, read and write the protection memory, read and write the security memory and compare verification data. And if you look in the manual, there's a very specific sequence of these commands that you need to present to the card in order to open it up for writing. So you need to, I think, read something twice and then present the security code one byte at a time using these commands. And so you just have to look for that pattern in the data. So there's a command structure to these. There's the command byte, there's the address byte and there's the data byte. So here's the security code presentation thing I was just talking about. You read the security memory, you update the security memory and then you write the compare verification data in three steps, one byte at a time, update security memory to N and then read security memory. And if you've done that correctly, it'll say, okay, the security counter is reset to three and you're set to go. And if not, the security counter will decrement to two or to one or to zero. So here is stepping through the data byte by byte. So here's the answer to reset and these are the first four bytes of data stored on the card in that right protected header. Here's the processing cycle. Read main memory from byte 15 to the end. And so then there's processing cycle and it starts dumping everything out. Here's the main header, here's the value, timestamp and so on and so forth. So do this many thousands of bytes later. And you find this. So it says, read the security memory, okay. Update security memory, okay. Cards processing, processing, processing, compare verification data, byte one. Hey, here's the first byte of the security code. Here's the second byte of the security code. Here's the third byte of the security code. Update security memory. I'm like, oh wait a second, why do I need to keep going? I found it. And for those of you who were in the back and can't read this, I've taken the security code and replaced it with Xs and then down here it says, why hello there. I'm the information security responsibility cupcake. And it's my job to tell you that you're gonna have to figure out the security code for yourself. Also, dead hookers. I figured it would be grossly responsible of me to just give you people the code. Because I'm sure there are some in the audience and not the audience who would just take the code and then all of a sudden Kinko's is losing millions of dollars to just random people coming in and making hundreds of thousands of copies for no reason. And then, oh, who's that Schmuck who presented about this at the DEF CON? Oh, me. So, manipulating the card is really easy. Let me turn this off and I'll open up the program that you used to do this. Stick the card in the reader here. I'm gonna use the basic blank one so I don't give you guys the real security code. So, here's the SLE4442 and here's the main memory. This card's blank, it's all ones. So, let's present the security code and hey, we got it right. This software is a little buggy. It says incorrect remaining chances equals three. But now that we know the code, we can write to it.   And there we go. So, we've written to the card, simple as pie. And to prove that we can write to the Kinko's card and we'll take this out. And let me just reset this. And here's a real Kinko's card and here's some data which wasn't on the card originally if we go to ASCII, it says LOLDeafCon. So, now that we can write to the card, let's figure out what we can do with it. Oh boy, internets. Your balance is $313.37. Wait a minute, you can only put $100 on these cards, what the? So yeah, this is the proof of concept. This is the first card I wrote to him like, here's a value that kind of proves I can write to. It ran off and it worked. So, that was pretty sweet. Now that we can rewrite these cards, how does the back end system interface with this? So, let's play with it a bit. I'm sorry? Okay. So, here's the layout of a typical Kinko's. There's one kiosk, there's a bunch of PCs, like maybe one Mac, probably you Mac people out there.  So, first thing, card cloning. Does this, because each card is individually serial numbered, does the system have some sort of balance tracking that it can do? So, buy a card, clone the card, make a few zeroes with the first card, and then print receipt with the clone card. And, it turns out that when you do this, like, whether you put the clone card in, it'll say, okay, you made two copies at 10 cents each, so that's 20 cents, and your balance is a dollar. So it just reads the balance off the card. Value alterations, does the system throw up red flags if the balance suddenly changes for no readily apparent reason?  And in this case, it goes, oh yeah, you purchased the card for a dollar, you made two copies at 10 cents each, so that's 20 cents off, and your balance is now $1.80, no red flags. Does the system freak out of the card serial numbers from some non-existent store somewhere? Does the system even verify that the serial number is valid? So, you buy the $1 card again, you alter the serial number to store<PHONE_NUMBER>, there is no store 9968 anywhere in the system, and you do the same thing, and it just works fine, doesn't even bother. And okay, is the card serial number invalid if you redeem the card for a stored value? Because you would think, right, okay, here's someone who turned the card in, they've got cash back, let's make this card not work anymore. That'd be the logical thing to do, right?  So, there's the $1 in the system that you're never getting back. You buy a $1 card, make a Xerox with the card, clone the card, redeem the original card, make a Xerox with the clone card, and see what happens. And it works just fine. The clone card, even after you redeem it, still works for Xeroxes. Okay, so maybe it takes some time for them to update their system or something, so you go eat pizza and you come back and try again. No, still works just fine for Xeroxes. Maybe, maybe, maybe you go back a day or six later because maybe they're really, really slow, you hope. But no, the card still works after six, seven days. Did you know, did I mention that they have only one product? This.  I wish this were false, but. And so, oh, and also the employee cards. It turns out that, okay, so with the convenience cards, you can just reset the counter of the number of copies you've used and it'll just keep working. You can alter the serial number, it doesn't make a difference. And the employee cards, all it does is check that timestamp and see whether it's been 24 hours since the timestamp. It doesn't bother to verify whether the employee is still working there or is even a real employee at all. So you can. Does it? Oh, okay, yeah. So it checks the store number two and that's it. But yeah, if you get the store number right, you can be Joe Blow 999123. Doesn't make a difference. Not a date in the future. I'm sorry? A date in the future? A date in the future, I didn't try that. But that would be a fun thing to try. If there's a kink goes around the corner, we can have fun. So how do we engineer a better system, right? Well, first off, there's several options, right? How do we do this cheaply and keep the existing base of installed cards? Well, the first thing to do is to change the way you store things. You change the way the security code works so that the security isn't the same for every single card in circulation in the entire system and you change the method for verifying the cards. So it's inexpensive because all you have to do is change the software, but it's still somewhat insecure because you're still using the same cards and also how do you ensure that the old cards that are still floating around aren't fraudulently being used? You increase security by verifying the information. You generate a hash, you encrypt the data, you don't store value in plain text. You basically make it difficult for someone to do what I did where you just look at it and go, oh, this is the store number, this is this, this is this, this is that. You make it just look like random garbage. Or you don't store the value on the card itself, right? You just use the serial tokens and you store everything on the back end. But, and you invalidate the cards when they're cashed out, duh. And don't use the same security code for every single card out there. Use some code derived from a randomized rotating value or don't base the code and don't base the code from any value stored on the card. So it has, okay, 10 minutes next. So better thing to use is use a different chip that has cryptographic product on some sort of cryptographic function on it. The Atmel Crypto memory chips used by my laundromat are higher security than Kinko's chips. So it's easier for me to make copies than it is to steal laundry. You use a chip with a microprocessor, you can do challenge response, you can encrypt data, you can do access control, you can do hidden goat's sea if you want, I don't know. And, you know, if these new chips are more expensive, like you can do what my laundromat does and charge a deposit for the smart card, currently the cards are free for the take and you just go to the kiosk and say, give me a card, give me a card, give me a card, and it'll just keep spitting the back out at you until the thing's empty. It'll go, oh, contact a team member to get a card now. So you charge a buck or two to obtain the card and then when you're done, you have the customer return the card and they cut their dollar back, big deal, right? And it'll prevent, you know, curious tinkerers like myself from obtaining massive numbers of cards for play and analysis, you know, like a small stack like that. So, some resources you can go to our SecureScience.net, which is my company, it's the plant's company, I work for it. You can go to my website, StromCarlson.com, Infineon is the manufacturer of the chip on the Kinkos card, Atmel is the manufacturer of the chip on the laundromat card, and SmartCardSupply.com is where I got the stuff. What? What? Am I? Yeah, but I never talked about that on here, so that's not a resource for this talk. So, questions, answers? Yes. One thing that you mentioned was that when you were practicing with writing cards, if you would write, you know, if you try to break the security code on the card, you only have three chances. But you also said that when the system goes through and correctly authenticates the card, it resets the counter, is that true? Yeah, it resets the counter. If you, for example, write the wrong code twice, you can go stick it in the kiosk again, and it'll reset the counter to three. But the only problem with that is you look kind of weird going with a stack of cards and sticking them in one at a time and then coming back the next day and doing the same thing. So, question? I thought, you know, wouldn't it be more secure to just actually put all this data, like the dollar amount data in a database and actually have a program searching for patterns of things that are strange? Because I don't know why you would put the money in the card. It doesn't make any sense to me why they would do that. I don't know either why they did this. So, that was the question, it was just more of like a statement. Yeah, I think I mentioned that. I'm curious as to why you called it hacking FedExKincos when you were actually hacking in track. Because no one's heard of in track, but everyone's heard of FedExKincos. So if I called a hacking in track, like half of people would go, what's that? Okay, never mind. Any attempt to do some power analysis to brute force the security code? I'm sorry? Any attempt to do power analysis to check when security code becomes invalid on a bit by bit basis? You can't do that with the way this, I mean, theoretically, right? Theoretically, I think you might be able to do that. But again, this is not my area, electrical engineering is not my area of expertise. Yeah, seems to use them just to give it to you. Yeah. After you've locked out the card by writing to it too many times, can you still read it? Yeah, you can still read the card, you just can no longer write to it at all. It's burnt out. I'm sorry? Yeah, can't be updated at all. But, well, no, see the thing is, if I actually tried that, if the system can't read right to the card, it just said, this card's bad and spits it back out at you. So, no, you can use credit cards in the same reader. Oh, wow, okay, interesting. I have five minutes, so a couple, and then use her.  I didn't try that. It's worth a shot. Have you tried notifying and track of the security issue, and if so, when? We notified them at the beginning of February. We didn't hear a thing from them for a month, and so we said, okay, usual standard practice is a week, so we went public with that. Is this attack still valid then? Yeah, this attack is still valid, which is why I'm not releasing too many details. Any other questions? I'm gonna shine this in your eye for being off topic. I'm gonna shine this in your eye for being off topic. I'm gonna shine this in your eye for being off topic. I'm gonna shine this in your eye for being off topic. God, okay. All right, no more questions. Oh, Logic Analyzer, if you just Google for USB Logic Analyzer, there's a number of companies out there that are selling them. Why didn't you build your own? Why didn't I build my own?  Yes? Yeah, the pinout is described in the data sheet of the card, and I think I put the data sheet on your DEF CON CD, so you can look through that. Any last questions? Okay, well, oh yeah. Did I cry what? No, I didn't try that again. I'm not much of an electrical engineer. I'm not much of a coder. I'm a phone freak. So, you know, this is just me tinkering. Okay, well, and if you wanna bring me your Kinko's card at any point during the con, I'll write something silly on it for you. Thanks.