So, Yannif Balmas is a software engineer and he started tinkering with a Commodore C64 when he was eight years old and he was kind of a teenage hacker of games as well and now he's in the security field and he got interested in the fax machine together with his friend Yel Itkin who is also a security guy and malware researcher and together they're gonna tell us about the fax machines and what the fax was still using people those machines and it's gonna be really interesting I think and the title is also hacking your network like it's 1980 again I'm really excited please give a warm round of applause to those two guys thank you thank you guys hi ccc you probably know this sound right and now get to know us so my name is Yannif Balmas I'm a security researcher I work at checkpoint research and with me here today is a Yel Itkin also a security researcher also it's checkpoint research and let's begin with talking a bit about the history of fax so I guess that not many of you know that fax started it was first invented in 1846 by a scientist called Alexander Bain fun fact this was this happened 20 years before the invention of the light bulb and then it had some more advances to it this is the actual first thing that looked like a fax machine like a standard fax machine and again this thing was invented 20 years before the invention of the telephone so humanity was sending faxes before we had light or talked over the phone and then there was some more advancements like radio fax and another important important point in time is 1966 where a small unknown company called Xerox invented came out with the first commercial fax machine this is the advertisement for it and in 1980 a strange organization called ITU defined the current standards for fax namely it's t34 t6 and those standards are still the same standards that we used to date basically with just minor changes to them so this was all in the past but what's happening today I mean today we have far better ways to send electronic documents from one to the other right you know let's compare fax to just I don't know off the top of my head just you know one method like let's say email and just to you know remind you we are comparing this to this okay so let's look at some of the features here in terms of quality yeah okay in terms of accessibility I'm pretty sure that all of you here have 24 by 7 access to emails not so sure you're carrying around your fax machines with you in terms of reliability well you know when you send a fax you don't really know if it got received or not yes there is this strange confirmation page but it doesn't really mean anything I mean if there's no paper in the receiving fax you still get it if the dog ate the they ate it you still get it so there's absolutely no reliability in fax and regarding authenticity well we can argue about emails if it's authenticated or not it could be forged of course but we do have public key cryptography and stuff like that that will help us when talking about emails while we don't have we don't have nothing when it comes to fax absolutely no authenticity so if we're looking at this table one might think to himself okay so who the hell still uses fax today it's 2018 I mean it deserves a place in the museum of great technologies and that's it so nobody is using fax today right yeah wrong everybody are using fax today and and you see fax is used like to send this very critical maritime maps to ships at open seas 90% of the Japanese population uses fax according to Wikipedia at least and if you Google any kind of combos like contact us and fax or stuff like that you will come up with something like 300 million results 300 million published fax numbers in Google and that's not counting the unpublished numbers right that's a huge amount of numbers but it's not all about numbers I mean it's not how many fax machines are out there but it's also who is using fax you see if you're a small corporate a medium corporate a huge corporate you have fax not necessarily anybody is sending fax to this number but there is a fax machine sitting there waiting to for a fax to be received if you're a bank you simply love faxes this is Bank of China the biggest bank of the world in the world and that's the fax number of it and I think most importantly if you're a government organization you simply wake up in the morning and you want to have more fax so this is Donald Trump's fax number if anybody wants to send him a fax go ahead that's it it's not a secret it's from Google so we should send him something by the way yeah so yeah and the thing is that you know those banks and government institutions they don't only support fax allow you to send fax the funny thing is that actually most of the time it's mandatory to send fax there is no other way you can either postal mail it or fax it they didn't hear about anything else so we looked at this state of affairs strange state of affairs and said to ourselves you know this looks strange I mean it can it can be true humanity came so far and we are still using these old technologies so what the fax and like we decided to try and do something about it and we started a very long research to try and find some security vulnerabilities in fax and before we do that let me just you need to explain how fax looks like today you see today fax doesn't look like it looked 20 or 30 years ago then it was just standalone fax machines right today fax is mostly old technology embedded within newer technologies so I mean we have fax to email services or email to fax services we have like as I said before radio fax and fax over cell light and stuff like that and I think most commonly we have these these machines all in one printers like you buy them they scan the print and they fax it actually comes with a phone cable out of the box so you can connect I guess most people connected and I also think that this is the most common faxing solution today so we decided to take a look at these machines these fax machines and if you look at these boxes from a security point of view you can imagine them to be just black boxes right and those black boxes as interfaces so in one side of the box we have interfaces like Wi-Fi Bluetooth internet stuff like that these interfaces connects the printer to the internal network the external network basically it connects it to the world right and on the other side of this box there's this little interface here that connects the this black box to somewhere to the 1970s I would say so yeah that's pretty funny and you know if you remember that at the end of the day these printers are basically nothing but computers I mean they have CPUs they have memories they have operating systems they are computers not standard ones but they are computers and we were thinking to ourselves imagine this scenario right there's an attacker sitting somewhere in the world all he has is access to a phone line and his targets number what will happen if this attacker this guy would be able to send a malicious fax and with this malicious fax he will be able to exploit the printer then he's completely as complete control over the printer right if he does that he could then maybe pivot through any one of those other interfaces let's say the internet and jump from this printer to the rest of the network that the the internal network effectively creating like a bridge between the external world and the internal network through the phone line that's 1980s again so we thought that this is a really cool at a tech scenario and we decided to accept this challenge and go for it and try and actually show this thing happening in reality we were really excited about this but then after we slept a bit and drank a bit and sat down and talked about it we kind of found out that there is like a lot of challenges really hard challenges in front of us and it's we're not really sure how to deal with them let me name just just a few of them so one of the challenges is how do we obtain the firmware the code that this printer runs it's not like you have it everywhere and after we get it how do we analyze this firmware after we analyze that we need to understand what operating system are those printers running and then we need to understand how to debug a print I never debug the printer before and I need to understand how to debug a printer and after we do all that we need to understand how does Fox even work we only know the beeping sounds like most of us I think and after we did all that we can start talking about where can we find vulnerabilities inside this big big big ecosystem and today we'll try to take you through these challenges one by one and explain how to do it until we'll be able to actually do the thing that we should just the scenario that we just showed you so let's start with the first challenge how do we obtain the firmware for the printer yeah so meet our nice printer it's an HP printer an HP office jet printer we chose this model for first of all we told we chose HP because it has like I think 40% of the market share so it's not that we dislike HP we really like them but unfortunately for them they are just the biggest target out there and this specific model well we have a lot of reasons why we chose this printer but basically it's the cheapest one yes so we bought it we didn't have a lot of budget we bought it and we abused it for a lot of time and our goal was to break the print the break facts right but before we do that we had to break the printer and I mean literally break the printer so yeah that was the fun part of the project we broke it and inside the printer we find this thing the main PCB the brains behind the printer and it looks like this let's map the critical components of it so we have here flesh from a pension some model and then we have some more memory here this might look like not a lot because the PCB has two sides to it of course and on the on the other side of it we have the more interesting components like USB Wi-Fi electricity SRAM battery probably for the memory but who knows and now we have two very interesting components here one of them is the main CPU it's a Marvel CPU and it's proprietary manufactured for HP so we can't you know tell anything about there's no available specs nothing we can just find bits of information here and there and then we have the fax modem it's located here and it's a it's a CSP 1040 and what we need to understand now is how does these two components operate and what is the relationship between them if we do that we're one step further so that's what we try to do and as I said the challenge is to the first challenge at least is to get the firmware of this thing and when we're looking a bit closer into this PCB we find these very two very interesting interfaces one of them is a serial debug the other is JTAG so if you're familiar with them so you know that they give you like debugging capabilities or at least memory read memory write exactly what we need to get the firmware so we're smiling to ourselves saying huh that's gonna be really easy but unfortunately it's not because the JTAG of course is disabled completely we can't do anything with it and the serial port well we managed to connect to it and we get this terminal that for almost every instruction we type gives us this error I don't understand well we don't understand either but it looks like this terminal is not gonna get us very far so we drop this pet and try and look for other ways to get the firmware and obviously one of the most common ways is to try and get grab the firmware upgrade and we after looking a bit in the internet we find this jewel this FTP site by HP that contains every firmware version for every HP product ever produced in the history of HP and and the internet and a lot of other stuff and it actually took us like about I think two weeks to find our firmware within this mess of filmers but once we did we had the we had the firmware upgrade file yes thank you it's still alive so you can go there and look for some that's a lot of interesting stuff in there and now we got ourselves a file and this file is a firmware upgrade file it's not an executable file it's just a binary and now we kind of need to understand how do you even upgrade the printer firmware I mean I never did it before anybody did it anybody upgraded this firmware lately good good for you good for you anyway the answer to this question is surprisingly funny I would say yeah you just print it yeah that's because you see a printer receives a firmware upgrade just the same way as it receives a normal print job that's that thing it's actually pretty nice and it's defined in a HP protocol it's called like PClxl feature reference protocol class 2.1 supplement that if you are still sane after reading this like 300 pages of insanity you understand that this thing defines something called a PJL a print job language if you ever scan the printer through the network you see this port I think 9100 something like that open that's the port that you send print jobs to and there's the same port that you send the firmware upgrade to and that's that's nice so when we look at the file it actually confirms this because it actually begins with the words PJL print job language so that's nice so now we know it's a print job language but unfortunately this document doesn't document anything about the firmware upgrade protocol or anything because kind of HP proprietary so unfortunately we had to like do it ourselves and analyze this thing now I'm not I'm not gonna take you through the entire process of unwrapping this firmware because frankly it's quite boring but I'll just tell you that it's composed of several layers of compression one of them is called NAL decoder the other is called TIFF decoder and another one called the RO decoder and the thing is that these things do something like you know if the previous line was all blanks then if this line is also all blanks just write one instead of the line so that gives you some kind of compression and it makes really a lot of sense when you're talking about print jobs because you know print paper has a lot of spaces in it but when you're talking about binary file it makes absolutely no sense to to do it this way but still you know it's just works this way so we after we understand this that we were able to decode everything decompress everything and we are talking to ourselves and laughing that you know when your hammer everything looks like a nail and when your printer everything looks like a print job so yeah that was nice and after we did that we have a big file that hopefully now it's our firmware so how do we analyze it so looking at this thing right in the beginning of the file there's something that really looks like a table and it's not doesn't really only look like a table it is a table we define it it looks like this and what this table defines is like a loading address section name and location in binary so what that means that our big file is actually split into several sections and this table just defines those sections so now we are able to split this big file into several smaller chunks and inspect each chunk and the most important chunk the most the one that looks most promising looks like it contains our firmware so we took a closer look into that and that's what we saw I mean it actually looks like our firmware that's because you see that's like one of the strings that we've seen it yeah we saw we also that before right it's error I don't understand but it's not completely error I don't understand right there's some missing bytes in here and we actually those missing bytes are pretty consistent throughout the entire chunk so although we know that we are looking at the code we can't actually see the code until we have those missing bytes filled we need to understand why aren't they there and what were they replaced with so let's try to analyze this thing together quickly now but first let's start to understand what is this thing we had a lot of things in mind everyone looked seem crazy but I think the least craziest option was that this is yet another form of compression a really bad one again because when we try to compress this thing with Zilip for example we get like 80% better compression than it currently is so and we know that the printer has illy because we see Zilip strings in there so why not use illy I don't know but still we are left with the challenge so this is one snippet of the code that you just saw and let's try to decompress this so first of all you need to understand this thing is composed of two types of characters one are ASCII characters stuff that you can read and some other are stuff that you can't read none ASCII characters and those none ASCII characters are actually those missing bytes that we have so we need to understand what they are so let's take a closer look at them and if you start this thing long enough you will start seeing some kind of pattern and I'll save you the trouble and just show you that it could it's composed of like these one single bytes and then those double bytes in there and if the distance between the single bytes looks suspiciously patternish like 8 bytes 9 bytes 9 bytes 8 bytes over and over again so what does this mean where is the pattern here if you look at this from a different angle maybe the pattern will look a bit clear you see the f7 and f7 they look the same the ff and ff they look the same something here looks really patternish and in order to understand this pattern you need to sharpen your binary view a bit and if you understand that ff is just one eight one bits and if you do this consistently for all of these chunks then you will start seeing the pattern you see the pattern is that the zero bit always falls within this two byte whole and what this means it's consistent throughout the file what this means is that the first byte is just a bitmap describing the following eight bytes after it that what it means and that's perfect because now we understand what is this single bytes but we still don't understand what are those double bytes and they were replaced with something but with what so if you know anything about compression you know there does not a lot of options here really it could be either a forward or backward pointer it could be a dictionary of some sort or it could be a sliding window now we can pretty easily confirm that it's not a forward backward pointer just because we try to follow the references in the file we see nothing that we that should be there same goes for dictionary we can't find anything that's consistent enough to be a dictionary so it leaves us with only with the option of sliding window and once we're equipped with this information we go to our favorite place to Google and try to find some similar implementations to this and luckily for us in some very dark corner of the internet we find this wiki page it defines something called a soft disk library format and I wouldn't I won't ask if anybody knows who what soft thing is soft disk is because probably somebody knows here it's ccc after all but inside this thing it defines some kind of compression algorithm that looks very similar to our two hours it looks actually really really like ours actually it's exactly our compression algorithm so so yeah that's nice and I think that the funny thing here is that this compression algorithm was used in the past somewhere and only there can you guess where yeah somebody who didn't see this presentation before yeah it was used in commander king and soft disk is the company who produced commander king so the compression algorithm from commander king made its way somehow into the HP the entire HP a line of products how I don't know you can check if there was anybody who was fired from soft disk and hired in HP probably that would be my guess but we'll never know so now we understand exactly what is this thing and how does this compression work we have the missing data that we need and these data means that those two bytes are actually composed of window location and data length and that's all we need and let me show you like really quickly how this compression works so we have an input text output text and sliding window we want to compress this string over here and let's try and do it so first byte is the bitmap I remind you so we leave it empty for now and then second byte we start with a so we place it both in the output text and in the sliding window and then we go to be same thing see same thing D again and now we get to a but a is already present in the sliding window so we don't need to write it in the output text you know we we can just write just do nothing and then go to be same thing is just the following character in the sliding window and then when we get to E we just write 0 0 0 2 that means go to the sliding window at position 0 and take the first 2 bytes that's what it means and then we continue to E F G after we did that we put our bitmap here and now we know the bitmap bitmap value and that's all there is to it that's the compression algorithm it's pretty easy looking at it this way right looking at it at reverse is a bit more difficult but yes now we can do that and now we completely open everything and yes we have our firmware we can read everything it's actual code and now we need to understand what does this code mean and basically first of all we need to understand what architecture is this what is the operating system and so on and so on so it took us quite some time to do that but let me give you a brief explanation first of all the operating system is called tradex it's a real-time operating system the CPU the processor is arm 9 big in the end and then it has like several components to it like stuff that's related to system some common libraries and tasks tasks are the common the equivalent of processes in normal operating systems so in the system stuff we have like bootloaders and some networking functionality and some other stuff common libraries we have a lot of common libraries and tasks once we are able to isolate them we can understand exactly the tasks and once we do that we now know that we all we need to do is like to focus on these tasks because they are the tasks relevant to fax protocols we can leave everything else aside it will make our work much more easy and we don't we want to start doing that but just a second before we do that look in at this we see something that looks not really I don't know it doesn't make sense a lot and this thing is spider monkey the printer every HP printer contains a spider monkey library I don't know if you know what spider monkey is but basically it's the JavaScript implementation by Mozilla it's used in Firefox for example and we were thinking to ourselves why does a printer need to render JavaScript it makes no sense I mean yeah it has a web server but it's not a web client we couldn't think of any situation in which a printer needs to render JavaScript it looked really strange to us so we decided to like try and see where is this printer exactly using JavaScript so we went back a bit and checked and we found that JavaScript is used in a feature called pack proxy auto-configuration it's apparently something no it's it's pretty common it's a common thing it's a good protocol and it like defines a proxy when you're doing a DHCP or something like that and the thing is that the top player functionality of this entire pack functionality was written by HP and when we were looking at that we see all this functionality and we see this strange thing here the printer once he does this pack functionality it tries to connect to this domain fake URL 1234.com just connect to it and do nothing with it some sort of sanity test I guess I don't really know why but the interesting thing here is that do you know who owns the domain fake URL 1234.com no it's not HP checkpoint is kind of yeah yeah I own it yeah it just wasn't registered so we registered that for five dollars and now every HP printer is connecting to my domain so if if anybody wants to buy the domain I have a very good price for you more than five dollars and now I'll hand it over to Ayal to continue okay thank you Aneev after we finished messing around with spider monkey it's time to focus back on fax or t30 t30 and it's full name it's itu t recommendation t30 he's a son of the defines the fax protocol actually it's a very very long PDF more than 300 pages but defines all of the faces and messages we need in order to send and receive a fax document it was force design very long ago in 1985 and was last updated more than a decade ago some from our perspective that's a very good idea because we want to find vulnerabilities in an old and complicated protocol we're most probably going to find some after we read through the standard we started to dynamically look at it you open it in Ida and look up on the t30 task and you can see that the state machine is quite huge as you can see here in Ida and actually that's a small state machine because most of the code blocks you can see over here contains additional state machines inside them meaning that this is going to be a very very huge and complicated state machine to reverse and if that wasn't enough it turns out that HP really likes to use a function pointers and global variables in their code meaning that statically reverse engineering this huge task is going to be very complicated although I personally prefer to statically reverse engineer this time we had to choose a different tactic we'll need to dynamically reverse engineer this thing and for this we'll need to have a debugger and as you mentioned earlier nobody knows how can we debug a printer we already tried the built-in JTAG and serial port and that failed we then searched for built-in gdb stub we could use but I couldn't find any such stub at this point it's very important to remember that even if we could control the execution flow no one can put a debugger without controlling the execution flow and we can't do anything that's a black box I can send papers and that's it and even if I could control execution flow and load my debugger the printer uses a hardware watchdog and this is an external hardware mechanism that monitors the main CPU and whenever many CPU enters an endless loop or halts the watchdog reboots the entire firmware and enter printer and this means that since essentially a breakpoint halts the program whenever we'll hit a breakpoint the watchdog will kill us so we'll need to find a way around this thing and the easiest way we could find out is to spit this enormous task into chunks if you could find any code execution vulnerability we could try to execute code over the printer and load our own debugger and at this stage we had luck and we believe that luck is an important part in every research project Henry on the 9th of the 19th of July Sanrio published a vulnerability called David Xavi David Xavi is a remote code execution in g-soap and many embedded devices and our printer included tend to implement a web server for management and configuration and in our case this web server uses g-soap and it even uses a vulnerable version of g-soap so we now have our vulnerability and we'll need to exploit it for those of you who are not familiar with devil's ivy here is the code and here's the vulnerability itself devil's ivy is an signed integer underflow vulnerability meaning that we'll need to send enough data for the variable to go from negative back to positive and that means we need to send roughly two gigabytes of data to the printer so HP really pride itself on the printing speed of the printers but not on the network speed after many optimization rounds we managed to reduce the exploit time to roughly seven minutes and so you start the exploit you wait and after seven minutes you have your exploit and here our stock of good luck ended because we had the side effect in our exploit and after two to ten minutes the printer will crash and this means we'll need to wait an additional seven minutes we'll have two minutes to debug it and then it will crash again so we're waiting a lot we waited a lot of seven minutes in our research if we recall we wanted a debugger so we could dynamically reverse engineer the firmware we wanted to read memory and write memory and now we have a debugging vulnerability so we could load a debugger we need to execute this debugger so we'll need execute permissions and to load it and the most important thing is that we need to execute our debugger without crashing the firmware because we want a debugger to run and a firmware to debug and we want them to blend inside the virtual address space of the printer leaving happily together we couldn't find any debugger but achieved these goals so I did what my brother usually tells me not to do we actually wrote our own debugger so this is cat scout is an instruction-based debugger it supports Intel CPUs and arm CPUs because we have an arm printer as a prototype we had a Linux kernel driver and this time we're going to use it in it's an embedded mode in embedded mode we compile it to be fully positioned in the pen it because we essentially throw it sour inside the firmware and we expect it to execute we're pre-equipped with useful address spaces like mem copy socket bind listen we find using Ida and whenever it tries to call these functions it goes to its own gut finds the address and jumps to it so after we compile it we use it in our exploit we jumped in we jump into this blob and it starts up a TCP server we can now connect to to send instructions to read memory to write memory and whatever we want you can find scouting a guitar with the examples for the Linux kernel driver and embedded mode and we're actually using it for some CDS now so it's highly recommended now that we read this point in our talk we haven't yet described to you how a fax actually works so we we've we've scouted with dynamically reverse engineered the firmware and now we can actually describe to you how a fax actually works in order to send effects we need a sending machine we need to send it to some modem the packets from the modem will be processed in the CPU and afterwards the data is going to be processed and probably printed let's see how it starts we start with network introduction trobing and ranging echo analyzer echo can sling more training and you actually need to be quite familiar with these steps because they sound like this with these beeps we actually created an HDLC tunnel through this tunnel we're going to send our t30 messages to the CPU in t30 you have face a which we send the caller idea which is this ring in face be you negotiate the capabilities so I send my capabilities and receive the printers capabilities face easy important step because here we actually send our fax data line after line page after page and face the we finish I send an act I receive an act and that's it let us now see how a normal black and white fax document is going to be sent for the protocol so we have our document is going to be sent over the HDLC tunnel using t30 messages over face see and the received document is actually the body of a t file compressed in g3 or g4 compressions from our perspective that's partial good news because there are many vulnerabilities when parsing tiff headers and we only control the data of the file the headers themselves are going to be constructed by the printer itself using messages from face a and face be so we partially control a tiff file and after it's done and ready the file is going to be printed like every good protocol and here's comes very interesting t30 supports many extensions can you guess what interesting extensions there are in a protocol so there was a security extension but no one uses it so the other extension is color extension actually you can send colorful faxes and the British use it in hospitals for some reason let us see how a fax document have a colorful fax works we send a document for the HDLC tunnel over face see and the received document is actually a jpeg file this time you control the header and the date of the file and we can do whatever we want with it and send it for printing now that we know how a fax actually works where should we look for vulnerabilities in it well we have complicated state machines we stand strings there are several file layers but the most convenient layer is the applicative one and most importantly jpeg because we control the entire file we can if we look on a jpeg file it mainly consists of markers we have a start of market application market we've length and data more markers with length and data and so on and so on if we zoom in on one such marker we can see that in this market we have a compression table a forward for compression matrix for the exact document we send and we have a header length field for reformatrix and the data itself if you zoom in a bit deeper we can see that here we get a matrix we sum up all of the values this matrix should be rather sparse with zeros ones and twos the accumulated value is going to be a length field in this case six bytes and six bytes are going to be copied from the data to a local small stock buffer like this so if you can see the vulnerability at this point we were like what a fax because that doesn't make sense we control the entire header if we put huge values in our matrix like so we'll have a four kilobyte length field copied into a stack buffer two hundred fifty six bytes effectively having a stack based buffer overflow in our printer it's a trivial stack buffer overflow we have no byte constraints we can use whatever we want null bytes none of ski bites whatever we want and four kilobyte of user control data that's more than enough to exploit on this point we had to bypass several operating system and security mitigations now and not exactly it's it's an RTOS fixed other spaces no canaries it's the 80s it's really simple we've got the CVS from HP 9.8 and critical you should really patch your printers now and you can see the response we received from HP after we worked with them to patch these vulnerabilities which is a good time for our demo unfortunately we couldn't bring it like that also we just filled something for you so this is our backup machine we need to do this for this script it's connected to a model that we will be like $10 from Amazon we're sending our malicious stack to this printer and yeah having call from who? Wait just a second faxes are slow yeah they are so from even a taker of course we you can forge this easily and now the printer is receiving the fax and processing it and now it's obviously a color colorful fax and now we have full control over the printer so it's ours but that's not enough because we want to show that we can propagate to another computer so our fax our malicious fax contained eternal blue in it so once any computer is connected to the network the fax now will recognize it and we try to exploit it and here you go yeah yeah yeah so so we made it after all it was a long way some conclusions we have to tell you first PSTN seems to still be a valid the tech service in 2018 fax can be used as a gateway to internal networks and all the outdated protocols probably not so good for you so try not to use them if you can what can you do to defend yourself against this catastrophe a lot of things first of all you can pet your printers as they all said this link will you know just tell you if your printer is vulnerable by the way every HP inkjet or official printer is vulnerable to this thing it's the biggest line of printers from HP over I think 200 300 300 models are vulnerable to this thing so really go and update another another thing I can tell you is if you don't need fax don't use it and also if you do need to use fax after all try and make sure your printers are kind of segregated from the rest of the network so you know even if somebody takes over the printers it will just be confined to the printers and won't be able to take over your entire network so guys these are really good suggestions all of them but really the best suggestion I have to give you today is please stop using fax thank you thank you and just just one second before we finish this was a long way a long journey and pretty journey we had some very good friends that helped us a lot along the way physically mentally technically so we must mention them these are the guys here some of them are in the crowd so they deserve some some claps and one special guy that helps us is Yanai Levne and he also deserve this and that's it basically guys so if you want to follow more of our work you can find us here follow us thank you very much we have five minutes for Q&A so please line up at the microphones if you want to believe now please do it to your right side so this side from the stage is the left side but for you it's the right side so please line up at the microphones I think I can see microphone for already so we start with microphone for please thank you for this talk it's scary to see that these things work today you talked about email to fax or fax to email services now it's is it possible that there are other entities in those as well I know for its box ruders allow fax to email could you attack those possibly so basically those services use t30 as well we didn't look at them frankly we had so much work to do with the printer that we didn't look at any other printers or any other services but I can't say for sure but if you're looking for vulnerabilities I would recommend to go look there as well great microphone number five please what can you disclose about the data that's sitting your URL what can you disclose about the machines that are knocking on your URL to fake you or one two three four there are a lot of HP printers out there that's all I can disclose so we have one question from the signal angel please did you try to activate JTAG of media printing a modified firmware we tried to use the JTAG we think it's disabled from the factory lines it was too much work so we decided to use devil's IV it's a good vulnerability once we have devil's IV and we can use scouts scout is more than enough for debugging essentially after we used the JPEG of vulnerability and we loaded up scout scout survived for weeks on the printer without any crash so that's more than enough great we go with microphone number two please yes so thank you for the nice talk and I think you're completely right you can have many problems with legacy protocols the only thing I do not really get was the part how you then can automatically successfully attack your laptop on the network my point would be my laptop is as secured as I am going to the internet cafe or something else so you would not be able with your HP printer to start the calculator on my linux or even not on my windows well your print your laptop might be secure I'm sure it is but many others are not we try to show this using the eternal blue exploit as you know wanna cry stuff like that you know this thing created a lot of and the war patches out there and still it was so we're not here to attack anyone we're just saying that theoretically if somebody wants to get into the network and he has a vulnerability that you're maybe not patched or secured facts would be a bad idea but it was not it was nothing which was part of the print sorry unfortunately we don't have more time for Q&A so thank you again very much thank you it's really nice


NATO is a political and military organization which has evolved over time since the Alliance's establishment in 1949. Some of the Alliance's military structure was set in place in 1949, such as the military committee, with other elements created later, such as the nuclear planning group in 1966. The military committee sits at the top of NATO's military structure. The military committee is NATO's senior military authority and primary source of military advice to NATO's civilian decision-making bodies, notably the North Atlantic Council. Based at NATO headquarters in Brussels, the military committee provides a link between political decision-making and the military structures of NATO. The military committee is supported by the international military staff, which comprises both civilian and military personnel. Its role is to provide strategic military advice and staff support to the military committee. It is organized into several divisions, including the Plans and Policy Division, the Operations Division, the NATO Situation Center, amongst others. NATO has two top military commanders. The Supreme Allied Commander Europe, or SOCURE, is an American general selected by the US President and approved by the North Atlantic Council. The Supreme Allied Commander Transformation is nominated by Member States and selected by the North Atlantic Council. The Supreme Allied Commander Europe has overall command of operations at the strategic level and is based at Supreme Headquarters, Allied Powers Europe, and Mons, Belgium. The Supreme Allied Commander Europe commands Allied Command Operations, which plans and executes Alliance military operations. Its overall aim is to contribute to Allied defense and security by maintaining the integrity of Alliance territory, safeguarding freedom of the seas and economic lifelines, and to preserve or restore the security of its members. Allied Command Operations comprises a small number of permanently established headquarters operating at the strategic, operational, and tactical levels. They are augmented by national forces assigned to NATO for specific standing and, or, crisis-oriented roles and tasks. When the North Atlantic Council agrees to launch an operation, member countries contribute military forces voluntarily, which then return home once their mission is complete. Supreme Allied Commander Transformation commands Allied Command Transformation based in Norfolk, Virginia, in the US. Allied Command Transformation focuses on ensuring NATO's military structure and capabilities remain relevant, capable and credible in a rapidly changing world. It evaluates trends and future threats, capability development, education, exercises, and the implementation of lessons learned. Throughout NATO's history, the command structure has adapted, and when our leaders last met in 2018, they took further decisions to adapt our command structure, creating a new cyber operation center, a military mobility command, and an North Atlantic command. So today we have 10,000 multinational military officers planning operations, conducting operations, and preparing forces for the future. Allied Command Transformation also contributes to allowing the NATO command structure to efficiently command, control, and support current and future operations. Beyond Allied Command Operations and Allied Command Transformation, there are various specific military components of NATO. The Joint Force Air Component, or JFAC, is a specialized quick-response unit equipped for crisis-response operations. JFAC can be supplemented from all Air Command entities, or augmented from other NATO Air Forces, or National Joint Force Air Components, as required for NATO missions. In 2016, as part of its Enhanced Forward Presence, NATO agreed to deploy four multinational battalion battle groups—Twistonia, Latvia, Lithuania, and Poland. Simultaneously, NATO developed a tailored forward presence in the southeastern part of the Alliance territory. As part of NATO's adaptation to security challenges from the east and the south, in 2016, the Alliance established eight force integration units in Bulgaria, Estonia, Hungary, Latvia, Lithuania, Poland, Romania, and Slovakia. These small headquarters facilitate the rapid deployment of forces to the eastern part of the Alliance, support collective defense planning, and assist in coordinating training and exercises. The NATO Response Force was established in 2002 as a high readiness force capable of rapid deployment. It is designed to perform a wide variety of tasks, including immediate collective defense response, crisis management, peace support operations, disaster relief, and the protection of critical infrastructure. At the 2014 Wales Summit, the Alliance decided to enhance the NATO Response Force by restructuring it into seven components, numbering 40,000 troops in total. The newest and most significant component is the very high readiness Joint Task Force, which consists of about 20,000 troops and includes land, air, maritime, and special operations components. Leading elements of the very high readiness Joint Task Force are ready to move within two to three days. NATO's standing naval forces provide the Alliance with a continuous naval presence. These forces can be deployed rapidly in times of crisis or tension. The standing naval forces consist of four groups. They are multinational integrated maritime forces made up of vessels from various allied countries. These vessels are permanently available to NATO to perform different tasks ranging from exercises to operational missions. NATO currently owns 15 Boeing E3 Sentry, commonly known as AWACS, Airborne Early Warning and Control aircraft. These provide all-weather surveillance, command, control, and communications. A group of NATO allies are requiring five Global Hawk, remotely piloted aircraft, and the associated ground command and control stations that make up the Alliance Ground Surveillance System.


Everybody forced here hoping 2022 top scrim f1 sapphire 5 box number 27 random teams The results can be found anytime late in sports cards. I will go ahead and get started I had to carry Jake to a win today and The three of the three of us played and got smoked And finally the AC guy all day today. Oh, oh, yeah, I wasn't well I only played for like 30 minutes earlier 30 to 45 minutes. That sounds terrible fight with AC guy Danny Rick followed by gold droog of itch for MP on the future stars to 50 Joe Guanyu Lewis Hamilton Like now you fix it for free because you mess it up Mike crack George Russell Horner and Joe Guanyu. I get the law involved Mike crack Max for stopping purple. Oh, he called. Well compost Two of ten on the purple for compost Oh He called well. I need the super Compost is f2 for Daniel L Mike crack. Yeah, Cal Williams Not even a prank name. It's just his name. Yeah, so awesome Carlos signs a Bosch on sepia to 100 combos again drug of itch Carlos signs Did you uh, did you pull a do you know who I am? Did you say that to him sin? God George Russell Aquamarino Sato numbered to 199 Gonna virtually do you know who I am? Magnus Magnus in in Hamilton I do that all the time. They're like, no, I really don't know you are and then I try to explain it for a long time And they still don't know and then it's just the saddest scene of all time Landau Liam Lawson Joe Guanyu Verstappen and so for the Paldi We've got an aqua Marcus Armstrong for high-tech to 99 Boutary Botas and Max Verstappen Hamilton Pierre Gasly Verstappen and Cytal come on. We need some variations Yes, it is kind of like superhero Keep his identity God Cordial Verstappen hugger and Vettel Landau Norris sepia Lewis Hamilton Mercedes I Like the image on that one 56 out of 100 Magnuson and Sergio Perez for share Fernando Alonso Alpine on the aqua Or sorry the chartreuse to 199 Boutas and Hamilton. Oh gross Invicta Makes Schumacher Lewis Hamilton Max Verstappen Omar soft now or Lewis Hamilton aqua. That's right. Both us on the That's a Mercedes Boutas Mercedes You know eight of 99. I think that might be one of his only non Alfa Romeo, right? Dom's Williams and Then a Leclerc Boutas. I know I don't want to I don't want to see it said I don't want to see it I'll take your word for it. That's the bono cone chartreuse to 199 Marcus Armstrong Carlos Sainz and Daravalla Nope. I'm no nope. Nope. Not looking at it Carlos Sainz Jack-2-1 Daniel Ricardo Read chat read chat Read some big things that scroll if you have to I don't want to say it out loud. It was gross Dude, that's what Sean looks like when I ask him to do two plus two Sweat can be sweating Got a It was a Marcus Armstrong chartreuse to 199 go into high-tech I'll leave him lost in Land of Norse. That's what happens when I when I was 16. I missed the phone call for my mom Marcus Armstrong Pierre Gasly Schumacher and Verstappen Landau chartreuse Gunther Steiner for a host to 199 So gross Joe and Boutas Perez Gasly Albon Verstappen. Come on variations. Where are you at? There's a gold coming up after the Landau and it is a mix Schumacher for hosts the 50 Okon and Caldwell toast Russell Lewis Hamilton and Vassour Lewis Hamilton chartreuse standard Ricardo that is a variation going to McLaren Number to 199. Yep variation Ricardo Alonzo and stroll George Russell and Alexander Albon on the sepia number to 100 Williams Sonoda and Ricardo Let's see let's see spot 17 to go on top strome sapphire 15 on bowman chrome 20 to go on cosmic leaf pearls at five and eight 17 and 19 on optic choice Sebastian Vettel green is a constructors world champion Mercedes out of 75 Callan Williams Latifi Kevin Magnusson sepia pos pos have a solid break. That's the 100 Drugavits future stars in Carlos signs res Sonoda chartreuse to 199 for Alphatari Magnusson and Hamilton Ricardo vesti Joe guanyu rookie and a Verstappen Max Verstappen Callan Williams, that's an Oscar Piaz tree variation. I believe that's pretty nice for Prima Aqua to 99. Yep variation Botas and Verstappen Hughes ghastly Verstappen saddle stroll chartreuse of a sewer to 199 alpha Romeo Betel Verstappen Verstappen Botas Verstappen Perez Albon one more box go ahead and get you guys link for tops chrome Sapphire 17 to go Top from Sapphire baseball. All right, last one. Thanks for joining everybody Carlos signs chartreuse Lewis Hamilton to 199 on the little bike there Joe guanyu and Botas Mercedes Botas Balthory Botas Alonzo Alonzo Albon and Verstappen Steiner green any Rick Aqua green it's green to 75. I thought there was alcohol for a second green to 75 Dana Ricardo McLaren Ocon and Caldwell a Mercedes world champion card another Lewis Lewis a sewer JQ's followed by a gold Jack do Han virtue OC to 50 Alonzo and stroll Sergio Perez CPI Max Verstappen Grand Prix winner Netherlands 2021 the Red Bolt 100 Sonoda and Ricardo Armstrong with a chartreuse Lewis Hamilton Grand Prix winner Brazil to 199 Lance stroll Cordil a tee fee Hamilton Daravalla and Betel. All right, we dust off. We'll do a quick recap here Yeah, the right ones do pretty well Damon Chartreuse to 199 We add Hamilton Hamilton Vassour Sonoda Alonzo Steiner Marcus Armstrong Marcus Armstrong same card there. Oh that was Daniel Ricardo variation. You had a sepia Verstappen Magnuson Albon Hamilton Bochum aqua variation Piaz three Aqua Botas, that's a variation. That's a variation to the the Botas didn't call that out of first but for Mercedes that is a variation of the Marcus Armstrong Daniel Ricardo on the green is 75 as well as a world champion Mercedes card Golda 50 of Duhan the Rogovitch Schumacher and purple to 10. I'll be called. Well Thanks again everybody moving on to soccer


I don't expect it to be a super exciting day for tomorrow, but we'll see how things work out, and, you know, we'll always find something. We'll find something. All right. Anyway, good luck today. Happy trading, and we'll see you tomorrow. Thanks, everybody.


Welcome back to the Breakfast on Plastic with Africa, now with the time we have left let's quickly move into talking sports and of course for everyone except Arsenal fans we've seen the most interesting transfer window in quite a while, from Manchester United to Chelsea to Manchester City, everyone has you know brought out money from their pockets and done what needed to be done, included PSG which also made it very very new to buy the season. So we're going to be talking about that now with Wally Scott, there's a lot of you know little details here and there and you know, good morning Wally Scott, now this is undoubtedly the craziest transfer season, I mean that's how analysts are on the world are describing it, well why so?  Now this guy goes on TikTok or something and burns his Ronaldo 7 shirts, when he was in Miami before thinking that he was going to go to Manchester City and Ronaldo eventually came to Miami United and an estimator said that that shirt would have been worth £200,000 if he had not burnt it, you know that's how crazy season has been and then you see Arsenal who have bought like six players now or five players, no names but we heard that but I am someone, I have been doing this for a while, a sports analysis and all that, I have been a reporter, I have gone abroad and this is the craziest, whoever thought Messi would leave Barcelona, whoever thought he would go to Pakistan, we thought he would go and play his trade with Manchester City with his former coach Pep Guardiola, whoever thought Ronaldo would go back to Manu after many years that he left. Are these money-motivated transfers or they are, you know, passion? I have no idea but I think post COVID, most of these clubs have become more money-oriented because we heard that Lionel Messi's jersey in Paris Saint-Germain sold out in 30 minutes. Who does that kind of business? They have made their money that they used to buy Messi from the chess sales in 30 minutes. My Ronaldo shirts have gotten so sold out now that some most of the shops in London have locked up because they don't have stocks anymore and the only thing they are coming to ask for is Ronaldo's number 7 shirt. Ironically, when they will show what number Ronaldo will wear. It's been confirmed he's wearing number 7 shirt by the way. Before that, they were just Ronaldo, no number on it. They were asking for it. Now that 7 has been put on it now, we have a different stock of people coming to look for it. Look at the kind of business these guys are doing. So let's talk about all the transfer rules. What are we hearing? Well, the window has closed already. We see us now buying players that are not just there. They've got this Japanese guy, Taki Ushu, he's a fantastic player but he's not in name. And like Osaregio said, these guys are doing right now his business. You're getting good legs, you're getting good players for the season but most importantly, what I've noticed is the English players are buying massively. Western United, for example, I am the Europa League for the first time in 60, 70 years. They were the ones that bought the most players, two seasons ago, they bought nine players, almost a whole team. But because the players they bought were not stars, we didn't notice them. But now they're in the Europa League, it's been a gradual crime. They've got a coach like David Moyers who has done very well with the club. Now they're buying more players too, they've got Daniel James from Manchester United. So I think it's a gradual process. Are there any fears of anybody flopping with their transfers? Lukaku already has started on a good note. Ronaldo hasn't played yet but I mean he had two goals against Ireland two days ago. Are there any fears that some of these transfers may be very, very much hyped but they may not deliver as much as is expected from Leonardo Messi, Romero, Lukaku, Cristiano Ronaldo, which of course is the biggest for now. I don't see, first of all, Messi doing his mercurial as he has been in Barcelona, in Pakistan. Lukaku, the defenders in England who finally get to catch him. When he was in Manchester United, when he first came in, he did very well. And then after a while, the defenders knew what to do right. He wasn't scoring anymore. With time, the defenders would know what to do right and he wouldn't score anymore. Jadon Sancho might be a flop for me, that is. But Ronaldo is good, he's the man that anybody wants to beat and the man you will do very well. But generally, which flop do I think would be the most major flop of the season for me would be Chelsea.  I don't know who will in the interim league, but they won't win the league. It's not going to happen. That's the major flop that I think. Chelsea would not necessarily be a flop if they don't win it, they haven't won it since Morino, half day. They have a fantastic team right now. They've got a bond, they are together, they just won the Champions League and they are defending Chelsea. They are still a team to be worried about, to be scared of. They won the Champions League last year. But everybody, the bookmakers are saying that there's a large possibility this should be Chelsea's year and not Manchester's year. I don't think so. All right, anyway, we need to leave. I don't think so. Well, Escobar, thank you very much. Thank you. Of course, we have games this weekend. Thank you. International break. But we have a match tonight. The Super Eagles will be playing Liberia in the World Cup qualifiers tonight at the Test in Balogham Stadium. We've got a full squad and Mardukaw Koye, the goalkeeper, has said that he's optimistic and is going to keep a clean sheet against Liberians. But the record favour us against Liberians. We've played 14 times with 1-9. They've only beaten us once. The rest are draws. So I think it will be a good match tonight. So if you are around, well, the tickets are not being sold. It actually comes from invitation. But you can actually watch the game live on television on some few selected media houses. Only 38 journalists have been accredited to cover it. Only two terrestrial television stations have been accredited to actually show the match. It will be live. It starts at 5pm, Test in Balogham Stadium, Nigeria against Liberia, the World Cup qualifiers. All the best to the Super Eagles. All right, we'll need to go. Thanks a lot for being with us all through the week. And of course, if you missed out on any of the conversations we've had this week, every single bit of it is on our YouTube channel, which is at Plus TV Africa. But also catch up on our Facebook and Instagram, also at Plus TV Africa. Yes, thank you once again for being a part of our week, the first week in the month of September. I am Annetta Felix. And I am Musaogi of Balang. See you at 9.


Community Matters here at four o'clock on a given Tuesday. Okay, we are honored today to have Provost Matthew Liao Tross from Hawaii Pacific University with us. We have a long and affectionate relationship with HPU. We are so glad to have you here with us. Thank you for having me. I appreciate it. Thank you very much for coming down. And my co-host Carol Mon-Lee, who is an academician in her own right, is here to make sure we cover the ground. Welcome, co-host Carol Mon-Lee. Thank you. So nice to be here. Okay. So, news. The first thing is always news. Yes. You have, as of what, July 1st? A new president. A new president. Tell John Katanda. Tell us about him. So, John Katanda is a Roosevelt High School graduate. He's returning to Hawaii after almost 30 years off island. He is a graduate of another school on island, I will not mention. But went off to Washington, D.C. as an attorney, was very successful in that. Moved into academia, was a college professor, and ended up being the dean of the law school at Villanova University. Wow. So, we're really happy to bring him back home to Hawaii. Does that kind of bio sound familiar to you, Carol Mon-Lee? Let's see. It goes from practicing law, being a lawyer, to being an academician, going into law school, and all that. I mean, going into a law school. Sounds like you. Yeah, but he's gone on to bigger and better things, and we look forward to having him downtown with us. Yeah, he's very happy to be back. He and his family are very happy to be back to our island. And it was a seamless transition from Jeffrey Bannister, who was there one day meeting with you in the following day. Yes. My last meeting on Thursday, the 30th of June, was with Jeff Bannister. My first meeting on Friday morning was with John Katanda. Now, you are the provost and vice president for academic affairs at HPU. How does this affect your job, if at all? It affects everything. And in a lot of ways, part of my job is to make sure that things keep on moving along. I have two real different roles. Provost is an old, archaic word for the person who used to lock up the faculty and students in the monasteries. It's a great title. There's even provost jails out there that I've seen. So provost, I'm overseeing kind of the whole student experience from students coming into the university, in class, in their co-curricular activities and housing, continuing on through career services, placement internships, and then getting jobs and handing them off to alumni. Academic affairs specifically is working with the faculty, developing the curriculum, supervising the degrees we offer the academic integrity and research integrity of the institution. So they're very complementary roles. So as a new president comes in, they're going to, of course, change kind of the leadership. You know, they're going to affect the leadership vision of the institution. They're going to really kind of rally us all into, you know, where we're going to go next. And a lot of what I do is put that into practice. So, you know, these are the degrees we're going to offer. These are what we're going to do to make sure our students are successful. Sounds like a chief operating officer, doesn't it? In some ways, although I don't really deal with facilities other than making sure that we have, you know, desing classrooms. Do you see any changes in academic affairs as a result of the change in leadership? I don't think we're going to have a change in academic affairs. I think we're still going to have a very strong focus on academic integrity, integrity, the quality of the academic experience, making sure that students have a valuable transformative experience at Hawaii Pacific University. I think, you know, anyone coming into the role of president is going to bring a slightly different perspective based on their experience. And so Jeff Bannister was at Boston University and president at Butler University before he came to HPU. So he was bringing a president's experience from a regional university similar to our own in Indianapolis urban school where he had really focused on that. John Gatanda is local returning and so he really sees, having gone to the mainland and seeing some successful universities coming back and integrating that into what it means to be the urban university of Honolulu. So, you know, complementary roles in what they're doing. So, you know, other things are happening. I'd like to cover them with you. For example, you sold, it was in the newspapers, the Hawaii lower campus in Kailua. And you're kind of consolidating, but also expanding here downtown. And we know that you're in a pioneer plaza because our studio used to be where the business school is now. Yes. Now the business school is there. It's really nice space. So can you tell us, you know, the process of this consolidation, what exactly is happening, and especially with regard to Aloha Tower? Sure. The university adopted a new master plan for the institution in 2014. And part of that master plan was to consolidate the academic programs downtown. Right now, one of the big challenges for the students is they have a class at 8 o'clock downtown. They have a class at 10 o'clock at Hawaii Lower. You have to jump on the shuttle, go back and forth.  Downing hall's over there, but then you have an afternoon class. So it's really messy from a student experience perspective. So in 2014, as part of our master plan, we decided we would consolidate all academic programs downtown. Since 2014, we were really focused on opening up Aloha Tower Marketplace, getting the student residences in there. And so we opened up last fall in 2015 with the student residences. We have had classes there for the past year in the multi-purpose rooms. We have a learning commons there. So we have an anchor downtown. Now it's time to focus back on bringing the rest of the academic programs downtown. Hawaii Lower College was a beneficiary from the Castle Foundation, just as Castle Medical was. So it was a natural relationship to really look at how we could best serve the windward community. We already have a relationship with Castle Medical. Our nursing students do clinical there and such. And you're going to offer a PhD in nursing, comes to mind. A doctor of nursing practice. I'm sorry. I'll get a couple of my accreditors. It will not be a PhD. It will be a doctor of nursing practice. But yeah, as the nursing has continued to professionalize and starting in 2020, the terminal degree in nursing will be the doctorate in nursing practice. And so we want to make sure we can offer that for our partners. That's great. We need nurses here. Yes. But the instruction will all be downtown by then. Yes. Well, you know, a lot of clinical work is done either at the hospitals and also for that particular degree, we'll have a lot of online components. And so we offer several of our degrees. We actually offer 17 degrees fully online. And so several of the classes for the doctor of nursing practice will be online as well. Designed for a low residency student so they can be a working, practicing nurse and complete their doctorate. And they would actually participate with local hospitals for this degree. Depending on their need for clinical hours and such, they might be working at a local hospital, for example, and need to move from a master of science in nursing to a doctor of nursing practice. You're going to be a center in that. So, you know, I remember you were heavily involved in the progress building. Is the progress building part of this, you know, campus going forward? Yes. So the model progress building is part of our footprint on Fort Street Mall. We actually have our, most of our College of Liberal Arts is located in the model progress building. We actually opened up three science labs actually over the summer, late spring and early summer we've developed and those will be opening up this fall. So we're bringing some of the sciences downtown already. And so, you know, we really want to look at, you know, plan and implement the plan to make sense for our downtown footprint so the students have kind of a contiguous university experience in downtown. Yes. Well, you know, it reminds me of GBA. I went to NYU Law School and I knew GBA pretty well. That's the Graduate Business Administration School. And they were a Wall Street school. They were right in the middle of Wall Street and, you know, their students came from Wall Street and went to Wall Street and spent their lunchtime rubbing shoulders with Wall Street. It was a Wall Street campus and a Wall Street school and that's what it sounds like you're doing. You're going to be a, you are now a downtown university. Yes. And I think NYU is a great example of an urban university really having a positive impact in a downtown community, not just business, but also the sciences, also the liberal arts. I mean, where's the center of the performing arts in Hawaii? It's in Honolulu. It's right downtown. So, you know, being able to make those connections, being able to walk out of class in social work and go have an impact on the community is really going to be a huge plus. It's actually brilliant. You know, because you'll be right here and there's all kinds of synergy involved. Being in the business community, having this kind of focused downtown experience, there's jobs, there's student possibilities, there's all kinds of events going on and you can do events and you can rub shoulders with the business community. That's really important. So I think this is a great direction, actually. Great direction.  We have a lot of historical centers and locations in downtown Honolulu where we have guided tours for tourists and things. So there's a public history aspect. So you can really actually practice all of the liberal arts, both do them intellectually, but actually practice them and convey, you know, enrich people's lives through, you know, our studies in the liberal arts. A moment on history. John David Dan has appeared on our show many times and I want to tell you now, he's great. He's a beautiful teacher. I'm a minor in history and I really care about history and he's a great teacher and a great guest on our shows. You mentioned tours, Matthew, and I heard something about a Chinatown tour that you do. Is that something that you're... We've had one of our faculty members over time do tours of Chinatown and specific locations in Chinatown. So it's not, you know, it's not something we do all the time, but it ties into our classes and the student experience at HP. We want our students to really understand Hawaii and, you know, the impact that we have in the Pacific and so that's actually part of our new Gen Ed. It's something required, not necessarily taking a tour of Chinatown, but how all of this ties together, how what we do is unique and important here. And I know you also have another campus, right? The Oceanic Institute. Yes. Tell us about that. So the Oceanic Institute is really focused on aquaculture, how we actually, as society moves forward, how we can help feed the world with ocean products. Where is that information shared with our audience?  Actually, if you're coming around from that way, the first thing you'll see is Sea Life Park, which actually is a tenant of ours at that property. But we do a lot of very applied research there. So most of the white shrimp that people eat in restaurants comes from our brood stock, from research that came out of the Oceanic Institute. Around the world. Around the world. Those shrimp come from here, and they're grown in Thailand and other places in Southeast Asia. The market is the world. And they're the best in the world. They are the best in the world. Right here from Oceanic Institute. Other things we've done is we successfully bred yellow tang. So right now, if... Yellow tang. Yeah, the little ornamental fish that you have in fish tanks and such, the yellow fish, right now, if you want to have one of those fish, you buy it in a pet store, divers are going off the coast of the Big Island and taking them off the reefs. And so it's very hurtful of the reefs when you have over essentially farming of the yellow tang there. So we're the first place to actually breed yellow tang in captivity where there's a couple on display at the Waikiki Aquarium. And actually, I think last week, a school in Florida with our help actually bred royal tang, the blue tang, the dory tang, from finding Nemo and finding Dory following our procedure for breeding yellow tang. And so we're creating a way to, in a sustainable way, breed ornamental fish. Exciting. It's a big business ornamental fish, yeah. But fish in general is going to be a bigger and bigger business. I mean, we haven't realized our potential really in open ocean aquaculture. It sounds like Oceanic Institute can really participate in that going forward. There's an industry, you know, that will happen ultimately as we fish out the oceans. And you guys can be part of that, big part of that, I think, in Hawaii. Yeah, Oceanic Institute is doing a lot of really neat projects. One other one I do want to mention is something we're running on the Big Island. We're running essentially a feed mill using ocean products, so developing cattle feed. Because right now for the cattle on the Big Island and over on Kauai, we bring the feed over from, you know, the continental US. And so we're actually researching using ocean products to develop a cattle feed so that we can just pull it locally and feed the cattle. Save a lot of money and make an industry possible here. So where do you do it on the Big Island? It's in Hilo. It's actually a long-term project that the Oceanic Institute has been working on. That same feed can be useful for aquaculture, open ocean aquaculture as well. Sorry, Carol. No, it's just fascinating. And as far as the different locations that you have, do you have students who go out to these different areas, to Oceanic and to the Big Island? What are they studying? What is their field? Right, so we actually offer undergraduate degrees in marine biology. We also offer a master's degree in marine science and an undergraduate degree in oceanography. So students in those three areas generally are working on these different projects. We do have students who do work out at the Oceanic Institute. Our marine sciences program, a lot of our labs that our students work in are out at the Oceanic Institute, as well as in Kaneohe. They haven't been as involved with the feed mill. We just actually got that. We're building that right now. It's been a multi-year project, but it actually is going operational this year. Let's talk a little about your students, because I know in the past, each of you was very popular for students from all over the world. And is that the case now? Is the percentage of student body of local versus national and international? So on main campus, about 17% of our students are international. International? International. And I have to back out the numbers. Roughly 40% are coming from off island and 40% on island. We also have a fair number of students on military bases doing degrees with us part-time. But if I'm looking at main campus, we have 4,000 undergraduate students and 1,000 graduate students and then another roughly 1,500 military students. Well, you know that whole experience with the international students coming into Hawaii has given you, maybe it's all intended, but a global perspective on things. And we have seen that here on Think Tank. We've seen your global perspective in a number of ways. And when we get back from this break, we're going to explore exactly how that works and why. We'll be right back. And that provokes naturally our trust on HPU. Hello, I'm Patrick Bratton. Please join me every Thursday at one o'clock for Global Connections, where I talk to a variety of guests and range through many issues from contemporary international political events, things talking about national security, all sorts of international issues and also more local issues, history and so on. I look forward to having you join me and talking to some of my guests. Thank you. Thank you for joining Think Tank Hawaii, meeting people we may have not otherwise met, helping us understand and appreciate the good things about Hawaii. Great content for Hawaii from Think Tank. Hey everybody, my name is David Chang and I'm the new host of a new show, The Art of Thinking Smart. I'm really excited to be able to share with you secrets on giving yourself the smart edge in life. We're going to have awesome guests and great mentors of mine from the political, military, business, and nonprofit. You name it. So it's something for everybody. We're back. We're live. We're here with Provost Matthew Liao Troth who is the Provost and Vice President for Academic Affairs of Hawaii Pacific University. We are delighted to have him with us. It's great to be here. So one of the things we'd like to cover, I think, is the sort of global view that HPU does. And somehow it seems to be related to the fact that you have a substantial percentage and you have had over years of substantial percentage of international students here. But you also go out. What I mean is we met a number of your students and graduates who have gone with the State Department and had really promising careers.  Carlos Suarez was also involved in that program and he got out all over the world doing, you know, what was it, a program in Austria and in Poland and throughout Europe actually. Here's a Fulbright scholar. A Fulbright scholar is trying to think. And most recently, you know, we deal with a graduate of yours every couple of weeks who works for Brian Schatz in Brian Schatz's office in Washington. His name is Russell K. Kohler. He's a graduate of HPU and very knowledgeable about foreign affairs and specifically about what's happening in Turkey. And as you know, there's a lot of things going on in Turkey. He reports to us. I mean, so what I'm saying is that, you know, Connect The Dots, an HPU, has a real serious global consciousness and is graduating people who are going out and doing what I think, you know, young graduates should do anyway, participate in global activities in the State Department and diplomacy and whatnot. Is this part of your long-term plan? Yes. We actually were honored to, for the last several years, be recognized as the most diverse university in the United States. And a key part of that diversity is international diversity as well as geographic diversity in general. We revised our general education program a couple of years ago to really emphasize the global and the multinational and the multiple perspectives that you really get in a truly liberal education. And so we really challenge our students in that way and we really push them in that way. We have lots of students from the mainland as well as local students, as well as the international students who are coming here because of that reputation. They want to be in a class where someone is from one country is here, someone from local is here, someone from the continental US is here, and in front and behind them are people from other places as well. So you could have really broad-ranging conversations in any class about any topic. It's great. It's just great. I mean, we need this. Hawaii needs to be an international center and you are actually graduating from an international generation in that way. Speaking of which, somehow, HPU and maybe you individually got in the Hawaii Pacific Business Hawaii Business Magazine's black book the top 250 businesses. How does that work? What is that? So it's a program that they run about the top employers and top businesses in the state.  We have hundreds and hundreds of employees. We're the largest tenant downtown actually because we're in multiple buildings across up and down Fort Street, Bishop Street and Loha Chowar Drive. Everywhere. And Baritania as well. The NYU of Honolulu. Yes. And growing. And so it's just a recognition program they do for impactful businesses and employers in the state. And I was one of the I was the person from Hawaii Pacific University that was rolled into that last year. Congratulations. Oh, thank you. Thank you. Well, so going to Aloha Tower, can you give me a walk through on how it is evolving, what it's going to be like? Can I still go to the restaurants there? Yeah. How is it changing? What does it mean to Aloha Tower? What does it mean to the university? And what are we going to do with that park? Oh, throw me a curve ball. Okay. So, you know, HP was really proud to be the steward of this property of Aloha Tower Marketplace.  We really appreciate that. We had 270 students move in last year for the first residents living upstairs in less than a month. What a beautiful dormitory. Yes. We had parents dropping off last year saying I'm sending my kids home. I'm moving in. The next group, you know, we've had students living there during the summer. We have new students moving in this fall for the new semester. It's really exciting. And it's not just students coming from Off Island. We actually have some students who are local who've lived at home for college, saving their money. But so their senior year, they wanted to live, you know, have that college experience. And so, as seniors, they're living at Aloha Tower Marketplace. It's a real draw. I'm sure to live near the water there, the beautiful location. Yes. Well, you know, we've been joking about it for the past week, but we have our own gym. A Pokemon gym. Right there in Aloha Tower Marketplace. Downstairs, we have, we still have the shops. We still have the restaurants. We have a couple who are under letters of intent for moving in and all that. Our big focus was getting the students in because we purchased this property specifically for the students. We wanted to make sure the student space was up and running first. And so we have multiple kind of, we're in discussions and letters of intent for multiple businesses coming in. And I can't talk about who they are, but we do have downstairs.  So the campus tours start from there, going up Ford Street Mall. We have our learning commons, kind of the contemporary library, the future, essentially there. We have a lounge. We have three multi-purpose rooms that are used by community organizations, as well as by students. We have some classes in there. We do events there. And then we have community partners using the space as well. So the community organizations can use it for, is there a charge, or how does that work? There is. That's one of the few things. It's not under the Provost portfolio. But yeah, so there's a whole process. So if you go to, there's a separate website for Aloha Tower Marketplace for doing that. And I will make sure I get that information to you all so we can share that. I believe it's email at alohahtowerathpu.edu to inquire about community and business meetings in that location. I think a great idea actually, because it is ideal. I mean, so many reasons. But you know, do you mind if we come around with cameras? We'd really like to do a little OC16 show at Aloha Tower to see who it looks like. The new Aloha Tower. Our bookstore is there. It's a constant location opening up, so it's really neat. Have you closed the Hawaii Loa dorms? No, no. Not yet. No. We've entered this relationship with Castle Medical, but we're going to be there for several years there. Really? Yes. So incoming students, the freshmen coming in this fall, they will probably still have, still be at Hawaii Loa four years from now. It's a multi-year relationship. So there's a, we will be leasing space and it's a long-term relationship. But you have a regular shuttle that goes between the both campuses? Yes. Three to four an hour. So it's very, it's helpful to get back and forth because we really want people to have, not be reliant on cars, but it adds one more thing to a student's life. Yeah. Oh, great. That's a beautiful location. Yes. So you have that. The dormitories, that's the principal use right now for Hawaii Loa. An office space too, is that right? Is that where your offices are? So at Hawaii Loa, we have 190 bed dorms, dining hall, and then we have the Academic Center building there, which has a couple of science labs, some science lab classrooms, and then our nursing simulation lab is there, as well as faculty offices for the College of Health and Society and the College of Natural Computational Sciences on the natural sciences side. Some athletic fields too. So it's a migration. I mean, in a few years' time, everybody would be down in town. They won't be there anymore. So where's your office? My office is on one of the buildings up Fort Street. Not at Aloha Tower, and not at Hawaii Loa, but not in this building, not in Pioneer Plaza. No, I'm actually at 1164 Bishop Street. HPU has been in that building for a long time. So we have up the Progress Building. We have 1164. Pioneer Plaza. Pioneer Plaza. We have Aloha Tower. Hawaii Loa. I know you can't tell us what's next. Oh, yeah. Well, we only have Model Progress. We have the Fort Street Center. We have the Lower Bishop Building. We have the Cuy Plaza. And then there's the military bases when we're in there. And the military bases. We have facilities. Yeah, we have offices to service our students. And then there are shared classrooms for anyone who's offering classes on the military bases. Neighbor islands? We primarily serve neighbor islands through online. Oh, yeah. Let's talk about online for a minute. Sure. What do you offer online these days?  So we actually offer eight associate's degrees fully online. And those are targeted primarily towards part-time students, primarily on the military bases. They can start there. They can transfer to Texas or St. Louis or D.C. and finish up with us. We also offer several bachelor's degrees, business administration, psychology, computer science, public administration, human resources development, criminal justice. And I'm sure I'm missing one in there. You have a prominent alum from the online program we had talked about. Yes. Congresswoman Tulsi Gabbard is an alum of ours. She actually did most of her coursework either while deployed in the Middle East or in deployed in Washington, D.C. And it's really nice to be able to help serve someone who's serving the U.S. I bet she did very well in her classes. She did. How long would it take? For proper reasons, I can't tell you her grades. Of course not. But all her professors say great things about her. Shout out to Tulsi. Good work, Tulsi. But how long did it take for her or would it take typically to finish a degree online part-time? Part-time, it really depends on how many classes you're taking part-time, whether you're going full-year or part-year. So you could, I mean, you could finish a whole degree in three years. That's a little, that's pretty aggressive though and hard to work while doing that. But it's pretty easy to, you know, if you're going half-time, then you could do it over six years if you're taking classes during the summer, fall, winter, spring. You didn't bring in the application forms with you, Matthew? hpu.edu. hpu.edu. Apply here. Click the button. So take a minute and talk to camera one over there. And tell the people, you know, where hpu is going. What's the general vision? I know it's early for John Quatanda, but so as it exists today, where is hpu going? We are Porta Lulu's University. We are serving the downtown area. We are providing kind of the urban experience. We are the center of the Pacific Rim. So we are pulling people from around the world for an American liberal arts education with a distinctive Hawaii flavor to it to really build global citizens who are going to make this a better place. We have students from northern Europe, northern Asia, southern Asia, South America, north America, Africa all around coming here and gathering in the gathering spot to really make a difference at hpu. And we're really proud of our students. We have great faculty, great staff, and we really want our students to be successful. Fabulous, and here we are in your lap. We are going to cover you, Matthew. Yes. Watch out for us. That would be great. We're going to talk to you lots more. That's fine. Thanks so much. Thank you so much. Aloha. Aloha. Thank you, Matthew.