Hello. Okay. I got my user mode Linux window trying to come up on the other side here. Let me just launch into the presentation while that's happening. Hi, everyone. My name is Michael Rash. Okay. How's that? Okay. My name is Michael Rash. I am a security research engineer for Enterosus Networks. I also released some open source software on my website, Cypherdime.org. And that software will be the subject of this talk. So first let me just say I like IP tables. I want to extend the functionality of IP tables. I want to write software, I do write software around IP tables that provides more functionality than IP tables has that should not necessarily be included within IP tables. And today the talk is going to have two main parts. The first part will concentrate on a new tool that I have written and released today on my website at this conference called FW Knot. It stands for the firewall knock operator. It is an implementation of a port knocking scheme, but it combines at the same time passive OS fingerprinting with a strategy borrowed from Poff. And the second part of the talk is going to concentrate on a patch that I wrote to the IP table string match extension, which allows the same content replacement that is performed by the replace keyword in Snort inline, except this happens exclusively within the kernel. And I'll display some net perf benchmarks at the end. So let me just say also that everything you will see here today is fundamentally made possible by IP tables. I don't want to have to appeal to a packet capture library like LitPcap. The FW Knot implementation exclusively uses IP tables log messages. A lot of people think IP tables logs, that's not very interesting, but you can get a lot of really interesting information from IP tables logs because most of the interesting fields in the network and the transport layer headers are logged for you and decoded for you by IP tables log messages and you can even log application layer data if you're using something like the IP table string match extension. So port knocking, sure many of you are familiar with it. The term was coined by Martin Krasinski. I apologize if you're in the audience and I butchered the pronunciation of your name. It is a method of encoding information within sequences of connections to closed or open ports. It doesn't really matter. It is commonly used to allow someone to modify the access controls that are implemented in a firewall by using a sequence which allows only say the person who knows the sequence to be able to connect through your firewall. They could be encrypted or they can be shared sequences. By shared we mean that both the client and the server will agree beforehand on exactly what the sequence is. If anyone saw David Worth's talk at Black Hat, the 20 minute turbo talk, he gave a really good concept about implementing a port knocking scheme around one time pads. That was really cool. FWNOP doesn't support this yet. I would like to mention that FWNOP, I'm very interested in accepting patches. Any comments or bug fix or suggestions that you have please email me. Multiple protocols can be involved in port knock sequences. They don't just have to rely on TCP. FWNOP support sequences that are sent over TCP, UDP, and even IC&P can be thrown in there if you'd like, even though that's strictly a network layer protocol and doesn't have a notion of a port number. If you encrypt your port knock sequences, you can get the third, you can have a third party IP address authenticated through the firewall which is part of the encrypted sequence. Even if someone were able to sniff the traffic between the client and the server they would not be able to deduce for what IP the firewall will actually allow access through for. Probably the best thing about port knocking is that it's ideally suited to be implemented around something like firewall log messages because the server side is completely passive. I never have to allow the TCP or IP stack that the firewall runs on to respond in any way to the client. If you have a firewall configured and the most secure stance, which is a default drop stance, then you can implement very easily a port knocking scheme around that as long as you're also logging packets which is something firewalls do pretty well. Let's take a look at a couple of knock sequences. First is a shared sequence. The sequence is agreed upon by the client and the server. The knock client sends a series of five connection attempts with TCP send packets to ports 1001 through 1004 and the last port TCP 22 will be agreed by the knock server as the port that, oh, the client wants access for so it opens up TCP port 22 after it sees the knock sequence come across from the client. Not very complicated. Let me just say here, of course, knock sequences suffer from the capability that if someone is privileged enough to be able to sniff the traffic between the client and the server, they can easily replay the same exact sequence that you sent across and so port knocking does not provide bullet proof security. It is simply another hurdle that a someone needs to jump through to be able to connect to SSHD, for example. I run FWNOP on my home system. I can authenticate to it with an encrypted sequence from anywhere on the internet but only clients that know that sequence can then connect to SSHD. I want IP tables to provide the security for SSHD because if I protect SSHD with IP tables, not only can they not talk to the demon itself, they can't even talk to the TCP stack or even the IP stack. So let's take a look at another shared sequence. It's a little more complicated. We have a, this sequence involves multiple protocols. You can see TCP and UDP involved there. A couple of IC and PECA requests and we can introduce timing delays that can be made significant. So the last port that sent its connection to UDP port, I should say a packet to UDP port 5003, but the sequence will only be honored if that packet is seen at least 10 seconds after the previous IC and PECA request. If someone is able to sniff your traffic, they may see all the packets. They go across from the client to the server, but they may not also realize that the timing delays can be made significant. So if they try to replay the sequence, if they don't introduce that time delay in there, the sequence will not be honored. Also, incidentally, if you're using an ethernet sniffer or something and if you're doing this as a manual process, then frequently people will restrict their view to say just the TCP protocol or just the UDP protocol. So they may see the TCP packets that are involved in the sequence, but they may not realize that those, they may not even see the IC and PECA request, first of all, and even if they do, they may not realize that they're also significant. Remember that we're just trying to make things just a little bit more difficult to connect to SSHD or whatever demon you prefer. This particular sequence, note that the, that the, at the end there, TCP ports 22 and UDP port 5000, which is used by open VPN. These two ports are opened after the knock sequence is seen, but the, these two ports are not, they do not appear at any time within the sequence itself. So the sequence, the server and the client must agree beforehand on which ports will actually be opened. Okay. Encrypted sequences. We can encrypt our port knock sequences by noticing that an IP address is essentially four 8-bit values. A port is a 16-bit value, which can be treated as a concatenation of two 8-bit values, so a high order byte and a low order byte. Protocol numbers can be completely described by a single 8-bit value. So one is ICMP, six is TCP, and 17 is UDP. And we need to select an encryption algorithm. So why not Reindahl? It was selected for the AES standard. Sounds like a good way to go. It's block size.  Notice that we've only used so far four bits for the IP, four bytes for the IP address, one byte, two bytes for the port number, and one byte for the protocol. So we have a total of nine bytes left over. FWNOP makes use of those nine bytes. I'll cover that later. And so if you see the plain text line there, we are going to have the knock server allow access through to TCP port 5500. Of course, that's arbitrary. You can make that whatever you'd like. For IP address <IP_ADDRESS>, which notice does not correspond to either the not client address or the knock server address. Sorry, this screams a little. Okay. And then if you take a look at the cipher text line here, notice that we have a sequence. It's 16 ports, but not all 16 ports are displayed here. Only the first few. Notice that the next to last port is port 80. Probably aren't going to be logging TCP send back to port 80 in your IP tables firewall. If you are though, you probably will notice it after your disk fills up if you have a high traffic website. So what we need to do is to have a way to use different ports other than ports that can be easily confused with well-known ports you may be running legitimate servers on. So we will define a special range of ports which is 8 bits wide, a total of 256 possible values. And we'll define that range on the server side to be 60,000 through 60,255. And then on the client, we will add 60,000 to each of those encrypted ports that we saw in the previous slide. And then we will connect in sequence starting with the first through all 16 port numbers. And the knock server, which will be monitoring that range of ports, will, assuming that the decryption works, which means of course it's a symmetric block cipher, so you must have a shared key. Assuming the decryption actually works, then it will allow access through IP 174-432 to TCP port 5500. Okay, so that's port knocking in a nutshell. Now let's cover a little bit about POPF. POPF is a passive operating system fingerprinter. It offers three main methods for fingerprinting the TCP IP stack on a remote operating system. The first is with TCP SIN packets. This is the method that we will illustrate how to accomplish with IP table log messages. It also offers SIN act fingerprinting or reset fingerprinting, but since that requires generally a bidirectional communication between the client and the server, we won't be discussing that because we would like to be able to completely characterize an operating system with only a single TCP packet. It uses libpcap to monitor traffic across the network. So how does it fingerprint an operating system? It looks at several fields within the transport layer header, the TCP header actually. It looks for a TCP SIN flag being set, of course. It looks at the TCP window sizes, and then the remaining options there, maximum segment size through the timestamp, are included within the TCP options field in the TCP header. And it also looks for TTL values, fragment bits, and the overall packet length, which are headers in the network layer header. So if we take a look at a couple of POP signatures, the first is for FreeBSD 4.4. If you see a packet on your network that has the following characteristic, the way you read this is it's a series of values separated by colons. The first value represents the TCP window size of FreeBSD 4.4 systems hard code, the TCP window size of 1024 bytes. The next field is for a TTL value. It's looking for a TTL value of 64. Of course, since every intermediate router between the client and the server is going to decrement the TTL value, you have to be prepared to have sort of a threshold that allows you to extrapolate what the initial TTL value probably would have been. And to do that, you can rely on the idea that generally, all packets, all routes between clients and servers on the internet generally will take about 15-20 hops. So that gives you a bound. The second signature is to identify Linux 2.4 kernel. You see the S4 there for the first portion of the signature that refers to the TCP window size must be exactly four times or a multiple of four, the maximum segment size. It doesn't care what Linux has set the window value to be just as long as it satisfies that requirement, it is probably going to be coming from a Linux system. Of course, these signatures, if you've gone around in slash proc and you've messed around with kernel data structures that are exported to you via slash proc so that you can change your TTL values. Oh, I'm sorry, your initial TCP window size, etc. This will not work. This just this assumes that you have gone with a default default values in the stack. Also, I believe Kathy Wayne gave a presentation about using packet purgatory. That was pretty cool. And that can change things as you have packets traversing a system to or outbound packets. So you can spoof some of this information. What we're trying to do is just make more information that more information significant in the actual PortNock sequence. So how do we do this? How do we implement this around IP tables? Well, first, we have an IP tables rule that instructs IP tables to log all TCP packets received on Ethernet interface ETH0. We put a logging prefix of drop so that these the packets that are logged as a result of this rule are easily identifiable in our SysLog. And we use the sort of less commonly used option log TCP options. Incidentally, that last rule there in parentheses, you cannot have IP tables both log and drop a packet within the same rule. And so if you actually want to have if you want to be sure that your firewall is actually dropping stuff to and logging it, you have to have that additional rule there. And the next three slides are going to examine a single log message. The first slide will show you the log message up through the network layer. And then we'll continue on from there. So this first slide, excuse me, we can see that it's a SysLog message. This packet was we see our drop string there, which means that we see our logging prefix that we added in that previous slide. We see that this packet was logged on the in interface of ETH0. We see that the out interface is blank. That's because this packet was logged in the input chain. The packet was destined directly for the firewall as opposed to being destined for a machine that's through the firewall. If it were destined through the firewall, then you would see the output interface filled in, it would be logged in the forward chain. IP tables does a great job about decoding a lot of information. We see source and destination IP addresses. We see TTL values, IP IDs that don't fragment bit is set. And we see that the protocol that's one layer higher in the stack is TCP for this particular packet. So we also get information in the transport layer. In addition to all the fields we had before, we also see source and destination port numbers. We see the TCP window is very clearly delineated there, 5840. And we see that the SIN flag is set. All other flags are cleared. And finally, because of that log TCP options command line argument, it also logs the TCP options portion of the TCP header, but it doesn't decode it for us. It just says, oh, okay, log TCP options. I know where that is in my TCP header dump, here it is in your log, that string of hex data. IP tables does a great job about decoding information, but it says, well, you know what, I don't want to burden the kernel with having to decode TCP options. So I'll let some user land application do that for me, which is probably a good choice. So we have to decode this information. No problem. TCP options come in two formats. The first format is a single type field of 8-bits wide. Examples of this, such TCP options are knob instructions, which are used to align TCP options on word boundaries. Not all TCP stacks will actually make use of the knob instructions. So any TCP implementation has to be prepared to deal with TCP options that may not be aligned on word boundaries. The only remaining type with an 8-bit field is an end of options code, which is used at the end of the TCP options. And then the most important type contains three fields, a type field, a length, and then the actual value. And you can see there that 020405B4, which was included in that IP tables packet, decodes to a maximum segment size of 1460. So if you take a look at that hex dump, you will see after decoding it that we have the following characteristics. The maximum segment size of 1460 selective acknowledgement is permitted by whatever operating system generated this packet. Time stamp is included. There's one knob instruction and then TCP window scale value of 0. So that log, the packet that we logged, if you look in summary, contains the following characteristics. In addition to the decoder TCP options, we see a length of 60. The don't fragment bit is set, TTO value of 64, et cetera. So what does POP tell us? The operating system that generated that packet was most likely a Linux 2.4 kernel. Okay. Should be mentioned that we have not talked about the IP ID, which is used, it can be used in other fingerprinting strategies. Toby Miller wrote a paper, passive OS fingerprinting details and techniques, which makes use of IP IDs, which are highly variable. The method by which they are generated is highly variable depending upon the operating system. I would like to be able to characterize an operating system with a single packet. And if I were to make use of the IP ID, then I would have to look at relative differences between successive IP IDs from the same operating system, which would allow me to deduce whether or not the algorithm that generated the IP IDs was random or followed at a simple numeric plus, you know, numeric additive rule. But I don't want to have to rely on multiple packets from the source. So I didn't implement that. Also, X Pro, of course, should be mentioned. It's an active operating system fingerprinter, but some of the same information contained in its database could be used. But I don't want to have to send packets back to the source. So I don't use it. So FWNOP gets strictly used as IP tables log messages to implement both port knocking and passive operating system fingerprinting as we've seen. It supports shared and encrypted dock sequences. You can send sequences over TCP, UDP, and ICMP. FWNOP makes relative and absolute port timing significant. So if you want to make it so that only someone who sends a knock sequence to the knock server puts a five second time delay between each connection, then that server will not honor the sequence unless it sees that time delay. The local username identification is used in encrypted sequences. Remember that nine bytes worth of information that we haven't used in the Rindall block size. You can install an FWNOP client on a multi-user system, but have the knock sequence honored only for a specific username that's on that system. So even though anybody can execute FWNOP on the system, if they're not the specific user that you want to allow through, the knock sequence will not be honored. And last but not least, you can either require that an exact match is made for the operating system that generated the knock sequence, or you can match based upon a regular expression. So if I want to say have any arbitrary version of FreeBSD able to connect to my SSHD and I can use a simple regress to match that or Linux or whatever you'd like. Just a couple notes about the implementation. It's implemented as a client server. FWNOP runs in server mode on a Linux system that's running IP tables where it has access to syslog messages. Of course, you can have IP table or syslog logging to some of the syslog server, but we won't really get into that. Sequences are encrypted via Rindall. FWNOP in server mode reconfigures syslog to write to a named pipe in your operating system. The reason it does this is because I don't want to have to have FWNOP worry about the possibility of an automated log rotation script or something to run out of cron that rotate my log file away and then I lose my file handle. It doesn't take POP signatures directly from POP. It uses the etcpf.os file that's included with an OpenBSD and it's available now on my website if you'd like to download it. Okay. Let's see if this will work. Is this on? Okay, down at the bottom, there's a tail-mind itself on my IP table's log or far log messages file. Sorry, you can't really see the whole thing here. I'll try to compensate. So the first thing we're going to do is we're going to send a simple shared sequence across. First, I want to display that SSHD is not accessible from my user-mode Linux installation, which is this top white window down here. The black window is my host operating system where FWNOP is running in server mode. So hold on just a second. Okay, you can see down at the bottom the IP table's log. It'll scroll up here. And FWNOP monitored a successful port knock sequence through IP table's log and allowed access to this particular source IP address for 10 seconds. If you have your IP table's firewall configured such that your accepting package to the part of established sessions first, then IP tables can have the log that accepts the traffic removed, but your session won't die because I'm still logged in up here even though I don't have access anymore to the SSHD. I'll demonstrate that. Hold on. Is that better? Okay. Great.  Now I'm going to send across a different knock sequence to the firewall. This involves TCP, UDP, and ICMP. But if you notice down here this time, so it's, FWNOP supports multiple knock sequences per individual source. This particular knock sequence was not honored because the time delay was not met. If I add a time delay between each port, the knock sequence this time will be met. However, I also instructed for this particular sequence that I'm expecting it to come from a free BSD system. And because this user mode Linux system does not correspond to free BSD, the sequence was not honored. And finally, we'll demonstrate an encrypted knock sequence. Of course, I have to type in my encryption key, which is just an eight character password. And you can see the IP tables measure just scrolling by on the screen below. Notice that I'm rotating between the TCP and UDP protocols for this sequence. And then down here we had a successful decrypt. It matched a regular expression designed to detect Linux systems across my IP tables logs. And it allowed me to connect to TCP port 22. So I'd like to take questions on FWNOP and then move for the second part of the talk. Yes. That's a good question. I could implement that. It's not currently used. I'm sorry, let me repeat the question. He asked why not use, make use of the IP IDs since I'm going to be sending multiple packets anyway. Good point. I would like to just take the signatures as they come from POPF. So I could make use of the IP IDs, but I'd have to combine the password operating system fingerprinting, say, in Tobey's paper with that of POPF to make, to come up with something useful. I'm probably not going to get more granular data by using the IP IDs than what I already get with POPF. So it could be added. It seemed a little bit unnecessary, at least from what I'm doing here. Anyone else? Yes. I'm sorry. I'm not target. Can I restrict not to a specific IP address maybe? Oh, yes. Right. So the U-Log target, he's asking about, could I use the U-Log target to implement this as well. Yes. It could be used. The U-Log target will give you pretty much the entire packet as a data structure to a user land application. But at least I think that's right. Is that right? Yeah. Okay. You could do that. I'm not sure if U-Log returns exactly the same format as the normal log target. So I mean you'd have to reinterpret the actual what's coming out of U-Log. But if you're running on a Linux distribution, I can probably, there's a much greater chance that the normal logging facility is made use of by IP tables instead of U-Log. Any other questions? Yes. Yeah. What I have right now to emulate that is a knock limit. You can set a knock limit on a, to define how many times any particular knock will be honored. But there, it'd be much, much cooler implementation would be to implement something like David Worth's one-time pad-based port knocking. Because if you say you are able to, say you set a knock limit of only one, of one, right? Then FW knock will, you have to be sure to either restart FW knock and then therefore you can use the same sequence or redefine your sequence on both the server side and the client side to be able to gain access through again. So I mean that is an option if you want to deploy it. So let me move on to the second part of the talk. The IP table string match extension is a kernel module that allows IP tables to match sequences of bytes at the application layer. It uses the Boyer Moore searching algorithm which is used commonly by intrusion detection systems because it's very fast. This constant BM max HLIN is defined as 1024. What this means is that if you attempt to match a string in a packet that contains an application layer payload that's larger than 1024 bytes long, the string match extension will not attempt to actually match in such a packet. That's due to performance reasons although we'll see later that performance isn't really too much of a worry maybe depending upon your application. So we're going to look at a couple of snort rules. This is snort rule or CID 940. It's a rule designed to detect someone trying to access a specific DLL associated with front page and we can write an IP tables rule that will detect the same string that snort is looking for. Note that we're logging this in the forward chain presumably because you're not running front page on your Linux box. We're looking for TCB packets with the destination port of 80. The TCB flags AC and AC refer to the TCB flags that we'll be examining and the ones that we expect to be set. So here we're just saying that we just expect to see the AC flag set in the packet. It doesn't care that also the push flag or the urgent flag may also be set. The reason for adding this is because of the flow keyword in snort which we can't exactly emulate directly with IP tables log or IP tables rules but we can sort of come close with making sure that the AC flag is set in the packet and then we look use the string match extension to look for the string slash underscore VTI bin etc. And we'll throw a log message saying oh I saw snort ID 940 on your network. Note that we're just logging it. We're not dropping it or rejecting it. Frequently we're going to try to look for stuff that doesn't involve just nice ASCII data. So we need to be able to search for non-printable characters specified by hex codes. If you look at snort rules many, many of them look for hex data in network traffic. So with the hex string patch that I wrote and it was accepted by the IP tables maintainers you can take snort content fields directly out of snort rules and put them into IP tables rules and we can see one here. This is an old exploit for name D snort rule ID number 261 and again we will just log the packet if it's seen over TCP port 53 and we're not dropping it. The string match extension is compatible with IP tables targets such as accept if you want to accept the packet. You can drop it if you'd like. Of course if you're running if you drop a TCP packet in midstream that packet will be continually tried to be retransmitted because that's a requirement of TCP. You can return if you and this target applies to custom chains if you have a custom chain that's trying to do more advanced processing within IP tables you can use the return target to return out of that chain and continue on through the rest of your rule set in effort to not have it examine successive rules within that same custom chain and of course you can also reject the packet so that it never actually makes it through the target system you can send a TCP reset for a TCP session you can send various ICMP messages in response to UDP traffic if you'd like. So if you're curious about how many rules can be translated directly into IP tables rules you can run FW snort it makes use of the string match extension in the hex string patch and it can translate about 70% of them notice that equivalent is in quotes we can't actually do exactly what snort does within IP tables rules we cannot search for application layer content that it starts at a certain depth or offset we can't support multiple content strings within single IP tables rule and we can't do things like take care of these standard IDS evasion techniques will defeat the string match extension we can only search for a sequence of bytes within a single packet if you can fragment your attack or fragment that sequence of bytes across multiple packets then it will defeat the string match extension and any you know clever encoding technique that you use also will also defeat the string match extension but if you have certain well-defined things that you don't want to see or at least that you want to send logs for you can make use of the string match extension so snort inline is an IDS it's a patch to snort which I think is going to be incorporated within snort before too long the IPS functionality not sure about that but it's designed to run on a Linux bridge it makes use of the net filter libIPQ library to queue packets from kernel space into the userland application inline snort and after passing packets through the snort's detection engine if they're if they're deemed to be okay to pass on into the target system then libnet is used to send the packets down on the egress interface and out to the target system so snort inline implements a new snort keyword called replace it allows you to change application layer data for example if you don't want anyone to see the same target system to see the string bin SH you can replace it with be in SH and of course that will not correspond to any legitimate path and target system and so presumably your attack is stopped let's examine what the packet has to go through if it's being processed by inline snort we start out in kernel space the packet is appears on the ingress interface we're still in kernel space the IP IP tables gets a chance to look at it and it it notes that it's in the forward chain because it's going we're running on a bridge it's not directly accessible it's not addressed directly addressable so any packet that is examined by snort and land will be examined first by the IP tables forward chain IP tables will descend the packet through live IP Q to user space once the operating system scheduler gets it gets around to running snort inline in the context which is performed the snort inline will have a copy of the packet within user land and it will get a chance to run the packet through the detection engine if it's okay it will construct a packet with libnet and then do another context which down to kernel space and put the packet on the ingress interface so we have I'm not sure how many packets can be queued at one time I don't think that it's required that every single packet requires two context switches but I'm not sure what the exact number is if you know the answer come see me after the talk so but note that at the very minimum we're going to be doing a lot of context switches and copying of data between kernel and user land so the string match extension runs in kernel space if you look at this file live IPT string dot see the function prototype for the entry point to the search algorithm you specify a character pointer to what you're searching for and there's a character pointer which points back into the SK buffstructs of the packet which show you which look would give you a pointer to the application layer data haystack and note that it returns a character pointer it does not return a simple return code saying zero or one whether or not the string was actually found within the packet it returns a pointer to the actual data so it's easy at that point then to also modify that data with one exception if you're modifying application layer data you must also if it's a tcp packet recalculate checksums because tcp mandates that a checksum will be calculated and verified for every packet sent across the network if the source of the packet happened to compute the utp checksum which is not required by the utp rfc then you also will have to recalculate it as well but that's an optional step depending upon whether not the client or the server as the client actually calculated the checksum first hand beforehand so the string match this patch adds a new replace string keyword to the userland portion of IP tables that allows you to say in our first snort rule take the underscore VTI bin and replace it with remove the underscore and replace the .dl extension with .dab and this time we'll send the string oh I instead of just seeing snort id 940 I nullified snort id 940 on your network for you we can do a similar thing with hex data it also adds a replace hex string option and if we take it a quick look running out of time here the packet goes through on the network we're able to stay in kernel space the entire time packet appears in the ingress interface the packet is matched in the forward chain we run the stream match function and the data replacement within kernel space and the packet goes out on the ingress interface so what does this mean in terms of benchmarks I have to admit the the description of the talk so that it was three times faster I have to admit that's a mistake I'm sorry it is not three times faster it is significantly faster but not three times faster and we'll see that in a second so this is on my home network I set up a snort or IP tables machine I can I'm using both and there's a net perf client a net perf server net perf is released by some engineers at HP nice piece of network benchmarking code it however there's a little bit of difficulty when you're trying to use net perf to benchmark something like an IDS or or IP tables because the way net perf is architected you connect first to the net perf server with the net perf client but the actual port that the actual data stream or test will be run over is not well defined it's a random port that the server decides to hand you after you connect first so I wrote a trivial little patch that hardcodes that port to us or to a specific one that we can specify so that we can easily say you know on port 50,000 or whatever that's where you're the rule will be applied in in both snort and also IP tables so looking at the benchmarks the first three sets IP tables forwarding with no IP tables filtering turned on I should say so I should say it's just a standard IP forwarding I get about 1.95 megabits per second snort in line because of the context switching which actually I think this is still pretty good 1.72 megabits per second not bad it's about 12% faster for IP tables or normal forwarding I should say if we turn on the replace that the IP tables replacement or the snort in line replacement it is about 10% faster for IP tables but this does not log anything this just accepts the packet on both sides but it has done the data replacement in line and it's about 10% faster note that the snort in line hasn't slowed down at all with the replacement turned on because DC 702 interrupted my speech and all they got was some lousy points and next it sucks that was diverting all right so snort in line note the sort of line hasn't slowed down at all from the first test and that's because we're all we already have to construct the packet with Linnet in user land and send it down so it's a very inexpensive operation actually replace content in the packet as well because we've already got it in user land and it's a little bit slower with the IP tables replacement turned on this actually this replacement is doing searching and replacing within and that's why it's a little bit slower but you can see 1.92 megabits a second versus 1.95 it's not that expensive of an operation and then the third set is if you actually log stuff to which you probably want to do we take a hit on snort in line and it makes it about 43 percent faster just to log and replace but with IP tables applications well-defined exploits C++ worm was a single 404 byte EDP packet yeah probably don't want that allowed that one into my network and maybe if you want to preserve application layer responses it's like you know translate URLs into four or four errors and have the web server do that for you maybe so and with that like take your questions think we have about one minute left yes yeah absolutely um IPS that does things like this content replacement is highly hyped up I think we're probably all aware of that I cannot give you I can give you I think one maybe possible legitimate use for this and that is that when you're executing an attack against the server system you might not be aware that the attack is going to actually succeed so if you're on the other if you executed an attack against the system and you have you have something like an inline IPS drop the entire session as a result of that attack you might be you it might tip you off that there's an IPS type device between the client and the server more easily than if you selectively modify certain application layer data but that's a stretch there I totally admit that I am not promoting IPS in any way shape or form this is just enabling technology if you want to play around with this essentially so is it useful probably not other questions yes if something triggers a snort rule can I rewrite the IP headers I'm sorry like redirect to a different destination IP I currently cannot I don't have that implemented within the string match extension I mean that's maybe possible you could use potentially use the route target within IP tables to do something like that but I'm not really I haven't really done that yet I'm being instructed I have to stop so thank you very much


This is Stink Tech Hawaii, Community Matters here. Thank you. Aloha, and welcome to Business in Hawaii with Reg Baker. We're a show that broadcasts live every Thursday from 2 to 2.30 from the Pioneer Plaza in beautiful downtown Halalulu, Hawaii. We focus on success stories in Hawaii of the businesses and the individuals that own and run those businesses, trying to counterbalance some of the negativity that we've seen out there over the years on how bad things are here in Hawaii. There are success stories. There are people that make things work. And we have them come on the show and explain what they've done and how they've done it and how they're getting around some of these challenges. Today we've got an organization that's been around for a while and it kind of went away and now it's back. And we've got a person that has been very involved in the community for quite some time. He's the president of the Hawaii Symphony Orchestra and his name is Michael Teeterton. And he's here to share some of his secrets on how he's making these things work. Michael, welcome to the show. Thank you, Reg. Nice to be here.  That's a while. And you came over here originally to fix something? I came in originally to work with the Hawaii Public Radio, which along with an awful lot of other not-for-profits had a bumpy ride during the 90s. And I thought it was going to be just for, you know, six months or so and apply a few band-aids and it turned into 18 years. That sounds like you enjoyed it while you were here. I loved it. I have not regretted a moment of it. It's been great. And what have you done previous to that that kind of got you ready to come in and get your teeth into the Hawaii Public Radio? Immediately before, I was bouncing around the country fixing broken stations. The Corporation for Public Broadcasting gave grants to stations that had run into some sort of difficulty or another. And I was one of the folks that they sent out to do that sort of work. But before that, I'd been building stations, which I used to enjoy building things, frankly. I don't care much for running them, but I love to build them. And before that, I'd been a reporter, I'd been a producer, I've been involved in fundraising, done a little bit of engineering.  Wow. That's a switch. It seemed like a reasonable evolution at the time. There was a lot of other things in between, you know, but yeah, that was my first trade was a tool and die maker working incidentally for the BBC, which was the Barking Brasswear Corporation or company. Is that what the name was? That's what the name of my company was. It was sort of an Avenger of Things Company. But there's another BBC too. I've heard of them. I've heard of them. They do good work. They're coming along nicely. All right. Very good. It was a broadcasting connection I was trying to make there.  Well, that's sort of what I became. I never planned it that way, but I just gravitate toward problematic situations, I think. Well, it's the challenge. It is the challenge. I've left to build things. And whether you're building or rebuilding, it's the same set of glands, I think. Very good. And so you've gone through and you had all that experience, and then they reached out to you and asked if you could help or how did that all work out? It was kind of curious actually. I was in North Carolina in Wilmington, North Carolina. I'd built the station there. I'd built the station. I helped build the station in Asheville, North Carolina. And I'd been working out of there for years. And I got to the point where I thought, well, public radio has been a really good way to spend time, but I'm about done now. I've done everything I care to do with it. And you know, I was involved with this going around fixing broken stations thing. And I had my house on the market and I wound up, I was winding up my businesses and I was getting set to go back to London, which is where I come from originally, and go back and reinvent myself again, you know. And I was all set to do that and had everything except a plane ticket, really. And suddenly, one week, I got three calls in the space of seven days, all of them telling me about this situation in Honolulu. And sure enough, there was a situation. And they were looking for someone to come out and, well, they were looking for someone to head up to the organization. They were in between managers. And so I gave a call. I really didn't have that. In my honesty, I had not much interest in coming out to Hawaii. It was the only state I'd never been to. But I'd seen it on television and frankly, it wasn't all that appealing. It looked like, you know, there are lots of sunsand and coconut vacations. Well, I was just going to say, if you go to London, there's a lot more sunshine out here. There's a lot more theater in London. You know, it balances out. But I really, anyway, it sounded like an intriguing thing to do before going back to Europe and I came out, interviewed with the folks and just, it was so unlike anything I'd expected it to be. In what sense? Was the unexpectedness the environment or the public radio situation? Oh, the environment. Specifically Honolulu, which I just had no real preconception other than what I'd seen on Hawaii 5.0 or what Honolulu looked like. And of course that was dreadfully misleading. And what I felt was this incredibly intense environment. I mean, I heard it was very cosmopolitan. People from all over the world lived here. And that was intriguing. But I'd also heard it was a melting pot and it was all very kumbaya. And what I found was exactly the opposite. It was a train wreck. And it was the nicest possible way. But all of these cultures coming together and managing to coexist. And not only coexist, but managing to be dynamic. And for all that there are real challenges, obviously, to doing business in Hawaii is, you know, better than anyone. It, I don't know, it was thoroughly unique. It was like nothing I'd experienced before. Just the fact that there's so much Asian culture here and that embedded into most Asian cultures is a reluctance, for example, to say no. And yet each Asian culture has a different way of not saying no. And so when you're in a meeting with six or seven people around the table, all of them from different places, the business of body language gets to be awfully important. Interesting dynamic that goes on. Oh, isn't it, though? And coming from North Carolina, which has a similar sensibility, nobody likes to say no in the South either. And there are sorts of ingenious ways of not letting you know that's what's happening. You have to sort of figure it out. It's very polite. And there's also an era of culture, which it is here. I'm very proud of it, quite rightly. But anyway, it was not what I expected. And there was a vibrant cultural community, which frankly, I hadn't expected. And it was wonderfully exotic. And that six months turned into 18 years. And a couple of radio networks, which I was kind of pleased with. And when you got here and you saw what was going on, you say, well, this place may be not so bad. I'm not used to it. You had the challenge of trying to work with the public radio and address those issues. What were some of those issues at the time? Well, as I mentioned earlier, we're talking about a period coming out of the 90s, the bumpy time in Honolulu, in Hawaii. And the radio station had had a glorious start. When entities like this are born, there's a lot of enthusiasm. And then there's a tendency for people to take it for granted. Exactly, exactly. Honeymoon is over. And there were a couple of moves that turned out to be not too timely, like the creation of a magazine that turned out to be very expensive and non-revenue producing sidelines. So it had gone into a sort of a decline financially. And that has its effect throughout the equipment. And it can snowball on you exactly with the staff and other issues. And so morale was down quite a bit and all that. So there was the issue of morale, staff morale. There was the issue of the bottom line of making payroll, always a challenge. But most of all, there was the relationship between the radio station and the broader community. Because of this slight but seemingly inexorable decline, there was not a failure of faith, but there was a bit of a shrug of the shoulders and, oh, well, that seemed like a good idea at the time, but it's not going to work. And convincing folks that this actually was a very successful enterprise is just that it needed a little bit of tweaking. That was the big challenge. And that must have been a particular challenge for you because dealing with staff morale and dealing with the community, as you mentioned, there's a lot of cultures and a lot of different ways of people watching and interacting. That must have taken a little bit of time for you to figure out or was it pretty straightforward? I took some time to figure out. Now, it had the advantage of doing this sort of thing around the country, just on two or three week consultancies, but essentially parachuting into a situation and realizing over a period of time that with all these challenged radio stations, almost invariably, the problems, whatever they were, engineering problems or morale problems or financial problems or programming issues or whatever, tended to come back to the same source, roughly speaking, which was a breakdown of communication between the governing board and the management of the station. Not invariably, but almost invariably. You could trace it back to that. Well, there's a constant that common theme, I guess, that was kind of plaguing a lot of different owners. Yeah, and you can't take that for granted, but once you identify that sort of pattern, then it makes it a lot easier to troubleshoot. And that had been the case here to an extent. The board was one of the reasons, that was another piece of magic, was just meeting with the board, the governing board, who, to a person, were just absolutely splendid. The agents of change, all of them, and all were a tremendous affection for Hawaii, obviously, and for doing positive work within the community. And they saw public radio as being not just a good thing in and of itself, but catalytic, possibly, for the whole enterprise. And they had that vision. They absolutely did. You know, I've been involved in a lot of different non-profit organizations over the years at the board level. And you really need to have that engagement by the board. That buy-in has to be there. If they're not passionate and they're not buying in, that makes the job really, really hard. Yes, absolutely, absolutely. And the same can be said of management. I mean, management has to. And that's the nice thing about working with not-for-profits is, generally, folks who have been around not-for-profits and not long enough to make it into management are doing it because they love it. They love the results of what it is that they're doing. They feel driven in a very sincere and good way. And I got to, in my opinion, one of your critical roles in coordinating that is to make sure that the board feels like they're engaged and that they are making a difference. And I've seen some executive directors that don't quite embrace that. They're more dictatorial, if you will, rather than collaborative. Yes, I mean, it's understandable. It's really understandable. When you think about the makeup of a lot of not-for-profit boards, they tend to be made up, once again, not invariably, but they tend to be made up quite heavily of people, of professionals, of lawyers, of consultants, or folks like that, many of whom have not had to make a payroll. And I've just seen that evidenced again and again and again. And of course, when you're running a not-for-profit, that's something that, yeah, it's not for profit, but you've got to pay people. And it's running a business like any other business, perhaps with a few more obstacles. Believe it or not, we're up on our break time. Oh, my god. OK, now quickly. Yeah, I did. And so we're going to take a short break for about a minute. We'll come back. And maybe we could just spend about 60 seconds on the makeup of a board. Sure. And then we'll go into the real reason that we're here today to talk about the symphony. All right, but this is Business in Hawaii with Reg Baker. We're here at the Hawaii Symphony. And we're talking with the CEO over there, Michael Teeterton. And we are going to be back in about 60 seconds. This is Think Tech Hawaii, raising public awareness. Planning all week for the day of the big game. Watching at home just doesn't feel the same. What on the list is who's going to drive? It's nice to know you're going to get home alive. Plan for fun and responsibility to the DD. Captain of our team is the DD. For every game day, a sign had designated driver. Hey, I'm Pete McGinnis-Mark. And every Monday at 1 o'clock, I present Think Tech Hawaii's Research in Manoa, where we bring together researchers from across the campus to describe a whole series of scientifically interesting topics of interest both to Hawaii and around the world. So hopefully you can join me one o'clock Monday afternoon for Think Tech Hawaii's Research in Manoa. Welcome back. This is Reg Baker, Business in Hawaii. And we're here today talking with Michael Teeterton about the Hawaii Symphony. I almost said, hallelujah. Yes, you did. We'll get back to that. We didn't quite get out. So the Hawaii Symphony Orchestra. But before we get into that, I just wanted to just touch on Michael, your thoughts about the makeup of a board. What's your thoughts about board makeup? Oh, well, it's tremendously important. Board recruitment is a tremendously important exercise, often underappreciated. You need a combination of things. You need folks who share a common vision of what the particular not-for-profit should be out to accomplish, what it should aspire to. But the last thing you want is a board that's too homogeneous. So they need to be. With all the same skill sets. Well, and the same opinions and the same social. It's important that they be steering the organization into a mutually agreed upon constructive direction. But no, you don't want a board full of lawyers, for example. Now, lawyers tend to be quite heavily represented on not-for-profit boards. And it's not a bad thing at all. But you don't want to overload it that way. Nor do you want it overloaded with financial people, because they'll all argue among one another forever about the next year's budget. And you don't want all of one group. You want different skill sets. And that can be, recruitment is a challenge.  But you don't want somebody, you don't want it populated with people who want it for the wrong reasons, in all honesty. You don't want some. I refer to that as resume builders. I've encountered people that just want to be on the board and do as little as possible. I have a name on the letterhead. It doesn't really serve anybody. But having folks who are motivated, not motivated to the point of micromanagement, which is a different problem. But different skill sets, finance is important. Legal understanding is important. Political savvy is important. Expertise in advertising or public relations. Maybe the industry a little bit. Yes, that can certainly help. Now, if it was public radio, which I'm familiar, public television, sometimes that makes as well with the disciplines and expertise of commercial radio and television, but not always. And you can be setting yourself up for conflict there. There are two completely different industries with different resonance debt and different ways of supporting themselves, different sets of objectives. Right. So it's just important for whoever it is that's in charge of president and CEO to make sure that not only do they have a current makeup of the board that works well, but they also have a pipeline. Because it over happens and you've got to be ready for that. And I don't want to dwell on that too long because I really want to get into the voice and for the awkward stress. So tell me how you got involved with the orchestra. Well, I retired from public radio last year after, I don't know how many years, 40 years or something in that industry. And traveled for a little bit and caught up on my reading almost. I was invited to join the board of the Hawaii Symphony Orchestra. And I was enormously flattered because through my association with public radio, really, that's where my musical education has been.  But public radio brought me into contact with classical music. And I've developed a real appreciation for it. And I have been very enthusiastic about the fact that we have a symphony orchestra. I had a symphony orchestra in this community. I was aware that they had had problems. And in fact, you made the observation earlier, inaccurately, I may say, that if I may be so bold, that the orchestra went away and came back again. It didn't. It went away and it died and it is no more. That was the sad end to the Honolulu Symphony Society, which was founded in 1902 and existed for over 100 years, oldest orchestra, west of the Rockies, wonderful, colorful history and had its real glory days. But they came to an end. And in 2009, they filed for bankruptcy and they went out of business. When that happened, it was very sad for many, many people. And a small group of citizens in Honolulu, a very small group, realized that they could not countenance the idea of a Hawaii without a symphony orchestra. And they recognized, also, that if this situation were to be remedied, it had to happen fairly quickly, because it takes a lot of professional musicians to make up a symphony orchestra. And of course, these folks no longer had employment in the orchestra. They had other side gigs, but they began to leave. And if that had been allowed to go on for too long, we'd have gotten below the critical mass necessary to stuff it up, exactly. So there was a certain urgency. And amazingly, this group formed a new 501c3, a not-for-profit company, and organized the musicians and created this corporate entity that would function once again as a nucleus for a symphony orchestra. And in 2012, it put on its first season, which is just amazing, absolutely amazing. That sense of urgency made that happen a little earlier than perhaps it should have or would have in a mainland community, where this business of assembling the critical mass of musicians wouldn't be quite such a problem, but here it's critical. It makes a big commitment to get somebody to move here. Exactly, exactly. And so that was why, in 2012, the Hawaii Symphony Orchestra, as it now is, came into business. But it came into business a little under-capitalized from where it should be, making a very difficult job, even more difficult. Not uncommon for a lot of businesses to start under-capitalized, so but it's still a challenge. But with a lot of businesses, you can start, smile, and grow with a symphony orchestra. You need those 65 musicians. You can't start it with a triangle and a flute. It's just not going to work. But the response from the community was wonderful. Standing ovation went on for half, I don't know, a long time. It seemed forever. When they first came out on stage, it was just glorious. Now, at that time, I wasn't involved with it. Of course, I was from public radio. But I've attended a lot of concerts since, and I've been aware of what it takes to make this organization happen. And I've become a great deal more aware since I joined the board a few months ago and have recognized that, boy, oh, boy, this is a real, a real heroic effort that's being made here. They're serious about it. They are serious. If they weren't serious, it wouldn't be happening. And it is happening in a glorious way. But it needs a lot of shoulder to the wheel sort of stuff. And at one point, at some point, I was invited. I was suggested that I take over the presidency of the organization or actually become president because they didn't have one before. And I agreed to do that. And I wasn't looking for another career. I'm still not. But I do care about this organization. And so I've been hanging out of the office the last little while, and now I have my own little cubicle. And there are a lot of time. And my personal objective is to get this organization onto a business-like footing. Because of the initial undercapitalization, it's been a bit bumpy for the first five years. We're coming into it. We're in our sixth season now. But we've been losing money each year. And that accumulates.  So one of my objectives is to get us debt-free. And that was my initial objective with Public Radio. Because I think that's very important. And another objective is to construct a business model that is sustainable. And I think we're well on the road to that. As I've been saying to folks lately when I give little talks, we have a glorious future for this orchestra if we can just get through the present. We have two minutes left. And I want to get to a couple things real quick here. So number one, and remember, I'm a CPA by training. And so I look for this stuff. But is there an endowment program or something that is there? There is a foundation. It's a separate organization, separate company, essentially. And it's been in existence for some years and was a foundation that produced an income, or part of the income for our predecessor. And it's providing some of that income to this orchestra. It's a little complex. Because when the earlier orchestra went down, it went down having borrowed from that foundation, from the corpus of that. And we're having to put that right before we can get back to getting all of our due from that. One of the areas that can be focused on is to build that back up and get those balances higher. Now we've got probably less than a minute before we have to break. And I just wanted to, yeah, there's a lot of programs. There's a lot of events that are coming up. And you've got a couple coming up here soon for the holidays. Oh, Evans, yes. Well, we have our masterwork series, which is our classical music series. And we have some of the world's best artists coming in to work with the orchestra. Leonard Slatkin, the very first rank American conductor, is coming in to work with us. Longlong is coming in, arguably the greatest pianist alive right now. So that's the classical series. We have the Pops series, which we have a holiday Pops coming up in December. We have this weekend where we're doing two concerts of music by Michael Jackson, along with dancers and singers in the whole nine yards. And that's typical of the way we're trying to spread our wings a little to a wider demographic. And real quickly, where can somebody go to find out more information on this and maybe purchase some tickets and attend? That's the most important piece of information in this program. It'll be at the website, HawaiiSymphonyOrchestra.org. Which is on the screen right now. Oh, yes, there it is. Look at that. And you go there, we'll find a whole schedule. And it's still in a state of becoming for this season. And I guess we'll have all the information about the different programs and when they're going to be airing and how to get the tickets and all of that. And we have a little office in Kaimuki, and you're welcome to come by and chat about the orchestra or even better, buy tickets or buy a subscription for the series. Well, maybe early next year, we can have you back on the show again. You can give us another update on what's going on over there and how well things are going and what the other programs are that you got. I love it. And thank you very much for having me. Well, Michael, it was a pleasure to have you here. Thank you very much. This is Business in Hawaii with Reg Baker. We air every Thursday from 2 to 2.30. And I sure hope to see you next week. Until then, aloha.


Thank you for staying with us. You're still on the breakfast on plus TV Africa right now. It's time for a hot topic And we're looking at the consequences of government debt Well joining us to make sense of all of this is Muhammad Abdulahi is a public affairs analyst. Good morning, Mr. Muhammad. Thank you for joining us Yes, thank you. Okay, so we're talking about the consequences of government debt now We know that Nigeria is in debt most times we keep borrowing to service The things that we say we need Sometimes we borrow to even buy a hundred and sixty million NARA SUVs You had to bring that I had I just had to we we borrowed to You know have like good road transports we borrow for a lot of things now servicing this debts is another thing But I just want you to walk us through Why we borrow and the consequences of borrowing Borrowing itself is not It's not like I always say like the very big deal. I mean this is even even the biggest economies the US actually The biggest borrower. I mean if you look at the statistics they hold a large chunk of Money to Externally and internally but you want to ask yourself if you compare to a kind of society What do we borrow to do? I think that is the Most important thing Yes, like I said earlier large actually borrow as well but the difference between these developed economics and ours is the fact that They're both of you know to finance capital project to finance infrastructure to finance things that will have That will be of relevance. I mean to the larger populace, but in our own case is the other way around I was listening to the news yesterday or watching the news yesterday And it is astonishing that I mean the National Debt Office is saying we all bought internally and externally about 87 trillion That's in it that in itself is not a bad comment, but you look at What were these monies? I mean this one is that we're both What were the capital projects that were done? Are they still viable are people using it and then how do we repay? It means it's very much possible for us to repay these loans But in a case where we are borrowing to Finance consumption we are borrowing like you rightly mentioned to finance Luxuries like SUVs We are borrowing to finance Luxuries like the presidential yacht and so on and so forth then it calls to a lot of question because that in itself Does not give any guarantee that we will be able to pay because this like this lot these are expenditures In fact more financing to maintain them rather than You know generate profits from them So these are some of the biggest challenges that we have in this part of the world most of our boring things We are meant for financing our luxuries You know is is is so shocking seriously because I think at this juncture and at this kind of time We are supposed to have gone past This this kind of thinking I was really disappointed in the new government. I must be very frank with Nigerian You know, there are so many Things that the new government have initiated that I felt are not right for instance If even you government is coming and it's you know, we're moving subsidy telling Nigerians to tighten their belt and so on and so forth and then boom The president goes ahead and appoint 50 Ministers for God's sake 50 even surpassing That of the former president for hurry, you know, how do you find dance this foot? Chris cost of Governance when you are telling Nigerians to you know, tighten their belt when we all know that we have challenges You know again issue of COP 28 as well when the government is saying they had More than a thousand delegation, but the government said, okay, the only spider government Specifically said this person about 140 something. That's still very many You know, so you see you you have a lot of things that is going on that is not right because this money's are not even there We are borrowing for instance, perhaps we will go to the question later even our budget. We are budgeting 33 be 200, you know poverty-stricken because if you divide 300 33 billion by 200 plus million people You have less than 200 dollars for a year to spend as a Nigerian Yeah, but to shock you at least 10 10 billion dollars of that 33 billion will be bought by the federal government But again, you have in this budget a lot of revoluted You know 15 billion error to be used to to build a new government lodge for the vice president And so on and so forth the National Assembly is there adamant in spending 57.6 billion in buying luxury vehicles from a budget That you'll be boring at least 30% of that, you know So these are these are the things that we need to correct, but it seems we are not ready to learn our lessons. We're ready to keep Dodging in this attitude of borrowing just to finance our luxuries and keep improving the nation So it's it's really hard hard breaking. All right. So you highlighted capital Projects now in Bouchie state the court has ordered a contractor to seize 62.5 million worth of properties from the states because the state is owing this contractor So we're talking about capital projects that we are not even doing there are not there's nothing There's nothing no roads no Infrastructure, but then we're still boring. We're still boring so much and we can't really see what they're using This money is for shouldn't we be asking this government why? Why they're not as transparent as would want them to be and why can't we see what our monies are being used for? And you know, we need as a people just just a moment as you answer that we need as a people to know Really the consequences of this borrowing because once we begin to know That this is what is going to cost us as a people Maybe we'll start to ask the relevant questions that we need to ask and take more proactive actions So what are these consequences of these borrowings that we keep doing without the infrastructure, right? Like like we may sing on not just the economy, but on the people of Nigeria The consequences are numerous first and foremost you and I are indebted perhaps As Nigerians we are indebted to external bodies whether it is the IMF the World Bank and so many You know and so many international bodies even though you and I perhaps have not seen a cobalt You provide your own security to provide your own water. You provide your own electricity as a Nigerian and so on and so forth But again, you are indebted At the last count perhaps I can't really recollect but I know at the last count it said that perhaps every Nigerian Ours all these international bodies perhaps to the top to the tune of a three four five thousand six thousand dollars And so I'm not I might not be very court, you know, I can't really recollect but you know, it is that is it it is in that range So and like I earlier mentioned you as an individual provide almost everything for a second security I'm sure wherever you leave you pay people to secure your gate.  So that is That's the consequences. So we need to as a people Continue to talk. I think that's the best we can do. We can take up arms But we need as a people to continue to highlight this to the relevant authorities But mind you people are actually doing quite a lot You know, if you if you look at some of the things that private entities and the lobbies are doing for instance I don't know if I could mention them, but I know of a tracker ng in Nigeria, you know Would that that breaks down the budgets of Nigeria every year They follow to the latter Each monies that has been, you know, allocated for each folder, but I tell you this is December 29 2023 you go to see various things highlighted in Nigeria's budget 2022 just two days to the end of the year A lot of those things have not been done. Monies have been allocated People have taken the money and nothing and nothing has been done You know, a lot of them just follow tracker on social familiar. You'll be amazed at what You know, the so-called perhaps elites and people in government are doing to this country You see a lot of projects Highlighted I was I was on their page yesterday and I see a lot of things projects in delta state projects That are supposed to be done in schools and so on and so forth a lot have not been done And money have been dispensed, you know, so what is ICPC doing? What is EFCC doing? Private entities are going deeper to bring these things to the fore So it's it and like we said Monies are borrowed actually to finance this budget yet People take this money They don't even budget it At best people do shorty jobs. Perhaps jobs that are meant for 200 million I just don't perhaps 50 million or even less and then the rest are is is is looted So we need to continue to talk and people Nigerians at best are doing their very best You know, like I said a lot of initiatives are out there trying to bring this thing to the fore But it belongs on our government to carry out action as soon as possible And if you also mentioned about if you want if you want me to chip into that I think Bouchie is like we always have in this part of the world. There is no continuity in government That project that was done in Bouchie was in since was since 2009 2009 how many years ago now that was that's like I think 14 years Also, you go and the then governor was even Isayu Guda, not the present government But again the the project was done Delivered a letter of commendation was signed by the relevant government agency to say yes You have delivered this project. So what is stopping the payment 14? 14 years ago since 14 years ago The challenges again that we find so perhaps this present government is thinking oh, we're not the one that signed out of this project We're not the one that delivered this for you. So why should we pay but government is in continuity And this is some of the things that we lack in this part of the world, you know You find so many abandoned projects here and there Perhaps, you know, we keep Re-budgeting and re-budgeting for things that have been budgeted for in the past This present administration wouldn't maybe won't complete it. The next administration will come But then for the same thing for the next eight years, and then we keep re-rolling on the same spot It's our kind of governance is very fun here. Seriously So where do we go from here? What are the things that we can do even? The citizens of Nigeria to ensure that we are not borrowing because if you're telling me that as I'm here I probably own all about six thousand dollars. Where am I going to walk about six million? Yes, where am I going to walk all of that money to pay? So as a Nigerian, I'm already indebted Without me even trying to get money because I did not spend that money But yes, I'm indebted. So what can we do as Nigerians right now? To ensure that our government is not borrowing as much and even if they are Since they say borrowing is not such a bad thing as long as you're using it For the economy for the economy to flourish What can we do to ensure that our government is borrowing for the right reasons and then not borrowing for frivolities? Yes, I think there must be check and balances and then even though Um Citizens like you and I have a little to do but we still have actually a lot to also contribute For instance, I know uh in Kaduna state in the first dispensation of the last uh presidency Uh, you know, I know uh citizens rally, you know, they are They are they are representatives and senators at the national assembly to stop the former governor Kaduna states malam el-wufai from taking a world bank loan. In fact, if you look at the statistics Aside legos Kaduna is the second most indebted state in Nigeria So the then senators which caused a lot of brouhaha between the senators and the governor then, you know Said we are just taking a lot of these loans. What are we actually doing with them? If there is no capital project that will you know impact the life of Kaduna citizens We shouldn't be doing this and then they blockade the the loan Based on, you know feedback from their respective constituencies. I think this is what we should do a lot more I'm not saying you can't take loans, but please there must be a blueprint To say this is what we are Perhaps the loans even be channeled directly not monies paid into governance into government Covers the loans I mean if they are to be taken should be paid directly into the coffers of the project to be delivered You know, and then there are modalities to say by this but doing this and doing that will be paying back And so on and so forth So Nigerians like yourself and myself have a lot to do we need to continue to talk We need to layer small with our Representative at the nationality because they are the ones that need to check the Excesses and balance the excesses of you know the executive whether they are governors or even the president and so on and so forth So we need to do more. We need to bring to fall to keep talking and and and and to keep advising to keep writing letters or keep visiting our Our representatives at the national assembly at the state assembly to tell them What needed to be done? I know some of the maybe quite not all But I know many of the national assembly members, you know, have what they call Uh, a town hall meeting with their constituents perhaps every quarter or at least once in the year at worst, you know So we should take opportunities of uh, this kind of forum or this kind of forum to to to to pour out our mind To tell, you know our because they are representatives You know they should be there to do our bidding even though it's not always the the team But at least we should do our own best in making sure that we tell them where we feel things are going right Or where we feel things are going wrong so that there should be or there could be a kind of amendment on their own part Well, um Let me speak like a lawyer now I put it to you that those town hall meetings are not for the people Because you get to a town hall meeting as an ordinary man If you are even allowed to enter the the hall or wherever they're having this meeting You will never have a microphone to speak It's a selected few that will speak and they are given questions to to ask and all that So it's never a really never really something that the people contribute to but like you said, uh, we'll still Keep crashing the party and making sure that we say what we need to say But in in closing let let's just pick your mind on On an issue that a lot of people are not comfortable with some are comfortable some are not the issue of External lending bodies you just made mention of the fact that when you are going to take a loan You need to have a blueprint with which you you can tell the people giving you the loans How you are going to pay back it doesn't seem as if Nigeria has this kind of blueprint all the time They go cap in hand to the IMF for instance But IMF keeps giving us these loans that they know very well that most times the politicians just use it to To finance their their their luxuries and all that So do you think IMF is playing a good role in uh in growing our economy or Our relationship with the IMF is more detrimental than beneficial The personal opinion place yes You remember this this adage that Whoever Paid the pipe at the take the tune, you know So it's like that, you know the IMF and other international lending bodies They have their own strategy as well. So before even giving you the loan even if they know I'm just let's just assume they know that you are not using that loan for what is meant for They already give you some kind of policies and principles for you to do for instance devaluation of currency Yes, you know for instance, they tell you you must do this this way You must do that that way and because you just want to get this loan you go to do even though it's At the detriment of your citizen. We've seen a countless, you know situations like that You know, in fact, uh two weeks ago the world bank was advising nigerian government to hide Kill prices I'm sure you must have seen that. Yes. Hello, sir. Are you there? Oh, I think we just lost lost the audio there. Yes But yes, I mean, okay That was your audio is breaking. But if you're able to come back, just wrap it up with what you're saying Okay, we lost the audio. Yes, just wrap it up. Yes I'm saying Just two weeks ago the world bank was advising nigerian government to sell, you know, you know That's probably things they may do into the internal affairs of these countries that they give loan and because perhaps the african the african Uh What they call the african leaders are so insensitive as well to the plight of their citizens They go cap in hand accept all these stringent policies and the detriment of their citizens Just because they want to get this loan and they get this loan like you rightly mentioned the you know They they they indulge most of it into their frivolities and luxuries the expense of the citizens and then the citizens are left You know to pay back perhaps in 20 30 40 years time or so and so forth You know, so it's it's quite challenging I'm sure your question to answer your question directly these international bodies are also not helping the situation And you you wouldn't want to blame them because it is our leaders who are selling The citizens and the countries to them at a very cheap and a very very cheap rate. So we need to rethink Okay, okay. Well, I hope that that's just done because I don't want to be owing That that's all that's ringing in my head. I don't want to be owing $6,000 that I have to pay and if we keep, you know Getting these loans It's it will increase and in a few years you'll hear that every Nigerian is owing about $10,000 20 thousand dollars Well, I just leave and go to that country. I just hope that doesn't happen. But yes, we want to thank you for Coming and speaking to us. Thank you Mohammed. Thank you so much for joining us and we'll see you next day Hey, man Yes, thank you All right, we've been speaking to Mohammed Abdelahi is a public affairs analyst and we've been talking about the consequences on government debt But yes, we'll go on a quick break and when we return we'll be looking at our next hot topic. Please stay with us