Well, hello DEF CON. My name is Paul Craig. I work for a company called securityassessment.com. I live in sunny Singapore, possibly the other place that's as hot as Vegas. I'm a pentester. And basically I hack stuff. This is my world. Okay, so today's overview. This is a hack conference, right?  Why do I not want to see PowerPoint? Because PowerPoint is not hacking. All right, so I do have a slide deck. I'm going to go through my slide deck, but I'm specifically designing this presentation so there's actually not a whole lot of slides. I don't really like slides. We're going to do lots of hacking. Specifically, we're going to be hacking kiosks, internet kiosks terminals. So I'm going to explain to you guys who I am, what my fetish with kiosks is about, how I break into kiosks. And then I'm just going to break into kiosks, all right? And yeah, we're going to have some fun. Okay, so what is an internet kiosk? An internet kiosk, well as you can see from the picture just there, that was taken in the Rio. It's basically that little computer sitting in the corner of a room that has internet access. So it's usually an X86 desktop running some breed of windows, sometimes Linux. It costs you four or five dollars and you can browse the internet and you can do something on it. You find them mostly hotels, motels, airports, all these crazy places. Okay, so I kind of call myself the subproclaimed king of kiosk hacking. So how did this come about? About five years ago I got a pentest engagement working for a bank in New Zealand. And the pentest engagement was to look at a kiosk that they were deploying in the foyer of the bank as kiosks was plugged directly into the corporate network. So I rocked up, I was like oh I've never seen one of these kiosks before, I'm sure I can probably do something with it. And I found pretty quickly that I could. I could actually bust through the kiosk, got access to the OS. And then from the OS I had full access to the bank's corporate network in the foyer. So I didn't even have to go through the security doors.  Because I realized that it's the attack avenue that people don't really know about. It's the thing that works as well. So I was hooked, fascinated, addicted, obsessed. And basically I spent all my time hacking these kiosks.  But I knew right then and there that I just had to become the world's best person at hacking these damn kiosks.  All I did was hack kiosks. Whenever I saw them I had to get shell. And it actually became quite a problem for me. It became an addiction. It became something that really started my life. So I had to go see a psychiatrist. I found someone I had talked about someone and they said look man you have what's called an addictive personality. Essentially you can become addicted to things that aren't addictive.  Excellent. Okay, all right. You need a distraction I was told. You need a distraction. So like okay, all right. Distraction number one. Nah, it didn't really work so well. Distraction number two. Nah, it didn't really work so well. Distraction, well three. Instead of kiosks they just, they won. So of the eight stages of grief, the seven stages of acceptance. I basically realized that there's got to be someone in the world who's hacking these kiosks.  We can't have that. So I said screw it. Let's take ownership of my addiction. Let's embrace my passion.  Every vendor, every product, every platform, systematically, methodotically create and publish everything I do. I basically be very open about this and try and just rape and pillage all the kiosks. Yeah, more. That's basically one guy from New Zealand versed the entire kiosk software industry. So I wrote a list of every kiosk vendor I could find. There's like 22, 23 of these guys. And for each vendor I tried to produce a series of repeatable steps. I wrote tools, scripts, add-ons, plugins, all these things that helped me compromise these kiosks. And then I tried to compile all of my research and all of my tools into one place. I wanted it to be easy for all of you guys to basically hack a kiosk as well. They have me in a box so to speak. And of course, the fruit of all my efforts became ICAT, the interactive kiosk attack tool. It's essentially a software as a service website that you visit from a kiosk, right? And this website owns the kiosk for you. You click, shelves appear is basically how it goes, right? You guys see where this is going. So DEF CON 16, I rocked up to Vegas. I was like, whoa, I got this thing called ICAT. Check it out. And it went well. It actually went really, really well too well. During my presentation I said, you guys know that you can hack all the kiosks in the RIV in about 10 seconds. And they did. For anyone who was at the RIV, they actually had the security guards in and they had the police there and they've been guarding the kiosks. Because basically people were just popping shells, defacing them and having porn up on all the kiosks. And this really began the cat and mouse game of kiosk with me and particularly with kiosk vendors. So the majority of kiosk vendors found out about ICAT. They watched the presentation when the videos got released and they started fixing all of the stuff that I found, all of my bugs. They also blocked ICAT, the URL. It's all right, okay, all right. A year later, ICAT 2, I rolled around, I found new bugs. I found new exploits, new tricks, new technologies.  So I did it again. And it was awesome. I got lots of shells. Woohoo. And then a few months after release, same thing happened again. They fixed it all. So I was like, okay, all right. I'm a professional hacker. You can't stop me. I will win. I'll just keep going. I'm very persistent. So next year, rolled around, DEF CON 18, I released this, ICAT v3. It's actually the same deal, new O-Day, new tricks, new magic. And also trying to just expand everything that I could own. So I focused on Citrix terminals, touch screen kiosks, photo kiosks. Basically anything that you could interact with touch, you could pop shell on, all right. Yeah. The downside of this sort of approach is that I've actually single-handedly raised the security bar for internet kiosks terminals. Because every year these guys fix, like, vast quantities of bugs. Yeah. So it's good for you guys. It's also good for you guys to clap. This makes my job a hell of a lot harder. All right. So DEF CON 19. I came up with, well, I said screw it. Let's do it again. So ICAT 4, ICAT v the vengeance edition. Basically I'm making vengeance against the kiosk vendors. ICAT is now used by about 35 to 40 kiosks per day all around the world. I see airports, hotels, lots and lots of places, lots of casinos. It's now become basically the de facto standard for hacking a kiosk. And vengeance is by far the smoothest, easiest, mostly bug free kiosk hacking tool. It also features this very nice commission to artwork of the ICAT girl holding a bloody heart. Yeah. So this is what I'm going to be hacking some kiosk with today. Oh look, here's a kiosk we hacked earlier. This was actually in Vegas yesterday day before. So you can see just how well it works. Okay. So a little bit about how kiosk works, how the kiosk security model works. Kiosk vendors obviously take security very seriously. The reason they take security very seriously is that a secure kiosk product is not a cheap kiosk product. So you see lots of words about monitoring and protecting and blocking and restricting. Yeah. Use access system management, PC lockdown, access controls. Basically they try and stop me from doing stuff on the kiosk and stop you guys. Now how do they do this? They do this through four distinct methods. Firstly they have what's called user interface security. You find that on a kiosk you're missing all the buttons. You're missing maybe like the start bar, you're missing menus, toolbars. Yeah, you're missing the functionality you want. You're missing the way to get to explore a pop shell. Second thing you'll notice is that you have an activity blacklist. If you do pop shell, the kiosk will probably detect that you popped a shell and then try and close the shell. You're like oh no, you're running a tool which is prohibited. Thirdly the kiosk is usually running in a hardened kiosk environment. So you will find group policy, SRP and app blocker around the kiosk. So they try and restrict you and block you at every possible level. Okay, so this is an example of how a kiosk basically locks itself down. This is site kiosk.  We see that when we run site kiosk, just how much the XP desktop environment changes. So we have standard XP here. Run site kiosk, bang, the start bar disappears and it gets replaced with this one which is a kind of clone. It's kind of gummy, you know, like it's missing all the stuff. And we're now inside the jailed kiosk environment. Now inside their little shell. Alright, so these are the things I've learned about the kiosk security model. Firstly, blacklists don't work. In the security industry we know that blacklists do not work. If you stop me from doing one thing, I'll do it a different way. Because there's like 10 million ways of doing the exact same thing on any modern operating system. The second thing I found was that websites you visit from a kiosk terminal usually have more access controls or access rights than you as a person on the kiosk itself. Alright, so none of the vendors really took in consideration of the remote attack. They just didn't think someone would do it. Thirdly, the underlying browser libraries that these kiosks are based on, they're usually IE. Alright, so IE has this security model where it basically trusts the dual on the keyboard. It'll ask you, it'll say, do you want to run this? Are you sure you want to run this? This can potentially come from a malicious website. Well, if you're hacking the kiosk, you say, yes. This is a problem. And lastly, Microsoft has these 10 immutable laws of security. And basically law number three, if a bad guy has unrestricted physical access to your computer, it's not your computer anymore.  Alright, so operating systems will trust the local users so kiosk is against the grain of the operating system. Essentially, the kiosk vendors have the hardest job in the world because the operating system is trying to contrast what the kiosk software is doing. And all you need is one instance. All you need is one instance where the kiosk platform will trust you and then bang, you got shell. And as you'll see, it's very easy to get shell. Okay, so hacking kiosk. The great thing about hacking kiosk is that it's really goddamn easy. It's like solving a puzzle. Essentially, the problem is how do you pop shell without a star bar? Alright, maybe you go like file, open, then find star, or find cmd.exe and run that. Maybe you find a creative or a different way of using windows in order to get what you want. It's very visual. It's very easy to follow. And I actually think it's very hackery, you know, like you can almost see this in hackers, the movie kind of thing. Alright, so this is my approach for breaking kiosk. This is a quick rundown on my methodology. First thing I do is I try and identify the platform and the vendor software in use. I figure out what my attack platform is. Alright, I'll show you guys ICAD and I'll run through how I do this using my tool. But essentially I have a button that says detect applications.  We can also visually tell quite a few things. So this is a Linux kiosk. I can tell it's a Linux kiosk because the mouse cursor isn't as well drawn as the windows one and it's got that funny little stock watch thing. The buttons have a different level of depth and a different amount of color but you can tell that this is Linux just visually by looking at it. On the other hand, this is windows. We can tell the mouse cursor is different.  Yeah, we can visually really identify what our platform is. So the next thing I do is I try and enumerate all of the available windows. Alright, so what I'm looking for when I say enumerate windows is I'm looking for a common dialogue. I'm looking for an open file, print file save. The reason I want file open or file save is that these controls essentially use explorer and explorer is webdav enabled. Alright, so let me put this in a different way. If I can get notepad to spawn up on a kiosk, I can use notepad and go file open, htdp colon four slash four slash file and it will download that file and put it into notepad because the file open box is webdav enabled. It's essentially a web browser. So anything that has file open, we can retrieve files. Anything that has file save, we can actually save files remotely using webdav. So we find creditcars.txt, we can file save to another place. The third thing I do is I try and enumerate all of the applications that are installed. So I look to see if there's a pdf reader installed, is Office installed, Microsoft media player, is anything installed on the kiosk that I can potentially leverage to pop shell. So can I load a pdf file which will then load cmd.exe? Can I load an excel file which will have an embedded cmd.exe inside of it? In all these file format tricks, can I use another handling application to escape out of the kiosk gel? And we can also try different methods of trying to retrieve these files. We might find that a kiosk will restrict downloading XLS files, but if we download like file.xls question mark.txt, then the file gets retrieved. So these are standard vulnerabilities, typically web vulnerabilities that we see in kiosk software. So yeah, I had this email. I get a lot of fan email, I guess you'd say. And it's a dude from Egypt. And he was like, hey, Paul, I want to hack the Egyptian tax kiosk.  So I was like, okay, all right. I think I can work with this. I've been talking to DiDler Stevens at the time. And DiDler come out with an Excel in-memory trick where he basically uses Excel to create a section of memory, marks it executable, and jumps into it. And that section of memory contains cmd.dll. So you get a command prompt loaded inside the context of Excel. So I basically took DiDler Stevens stuff. I have my own code signing certificate. I signed all his macros. And I created this tool called OfficeCat, which I gave to this Egyptian dude. It's the Excel file. It's the example of using Excel file to basically escape out of a kiosk environment. You just open it up, get an open command line, wait a few seconds, yeah, then a command prompt pops up. So this is an example of using a relatively innocent file type to escape out of an environment. The fourth thing I do is I look for registered URI protocol handlers. So I look for things like mail to, call to, HCP shell. I try and install my own browser add-ons. My own browser plug-ins. So iCat has Java, ActiveX, Clikwans. Yeah, I got all sorts of things. And I also look for any internal URI handlers that the kiosk software might have. So is there an admin colon four slash four slash? Things like site kiosk have their own SK admin URI handler where you can access an administrative interface. Then I try and install my own browser add-ons. I got all sorts of all sorts of things.  I had so many cool little nifty plug-ins. And all of them were unsigned because I don't have a code sign.  So they basically blocked any unsigned plug-ins from being installed on any kiosk. Like clearly, this evil hacker can't afford to buy a code sign certificate.  Like, oh man, seriously. But it was actually a kiosk vendor who contacted me. And I said maybe we can do a partnership here and I'll tell you some problems wrong with your software and return you give me enough money to buy a code signing cert. So I helped them secure their software. I got a code sign. So now you'll see that all of my plug-ins, all of my tools, all of my files, absolutely everything I have have been signed by Shiny Soft Limiters. So this basically gives you the best possible chance of getting your add-on of your plug-in installed on the kiosk.  Because when you crash the kiosk environment, guess what happens? You get to the desktop. Well, that is really damn trivial. It's very, very easy.  I mean, it's not difficult. It's very, very easy to pop out of a kiosk using this trick. So I call this emo kiosking. Now the seventh trick I find, usually once I've popped shell on a kiosk, I try and hack the windshield itself. So windshield hacking is essentially trying to manipulate the gooey environment that's shown me. So when you are using a Windows desktop, obviously the windows you see are not all the windows that are available on the desktop. A lot of windows are marked WS visible equals false. And you might have some really interesting windows here. You might have admin windows. You might have backup software that's running. You might have tools running in the sys tray which you can't see but they're still there. So I've developed a whole lot of tools which basically allow you to make visible, right? Windspies. You click buttons, more windows appear, use those windows you escape. Alright, so what's new in iCat 4? So, firstly, I've been finding that a lot of kiosks these days are deploying more and more SRP. SRP, Group Policy and AppLocker. Really trying to restrict, like you cannot run CMD.exe or any binary signed by Microsoft. So I was like, okay, alright, how can I get around this? How can I defeat this? So what I did was I wrote a little tool which traversed the entire Windows file system and heuristically looked for any calls checking local group policy. Or checking SH is restricted. And if it finds that, it knocks it out. Or it patches it out, alright? So this basically gave me about 100 binaries out of Windows which do not validate local group policy.  I then took all of these binaries and I relinked them, alright? So by way, the executable now looks noticeably different. Okay, so two down. Then I signed it with my own code signing certificate. So it's no longer signed by Microsoft. So if you have an SRP policy which says block Microsoft, it's not signed by Microsoft. The three down. And I'm basically left with a nice little executable that you can run that will just work. I won't validate anything, nothing blocks it and it just works. So iCAT's now full of this stuff. Yes, there you go. There's another example. Unlocked CMD to time by showing yourself. I discovered that sometimes there are files on Kiosk that you want to view. Sometimes you want to view like a credit card stock text. The only problem is they remove notepad. There's no text editor, you can't spawn notepad. So I thought well why don't you just upload the file to me and I'll reflect the contents back to you. So you select the file, say I want to view this file, use the file and it'll send you back the file contents so then you can look at it. So it's pretty handy for config files. Particularly Kiosk, Kiosk config.cfg kind of thing that contains admin password equals. Very easy way of retrieving information. Now registry files, system config files. Yeah, it's pretty handy trick. Then I decided it would actually be really handy just to wrap Metasploit around this entire thing. Like what the hey, I mean Metasploit can help me. So I set up an modification of browser auto pane, called icat auto pane. Which basically, you know, one click and it uses a download and exact payload and that download and exact payload. We'll then try and spawn shells and privask and spawn shells.  But it's fully Metasploit on the back end. Now this is handy when you have commercial Kiosk shipping with flash six, which came before. This was like an up to date Kiosk product that I found.   However, there's way too much clicking. I have to do too much work. You know what you need?  And that button is Pone. You know what man, you're right. You're really right. I kind of scripted and automated everything. So I've got this little page that will basically detect what the Kiosk is, finds what's installed and it says okay, well you want the .NET exploits, you have Java, so I'll give you Java and I'll throw you Metasploit for good luck.  It tries absolutely everything. Yeah, my best ideas always come after drinking. Okay. So enough talking, right? This is a hacker conference so we are going to be hacking four different Kiosks. These are the latest versions of these Kiosks. These Kiosks vendors, they've patched their stuff, they've fixed their stuff. We're going to be hacking Kiosks Netstop, which is very common in Vegas. Not that I promote Kiosk hacking. Web Converger, which is a Linux based open source Kiosk, just so I can show you guys that Linux products are not more secure than Windows and that you can still see. We're going to hack My Cafe Cup, which is one of the most popular in Europe. If you guys ever visit European internet cafes, then finally we're going to hack Morphix, which is another open source Linux Kiosk. And of course we're going to do this all live, unrehearsed. There's no videos.  So security cons have always been told that before you do a live demo you have to sacrifice a version. This luckily is very easy at a glance. Alrighty. So this is my standard XP desktop environment. I'm going to run up the Kiosk program. Anyone here recognize this UI? You've seen this around maybe? Right. I'll get my $5 per inch of the machine. I'm going to surf the internet. Fire up the web. Cool. Now I heard about this cool site. ICANN.HA.CKD.NET. Sorry, this site's not allowed. So this was the first thing that this vendor did. He was like, well, you know, screw Paul Craig. I'm just going to block ICANN.HA.CKD.NET. So well, I said I'll screw you. I'm going to set up a DNS wild card. So basically anything .HA.CKD.NET goes to ICANN. Woo! Simple stuff. Simple stuff. Okay. Here we are at ICANN. This is it. So the first thing I really want to see is what's installed, so I'll detect all my applications. So this uses a bunch of different tricks to basically figure out what's installed. Okay, it's told me I have net.pro kiosk. I have ActiveX, Java. The .NET CLR is installed and I have click one support. Click once is kind of a funny thing. Most people don't really know what click once is. Essentially click once is being able to deploy .NET application through a .application file, if you have the CLR, if you have the .NET framework or the CLR installed on your computer, you can run click once applications. I also have Windows media player, net meeting, yeah, detected Microsoft .NET framework, one and two, MSN messenger and movie maker. Okay, all right. Let's start from the top. Common dialogues. Okay, so can I get to a file open dialogue? Okay, it's function not supported, security reasons. Can I get to a file print dialogue? Okay, I can get to a file print dialogue. And a printer. Okay, so I'm starting to like try to enumerate all my windows, I can add a network printer. I need to get to a, you know, like print to file would be the best way, but you can see it's been great out. They've tried to disable this. So actually the print dialogue here, we can't get to any common or good common dialogues. File save as dialogue? No, can't do that. All right, can I, can I get an UI handle popup? Can I use call to? Okay, so I can get net meetings the spawn, okay? That's handy. What about HCP? A E E, HCP spawns? Well that makes it too easy we're not using command prompt. So really the only thing Kiosk Vendor did here is they blocked the ICAD.HACKG on it. But no no no, this isn't share! As we can see the command prompt has been disabled by our administrator. So they're using disabled CMD, which is the local group policy to block me. So we haven't won yet, don't get too excited. But we're getting close. Okay. Can I download a tool?  So unfortunately, they're not nice enough to give me commercial versions of their software. Okay. We can't download things either. Okay. All right. So I know I had .NET installed. Let's just try and run my sign. Click once to talk. Can I do this? Tick, tick, tick, tick. Launching application. The second I see launching application, I have one. Okay. We wait. This downloads about 10 turn-and-a-half meg of binaries, tools. It basically downloads all of the ICAP suite, everything inside of it, directly into the kiosk. And then we're going to see if we can bypass the local group policy so we can get that command prompt up. Okay. Are you sure you want to install this? Yes. Installing. Okay. Awesome. Now I have ICAP click once. Okay. I want user shells. Okay. All right. So this tried to do Mike Rusnovich's SRP bypass. So we might have bypassed SRP, but local group policy stopped us. Okay. This tried to spawn local CMD. That didn't work. This tried to spawn different versions of CMD. It didn't work. And this one, well, that worked. Okay. So now I have shell. Awesome. Okay. But you know, I'm Paul Craig.  I can't do anything in this. What I want is system. So I just clicked spawn system shell. Okay. Let's try that again as we get to doing live demos. So that was using Tavis' NTVDM allowed trick to spawn a local shell. That actually usually works. That's the first time that's blue screened. If you guys are interested, I can show you this again. See, since I've run it, it's actually now installed it. So I can just run this. We'll just try one more time. Task manager process. And we should see, ICAP.exe is now running a system. Okay. So I imagine we're still in the kiosk environment. I know a system. Yay. Yay. Okay. Now, let me show you guys another trick I found recently. So I showed you the command prompt was disabled, right? We type cmd.exe. We get this. You know, the command prompt is disabled by your administrator. You guys remember command.com? Type command.com. We get this, all right? But we type dir and it says this command prompt is disabled by your administrator.  Because inside command.com, I can do stuff like this. Do C and D. I can't do that in cmd.exe. But if I type dir, it doesn't work. Okay. So what about if I typed C colon pipe 2 dir? Oh, that works. Oh. So that's actually a little Microsoft Ode there. That's a little trick. So we can use C colon, 4 slash, pipe 2, notepad and notepad spawns, even when the command prompt has been disabled by my administrator. Thanks, administrator. Okay. So now we're going to hack a Linux kiosk. It was actually really funny. When I released the first version of iCat, there was a bit of press about it, like, oh, this Kiwi guy found all these ways to hack internet kiosks.   So I went out to basically hack all of the Linux kiosks because I don't buy that they're more secure. I paused all my VMs. Hang on. I have to just start this up again. I didn't sacrifice enough versions this morning. Yeah, so I went out to basically hack all of the Linux kiosks, but the trick for hacking Linux kiosks is completely different. You can try and do something completely different. For starters, you're not trying to pop CMD.exe. This is the first thing I learned as I'm really a Windows guy. We're trying to pop USR-BEN X term. That's the goal, right? The platforms obviously are not IE based at all. We don't have any of the standard Windows tricks. We have to do everything in a relatively Linuxy way. The kiosks used in Linux are primarily Firefox based, okay? So we just got to think about Firefox tricks, Firefox plugins, Firefox add-ons. I wrote my own Firefox extension, which will try and hack Linux kiosks based on Firefox or Windows kiosks based on Firefox. And, yeah, I actually had a lot of success. All right, let's go now on my computer, response, 1, 2, 1, 6, 8, 1, 1, 2, 8. Okay. So it's detected a non-Linux Windows kiosk, which I kept. Okay. Let's, first of all, what can I do here? Can I download a file? Can I download? Shit. Can I download? I've got some shells. Okay. I can download files. Okay. But if I download the file, how do I spawn it? Well, Linux users, how do I spawn a file without a start bar? I'm in this restricted jailed environment. So my first idea was I should reconfigure the kiosk. I should actually reconfigure the whole thing. It's using about, colon, config. All right? You go to about, colon, config, and you get to the whole config of the kiosk. I'm like, okay. Maybe I can hijack something. I can hijack something to sort of detour and run USR bin next time. It's a really simple trick. So let's say, like, I'm going to look for the printer. We'll go for the printer. I'll look for LPR. Okay. So we can see the printer here is LPR, MOS, print name, MOS. The printer is USR bin, next term, printer is USR bin, next term, look it back, common dialogues, file open, file print dialogue, yeah, print that, very, print it. All right. So once again, though, we have shell and we're basically a non-preview user.  This isn't enough for me. So because we can download files, let's get root. Okay. So I have this thing called get root. Let's download this, save this to disk. And then we'll go back and print the page again, put another shell. Where would it download to? I'll just download it again. This can be faster. So now we've got root on the kiosk and it's zero. But it was actually particularly easy because this kiosk is still shipping with <IP_ADDRESS>. So yeah, not very up to date. All right. Let's hack another Windows kiosk. Let's hope for some better results this time. Okay. So this is this kiosk. We've got to log in to the kiosk, log in. Okay. All right. And now we see we've got this timer down the bottom. It's like, yeah, you've got $990 left. This is your environment. We'll basically get Windows environment. Okay. We try and pop the shell. Okay. It's been disabled by our administrator again. Okay. Sweet as. So let's run up a browser. We get standard IE. We'll get a icat. Let's see. Let's see. Do you down there? Let's see. I cat. All right. So the trick here is what have they stopped or what haven't they stopped? So can I download files? Can I download this file? I can download files. So you know, I think they're actually thinking that since they block cmd.exe or disable cmd, that you can't pop shell because cmd validates disabled cmd. But my cmd.exe doesn't validate disabled cmd. No, I have shell. That's too easy. That's way too easy. What I want to try here is that I actually want to get someone else's account. I want money. You see the logon thing at the beginning? Yeah. I'm going to go for that. So what I'm going to try and do is I'm going to try and hack the UI shell. I'm going to use this make visible tool.  Now the reason I want to do this is because of this thing sitting in the corner. This tells me that there's actually a whole lot of interesting process. There's a lot of stuff running here that I probably can't see. So this shows me all the Windows and obviously all the ones that are highlighted are currently visible. Scroll down. Scroll down. What's on here? Okay. Logon. Use a code password. Oh. Sorry. Sorry. What's this? User rates. Users. Oh. Right. Okay. Let's add a user. Defcon 2. So basically how the application works is that when you log on to the application, use the correct username and password, it makes this window visible. Well, that's fine. I'll just run my little tool which makes the window visible. I don't need to log on to the application. Yeah. We basically have, yeah, we have full access to this. And try for good measure. Can we get system? Yes. Thank you. It's better. Well, it works with system. Task manager doesn't, no, task manager doesn't want to come up. But anyway, we have system. So that's another kiosk done. Then we got all the username and some passwords and we can add ourselves another account. Let's do another one. This one's a Linux one. So we've got a bit of a problem with this one. To be honest with you, I had hacked all the earlier versions of Web Converger. And I quite enjoyed hacking Web Converger. Then I read their website one day and in one of the support KBs, there was this guy who posted, like, oh, I found all these security issues with Web Converger. And he basically listed all of my tricks, everything that I had been doing. And asked the developers very kindly if they could fix it all. So they went out and they fixed absolutely everything.  So I downloaded the new version. I sat down and sat down with a coffee and I was like, I'm going to get this. I'm going to totally, totally get it. So, okay, what can I do? How I'd hacked this originally was that I was using my iCat Firefox extension. I'll basically say install extension. The software installation has been disabled by your system's administrator. Okay. Or I would just download files. So I'll download like this.   All right, okay. Can I disable this thing? Yeah, I'll be careful, I promise. Can I disable XP install? XP install enabled Boolean false. Status locked. So basically they have a file set which says you can't modify this and you can't install software. Awesome. Okay, so I can't really, I can't do anything with this. I'll say, what do I do? What do I do? So I think what are the Chrome resources do I have that I can potentially mess with? So these are all the internal zulls for Chrome. So you access like this page. Chrome global content config is about config. We can access the plugin install wizard. We can access tools options. I didn't really find much until I got to this. Safe mode. It's like, okay, I ideally want to get rid of Web Converger.  So I'm going to safe mode. Okay, disable add-ons. Reset toolbars. Yeah, reset. Disable, disable, disable. Let me change this restart. Okay, and now it's disabled. Web Converger. So now, well now I can download files to begin with. And there's no more Web Converger. So this is a good start. But I don't have shell. I don't have shell. I'm without shell.  It's okay. I need to pop X term. All right. So I went about like, can I pop X term? So USR, Ben, X, TR, they deleted X term. Like, ah, dude, how else do I do this? They break my balls, man. So okay. All right. Now I can download files. I'll just download X term. I'll save download X term. Okay. And then I need to download a loader. Because of course files I download will be marked non-executable. So I've got to download a loader as well. So download X term loader. Okay. Of course we need. Okay. Now I need to find a way of getting home, WebC, X term, loader or SH to run. Okay. So I go back to about config. Now because I have disabled Web Converger, I have my right click context menu. One of the best things in my right click context menu is you page source. So I'm going to hijack the page source viewer. Yeah, I'll be careful. All right. Source. Okay. So my editor is external, true. So they didn't lock any of these settings. And my editor's path is home, WebC, X term, loader dot SH. Go back and see if that works. Page source. Now that didn't work. Okay. Let's, of course, I can't just run the SH. I've got to have a, so my view source editor is binSH, which is going to run home, WebC, X term, loader dot SH. That's better. Sure.  So there you go. As you can see, it's pretty goddamn easy to hack kiosks. And I hack four of them right in front of you. Okay. So collaborations and donations. iCat is obviously a very open source project. It's free to you guys, but sadly it's not free to me. My code signing certificate will need renewing. My hosting is not free. My domain names are not free. I openly ask for donations. A little PayPal donate link. Please don't be cheap. If you like iCat, if you've ever popped a shell with iCat, give me five bucks. Okay. So some other goodies. I mentioned that I've been working on photo kiosks. I came up with this thing called iCat Photo, which is basically you can stick on a little memory stick, a little flash card, stick it into a photo kiosk. And it exploits orderon.m, all the L and K vulnerabilities. It has all the tools on the USB. So basically you put it in, you try and browse the device and it'll either crash and give you the desktop or give you a shell or the on-screen keyboard. So it's pretty handy. Pretty handy to keep on you. I also have iCat portable, so you can download the entire thing of iCat. If you want your own version of iCat, if you're doing a pen test internally and you want to have your own server running, you can download it. One big archive, it's all there. Okay. I've been working on something quite interesting at the moment. I've been working on a 10C++ iCat dongle, the USB dongle. This sort of, I was inspired by the PS3 USB malloc exploit, which basically uses the same piece of hardware. The idea is that can I attack a kiosk using the USB plug? Can I attack it using the one thing I haven't tried? So, the trick with the USB dongle is that I can simulate any other USB device. Okay. So the first thing that comes to mind is that I can simulate a keyboard. Yep. So I can send the keystrokes to pop up notepad, type out the contents of an exploit, save the exploit and then run the exploit. I can do this from my USB dongle. But that's not actually that cool. The thing I've been looking for is a way to get free internet access.  So, I can simulate any USB device. Keep that in mind, any USB device. Okay. Meet the microcoin, QL coin and note validator. This is based on a TL4 USB serial chip set. Basically, this is a USB device. You put money into it and it sends a USB signal. Serial basically says, dude inserted $10. The iCAP dongle, yep, you guessed it, goes through cycles and simulates all of these things. It tries like, on this one, now this one, now this one. So the idea is that if you have a USB interface exposed, you can plug it in and hopefully it'll say, user just inserted a million dollars. And then you have all the insnets you ever wanted. So hopefully I'm going to be releasing this towards the end of the year. My problem is that I need to collect all of these coin and note validators. Which are actually quite tricky to find. And the vendors are not so keen on sending them to me. That's it.  This is something that really, yeah, really consumes me. If you're interested in either donating to the iCAP project or you have an idea or a concept, you think you know something that's cool about hacking kiosks, come up afterwards, chat to me, tell me your stuff, give me your stuff. Yeah, otherwise you can buy me a beer. I'll give you around here. Thank you very much, Defconn.


Welcome to the session. In this session, we will discuss sales tax and that. First, let's discuss sales tax. Sales tax is a consumption tax which has to be paid while purchasing some goods services. This additional amount that you pay is at a rate specified by the government and also the sales tax is added to the cost of peak commodity. We can also say that sales tax is an indirect tax. That is, when we purchase some specified items from the market, we have to pay certain extra amount which is at a rate specified by the government in addition to the cost of the item and that extra amount is the sales tax. Sales tax is calculated in the same way as we calculate the percentage. For example, if the cost of a CD player is given as $200, 8% is charged on the purchase of the CD player. So this means amount of sales tax would be equal to 8% of $200 that is 8 upon $100 into $200. This is equal to $16. This is the amount of sales tax. After charging a sales tax of 8%, let us now find out what would be the total cost of the CD player. This would be equal to the cost of the CD player which was $200 plus the amount of sales tax charged on it which is $16 and so this is equal to $216. This is the total cost of the CD player. So if a person wants to buy a CD player of cost $200 on which a sales tax of 8% is charged, then he will have to pay $216 to buy that CD player. Next let's discuss about that that is the value added tax is a tax on the value added to a product, material or service at each stage of the manufacturing distribution chain. Now the manufacturing chain consists of the manufacturers which could be more than one and the distribution chain consists of the distributors, the wholesalers, the retailers and after that the commodity reaches the consumer. The seller charges that to the buyer and the seller discuss that to the government. That is collected by the state governments. Let's discuss some points on computation of that that is value added tax. First we have that the VAT is calculated on the value added by the dealer. So it's supposed that the dealer buys any article or an item for $100 and he says that item for $120. Now he will pay the VAT on the value added part only which would be $120-100 that is $20. So on $20 only that would be charged. Then next we have that is charged at a specific rate on the selling price of the items discount is allowed then that is calculated on the net selling price that is the selling price of the article after deducting the discount. That is the net selling price. Like for an item if the selling price is $100 and the discount is say $20 then its net selling price would be $100-20 that is $80 and so VAT would be calculated on this net selling price. Next is a dealer pays VAT at the time of purchase he charges VAT on the selling price while selling the item. Now as the consumer is the last tax point so VAT paid by the consumer is equal to the sum of the taxes paid to the government at various stages of transaction. Here is an example in which we have that the trader buys an item wholesaler for say $1000 and it is given that the rate of VAT 5% then the VAT paid by the trader to the wholesaler is 5%. That is 5% in $2000 is the VAT paid by the trader to the wholesaler so this is equal to $50. Now if the trader buys the item to a consumer for $1200 then the VAT paid by the consumer to the trader is equivalent of $1200 that is $1200 into $500. This comes out to be equal to $60. As we have that the trader buys an item from the wholesaler for $1000 and he sells that item to the consumer for $1200 so this means that the trader has added $200 that is $1200-$1000 to the value of the item. The VAT paid by the trader to the government would be 5% of $200 which is equal to 5 upon 100 into $200 and so this is equal to $10. Now let's find out the total tax paid to the government now this would be equal to the VAT paid by the trader to the government which is $10 the VAT paid by the trader to the wholesaler which is $50. So we have $10 plus $60 and this is equal to $60 this is the total tax paid to the government. We already know that the VAT paid by the consumer is the sum of the taxes paid to the government at the various stages of transaction so this is equal to $60 that is VAT paid by the consumer is $60. So this completes the session hope you have understood the concept of sales tax and VAT.


And welcome to the First Unitarian Society. My name is Kelly Crocker, one of the ministers here. And along with my colleague, Roger Birchhausen, we are joined today by Drew Collins, Linda Warren, Heather Thorpe, Daniel Karnes, Stephen Gregorius, and the Espinoza Forlenza family who will lead our chalice lighting. We're so glad to have you joining us virtually today. Though not together here in our beloved meeting house, we remain together through the bonds of community and affection. Here in this community, we gather to grow our souls, connect with one another, and embody our UU values in our lives, our community, and our world. We hope you will join us for our virtual coffee hour immediately after today's service and the information for that will appear once again on your screen after the postlude. And I invite you now to take a few deep breaths, to be present together here, to bring ourselves fully into this time and this space we share. Opening words come from Gretchen Haley. Cast your vision here, this life with so much worth saving, this fragile faith for the children born now, into the world as it is with the threat of war and whole continents burning. Offer the vision you've tried to talk yourself down from. Your wildest dreams, your audacious aims, the beauty that whispers to you to follow and build and become.  Be generous with your dreaming and brave. All paths to the future are born in this courage of imagination, this willingness to shed, to salvage, to start again to be this blessing to each other and to be blessed. Come, let us worship together. And I invite you now to join in our chalice lighting by lighting a candle at your house. Our chalice lighting words will be shared by the Espinoza for Lenza family. Let us hold the quiet moment together as our chalice is lit. As the wild wind bites, so does the still flame warm us. As the deep snow blocks our doors, so does the gentle flame bring us out. As the crackling cold air stops our breath, so does the radiant flame draw from us the words we need to give and to receive. Words of welcome, words of comfort, words of solace, words to challenge our minds and words to bring us to action. Let us gaze upon this, our common flame, so that we remember who we are and what we can do when we are together. Be well. For our message for all ages today, we'll hear a portion of a TED Talk by Janet Echelman, an artist. It is about her using stuff that is nearby to create something amazing in the world. This story is about taking imagination seriously. Fourteen years ago, I first encountered this ordinary material, fishnet, used the same way for centuries. Today, I'm using it to create permanent billowing voluptuous forms, the scale of hard-edge buildings and cities around the world. I was an unlikely person to be doing this. I never studied sculpture, engineering, or architecture. In fact, after college, I applied to seven art schools and was rejected by all seven. I went off on my own to become an artist, and I painted for ten years when I was offered a Fulbright to India. Promising to give exhibitions of paintings, I shipped my paints and arrived in Mahabalipuram. The deadline for the show arrived. My paints didn't. I had to do something. This fishing village was famous for sculpture, so I tried bronze casting. But to make large forms was too heavy and expensive. I went for a walk on the beach, watching the fishermen bundle their nets into mounds on the sand. I'd seen it every day, but this time I saw it differently. A new approach to sculpture, a way to make volumetric form without heavy solid materials. My first satisfying sculpture was made in collaboration with these fishermen. It's a self-portrait titled Wide Hips. We hoisted them on poles to photograph. I discovered their soft surfaces revealed every ripple of wind in constantly changing patterns. I was mesmerized. I continued studying craft traditions and collaborating with artisans, next in Lithuania with lace makers. I liked the fine detail it gave my work, but I wanted to make them larger, to shift from being an object you look at to something you could get lost in. Returning to India to work with those fishermen, we made a net of a million and a half hand-tied knots. Installed briefly in Madrid, thousands of people saw it, and one of them was the urbanist Manuel Solomeralis, who was redesigning the waterfront in Porto, Portugal. He asked if I could build this as a permanent piece for the city. I didn't know if I could do that and preserve my art, durable, engineered, permanent. Those are in opposition to idiosyncratic, delicate, and ephemeral. For two years, I searched for a fiber that could survive ultraviolet rays, salt air, pollution, and at the same time, remain soft enough to move fluidly in the wind. We needed something to hold the net up out there in the middle of the traffic circle, so we raised this 45,000-pound steel ring. We had to engineer it to move gracefully in an average breeze and survive in hurricane winds. But there was no engineering software to model something porous and moving. I found a brilliant aeronautical engineer who designed sails for America's Cup racing yachts named Peter Hepple. He helped me tackle the twin challenges of precise shape and gentle movement. I couldn't build this the way I knew because hand-tied knots weren't going to withstand a hurricane. So I developed a relationship with an industrial fishnet factory, learned the variables of their machines, and figured out a way to make lace with them. There was no language to translate this ancient idiosyncratic handcraft into something machine operators could produce, so we had to create one. Three years and two children later, we raised this 50,000-square-foot lace net. It was hard to believe that what I had imagined was now built, permanent, and had lost nothing in translation. This intersection had been bland and anonymous. Now it had a sense of place. I walked underneath it for the first time. As I watched the winds' choreography unfold, I felt sheltered and at the same time connected to limitless sky. My life was not going to be the same. I invite you now into this time of giving and receiving, where we give freely and generously to this offering, which sustains and strengthens our community, this community of memory, faith, hope, and love. Today's outreach offering recipient is the Community Immigration Law Center, which is a 501C3 nonprofit sponsored by a coalition of legal, social, and faith-based organizations wanting to contribute to the community and to address the unmet legal needs of immigrants in Madison and the surrounding areas. FUS has partnered with CILC in providing trainings and volunteer opportunities and as founding members of the Dane Sanctuary Coalition. You will see on your screen that you can donate directly from our website, FUSMadison.org. You will also see our text to give information there as well. We thank you for your generosity and your faith in this life we create together. Twice during my 25-year ministry in Appleton, I did a sermon titled, What I Would Say If I Was Leaving. So it dawned on me 15 years in that I had not experienced the freedom a departing minister has to cut loose and tell it like it is. I pride myself on being transparent, but still the mindset of, I'm out of here, can unleash the imagination and loosen the tongue in wonderful ways. So 15 years in, I began the sermon with the news that was, indisputably true, I was leaving. I was going to resign, retire, be fired, or die in office. One of those four things was going to happen, no exceptions. We just didn't know when or what the reason for my leaving would be. So I said that, and then I shared a few things that had been on my mind for a while. Ten years later, I used the same title to share some more blunt thoughts. This time, I did have a date of departure and a reason for leaving, thankfully resignation. Well, no wonder I was drawn to enter a ministry for this final chapter of my career. This is a ministry where I am pre-fired, where the date of my departure, likely anyway, is known from the beginning. So when I ventured into your lives in August, we all knew that I would be leaving this coming July. You knew from the moment I was here, and I knew this is how it would be. So I have been untethered. My imagination has been untethered from any anxiety about my longevity here. And I have to say, I'm loving this. So in this spirit, I want to share several observations about First Unitarian Society. And I should note that today is actually the end, this very day, of my first six months, so halfway through. I've not been here very long, and oh yeah, there's a pandemic, so I've probably met less than 10 of you in person. So take what I'm going to say with maybe a little bit of grain of salt, but also I hope take it seriously. My first observation, and this is the foundation observation, is that this congregation is built on layers upon layers of legacy, rich legacy. The first strand that comes to mind for me are the strong and packed full, sturdy ministries of these past 70 plus years, Kenneth Patton, Max Gabler, Carol Taylor, Michael Shuler, Ruth Gibson, Marianne Macklin, Scott Prinster, Karen Gustafson, and of course my beloved colleague Kelly Crocker. I'm so lucky to actually have known all those, but Ken Patton. The long-term senior ministries, especially of Max and Michael, jump out as a real deep legacy of riches. There's also of course the legacy of lay leaders who have been so, so wonderful, a devoted and skillful staff, dedicated members and affiliates who have given so much of their time and their treasure to FUS. I honor the gift of these thousands of people, including you. FUS is what it is today because of you. Every minister knows this. This place would be nothing if it was just the ministers. You are what makes this place work. And there is also of course the rich legacy of the building. Clearly, the dedication of the landmark building 70 years ago this coming Thursday was a turning point, a point that changed everything. From that point on, the congregation has had the blessing of an aesthetically beautiful and breathtaking building and the curse of maintaining it and working around the impractical aspects and the idiosyncrasies of the architect. Recognizing that the congregation had outgrown the landmark building and constructing a really amazing new addition and new worship space included is also a remarkable accomplishment in a lasting legacy. The treasure of legacy runs very deep here. A second observation about FUS is that another source of vitality for congregations, a sense of mission, is the need of renewal and reimagining. The state admission of FUS was adopted 18 years ago. A lot of you were part of the place then, but you have changed. Whole bunch of new people have joined since then and the context of Madison and the world has changed. Creating a new mission statement is generally not productive work for interim ministry and it's about killing me not to dive into that and I bet the same is true with my predecessor Doug Watkins. I hope that you will do this work early in your settled ministry. I hope you dive into this work with the kind of imagination exemplified by the artist and the message for all ages. Use the material at hand the rich legacy of this congregation to build something new and amazing and innovative. Let me add an important parenthetical note here. Reverend Kelly and the new minister and the board may decide that something else is more pressing than mission work right out of the gate this fall. If so, know that from afar I will support that decision a hundred percent. So please don't throw the observation I made just now about doing the mission early into their faces if they decide not to. I don't believe in curses or in haunting people but if I could in you ever say well Roger said I would like to haunt you. Whenever this mission work happens the reimagining of it will give FUS focus for the coming years. When there is not a compelling timely mission then it's very difficult to figure out what the priorities are and to zero in on them. This can be especially problematic in a large congregation where things can start spinning out of orbit. So we've practiced this year with a placeholder mission updating a vision for ministry statement from a few years ago and three strategic priorities. Ministry during the pandemic, centering anti-racism, anti-oppression work and supporting the ministerial search and transition. This is given focus and coherence to the board, the staff, the ministry teams and it's a small direction in the way that I think this congregation will go in these next few years. My third observation is there is continued internal work to do at FUS. FUS will not magically become a more thoroughly anti-racist, anti-oppressive presence in Madison or more multicultural without continuing this hard work. Overwhelmingly white UU congregations generally love to dream about becoming more multicultural as if the dream itself will make it happen. What actually makes it happen is white folks like me doing the hard internal work of examining our privilege, dismantling white supremacy culture and becoming more inter-culturally competent and there are some great ways to get involved in this internal work. Right now at FUS there's the racial justice learning circle that meets every other month. There's every month actually. There's next week's transforming hearts workshop that focuses on trans inclusion and next month an FUS group will be participating in Nehemiah's Just Anger program and there's still spots in that group. Keep this work up. Don't get sidetracked by fake fights and zero-sum games that simply are a diversion from this work that needs to be done. This work is urgent and it's also a marathon. There's another piece of internal work that we're planning to do in these next several months and that is to create a behavioral covenant. A behavioral covenant is a written articulation of how members of the congregation aspire to interact with one another. A behavioral covenant can help the congregation be intentional about articulating and embracing healthy interpersonal practices. For example, communicating directly with a person if you have an issue with them. It's important to note that FUS has a covenant called the bond of union that goes back to the beginning of the congregation in 1879. I don't envision a behavioral covenant replacing the bond of union. Instead a behavioral covenant more zeroes in on concrete behaviors and really is built on the platform of that sturdy long-lasting bond of union. Stay tuned for information on this behavioral covenant process. There will be ample opportunities for members of the congregation to get involved and I hope that there'll be a final draft for the congregation to vote on in the parish meeting in June. This is one way that we can more consistently make this a house of peace from the words from the first hymn. Not a house of agreement, not a house of like-mindedness. In fact, actually this kind of work, this behavioral covenant will help us embrace all the diversity of people and ideas present at FUS. And let me say one more thing related to this internal work. It's hard to know for sure because I've been here but a short time and there is a pandemic. But I have a sense that a fair number of people here may express dismay with decisions at FUS by cutting financial support and or stepping back from involvement. Of course everyone should give and be involved to the extent that feels right to them. But it's unhealthy in a congregation to use money or involvement as a cudgel to get your way. I like it when congregants feel unconditional love for their congregation. Even when things don't go their way they have such an abiding love that they continue to give their money and their time as generously as they possibly can. If you've been withholding support from FUS this year and in these past several years, I hope that you'll jump in. I hope you'll jump back in and I hope you'll be all in. FUS really needs you for this next chapter that's about to dawn. My next observation is that for the 30 years plus years that I've known FUS, I've always been impressed with the remarkably dedicated and talented staff you have. And this year has been such a joy to get to work with these fine folks. And there is a shadow side to having a talented dedicated staff. Their presence makes it a little less compelling to volunteer. It's easy to fall into the mindset of the staff can do this so I don't have to. More and more stuff then gets heaped on the staff and the absence of a fresh compelling mission compounds this the staff don't have a way of saying hey that's off mission great idea but off mission. A byproduct of all this is staff burnout and the development of a consumerist mentality among congregants. The reality here is that declining revenue has significantly shrunk the staff over the past six to eight years. This creates an opportunity for members simply put FUS needs more volunteers. This is difficult given that I know people feel really stretched in their lives but I believe that even super busy people can sometimes make space for meaningful volunteer activities. The key is to match people's passions with the needs of FUS and a second key is to develop a robust leadership development program that puts primacy a primacy on training folks not typically in the leadership here young adults and people of color for example. And a final observation FUS continues moving forward in its gradual decades long evolution toward being a more theologically diverse and inclusive congregation. As I said earlier this month digging deeply into our theologies and embracing the differences among us is of paramount importance in the words of the closing hymn we'll sing shortly. We do that that work as we drift along together our ships companions here at FUS joining in that work casting our questions into the deep and sharing what we get back with one another this is sacred holy work at the core of this congregation. My guess and my hope is that the settled minister that you call this spring will have a theology that's different from Kelly or Michael or Doug or me. I hope you allow your new minister to have a theological viewpoint and theological language different from your own without feeling like that somehow devalues your own beliefs. It does not. It's OK if your new minister is most at home in your winter solstice service or the more traditional Christmas Eve Vespers communion service or Diwali or a humanist holiday. It's all OK. There is space for all of you here in this inclusive congregation including your new minister. Rest easy in that knowledge because of its rich legacy and many other strengths FUS has been is and will continue to be a flagship congregation in our Unitarian Universalist movement. As remarkable as your history has been and in spite of considerable head wings going against religion these days I really believe that FUS's best chapter lies ahead over these next six months. May we together continue to sow seeds that will help this next chapter of FUS which dawns this summer and fall bloom with an abundance of energy imagination beauty and promise. Each week we gather with hearts that are heavy with sorrow and hearts filled with joy and celebration. We bring these here in community knowing that we are held in love. This week we light a candle of sorrow and loss for Gwen Harman who passed away on January 2nd. We send our love to her family and friends especially to the members of her chalice group here at FUS. We light a candle of sorrow for the passing of Anna Bender on January 17th. Anna and her late husband Dale were long time members here at FUS and also members of our Oakwood group. We will miss Anna's smile and warm welcome when we are able to return to Oakwood again. A candle of love and strength to Chris and Jill Carlson as they mourn the passing of Chris's mother Betty Valentine on January 20th in California. We send them our love and our strength as they remember the remarkable woman she was and all the gifts that she brought to this world. When we light one final candle for all the sorrows and all the celebrations that live within our hearts may we hold ourselves and one another in love and in gratitude remembering that we are loved just as we are that we are connected with all that is and that we do not journey alone. Blessed be and amen. My benediction words come from Barbara Peskin. Because of those who came before we are. In spite of their failings we believe. Because of and in spite of the horizons of their vision we too dream. Let us go remembering to praise, to live in the moment, to love mightily and to bow to the mystery. May you go in peace.


Everybody, we're back. Welcome to day three of HP Discover. This is theCUBE. I'm Dave Vellante. theCUBE is a live mobile studio. We go out to events. We land in, we extract the signal from the noise. We broadcast all day long. We've been here for three days now at HP Discover. This is HP's big European event. It mirrors the event that Hewlett Packard has in Las Vegas in June. HP Discover, it's the big customer event. In fact, HP does quite a bit of business in Europe, I would say in some ways this event has actually a little bit even more energy, believe it or not, than what you saw in Las Vegas. So big European contingent, obviously a lot of diversity and a lot of energy. So we're going to kick the day off today. Two great guests, Shilpa Luanda is here. She's the vice president at Vertica and Brian Weiss, VP at Autonomy, both of course HP companies. Folks, welcome to theCUBE. Good to see you again. Thanks, David. It's great to be here. Thanks for having us. So Shilpa, let's start with you. First of all, thanks for staying a little later. I know that a lot of your colleagues are hitting the road, but we're hanging tough here in theCUBE. So thanks for hanging with us. But give us the quick update from your perspective. What's going on at the show for you and for Vertica? So it's been a great show for us. We announced Vertica 7 a few weeks ago and we're just starting to see people's reactions to it and it's been just unbelievable for us. You might have seen that yesterday we had the Facebook CIO on stage with George Garifa talking about what impact Vertica's had on their business. And so it's been just a great show with lots of good customers talking on our behalf, as well as a lot of good customer interest in Vertica 7, especially with FlexZone, which enables us to do not just structured data anymore, but also structured and semi-structured data. And so it really is a huge leap for us. Yeah, it was a great testimonial from the Facebook guys. It was quite an amazing demo. For those of you who didn't see it, it's actually worth going back and checking out the replay. But the gentleman from Facebook put up what we thought was a map, right? But it was the points of light of all the users of Facebook and all their connections. And it essentially formed a map and you could very clearly see the map of the world and the continents. And he said, there was no map when we put this together. This is just points of light. It was pretty inspiring. Now, Brian, from the autonomy standpoint, we're starting to see this sort of monolithic, massive chunk of software being broken into pieces and web services created that HP is beginning to leverage across the organization. That's got to be really exciting. First of all, that you can actually do that with the architecture. And second of all, that it can now find that thousand points of light, I guess pun intended, across the organization. So give us the quick autonomy update. Well, you know, this is one of the benefits that we have coming into HP because you can take the resources of a company like HP and a platform like Idle, which really understands human information, right? And it helps us get insight out of that data in a way that most analytical tools can't do. But as you point out, the problem is that most companies have to invest in the platform. They've got to install it, et cetera. And what we've done over the past year is invest heavily in making it possible now for developers to access Idle on demand. So we're hosting it. And instead of having to put up software and index data and run your applications out, you can just ask the question. So for example, something like image recognition or sentiment analysis, for example. If I'm a coder, I can take that block of code and say, look, I'm going to forward you this image. Tell me where the faces are. And I can build that right into my applications right now. So the functions inside Idle can now be exposed very quickly and easily. We've got some great examples where we're building apps in a day based on a lot of these robust functions. Yeah, so when I look at HP's software strategy, we heard George Kadeefa yesterday and he sort of laid out the portfolio and the capabilities. It seems to me that the big growth area, I mean, it's pretty obvious, is the whole big data platform. However you want to sort of define that. And that's really what Haven is all about. But there's this big white space that we talk about all the time and sort of an algorithmic bond. There's not a lot of big data apps. And big data apps are hard. And why is that? Well, you need domain expertise, you need data science, you need technology, you need tools to build apps. And they've been lacking, haven't they? Well, I think that's true. I think what's helping my experience with this is that the problems that we're really focused on in big data are the ones that are on the extremes. It's the intense amount of machine generated structured data and how do you do that? You can't really do that with normal relational database tools. It can't happen. Or human information, what does it mean? How do you get the sentiment? How do you get that understanding that you and I get very easily from reading or looking at something? But the computer doesn't understand. So we live at those extremes and that's really where the most value is and we're putting a lot of effort into making a platform that you can develop. So Haven, right? Let's just break it down. So it stands for Hadoop, Autonomy, Vertica, Enterprise Security, and N. The N is for N apps. N apps. And then if you add enterprise services and enterprise group to that, you're in heaven. Right? So I'm in here first. Okay, so the idea is I'm in application development heaven for some of these emerging big data apps. Talk a little bit more about Haven platform. Shilpa, just from an architectural standpoint, what should we know about it? Yeah, so Haven basically gives you all the building blocks you need to essentially analyze all of your information. So it's not just structured data or human information, but it gives you the tools to really put them together. So to give you an example, let's say you're a telco and you're trying to find out which of the customers that matter to you, right? So there's a lot of information you can collect from your call detail records and so on. And a lot of that is structured or semi-structured information. Vertica can do great with that. And we have, you know, I would say seven out of 10 telcos in the US are our customers. So now what if you have call logs from your call center and you want to basically find out what are people really talking about your products when they call your customer support? Like, are they happy or are they experiencing dropped calls and things like that? That sentiment that you need, that's human information.  What were the words they dropped or, you know, are they happy customers? You really want to focus on your unhappy customers and those are the people you want to send your emotions and so on. So this churn analysis is a major problem for telcos. And that's not a Vertica sweet spot. And that's not a Vertica only solution.  And these, this processing, all of your information is I think what's going to be the edge. Once everybody starts doing big data, then what keeps one company different from another one? It's what you can do with all the data. I mean the point is to be able to get insight, right? Insight out of information and be able to do that. You have to be able to understand it in human terms and be able to handle a massive volume. So it's great to know that you've got, you know, you get a 10 million calls between 10 and 11 o'clock and you've got a lot of data points about every phone call. But were they mad? What do they talk about? You can't get that data point without understanding and analyzing the actual call itself. And of course we can't listen to these calls. The computer has to do it for us. So if I were a head of application development at a telco, let's say pre-haven, and I wanted to solve this problem, I got relational databases, I maybe have some column stores, I maybe have some way to analyze unstructured data. How would I go about actually building those apps and how would haven change my world? Yeah, so previously, I mean, I think this is the kind of app that I don't think people normally do today. Yeah, it's too hard to just say, this is like, you don't even know it's possible. Wouldn't it be great if? So essentially they would do it in silos. And then try to put the information together and squint through it and.  But that's metadata, right? That's not leveraging the data in your human information, right? So now, on the other hand, you know, Vadeka can do a lot of analysis on the machine data on the call logs and on the call detail records type of analysis. But that doesn't again give you the human, you know, so the combination is, I don't, I think those are the applications that so far haven't been built. And that's what Haven gives you. And look in that equation, what idle autonomous technology doing is telling you the ideas that are in that phone call. What did you and I talk about? It's telling me the main concepts, it's telling me the things that are related to them and it's telling me whether I was mad or not in fairly subtle details. And there's a lot of data points that come out of that. And so now I can use those two together and build an analytical app that says, these guys are mad about this topic and this particular geography and most of them are getting drop calls here. Those sort of things are now visible immediately. So, so Haven is an out of the box platform. It comes with a Hadoop distribution of my choice. Is that right? Or maybe it's Apache, right, Hadoop. And then I get Vertica, I get Autonomy, I get my security piece, and then I get development tools. Even if you don't need all of them. So our focus is really, look at your use case and figure out which blocks do you want to use to build. So for example, there's another example could be Vertica and ArcSight together for a security analytics application. So you might have, you might just buy those two components if you need those other, only two Vertica and Hadoop is another combination that's very common. So what I'm trying to get to is technically or maybe not even so much technically, but what do those building blocks give me? It's from in terms of developer productivity that I wouldn't have otherwise. In other words, they work together. What does that mean? Architecturally or technically, and then ultimately productively? So essentially gives you APIs, right? So it gives you APIs as well as it gives you sort of, think of it as reference implementation. So we have the developer portal as examples of how you would put these two things together. What are the APIs you would use to put these things together? So the other thing you get David is connectivity. So in order to be able to get the data, whether it's human information or structured data or logs coming off of your ArcSight, for example, you need to have connectors. So we have connectors from all the libraries, whether they come from autonomy or ArcSight that actually allow you to get to that. In fact, when you're using Hadoop, you're using, in this framework, you can be using the autonomy extraction to be able to put the data into it. So in fact, the ETL process itself uses the toolkits that we have. Everything from the attraction, everything from the connectors to the extraction to what you do with that data. Okay, I think to your point, the idea is people are coming and saying, start with the use case. What kind of data do you have and what would you love to get out of it? So for example, in the security use case, you've got Vertica, which is handling all those massive logs, right? All the events. But then we also take idle and we couple that on top of it and say, if there's any human information in this event, what's it about? So I can track the fact that at five o'clock I sent a document out of the environment. That's in the log. Here's the question for you. What was the document about and do I care? Was that sensitive IP, or was it just a recipe, or was I sending a photo to the shelter of my kids? Now idle can come in and say, I can enrich that insight into what's going on in your environment, not just what happened, what did it mean? And so that toolkits available now and we can actually couple both idle and arc side together and deliver it out to the field. Okay, so I can have my developers spend time focusing on whether it's implementing the policy or driving revenue or whatever it is and not have to worry about the integration. So you're essentially giving me programmable software infrastructure right out of the, I called it out of the box, but it's not coming in a box, but yeah. Okay, great. That's good. Now let's go through some examples. You guys have announced the digital marketing hub. That's one example. Let's go through some. Yeah, so we talked about the digital marketing hub. This is a framework which is hosted as a service that we can provide and it allows marketers to take multiple different data points about their customer. It might come from their call center, it might come from their customer databases, it might come from their marketing platforms or whatever it might be, multiple different touch points and aggregate that information and allow you to run campaigns in real time. So historically what you'd have to do with marketing is get information from my various applications whether it's Adobe or Marketo or whatever it might be and find out where the customer's touching, what are we doing, how is our campaign working and you have to come back and analyze it and then you have to come back and adjust the campaign and then you have to see if that one's working. So there's long hang time to be able to test and analyze and discover whether you spent money in the right place. Well now all that information is aggregated in one view and we can actually then take it and drive what you're learning about your customers in real time into the campaign itself directly. So I can get campaigns to launch automatically based on dynamic segmentation of my customer brace now. And by the way, this runs on idle and Vertica's on the back end of it. So this is a Haven-based application that we at HP have delivered to the market. So it's built on Haven, Haven's the platform. Digital Marketing Hub is the sort of application that you've built and it supports other applications like Marketo, you mentioned Adobe. Well see, those are data sources, right? So I know a lot about my customer based on any number of different applications which tell me, my call center for example, right? My touch points to you, but normally those are separated. And in order to figure out what I want to sell to and who my segment is and how I'm going to campaign to them, I usually need to do a manual aggregation of it. And now I can do that in real time. And how would people do it prior to Digital Marketing Hub? They'd do it in- Well you'd collect all this and then you'd sit down and put some spreadsheets together and say, you know what? That campaign didn't work very well. We probably didn't target it to the right people and here's what we know about the manual exercise. So it's Excel, Hal, and pivot tables and the like. You know this is the thing that's really interesting and is concept of connected intelligence. People always talk about I want to get value of my data. I want to get insight out of my data. What we're also seeing people focus on is I want to get value out of different data types. I want to see across this one, this one, this one and this one and not, the big data is actually going deep on one particular type of data. It's what you get when you go across all of them. As an insight. And that, you know, we're- It's eliminating silos, right? So another example is the operations analytics product. It's a great example of a use of, you know, different log analysis technology that we have in different products in HP. But Vertica is the engine that provides that analytics. So the data goes into Vertica. But what that allows you to do things like take your network operations data together with your security data and do correlations across those two domains. That even in an IT organization, sometimes those data is owned by different parts of that organization. So they tend to be in silos. If you put the two things together, then you can actually almost think of that data as an addition to your business data, right? Because you might find interesting correlations that you might not find just with your data warehouse that you like, why did I get a spike in sales here?  Did I do something wrong? And you might find that, oh, people just, you know, bought more of my product because it was raining outside.  And so, but unless you have the business, the data warehouse or whatever it is, your business sales data correlated with your network data, you would never know, right? So these are problems that sort of cross domains across the business data, machine data. And then if you add human data to it, that's when you get insights that are competitively valuable. So I heard at least two use cases there. One was more sort of what's happening with my sales. The other was what's happening with my IT infrastructure. So are those common use cases that you expect or things that you've talked to customers about? Let's take the latter. Yeah, so I'll give you another example. So think about, you know, you're doing, security is a problem for everybody. All CSOs are thinking about, you know, how to keep my enterprise secure. But there are these threats that really require, so your security software will handle things that are events that happen in a short period of time. But then there might be behaviors you need to identify over long periods of time. So for example, Shilpa is an engineer and she, you know, logs into these systems. But one fine day, Shilpa logged into a sales system. Right? That behavior you can only identify myself as an identity over a long period of time. If you were able to, you know, correlate my activities and establish an identity for me and associate it with my behavior, that type of analysis requires an engine like Vertica, right? So because your same products will do that because that's not what they're meant for. And so these are the kinds of things that you can do by putting, you know, the power of Haven. You were mentioning machine data before. So we've been doing a lot of work in SiliconANGLE Wikibon on the whole, whether you call it internet of things and we did this big piece of work with GE recently on the industrial internet. John Furrier hosted a panel with Jeffrey ML. It was really interesting to hear folks from, you know, transportation, airlines, oil and gas, just talk about the types of data that's being generated by machines. And of course you start thinking about, well, where's that data going to go? How's it going to be analyzed? What kind of conversations are you having with customers in that regard? Are you having them at this point in time and what are they asking you about? And how do you see HP participating in that whole trend? So, as you know, we recently announced FlexZone, which is Vertica's ability to ingest semi-structured data. What we find is a lot of this data, sensor data, machine data, things like that. Even though people think of it as unstructured, there's a lot of structure in that data. It's semi-structured and we find that, you know, making it possible for people to easily ingest and analyze that data is a huge leap for a lot of people because, you know, this data stays dark. You know, a lot of this data that just people throw away. Like there's incredible amount of machine log data that people throw away because there's, you know, they don't know what to do with it. Or they might keep it for some period of time, just for troubleshooting or something. But it's the long-term retention and being able to find insights over time. And across many people. A lot of that data is deadly boring. Like, you're going to have, you know, billion clicks and whatever these machines are doing and you care about the billionth and one that's a little bit different. Because you got to keep the other ones in order to be able to understand the difference. And so you're collecting a lot of noise in order to be able to get that little bit of signal.  They're not for the right job, right for the job. So what's the potential of that space? Is the potential there to really start to take waste out of industries? Whether it's to- Speed to insight. Okay, speed to insight, but, so like you said, Brian, there's- Yes, you take the data exhaust. You take the data exhaust. Exhaust, like all these machines. But as you point out, there's so much- Yeah, use that to find trends that are like across populations and things like that, right? Which is not something that, you know, it's like your refrigerator, the next generation of it would have, you know, four, eight hundred sensors that'll tell GE or whoever the company that makes them all about like, what is this person's usage pattern? And you know, what is, and that, if you can correlate that with their energy use, then there's just so much, so if you think about it, you know, I would say the next sort of frontier for analytics would be like data, products that are really built using analytics, right? So it's not just about understanding your own business or your own customers. That's the Web 2.0 model, right? Understand your customers, but like make your products like collect analytics about themselves and then use that to improve the product experience for your customer. That's like, I think the next level of where you're seeing, you know, the internet of things and all that.  And normally, I think that's an outside of the box idea for people. The idea that I can have a computer listen to this conversation, actually listen to all of the conversations in the room. A computer, okay, we can have machines. Tell me what people are talking about. Things that you would ordinarily need people to do. Like, look, if I'm, for example, if you're a lawyer and you gotta find relevant documents for a case, the judge does not say, find me the one with the word bridge in it. He says, find me the relevant documents. Now you can pay people to do that or you can ask a machine to say, by the way, read all of these and tell me the main ideas or listen to all these phone calls and tell me what's in them. And that's where we get into sentiment analysis, social analysis, really valuable for customers like NASCAR, right? All that data is coming in and there's the tweets and how fast they're coming in and when they're happening. What are people saying? Yeah, so this is what I wanted to get to is you've mentioned, Brian, that so much of this information is deadly boring. So, and it's just such a huge volume. A human just can't sift through that, no way. So what you're putting forth is a vision where machines start making decisions based on maybe human injected policies, you know? And maybe a human's watching to make sure something's not going wrong. But the machines are actually affecting whether it's the utilization of a turbine or what gets packed on which freighter or whatever it is to increase utilization. So what happens to the humans?  The humans just do more productive things. What do you guys envision there? Well, two things I'll say, there's automation. So to your point, the computer can actually do things and make decisions. Say for example, you see this in fraud detection all the time, right? If, whether it's something I've written or something I've done, if it triggers a fraud alert, I can block it, right? And the funny thing about, for example, insider trading, when people are going to do that and they're going to write an email about insider trading, they don't use the phrase insider trading. They say something else. And so you have to analyze the subtlety of that, but also you can block that. Or the other one is insecurity, video. If you're analyzing video, and maybe we have our technology doing this in the field from drones, what's important and what's not? You've got thousands and thousands of hours of noise, but the analyst needs to see the one event which matters. And they cannot sit there and watch thousands. They need the truck-shaped object is going to a place where it's not, so you're right, it'll give you, it'll make you more efficient and it'll bring the signal out of the noise so you can either automate a process or being much more valuable and efficient with your time. Insider trading example is interesting. I was just reading an article, I forget what magazine it was in recently. And they were just saying that, that they're not saying, I'm doing some insider trading, they're talking about takeout, I want Thai food today, whatever it is. And when they see that pattern occur, some anomaly about talking about food, in a consistent pattern, and then they identify it with another person, and then that's how they're identifying trading fraud, which is fascinating. There's no way a human would ever be able to do that. Yeah, I'll give you another example of, that impacts like me, this device I'm wearing, Fitbit, right? Yeah. This is why analytics touches me personally, right? Like, I walk extra just to get the five dots at the end of the day, every day. And it's because it tells me, hey, you only have a thousand more steps to go, and then you'll do it, right? And so, just think of the impact that these devices can have on people individually, not just people understanding, okay, you know what? People socially together, you know. If you just tell people a little more data, I think we all become, our lives get better. We were at, I'll tell you a quick story, we were at Hadoop Summit in June, and we were interviewing, I forget his last name, Skye something, I remember his first name, his first name was Skye, and that actually was his given name. He's out there somewhere watching probably live. So he was an Olympic athlete, a velodrome athlete, and he was very upset, of course, with all the doping that was going on. And you know, he was a clean athlete. And he worked with, I think it was maybe Datamere or something, I can't remember the company, to use the data from a Fitbit to try to identify temperatures when he's sleeping, you know, food intake, calories, and everything else. And he were able to dramatically increase performance through data. So that's a fascinating example. The other day I was at a Christmas event, and I was talking just, you know, talking to somebody, and they're a researcher in education. And one of the interesting examples they were looking at is if you give a child or a student, let's say a high school student, information about, you ask them a simple question at the end of a test saying, what resources did you use in filling out these answers? And then you do a survey across all the students and give the students back analytics to show that if they used all that, so for example, did they ask their parents questions? Did they go use the internet? Did they use Google? Did they use Wikipedia? Like what resources did they use? And so if you can show them a positive correlation between the resources they used and their scores on the test, the students apparently go look for more resources. So even like children will make use of analytics if you give them to it without, they won't even know that it's analytics, but that's the power of data, right? I also think there's a great example from the CIO of Facebook and Shilpa and I were just talking about this before we came in here is what they're doing there and you can tell us a little more about it, but the fact that they can get live, almost real time information about who's buying what and where when it ordinarily took them a day, the really interesting point he's made is that we can build a whole different class of applications now because in real time I know what's happening. So they're going to be able to go back in and deliver because of the speed of the insight a whole different class of applications at Facebook because of that. If you have to operate in a batch, way today to get an answer, I can't build an application that's going to react to that and give you a different price or give you a different offer or optimize by marketing. I can't do that. And the exponential factor there, as he said, was the relationships, because it's not just an individual, you can then begin to market to that individual's social graph. The speed of what they can do with that and that was, I mean, what's going to make a whole different class and a whole universe of applications? So it's early days. Obviously you guys are really, this is sort of just getting started here.  What do you guys expect that we should be watching? Brian, we'll start with you, just as observers. What should we be observing as the uptake in this market? What are they going to give you? The key parameters and indicators that we're really starting to take off and see momentum here. Well, I think you're going to see very rapidly extremely high value use cases coming out publicly. I mean, the Facebook one's a good example, but places where we're providing insights that traditional technologies couldn't do, whether it's coupling an insight into the data with the security event itself. And so you'll start to see those kinds of uses come out of our customer. They're digging into them right now around more and harder, difficult types of information, understand audio and video. So you will start to see those come out and I think there will be some that are mind-blowing. And that uptake is, it's happening faster than I would've expected. Problems that you really wouldn't even think about solving before because it was too hard. That's what you're going after. Anything you'd add to that? The second thing I think that you will see and you're already seeing in this conference a lot is partner activity. So we've seen an unbelievable response from our strategic partners, our service partners, our resellers, technology partners, and really the whole ecosystem around Haven. And so between the developers and the partners, I think we really believe that we have something here. No other company has that whole gamut of tools to handle really all the data. And it's nice to see the uptake by developers as well. So we introduced idle demand. On demand we've got Haven developer tools. The uptake by the folks who want to build applications based on this level of insight is really high. Now you've been asked to SDK, right? So big opportunity for HP obviously in the software group is to go after the developers. We talked to Robert Young-Johns about the potential of having a developer conference. Really excited about that. So anyway, congratulations for being in the hottest space in the company. You must be really excited about that. And it's a pleasure for us to be sort of watching that progress. So Shilpa and Brian, thanks very much for coming on theCUBE. My pleasure, David. All right, keep it right there. Everybody will be back with John Furrier with our next guest right after this. This is theCUBE. We're live from HP Discover Barcelona.