Welcome back everybody, welcome back. I'm happy you're here. You read the title, you know what we're doing today. This one should be pretty fun, I think, right? We're doing something new. We got something spicy for the gamers in the room, the gamer gang. We're gonna be taking a look at some Discord malware. And I think that's kind of peculiar and kind of neat.  So if that doesn't make you like the video, I don't know what will. What we're gonna be diving into today is something that a fellow community member, right? A viewer had offered to me, sent it along. And again, please, please, please keep sending me malware. Thank you, literally, please send me malware. I'm gonna keep saying it over and over again. But this user was generous enough to donate this, send it along. And I think that it is worthy. I think it is something that we could have some fun with in a video here. Disclaimer, right? The usual kind of a notion and thing that I had to go out and say, this is a very exploratory video in that I don't know what I'm doing as I'm going through it. And I don't know all the things. I don't have all the answers. So forgive me where I fumble and stuff. But hopefully it'll be fun. We'll get to learn a little bit. We'll have a good time. And obviously this is all for education. This is all for educational purposes.  No, no, no, no, dude, we're here to learn. We're here to have some fun. So let's get to it. You know, let's hop over to my computer screen where all the good stuff's going on. I have this script open. I have this script. This was the maybe discord malware.py. And the .py extension tells us that it is a Python script. Interesting decision for one thing because if this were to end up running on an end user computer, if this were to run on the victim or the target, it would need to be able to like know how to interpret and run this. It would need the Python interpreter program because Python is a scripting language, right? So you could freeze it, you can compile it. You could do some weird things with it to make it a bundled packaged executable. But that would be, I don't know, I feel like it would make for a large file if you were to try and get that on a victim, but whatever, we'll explore it. We'll see what's going on here. So this is the file, maybe discord malware.py. I'm having fun with this one because it is not obfuscated whatsoever. It's also written in Python and I tend to read and play with Python a decent amount. So we'll see how it goes. We've got a little import OS statement right up at the top here. So getting that module, kind of getting the operating system library to be able to read in and pull some data out here. And then it immediately goes through an if statement like, hey, if the os.name or if that property from that module here is not equal to NT, then we exit. Then that program just goes ahead and dies. That is important because it tells us this is literally only going to run on Windows. So I have a Python 3.9 installed on my machine here. I'm running Windows currently. So if I were to import OS, if I were to do an os.name, we can see that it is the string NT for new technology, Windows thing, and that's all. If I were to do that exact same thing over on a Linux virtual machine, so I have a little Ubuntu virtual machine created up up here, I'll spawn a terminal, use Python import OS, os.name will tell me posix. So it's running Linux and it is not NT, it is not Windows. So there's that distinction. And that way we know, okay, this will only run on Windows. We pull in the find all method from regular expressions, that built in library. We pull in some functionality to be able to load and dump strings that are in the JSON format with a JavaScript object notation. Of course, base 64 for some B64 decode for decoding base 64 represented data. And we pull in the popin and pipe data and stuff. I lost track of the words of because popin is going to end up being a function or the class constructor thing to create and pipe will go ahead and be the constant that it will need for making like pipes. But sub process means we're gonna end up running code, right? We're gonna end up running a command executing, executing like system shell commands. URL lib is pulled in to grab the requests in the URL open, et cetera, et cetera. So we can make calls to the internet. We of course want to know the time. We want to be able to spawn threads, grabbing the sleep functionality and knowing arguments that we pass into this program. So I don't know if I wanna go this entire video at that pace that took us some time to just go through the import statements.  Okay, John, that easy baby stuff, but I wanna make this approachable for everybody. So all of this, right? All these modules that we're seeing right now are native and built in to Python. So it doesn't need any other libraries or modules kind of included to run this malware. It'll just do it if you have Python. They're all part of the kind of core standard library that Python would work with. So then we go ahead and get some environment variables from that OS module here. They're defined as local and roaming, which will be the name of the variables here, but we're getting the environment variable local app data and app data. Now again, this is only going to be running in the context of Windows. And because I'm on Windows, I will open up Command Prompt and see what those values are. I've showcased this plenty before in batch tutorials that I have that are like decades old. And if you were to actually try and reference a environment variable or a variable in batch, kind of the language of the Command Prompt and Windows to begin with, you would normally use it wrapped in percent science. If delayed variable expansion is on, it could be exclamation points, but that's a whole nother can of worms. Right now we just want to use like the percent signs surrounding the variable name that we want to look at. So app data, right? It's going to evaluate out for me, C users, John H app data, roaming. Now we know the value of what that will be. We'll do the exact same thing for local app data, right? Local app data. And now you can see it is local as the subfolder rather than roaming. So those are some worthwhile directories apparently because the program is going to grab and gather those. And then we have a whole list of paths. This is ended up being a dictionary, right? So discord will be referenced with the roaming folder slash discord, roaming folder slash discord canary, et cetera. And some local folders as well. But it's peculiar here because we can see discord being referenced, discord canary, PTB and Google Chrome, as well as opera and brave and Yandex. All of these are seemingly getting the file system location or the path to the data and configuration stuff that might be stored for that particular program, right? We're going to end up seeing that in app data, local or roaming. That's where that's typically stored. We also have some other functionality defined here get headers and it will take in a keyword argument token that is kind of by default optional and set to none. But it also includes a content type as a keyword argument that has set and defined to application slash JSON. I don't think that'll actually end up being used or modified anywhere else truthfully because most of the stuff this is going to end up doing if it does end up working with discord via their API, it's going to be in that JSON format. So the headers that it defines inside of this function after it takes in potentially the token and content type are the content type for what request it might make if it were to create some headers. And it adds a user agent for a regular like Firefox. Oh, Chrome here you can see. Chrome browser connecting to it. And if it has a token, it will go ahead and add that into the headers with headers.update with the authorization header, pilling in that token. That is good to know because that I think will basically be the crux of how this works. Let's kind of minimize that for now or like fold that code. Then we can get user data with the token and that is a mandatory parameter. It will try to loads and that's going to be the JavaScript object notation JSON structure and format for making a request with the URL library to discord.com slash API slash v6 users me with the headers that it's created previously with that token and reading it out and decoding it. So that call on its own get user data will get information about your discord account. That's it. It's just querying the discord API to be able to do that as long as it has a token and that needs to be passed in. So the tokens, that's gonna be the most valuable part, right?  Now, these are apparently stored and this is news to me, I was learning this, right? With the path that's passed in inside of this get tokens variable function caller here, right? It adds this path that takes in that argument path and adds in a local storage level DB. Now it creates an empty list of these tokens and then for every single file name that it finds inside of that directory or the path that it's just built out here, it will check, hey, if that file name does not end with .log and it doesn't end with .ldb, then just ignore it, continue on this for loop and keep cruising through until we find something that actually does work. If we do find a file that has .log or .ldb, then we will look through every single line in that file once we open it up. We'll open up that file, ignore any errors and then read every single line and look through them. So yeah, it just pulls out those lines and then it uses the regular expression syntax for a regex in this kind of tuple of two potential regex structures, the patterns that it's going to look for, whether it is a word, excuse me, word character or another 24 iterations or occurrences of those, word character following a period, six iterations of those, another one, et cetera, et cetera, or because it's a four regex in both of these, it'll continue to loop through both of those or if it starts with MFA a period and then 84 word characters. If it finds those based off of that find all call, it goes ahead and adds it to the collected tokens. So it's just going to end up carving those out. That's it. Interesting, right? There's a real functionality to steal and harvest the tokens for your user account. So let's put that away temporarily. And then we have another good one. We have this get developer function here. I don't know what this dev equals WODX might be referring to. I don't know if that is an Y that's created or why it's set to that because just after it, again, it will try to do something and if it fails, it totally ignores it, but it will go ahead and download the data from this Payspin URL. Now, I wish I could make this pretty cool and pretty fancy, but I don't think that that actually exists. Yeah. Payspin.com slash raw, that. Yeah, it's no longer available. I don't know if anyone knows or if there's a good way to be able to kind of track down some previous Payspins maybe it's a way back machine or internet archive or whatever, but that would be interesting to see what that had. Regardless, can offer too much there. Another interesting function though, get IP. All this does is make a get request out to api.ipfi.org which we've seen in other videos we'll just straight up tell you your IP address. So it collects your public IP address. That's what this Discord malware is another thing, another piece of information that it will steal and collect and grab. It will also grab your avatar. Again, just reaching out to the Discord API with your user ID and avatar ID, seemingly, yep. But those would be pulled in and passed to this function here, carve it out. And then we do some interesting stuff that's kind of native and local to that computer. This getHWID or the get hardware ID, that's gonna end up using WMI or the Windows Management Instrumentation C command line, that tool utility, kind of old. It's a very cmd.exe like and DOS oriented interface to the Windows Management Instrumentation interface. It will go ahead and grab the UUID of this current computer. It will run that as a shell, collecting all the data and that's why we pulled in popin or those sub process module functions, right? Pull all that down, collect it, have the convenience functions to be able to do that. Then it does some other spooky stuff. Like, hey, we got getFriends carving out, hey, whatever relationships your Discord user might have, again, passing in the headers generated by the token. And it will get chat information. Based off of another user I'm assuming you're chatting with, right? Reach out to the Discord API for the current user with that token for your current account data, checking if the recipient's ID is going to end up being whoever that other individual wants to talk to or their chat history might be. Pulls it down and pulls it. Now, this one's kind of spooky, spicy, juicy. Hey, what kind of payment methods do you have? Do you have payment methods? Let's pull it down, let's carve it out. So all this one does is check whether or not you actually do, right? It will return a Boolean value if there's content in there. Determines from length, right? As it loads and carves out the JSON, checking out your billing payment information and those sources there based off of your token. Nice. This one is a sendMessage functionality so you can chat with other people that actually the program itself can send other messages via the API. And it adds it in as a really interesting, file, multi-part form data boundary. It's actually added in there. Form.encode, read.encode. Okay, so it posts that data sent along to it, I'm assuming. And this other one, this other function is called spread. Takes a token, takes the form data in a delay variable and it actually is currently disabled. This return function will tell it, hey, don't actually run anything for that function. Just kind of stop and don't bother. But if you were to comment it out, just like this comment here says, hey, remove to re-enable this, well then it'll continue down on the rest of this code. And it grabs all of the friends that your account has and then it tries to actually get the conversation with them, get the chat ID, right? Get to know who that individual is, know the message conversation and then send them a message with the supplied form data. So imagine all of your friends on Discord getting slammed with whatever message or spam comes from this. And it'll sleep just a little bit of time to not be an absolute machine, but that's how it will spread this virus or malware, collecting and harvesting more tokens. There you go. Now this main function is where all the real action happens. This is where it all kind of goes down. The main function is what's going to end up running and executing when the program runs, but all these other functions that we just saw previously that was building out the functionality for what this tool can do. Now the main function will apparently cache some of the data that it finds, stores it in roaming.cache with a little hidden name there. It'll prevent spam supposedly. I don't exactly know where that else is going to be used or even if it is, I'm control f'ing for it, but that's literally the only place that's defined and ever used. It doesn't do anything. Self spread equals true. That is apparently used later. We have two matches in that. So we'll get to that in just a moment, but the embeds is an empty list, working is an empty list, checked all these other things are defined, but it of course immediately grabs your IP address. Hence that getIP function. Then it will grab your username based off of the environment variable on your computer. And we've done this already, right? Pulling up our command prompt, getting that variable username. In this case, it's John H for me. Other one it grabs is computer name. Good enough. Creator is the name of my desktop machine right now. And user profile is going to end up being where it will look for your like programs, et cetera, et cetera. So your essential home directory, right? In this case for me, it's users John H. And that's usually just a user's directory. Developer is going to end up retrieving whether or not supposedly this is a developer account, but we don't know what that paste bin link actually ever had. And then we start to steal some tokens. Yep. Now we start to loop through all of those paths that we had seen already defined up top here for Discord, for Discord Canary, Discord PTB, Google Chrome, Opera, Bravian, et cetera. Now I'm not positive if this is stealing like Google Chrome or Opera credentials. I really don't think it is. I think it's strictly looking for the things that Discord stores and saves and how they do that. But we'll explore and we'll dive into it in just a moment. For each platform and path in those locations, it will try to see if that path exists. If that folder, if that file location doesn't exist, well then it's safe to assume, okay, Opera is not installed or Brave is not installed. So it'll just continue on and keep looping. Now it'll try and get tokens from that path. So this location, roaming slash Discord, now looking at that get tokens function again, slash local storage slash level DB with these log or LDB functions, those will have the tokens that this malware is trying to carve out and steal and compromise. That is the data that's going to end up kind of grabbing. If it has them, if it's kind of in check, then it won't bother to do them again. If it does already have those, or if it doesn't, it'll keep getting those. If it doesn't start with MFA, I'm assuming that's going to be like multi-factor authentication. It will try and do some base 64 decoding magic to grab the other format or representation. But then all it simply does after it has your token as it grabs your user data and then it gets all the information that you might happen to have, right?  Huh. So let's get a little meta right now because I think we've laid out enough groundwork that we could really show you how this works. And I have to be careful about doing this because I'm essentially going to hack myself and put it out on the internet or whatever. I'm gonna blur obviously a lot of the sensitive stuff out but we know the file locations where Discord is going to end up storing our token, right? Check it out. Do we still have our command prompt open? No, we don't. All right, so let's bring this down again. We know it's going to be in that roaming variable which was grabbing the data out of app data. So if I go into that directory, we know that there was a Discord directory, right? Cause that's where it tries to go find the Discord. Now I have Discord installed, right? You can see it kind of in my system tray down here and I use it all the time. Inside of the Discord directory, we know from this get tokens function, there should theoretically be a local storage subdirectory and a level DB subdirectory. So let's go check that out and there are those directories. So if I clear my screen here, CLS I think in Windows, yeah, yeah, yeah. I'll dir to see what files we have in this directory and check it out. There are these log and dot LDB files just as it mentioned. Now I need to be super-duper careful here because I'm going to basically hunt for those tokens the same way or at least in a very similar way that we know this function was going to do it. It just looks for regular expressions where a MFA might be present with other word characters. I'm gonna do that just for my account and I'm hopefully gonna successfully blur out the contents here. Because if I were to go ahead and try and run strings and I have that Linux utility kind of installed on Windows right now for MingW and stuff, if I were to strings out everything, there's gonna be a lot of crap and a lot of content. I'm really sorry, seizure inducing thing. But if I were to take that strings of everything and look for the plain text strings and if I were to essentially use grep if I were running on Linux, right, but I don't have grep installed, so I'm gonna have to use the Windows fine string. If I were to run fine string with that data that we know is going to be in the text there, MFA, I will add some spaces so that's visible. Check it out. I'm gonna have to blur that. I'm gonna have to censor that because those are genuinely my Discord tokens. So now let's make it even worse. Now that I've showcased that, let's go ahead and try and retrieve the same information that this malware would have received, yeah? I'm gonna hop over to my Linux virtual machine to be able to do that really quickly and create a new directory here. Just for keeping things clean, I have to make the directory, make directory Discord Mal for Discord malware. And we know I'm going to censor a lot of this here. I'm like collecting my thoughts as I realize what I'm accidentally or might be showing on screen, right? We want to use the curl command so we can actually go ahead and access that API. I'm gonna nerf that command prompt real quick and I will paste in the authorization that we know was the header that used our token. So now that my token is pasted in, there we go, I will go ahead and retrieve the data that might come from getting my user information, that get user data function, right? So Discord app users me is the link that we're going to, including the headers, all that we've sent thus far. So if I include that, if I hit enter here, I made a mistake, authorization, is wrong, I will try a different token. I did have a couple others that opened up and that command prompt. Let me go reopen and do that just a moment. Okay, I'm back. Now I have verified that I have the correct token because there were multiple that were listed in my account. So if I were to go ahead and make this call request, hiding my address here, I will pipe this to JQ. So it's kind of pretty and beautiful. There we go here. Take a look at that. That's the data that you can pull, you can see a supplied phone number, you can see the email address, you can see the country code, the avatar, the ID number, et cetera. Now if we were to try and pull the payment methods, if we were to try and pull the actual friend list, if we were to try and pull other messages and send other messages, that's what this could do. Let me do that just to show you the spooky, right? So we have some fun with get user data, but now that we know we could get the avatar or get the friends or the payment methods is probably gonna be what the hackers are interested in, right? They wanna see what other information could they carve out of this. So I'll grab this location and I will go ahead and add that in to what we will go ahead and display out with JQ here. Paste that in and I'm gonna need to blur this. You can see a kind of card and payment method, you can see the last four of that credit card, you can see the original address for the billing address, et cetera. That can get kinda spooked. Okay, that's enough publicly embarrassing myself or trying to hack myself via this malware, just using the tokens that you can uncover from the Discord account that is stored and saved on your computer here. Let's continue to explore what we had because this now got interesting and that it would collect all this data, right? Whether or not you have Nitro, what billing methods you have and you would be able to have that message received and if you were the hacker, if you were the bad guy, if you had this malware, if you were distributing this virus, right? You can get the account info, the PC info, IP address, right, PC username, PC name, et cetera and token location, right? I think I see over here. Yeah. And then the token themselves, right? So you could become and act as that user. The author here is whatever is really supplied in that username or user ID, but the footer is kinda interesting. It says, hey, this is a token grabber by THC4L. Gotta love that attribution. Am I right?  Granted, this is a hacker handle. It's an alias. It's not anything like whoever, it's not a name or an individual, but we could obviously do some more research, do some more digging and trying to see who THC4L happens to be and with these embeds, right? Now we've saved and captured all of that and it could be sent later on and retrieved for whoever was ending up using this token stealer or this malware. So it will of course save all this information in that cache path that we saw previously. It will append some data to working that I'm not exactly positive why that's doing it, but take a look at this webhook, right? The webhook includes the embeds that was just carved out from this username that we might wanna supply in for the bad guy, right? And this avatar URL is supplied. Now, if I were to go back to Chrome, try to see what this avatar might be. I wish it were something kind of more fun, but it's just kind of the bland blank Discord logo. So after we've defined this webhook, we try and make a request to the webhook and send that data, right? So that way, the bad actor, the one waiting to receive all the stolen information, the stolen tokens, et cetera, those would be displayed and just sent to them, right? Those are fish that they caught in their fish net. Great. We also have some other functionality for self-spread, whether or not this thing is going to spread, and we did see that was set to true, right? So for every token that it knows is working for everything that it collected, it will try and open up itself. It'll try and open up this script, like this Python code on its own. It'll read that, save it as this content variable, and then develop a payload that will send with the data information name, the file name will be this file, right? And then the content being this entire script, being this code. And now, an interesting thing is that it includes the message server crasher, Python download and it links to the Python website so that potential victim or target might be fooled and maybe they'll go download Python so they could run this to go crash some servers, I don't know, or it'll just keep farming tokens for the original bad guy. So there's that. This thing could potentially spread, but it does rely on that end user target victim computer of course having Python installed. So that's why they're literally linking the download to go install Python. And it threads this out, right? For every single token, it tries to spin it off and they'll go spread that function that we saw earlier that will message everyone in their friends list. It'll include the token that it needs, right? The payload and then how long it's going to actually wait to send those. It looks like, what is that? Seven and a half seconds, I think, but starts it. And that's it. It runs that main function. But that is the damage that could come from this thing. Now I got kind of curious, right? I wanna know who is this THC4L if they're literally telling us, hey, check it out. This is a token grabber. Here's some Discord malware by yours truly. Me, is this known? Is this present on the internet? So I started to ask Uncle Google, went to our good friend over here, token grabber by THC4L. Let's look for, I guess, Discord reference here. And now there's a lot of peculiar stuff. In fact, this one, I just saw the other day. This is literally when I was receiving this message when someone sent this code to me, which was yesterday. This video was released then the day before and now this is two days ago. But this video is kind of peculiar. It shows other interesting things. It's just not the exact same code. It's actually a completely different program. So maybe we'll dabble in that for just a little bit. I actually kind of wanna table this. But the comments are here are interesting. I like this thread here. It says, hey, this is for educational purposes only. I'm not responsible if the tool is used for legal purposes, as you can download it with the password here. But the tags are Discord Token Grabber GitHub, Discord Token Grabber, Discord Token Grabber, Best Discord Token Grabber Discord. Like, yeah, is that so, buddy? Educational purposes only, except you really wanna tell people about it. You people really should know. So that's that. The comment is like, hey, LOL malware. And the comments are like, for real? Yeah, man, LMFAO. Now the file itself is a token grabber, so we're trying to grab people that are trying to grab someone else. Ooh, ooh, what a scheme. Hack the hackers, am I right? So there's that. There's another interesting one, how to use Token Grabber on this location. Uh-oh. Oh, where am I now? Easy way to get Discord tokens. This just looks like. This just looks sketch. Discord malware stack overflow. How to spam RAID Discord servers 2020. Best Discord token stealer. Oh, there's GitHub stuff like this. So this like opened my eyes to a complete new world that I had no idea existed. And this actually, the original individual that had sent this to me told me that he produced this or published this and posted it on Stack Overflow. And he said, hey, a friend of mine contacted me with a problem he's been having with Discord. Windows Asset Program, the code below should be run with and default is Discord. Every time Discord is run, the chunk of code is run. So it looks like they didn't have like Python actually installed or something. And maybe it just, right, it wouldn't run. But that was the original code. The comments here are like, yeah, hey, that does seem to be malware. He says, what I believe to be the creator's YouTube channel is referencing the code here and you could go visit this link. But of course, hey, that's been terminated and shot down for being a bad guy. And then the creator's Twitter account is apparently linked in the code. I didn't see that exactly, but Kelly Linkox that are protected tweets, errors.tools. Oh God, that brought me to a Discord server. I'm sketched out. Leave me alone. So let's put that one away. Sorry, I didn't mean to be shouting. The response is, hey, that is malware, not only a token logger, but also stealing Chrome, Brave, Opera, and Yandex passwords. Uninstall that immediately and change your passwords. YouTube channel of creator. That's the same link as earlier. As it turns out, it also steals your IP address. So we saw that as we were going through it, but I'm not a thousand percent positive if it is stealing like your Chrome cache or the web browser passwords that are stored and saved locally. Brave, Opera, and Yandex passwords. I don't know, because I just don't know off the top of my head where those are stored or how those are stored, but it looked like it was more pertinent to getting the Discord stuff. It didn't seem to have anything specific to like, hey, cracking or, those are not the right words. But tracking down the Chrome cache and everything, these are specific to Discord, I think. Maybe those are going to be the locations if someone were to open and use Discord in the browser, in those browsers, maybe where that information is stored. I don't know, truthfully, the desktop application of Discord is what I'm using and that is where we saw genuinely the Discord tokens. So that's that. This is an interesting one, I think. This site wants to show me notifications? No, no, thank you. Of course, video is no longer available. Some other peculiar things, but like, look at this, look at this. Some of these, oh no, these actually aren't that bad.  Good stuff. Genuine purposeful use, but best Discord token stealer grabber hosting in scripts, March 19th, oh, that's actually today. You can see that down below, like in my calendar down there. It's genuinely March 19th, is this updated today?  You don't need to download any files. Imagine the, imagine the audacity, right? Imagine the, imagine what fire has to be in you to make the sales tactic, to market this thing, like oh, you don't need to download, you don't need to have any extra software. It's fully undetectable. Whatever you do to like market and have a business strategy for malware and bad stuff is just insane. Oh, here's a video. Today I will show you a Discord token stealer. Yeah, is that right? Oh, this is the same, this is the same YouTube video that we saw earlier, didn't it? Isn't it? Wait, let's go to YouTube. Let's see this thing for real. No, this is back in February. Tamed Devo, download area. Oh, they sent me a Discord link. I don't like it. 51 comments. What are these people doing? The Juice World song just hits different, man. Okay, okay, you know what? Let's, what else does this thing do? Oh no, this is the exact same footage that we saw in that one that was uploaded just two days ago. Wait, what? What is he sending? Install this to get free Fortnite hacks legit. H1111, how do you XE? What the heck? What was that? Webcam.jpeg, oh, I don't like it. That's, oh no, get me out of here. I'm leaving. GitHub stuff that doesn't exist, but like, check it out. So let's say we were to look for that on YouTube. Like we had Googled THC4L, and now there's a gray dank discussion community post, apparently redirecting me to slamnetwork.rf.gd. That might not be good. But he's all about, look, dude, check me out on YouTube. THC4L cheats, check me on YouTube. I don't know if this is the way to internet fame my guy. I don't know if this is the path you wanna take to be a content creator. Shop paid my THC4 discord token shop. I'm clicking on, I'm going to weird parts of the internet right now and I probably shouldn't. So I'm gonna stop. I'm not gonna do that anymore. But look at this video, before I actually, you know, hang on, I've said a lot of things. I did have an original thought though, that I wanted to latch on to you before we get to kind of the end of the video. This, this best discord token stealer grabber 2021 that was released two days ago, this download is different, right? I'm gonna check it out, steelybuilder.rar. I just wanna see if it was the same thing because when I checked it was different. I am gonna do this on Linux. Actually, I have ILSPy, so I know, right? I'm gonna have a little bit of foresight to, excuse me, figure out what might be going on here. I need to have a raw decoder. Do I have ILSPy on this thing? Opt ILSPy, I do. All right, so let's do that. Let's, we have Firefox open on this. Go to that URL, please download that thing. Come on mega, yep, that's fine. Download the thing, downloaded it. Save, please, I'm gonna go back to my terminal. I'm gonna move that downloads steelybuilder.rar. Let's unrar that thing. Steelybuilder, what is unrar is a command. I have to install it, what? All right, if you guys can't tell at this point, I have taken off my presenter showman personality persona and now I'm just kind of goofing. So yeah, let's unrar that thing because now we're back on the keyboard. Why can I not tab complete that? Unrar X or something? Yeah, enter password. Oh, it said it was six. Yes, use the same password on all of them, please. Okay, so now I have this builder directory and I have all these files in here. We have a steelybuilder.exe and an assembler source. What is that? Steely.il, whoa, whoa, what is this? This should be a C-sharp, C-sharp syntax. Is that right? I don't know. Module is hog stealer v4. I don't know how much we'll get out of this but index.js, other variables? What the heck? All right, this, before we dive in, I don't think we really need to deal with the IL thing because we know that this executable, right, is a .NET assembly so we can open up an IL spy especially if this is a .IL. There's particularly good stuff in there. So let's run opt IL spy IL spy and completely change direction to go analyze something else, you know? Oh, please forgive my malware. Please totally ignore all the other things I had open. We want to go to discord mal builder, steelybuilder and our good friend, steelybuilder has assembly version <IP_ADDRESS> which makes sense. Some of the references that it refers to are nothing interesting. Text for the expression, actually there's a lot here though. There's like a lot here. I don't know if that's just from what it already had an IL spy or something but first and second have these values. This looks like JavaScript code. That looks like JavaScript code. Am I wrong? Those are in the resources though but we genuinely have and can see those. Can we not? Rez resources, steely.rez. Is that gonna be plain text? Nope. What about you? Nope. I also like could save that to a table so let's do it. Let's put that in discord mal builder. Wait, no, no, no. I just want like a plain text thing. Resources.xml? Resources. Imagine that. We'll call the resources file resources. Resources. Oh, what the F guys? I don't know what I'm doing. Can I copy this whole value? No. String table. Okay. That looks like JavaScript though. That's very obfuscated and not easily readable so I'm very sorry that you can't see that. Sorry for that tangent everybody. That's the danger in doing it like live except it's not live. You're gonna be, this is a dead John by the time that you watch the video but I'm doing it live in the past so that I can have the opportunity to edit things out and blur things like payment information and my discord token and all that. So yeah. This Hog Stealer v4 program checks out a couple build strings, discord of course, enumerates through all of them and runs mod and melt. So mod will check if the directory exists and the get folder environment special name slash build which is that and if it does inside of each of those directories it adds an index.js. Oh wow. Okay. So that index.js must have been that other value for each string text and files if it contains a discord desktop core it will go ahead and take the full path of that location and replace the discord desktop core modules with our index.js. Okay. So it's just going to like basically hijack what discord will do to begin with and it replaces the hook ID, hook token variables and that I'm assuming is going to be another web hook right to send that data out to individual the bad guy collecting all this data. So username will be hog delivery service avatar URL. Ooh, we got a little bitly link here. Dude, we should check that out. Let's do it. I am in my VM still, right? Look at that hogs dealer. So part of me wants to save this image and go look around to see like where else is this used on the internet? If I do a Google images on this, are there any other spooky squirrely places that people have just straight up, I don't know, use this software? If we were to search for hogs dealer v4, is there anything out there? Soft. The definition by Maryam Webster.  Oh, okay. Okay, okay. Let's get back to looking at C sharp NIL spy. So content says congratulations. A discord client has been infected with hogs dealer. Whoa, congrats, what a party. Modifications will only be applied upon restarting the client. So you may have to wait a little. Yeah. And then, okay, it sends a web client, webhook stuff. Melt. I'm assuming looks like it starts cmd.exe with a choice and deletes itself. The and DEL is to run the other command and it's gonna grab its current process and its file name. So it deletes itself. Okay. And that's it. Checking out settings over here. Oh, you got a your webhook. So like the webhook that we saw in the Python script and this webhook that we can see right here, like it's cool that we can see it at all but I don't know if there's a way that we can like kind of skirt back as to where it's used or how it was, where it was ever put to use. Maybe I'm just naive.  But if your webhook contains that information, it checks, hey, is this a valid webhook, right? Then it will carve out the hook ID as is necessary and the hook token and grab it all and then program melt or kill itself supposedly. That's Hogs dealer as kind of an extracurricular as to the Python one that we were doing this time written in an actual executable, right? Actually written in a .NET assembly program to be compiled and could run but I don't think this will spread the same way unless we don't know what that index.js was though. Oh, I really want to find that index.js. Was it in steely.il? Cause we had this thing open. We know there was a constant value in a string. No. Dang, I really want to see how we could deopt, just get that JavaScript but maybe that'll have to be a different video because I think we're already been going for quite a while. I think we're already at an hour. So we've been partying. If I were to run foremost though and like steely.resources, would it carve it out? Oh, shoot. Is it an output? No, it's just audit right now. Oh, that needs to be RM Tech R because it's a directory. Same problem. Checking out output. Yeah, nothing. And it would be a string.  I don't care. We don't even need Tech R. So for const, oh, it's all gonna be on one line, right? This is humongous though. Zero bar. And this is probably muffed up in some way but oh, this is like base 64 in here. I'd be curious to like run this with node and be carved up. Look at it. Yeah, yeah, yeah. Discord modules.node.  This would be a gold mine.  But I see some passwords and stuff in here. Oh dude. Content type, hook ID, hogstealer v4. We're in the right spot, ladies and gentlemen. I don't know if we're cleanly carving it all out though, just trusting strings. That seems like a bad idea. But this definitely is a good start. So, regex, electron require. Yeah, massive, funny. Maybe this has some goodness to it that we could look through eventually but I don't think I have the volition to do it right now. I'll be honest. Add it to the list. Keep screaming at me in the comments if you want me to go back and do this thing eventually.  Well, I hope you have fun. I will say, as I mentioned, that this is crazy to me. Cause look, we were looking up Discord Token Stealer when we had looked it up on YouTube. There's a lot of stuff on this idea. Demonstration Discord Token store three months ago. There's one two weeks ago. Imagine running one in pipe. Oh, we have to watch this now. Easy way to do Discord Token. Best Discord Token grabber. Grab all the information of an account. How to hack a Discord Token. Oh my gosh. This is a whole new world and I have no idea. So maybe we'll have to pour into this a little bit more if some folks are curious about the Discord stuff. But I think that just blows my mind. Cause I don't know. I'm not that kind of guy. You shouldn't be that kind of guy. No one should be that kind of guy. No one should be doing that sort of thing. It's all bad. It's bad. So I hope you did learn a ting or two. A ting, a ting or two? I don't know what I'm saying. I'm getting the end of the video when I'm burning out. You guys know me. So I hope you had fun. I hope you learned a thing or two about some of this Python stuff that we were doing. I hope you enjoyed it. Maybe dive into some of the research or just Googling around with me. I else buy again for checking out that Hog Stealer one. We could maybe research if there's some other stuff on that. Of course, like the token grabber thing we saw referenced to.  This, this has some runway. You know, Hog Stealer. Oh, this is the source code. This is just, this is just the original thing. I don't have to use IELTS by is it? Wow. Oh, I thought I was gonna end the video, but I mean, they're doing basically the same thing we saw already. Kind of neat though. Solution settings. Yeah. The sewer pig.github. Not cool dude. Hog spammer. A discord rating tool written in HTML and JavaScript. Oh, join my server everybody. Prepare to get spammed. Oof. Anarchy grabber targets discord users. That's insane to me. Oh, it does the same thing though, index.js file. Apparently that's a known technique. Clobbering index.js to run different things. You're literally a hijack what discord does as it starts up. That's insane. Well, hey, if you didn't know anything about discord tokens and discord session stealing, now you do. You know just as much as me at this point. So wow. Wow. Wow, wow, wow. Hey, I think I'm done recording at this point. I had fun. I hope you had fun. I hope this was a good video. I really appreciate you watching. I appreciate you doing all the YouTube algorithm things and you can tell by the endless video I'm already going crazy. So if you enjoy my suffering, if you like watching this pain, if you like kind of seen it, please do. Those YouTube algorithm things. I'd love to see you like the video. Remember that. Remember the Legend of Zelda t-shirt. Dude, that gets a like. Come on. I feel like that gets a like comment and subscribe. If you could please like comment and subscribe. I'd be super duper grateful. Thank you so much for watching everybody. I love you. I'll see you in the next video. This has been fun. Take care.


DDoS, protection, total annihilation. First of all, now I'm working in Laszka, a company. You can do any research you want. In here, we have our many talented people. He is inspiring us. Let me have many creative ideas I can share today. I will show you how we try to bypass all the long solution, all the DDoS mitigation solution and service provider. First of all, thank you for Laszka first, because they sponsor us, so we organize, let's let that information sharing and analysis center and we can come to here to share the information. Some information, you will interesting. Some information, it is sensitive. First of all, here is our agenda. I will spend around five minutes to give up to give the background and the motivation. After that, we're talking about the authentication in here, because all the authentication we show in here is the most accurate and effective nowadays if we can bypass it. That means we can hit the server directly. After that, we have the live demo. We show the evidence to your guys to prove that what we've done need to be boring. First of all, the attack size now is much more large, because the internet coverage now, every guys, they will have the computer, but their security sensors still same, so the botnet, that means they can have much more, we have much more zombie. The result is that the size become much more large. Another one, the frequency of the attack, actually, I will say the attacker, he only will attack you in your P-hour. Give an example that happened in Hong Kong, one of the store exchange, they are under DDoS attack. The result is that the whole Hong Kong stock market is stopped at that date. Another one, the capacity of the attack, because the benefit attack is expensive, so the result is that they try to make the attack much more competitive. Give example, I use the tanking attack to terminate some service, but now we just use maybe 2 Mbps, the latest attack, we already can do it. After that, the result is the cost is talking about USD 6 million per hour. So, let me introduce the attack known today. First is a volume metric attack. Just use one sentence, they only focus the attack size, no matter it's TCP, UDP, ICMP, what kind of the medical, they only focus the size. Another one is a symmetric attack, maybe I use another term, protocol base, application base, they are attacking the witness of the protocol. Give an example, GATFAT, slower, lower attack, they are attacking the HDD protocol and TCP protocol. Now, they are focused on the application level. Application level, that means maybe they are attacking the database API. The last is the banner attack. The banner actually is the idea, use the one DDoS attack to hide another DDoS. Give example, 30 gate of the SYNFAR is attacking you. In the same time, they will send the AR7 attack, but this AR7 attack, maybe just one Mbps per second, but this cumbersome attack will crash your server because it confuses you.  First of all, we have the matrix in here to show you. The matrix is summarized as a characteristic of the very major attacker and the embedded attack. The SSS represent the attack complexity. The YSS represent the attack size. In here, we see some mitigation we can use in here. Oh, it's the basic mitigation, but the most important aspect of the mitigation is start with detection. So, we can add lot this one because if we cannot detect that, how we mitigate it? And then we have the detection in here. The main thing, we can classify it in free time. Ray measurement, base lightning. There's a use of the Ray base and flow base. In here, they will show you the level graph, for example, the packet per second, B per second, and what kind of protocol they're attacking you. Another one is protocol sanity tracking and protocol behavior. Protocol sanity is the focus on tracking the map for the protocol. Protocol behavior, this one is focused on the traffic utilization application lock. Actually, maybe it will give you some hints under DDoS attack. So, if we combine all together, we will become the big data analysis. So, this is our tools, QDM, or actually, we have the free session. I will show you how we attack to bypass all the detection I showed you before. First of all, I will focus on the TCP ocean and HTTP ocean. Last year, we were talking about the authentication bypass. Something, we are doing automatically, give an example. We have the traffic pattern simulation, just like the traffic behind the policy, I will explain detail in the data. Another one, we have the HTTP header simulation. So, the result is that the attack traffic is seen as the normal traffic. If you drop the attack traffic, that means you drop the normal traffic. So, how we do it? First of all, we use the policy in here. At the program, in the same connection, we will use the same user agent. When we send the attack out, just like the traffic behind the policy. So, in this one, when we send out the attack, you will try to analysis it. You just see that all the attack just like come from a policy. This one can empower the attack. Another one is HTTP header simulation. In this case, because the HTTP header, we will change during the request. Give an example. The first request we send to get an app page in the HTTP is access sync slash sync. That means we didn't know what we need to take. After that, the server will reply to you. So, the second request we will show you just in here, access image GIF, image JPEG, image something. So, in our tools, we automatically to do this one, just like the real traffic. Because the GIF now always same the pattern. Our pattern will change as same as the normal traffic. After that, we will focus on the TCP ocean and power. First of all, the TCP ocean design is against the detection. And then we try to empower the attack power. At last, we will use a QS string. Let me show you. This is one of the examples how we use the TCP option against the detection. In here, we can fully control every TCP's data. This one is an example of a slow lawless attack. In here, you will see that after freeway hand shift, we can hold it. After a period of time, we send the first push at. Why we do this one? Because after we hold that connection, that means we can know the limitation, the barometer, the detection they say. After we send the first push at, the ad is replied. We also hold it again. Because this one, just how we extend the TCP established status. Because if we try to extend this one, the attack power will be much more strong. Because how to say this one? It is because if all the active connection is spent much more resources, just give you a compare. This is an old fashioned HTTP attack, but send, send, add, push, add, after the add, finish, add, and close the connection. This kind of attack, you can see the result is that there are several just high CPU. And then you will keep the constant of the number of the connection. But your server has no impact. Just high CPU is still can come here and the HTTP 200 replied. Nothing. So how we do it? If we wish to attack, we need to do it like that. First of all, with freeway hand shift, push add, the first request. After that, don't close the connection. We keep send the push at. I mean the HTTP request. The result is that this time, the server with high memory, they were high, not just the high CPU, because the one they crashed your server is high memory for will not have a CPU. Another thing is that because we try to keep the connection, so the connection will keep increasing. The result is that maybe after five seconds, 10 seconds, your server is HTTP 503 service unavailable. This one is never common. Another one we will do, we force no cache. How we do it? Just easy. We just use the curious string, a question mark. After the question mark, I have a random call because for the palm of the wheel of the server or the low balance of the policy, every this kind of the curious string, they will think that it's a new request. So they will not cache it and then let you bypass. The result is that just the example I show you, I tried to download a large PDF and then use the curious string. The result is that your bandwidth will use the up. After that, we will go through the source holds verification one by one. All the obligation in here actually is the last, also is the death line that we are trying to mitigate the attack. First, I'll show you the TCP sync obligation, the TCP reset. That one, they authenticate based on the favorite 100, the TCP layer. First, we send the same. He will not let you pass the intercept you. After that, we will have the same ad. He will reset you. This one is the mitigation device. We try to pull our active calls. Reset is different to finish. Reset, that means I think that the collection have problem. I will terminate it. After that, when we try the same, we will bypass it. So that is the TCP sync. Another one I will want to show is TCP out of sync. This one, they will need to be cheeky. When I send the sync, here we put the sync ad. The sequence number is wrong. What will happen if the sequence number is wrong? This time, the client will reset the connection. After that, if you see your, see you, the source IP is seen, you come again.  So what is the difference between the TCP reset and TCP out of sync? Actually, when we handle the DDoS attack or the sync fuck, what really happens when we send the sync, sync ad, and then we will send the reset because we use the spoof IP. What's mean by the spoof IP? That means you will not add, you only send one sync in this case. So the result is same. But why they decide like that? Because the efficiency handle I really use is totally different. Give you an example, the TCP reset, if we add all the packet together, just mention, two to length is different to the packet size because the header length always turns itself over. Here you will see that the TCP reset is 180. And TCP out of sync, we just use the bandwidth around 140. So in here, we will find, oh, the TCP out of sync is better. Is it really better? I will show you another one. Actually, we can bypass easily, use the spoof IP. I use the spoof IP can bypass the TCP sync authentication. In this case, we try to use the same source IP, send the sync. When he, no matter he replied the sync ad or not, we just send the reset again. And then we send the sync again. Use this kind of the methodology, 33% of the attack can bypass it. I mean the spoof sync can bypass the TCP sync authentication. But actually, the traditional sync file, they are 40 bytes. They are missing something. Maybe you are not hard to find some news to show you, oh, I can mitigate 100 gig attack. I can mitigate 200 gig attack, something like that. Because they haven't shown you something, some secret. Because if the TCP sync is 40 bytes, we can drop it by the ISP directly. Actually, TCP will not 40 bytes. Because according to the RFC decide, the TCP sync, he will leave the TCP option. Because the first thing, he will try to let you know what a significant example, the maximum segment size, he will tell you how many segments I can use it. So when we try to simulate a real sync traffic again, I will suggest in the IPDR piece, randomize the TTL. Because the attack now all is 255, it's boring. You just see the strict line, oh, this is attack. I dropped by the TTL. Another one, please randomize your window size. Window size just will tell you what is your OS. Give you an example, maybe window 555, something like that. This one also need to give you an example, maybe I spoof the XP, window MT, or window 7, something like that. And then we need to add the correct option. Because if we add this one, the ISP cannot drop yet easily this time. So another authentication I wish to show is HTTP redirect authentication. In this one, we will focus on the layer 7. When the first get we send, he will redirect a path. If your client can redirect that, he will, and then he will redirect you back the first path you wanted to go. The result is that you can pass it. So what is the key to bypass HTTP redirect? First of all, we need to find out the detect the HTTP V02. Because when you capture this one, that means they have the HTTP redirect. You need to do something. The second thing is you need to, in the same time, you need to make sure they have a location, hdba.c.com. So if we find the C02 and location, that means they have the HTTP redirect. In this time, we just loop the script until they come back HTTP 200. That means bypassed. So easy. Because just a simple program like WGAS, CURL, also can do it. So we enhance it. We show HTTP cookies in this time. This time, not just redirect, we add the cookies if the client, he can add the cookie and reply it back. He will redirect you back to the page you want to grow. The result is that this time you can pass it. And why this you? So what is the key to bypass the cookies? First of all, we need to detect set cookies, the key word is. If they have the set cookies, that means they have our fan code. You need to copy it. And another thing you need to make sure is the expire. Because the expire, it is the sense to tell you how to set it with authentication. Because now the authentication, he will use time base or traffic base. Give an example. Maybe you authenticate it. After five minutes, you need to authenticate again. So this time, we told you the Churchill you need to set. So sometimes, if you're in the first HTTP redirect request, you saw this one, delete it. That means back luck. Why? Because that means every time, you change the cookies. So you need to do the obligation every time. We also have the enhanced one. The HTTP cookies use the header token. In this case, you will see that he will use HTTP header. It's not common. This time, they use HTTP code. Maybe in our case, we use X-heather, something. Other things, it seems as the cookies authentication. But this one has the problem, the policy dependency behavior. Why we have this problem? Because if you wanted to develop the header token, that means you need to use the API, HS, and XHR tool. But the problem is that this time of the tech lead till now is not comparable to all of the bouts. The result is you can, the render cannot fully use all the functions. So we just simulate the traffic flow. We can bypass it. And then we have the JavaScript actually, this one is most challenging now. Again, we send a get. It will give you a hint. It will give you a JavaScript. And then it will ask you to calculate something this time. If you can calculate and post the result, it will direct you back to the index page. So it will wireless you and you can pass it. The key to bypass the JavaScript is that, first of all, JavaScript is client-side program. What does it mean by client-side program? That means you just open your WildShark, HTTP watch, you can find the path and download it. JavaScript is human, can understand. That means you can read it, analysis it. After that, we can use a different algorithm to bypass it. First of all, after that, we can calculate the result, just simulate the traffic flow and bypass it. All the guys doing this one now. Another one is that we use the client deployment mode and server deployment mode to cover the method. Actually, we use the auto bypass. I will show you because our program is just one megabyte. What is the client deployment mode? In this case, we will add the JavaScript engine inside the bot. But this one has the limitation because we just can run something. It's purely JavaScript only. It's no WVC, DOM, I mean maybe some parameter inside HTML and then you need to call it back in the JavaScript. Cannot. In other case, we use the application bundle, in this case, the server in here. So whenever the CNC server asks the bonnet to attack, the bonnet will communicate to this server. He will send back, he will seep the file and send back to the server and then he will show a calculation by the server. After that, he will give back to the client and then to bypass it. Actually, this one I will say is the most effective and accurate, but the problem is that the user experience may be poor because sometimes people also cannot understand the capture. Again, just seem as the JavaScript authentication. This one, he will use the after you fill in something and post it and then we redirect back and then you can pass it. So what is the key to bypass the capture? I have something wrong, but never mind. First of all, we need to find out the path of the BMP, I mean the orphan page, just the capture page because if you can download it, that means you can use some algorithm to bypass it. After that, the challenge is that embedded the capture engine in the bonnet, we will use the same method as the JavaScript. Just simply the traffic flow, use the current deploy model or use server deploy model. But actually, if you come to DevCon, you will find that have many capture engines, we can download it and then can use it and add it in our program. So this is the summary of the source host of replication. First of all, they will verify your launch booted soft IP or not. After that, HTTP redirect and cookies, they will verify, is it HTTP compatible appliance of not. Now JavaScript, they will verify you are the real browser or not, the capture, you will try to verify your real human or not. After we bypass all of them, we can attack directly. So Tony bring out and very important points that in today's detection mitigation techniques, we have to rely on the source host verification. And once we can bypass these verification, we can get to the back end directly and they attack all to the back end. So our proof of concept tool is trying to bypass these authentication. First, we try three times because the first time expected TCP authentication, it will fail because it will reset you or it will send a wrong sequence number to let you reset. So the second authentication, we suppose it will success. And the third authentication, we are just for sure, make sure it is correctly put our IP into the right list, for example. And also to make the attack and authentication more like a real user, we will have a true TCP IP behavior handled by the operating system TCP IP stack directly. And also from the POC tool, especially the cookie authentication, the HTTP cookie will be carried on the following attack packets. Because even you are putting into the wide list, if you don't have the cookie in the subsequent attack, you might be blocked. And also the JavaScript, we are implemented using something like a spider monkey or a JavaScript engine. Currently, we don't have a DOM implemented in that included, but this is just a matter of time. And finally, how about the capture? As you can see, or in the coming video, you will see how this screen comes from. The design is that to make our attack tool sending a correct capture back to the mitigation device. The design is that we first convert the color image to a black and white and maximize the contrast. And then apply the medium filter to filter out the noise and then segment the word into individual characters and find out the boundary of each of the characters. Finally, we simply calculate the pixel difference. You might think that this is very, very rough implementation, but it can successfully break the capture by more than 50%. In fact, if you want a higher rate of capture authentication, you need a capture library. I think DevConnet presented a lot on this, no matter in this year and past years. After bypassing all the authentication, now comes to the attack. In the attack, we have the TCP options and also the TCP options. What TCP options talking about is control the timing of the TCP connections. We can control the number of connections established to the back end server. Why back end server? Just because we bypass it. And we can hold the connection for a certain amount of time. This, as Tony mentioned, this benefits for the slower attack. And also, we can handle the connection idle time out after the last HTTP request. And we can control the connection interval so that to avoid something hitting the threshold of the meditation device. For the HTTP options, it actually is that within the TCP connection, there is a period of sending multiple requests. This request, each HTTP request is an HTTP connection. We can control the number of connections and also the intervals of each connections. And now we are showing the video. Let us see how it runs in real examples. First of all, we look at HTTP redirect. That means you can see in the left part of the user interface, the first checkbox. From our testing, the left side is the client side. As you can see, the client launched our QDEMO tool. And the right side is the server side. As you can see, the web server log. On both sides, we have a packet capture. One side is capturing the packets. When we start launching the attack, you can see this is the authentication part. You can see because the first time, this one returned a real tool. So it redirects authentication. And you see subsequent 200 OK for three times because, as I said, we are doing the authentication for three times for sure. Now let's see what's next. After authentication, you can see from the primary test, we hold a few seconds and then send four requests. This is the first one you can see from the query string. Started with E and then the second one started with N, etc. And the four requests are all going to the back end. As you can see, both from the server side and both the server web server log. Next, we are going to the HTTP cookie authentication. For the same setting, the testing environment, you can also see the redirection because it requires you to send back the cookie. And also you can see four different requests going to the back end. Yes, in the testing environment, we use four. But in the bottleneck environment, I don't think you in your server, you will receive four too little because you will have so many bots. Let us pick one of the attack HTTP requests. You can see, as I said before, the authentication cookie is carried to the attack. There is a cookie view in this attack packet. Now goes to the JavaScript authentication. This one we are using a CDN to test. As you can see, the JavaScript is quite sophisticated. It holds your authentication for some time. And then it also has a cookie embedded in it. And from the right side, you can see the server side. You can see the four attacks. You can see the four attacks are all goes to the back end server after we bypass the JavaScript. Let us take a look at this one. And as you can see, even if this is JavaScript, it also has a cookie cookie view there. And the cookie clearance means that we are successfully bypassing the JavaScript. And lastly, we are showing about the capture authentication. This one will be the same. And you can see from the authentication phase, the mitigation device has the capture image, the bitmap sent back.  And we are interested in whether it is really bypassing a correct capture image. So we pick up a packet about the after we recognize the bitmap and send it out. And you can see this is WMGK, which matched the original bitmap. So this is our tool, kill them all, integrating both the authentication and the attack phase. As you can see from the video, our tools simulate the true TCP IP behavior through the OS TCP IP stack. And we have a believable HTTP header so that no matter it is a mitigation device or a cloud CDN environment, it believes our HTTP headers are true. And also, we have embedded JavaScript engine so that it will not, so that it is not bulky, it is lightweight. And also, we have our capture solving capability. And to maximize the successful rate, we randomized the payload, including HTTP header such as user agents, and also tunable post authentication timing and traffic models. In conclusion, this is all these settings making it indistinguishable from human. How indistinguishable is this? You can see. We get from our testing, the date of our testing you can see from the slide. We try for, this is the CDN, we try it for 11 times, each time we have four requests. So you can see 44 requests. And from what the CDN portal, we can see that all are regular traffic. No bots, no threats. 44 is a small number. In real life, you will receive 44 million. So it comes testing environment. For the device, that means for the four authentication, some are doing on the device, some are doing on the CDN. This is the setting that against the device and against the cloud, we put the server behind the mitigation device and the client side on the other side of the Internet. This is the result and summary. And I'm not intended to talk about here, but you can see we do a lot of testing to make sure it is all bypassed. And the attacks are successful. These are all as well. These are the two secure CDNs. So it comes to the end of our presentation. And you can check out our new version of tools here. Thank you.


OTAN Outreach and Technical Assistance Network. So this is how we embedded our co-app for our digital literacy academy project. I am Jill Wright and my team member is Vicki Costa. She may be able to be here. We're not really sure about her schedule. She wasn't sure. We work with Oxnard Adult School and we are part of the current D-LAC cohort, which is an awesome program. And I highly encourage you all to join or to apply anyway, if you can. Next slide. So why did we do this? D-LAC program asks each agency, each participating agency to come up with a site-specific project. And at the beginning of the pandemic and before the pandemic, we realized at our school that we were dealing with the need to change and expand our thinking. We wanted to ferment our culture and move some things forward. We wanted to shift away from preconceived notions of teaching and learning towards incorporating technology as a learning medium. We recognized an uneven distribution of technology services and resources. There was definitely, and still is, a lack of tech know-how. And we wanted to help people, our students and our teachers, move forward into the 21st century and use technology in teaching and learning as a 21st century life skill. One of the presentations I went to this morning was talking about that very thing and the digital divide and what people can and cannot do if they know or do not know technology. And we really wanted to move this forward. Okay, so we felt that our curriculum would fill a specific need at our school and we conceived our D-LAC project to address these needs. Digital literacy, again, it has become a life skill. So what is a co-app? A co-app stands for Civic Objective and Additional Assessment Plan. They are part of the causes California, English language, civics and civic participation. And each civic objective has one or more alternative assessment plans. Co-apps are literacy and language objectives. They're not tech objectives. And the goal of California EL Civics Education is immigrant integration. So we wanted to take this and combine this with our digital literacy vision. So first, how do you find a co-app?  And I'm going to show you how to do this. All right, so here we have the causes website. So to find co-apps, scroll down, down, down, down. Over here to California EL Civics. Down a little bit, not too far. California Civic Participation and IELCE. And then we go here and I always get this one mixed up. I believe this is the right one. This is the right one. This is new. It's this one. All right. Does everybody see my screen saying civic objectives and additional additional assessment plans list? Yes, we do. Thank you. Thank you. So there are three. Tech co-apps 47, 48 and 73. So the way we look at them. 47 program year, and then you click go. When we look here, we see different options that we have for the content of the co-app. So here we've got 47.1, 0.2, 0.3. And here this area tells you what the co-app requires the student to do in order to pass the co-app. So for example, identify and categorize common uses of the internet, research, read and summarize literature, read aloud and or discuss issues, identify common online safety issues, identify vocabulary and or describe actions and precautions that can be taken to reduce online risks. That's really important and demonstrate the ability to read and interpret, blah, blah, blah. Okay. And next to these, you have a number that corresponds to what that objective is. If you look at 47.2, the objectives are a little bit different. So 47.1 is 1, 2, 3, 4, 5 and 6. 47.2, 3, 4, 5, 8, 12, 15. And then 3 is 1, 2, 3, 4, 5 and 6 again. And then here it tells you the levels of ESL students that would participate in this particular assessment or co-app. So we were looking for something beginning low to advanced and all of these are beginning low to advanced. All right. Anybody have any questions so far? Not in the chat pod. Okay. All right. So let me go back to my slides. All right. So here we were civic objectives, additional plans list. Okay. Back to our project. So our project had several iterations. Our first idea was a 30 hour face-to-face pre-class orientation for ESL students. And we would teach the tech that was necessary for class only. That would be face-to-face. Then the students would go into their level classes. And hopefully continue to use that tech. Our second idea we got, we really thought, well, if we're doing this, we could do that. And we could do the other thing too. And oh, why not put all of that together into something amazing and big and comprehensive. And it would be absolutely wonderful. So this, our second idea was, we said it was a 30 hour face-to-face pre-class class. Probably it would have been longer than 30 hours. That would include embedded co-apps. Comprehensive. We would start from the very, very beginning for all students. Also prior to entering ESL. Got a little bit of pushback on that one. So our third idea, our big idea. The one that we have right now is we would also start from the very beginning, be thorough, explicit. Now when I say start from the very beginning, I mean, this is a cell phone. This is the button, the on button. This is the off button. So really, really, really basic. We identified the minimum technology skills that students need to be successful in our school technology objectives. And then we wrote objectives for them. And we broke down the larger concepts into smaller, more manageable fights. We integrated our co-apps. We pulled out the literacy objectives and stuck them into our curriculum. We decided to teach both tech and literacy together at the same time. Each objective. Contains a tech skill, a specific, specific related vocabulary, specific grammar, and a mini assessment that goes just with that specific thing. And we call it digital literacy skills for learning and life. And let's see if I can go here and show you what that looks like without doing, there we go. Okay. Everybody see my spreadsheet? Yes, we do. Okay. And I put the link for people if they want to follow along in the chat box. All right. Thanks. So we put this all on a spreadsheet, which is going to be difficult for me to show you with the zoom stuff on the screen. It's quite extensive. So the yellow issues, the yellow boxes are areas that we have not resolved yet. One of the things that our teachers always commented on or complained about with regards to EL civics was, but they need grammar, they need vocabulary. And there's so much technology. Vocabulary, not as much grammar, but there is a lot of vocabulary. So we just stuck it all right in there. So for example, this objective here, so identify and demonstrate basic parts and functions of a computer. We've got all this vocabulary, different parts of a laptop, different parts of a desktop, parts of a Chromebook tablet and smartphone. And then we've got what do you do? You scroll up, you scroll down.  And these are all words and things that we use every day. And we don't really think a whole lot about it, or maybe we do think a lot about it. But we decided that this is necessary vocabulary for our students to know. And then there's grammar. It's really basic. This is a, what is this? What is that? Where is this? Where is that? What I didn't put in there, maybe I need to add is what does this do? And then the tech skill is navigating the device. Or here we've got the tech skill as using a mouse or a trackpad or a keyboard. Then we go into keyboarding shortcuts, keyboarding, it's just basic typing. Anthony was talking about that. Copying, pasting, undo, redo. I've taught this to teachers. I've taught this to teachers. I've taught this to teachers. Scroll up, scroll down, refresh and move to trash. So the device, we really want to be inclusive. And it's becoming more and more difficult with the proliferation of devices. But most of our students use laptops, Chromebooks, tablets and smartphones. Some people also have desktops and we still have them in school. So people need to know how to be able to use this stuff. So we've got basic tech skills. We've got basic tech skills. And that's this section where we're concentrating our efforts. Once a student has mastered this section, or maybe once a student is proficient in this section, they would move up to all things Google. And we were going to write a Google curriculum. And then we remembered about the applied digital skills and thought, well, we don't need to reinvent the wheel. So we'll move students into that. And then look at the assessments. We have not started that yet. Look at the assessments that are built in and see what we want students to be able to produce. Maybe shift around some different assessments. Do the same thing with Microsoft. And then ultimately, hopefully Canvas and, well, we said Canvas and Moodle, but it looks like Moodle might be going away. So we might not be able to, we might not do that. All right. And we are writing. We've got a scope and sequence. So we've got week one, basic parts. Week two, week three, four, et cetera. And again, all of this is still a work in progress. And then our cover sheet is all kinds of different resources. And eventually there will be a full set of lesson plans that include digital worksheets, digital practice, slides so that a student can look and see, oh yeah, that's the on button. That's the volume button. And where do I click now to go to that thing? And they'll have all of that. And basically, that's pretty much it. So I'm going to stop sharing. I've got the PDF of the slides, which I'll put in the chat. They were here a moment ago. Where did they go? There we are. All right. So everybody's very quiet. And that was a whiz whiz fast through, through our year long progress and our year long project. Anybody have questions? Well, I, I have one, Jill. Yes, please. Could you please go back and show us how you embedded the co-op? Yes. Okay. And then we have another question. How, from Lori, how have the students responded? All right. Let me show you how I embedded the co-op. Right. So if we go this way. In our assessment sections, we have co-op tasks. Okay. I am not a spreadsheet girl. And I am really, I do not like spreadsheets. I do not like working with them or anything else. So if I'm looking really wonky with the spreadsheets, because I am. So anyway, what we did was we identified for each tech objective, the co-op objective that would go with that tech objectives. And then we just embedded, made sure that all of the teaching points were in there and that the vocabulary and that the student could actually do what they were supposed to do at the end of that particular co-op. And we embedded that in the teaching points. And then the assessment is the co-op assessment part. And so for this one, this one is, let's go back. So this one here is use email, click on links. This is all my vocabulary. My grammar is sign in using imperative, using correct register, recipient, send, receive, sender, date, signature, opening, closing, body, link, user name, password. And my grammar is sign in, use the correct register, formal versus informal email language. My tech skill that corresponds to this one is create a personal email account if the student doesn't have one already, access the school email, retrieve an email message, open it. Recognize legitimate and non-legitimate email messages. We've got some examples. And then ultimately respond a person. We've got some examples. And then ultimately respond appropriately to the school email message. That one would be either from the EL civics person. If that's the, if it's a school-wide co-op that we're doing at that moment, or if this is just a class and it's not a school-wide co-op, then it, that email would be from the teacher. And then. So this is the co-op that we are looking at. Co-op 48.1, task two. Or task three. Now I've got task three for intermediate, low, advanced. Let me find the right. Okay. So now we're back at the co-ops list. I'm going to go to 48. When you're knowing that I have a couple of more questions for you. Okay. So here's 48. I go to 48.1. I click over here on view details. So when you click on view details, you get the comprehensive picture of the entire co-op. So it tells you the name, the number, the civic objectives, the tops pro form. This particular assessment type is written. This one is for beginning low here. Rather, excuse me, from beginning low to advanced. We want to be inclusive. So we want to teach this to all of our students. And so that's why we chose beginning low to advanced. And then we scroll down. I think I said 48.1. So this, this one is one identify internet uses and communication techniques. To demonstrate understanding of common uses of internet. And conventions specific to online communication for work, for study, for friends and family. Student will identify in or describe early or in writing, five pictures or video clips, depicting common uses of the internet for communication. For example, email or chat. And then the next one is student will identify in or describe up to 10 vocabulary items. Other stuff commonly used in online communication. Okay, if we go down to task two, interpret and online communication. So given a level appropriate, authentic email, blog, social media post or video clip or something like that, student will respond orally or in writing to five level appropriate information about the content, format, style, central idea, details, point of view, et cetera. So we can have, we can send our students through their school email account, a simple email. Or for more advanced levels, a little more complicated email, and then they can respond via email to that particular message. And then we assess them. And then the answer is appropriate. And then the answer is appropriate. According to this scoring rubric. So regarding the content, the answer is appropriate, clear, complete and has correct content. Maybe errors, but they don't interfere with meeting. Then the answer is appropriate and has correct content, maybe partially complete. There may be errors that interfere with meeting, but the answer can be understood with inference. Or the answer is incorrect or incomprehensible or no answer. So that's our wonderful email. That's for intermediate low through advanced. So this tells us how the student approaches the email that was sent to them and how they must respond. So I have a few questions. Sure. So one Jill, Julie asks, are you differentiating for the ESL levels? And I think you can answer that. Yeah. In the class. Yeah. Maybe so. We're not assuming that the higher levels know all this stuff. And we're not assuming that the lower levels don't know all of this stuff. The approach that we took is that we would start from the very basic beginning of the beginning with everyone. And then that way people who know more or levels or classes who don't know more, you know, they don't have that previous knowledge, then they will proceed more slowly. I mean, in doing this research, I found names of things I didn't know. Not that I know everything. So, okay. Dana asks, what is the length of the course? Well, we're still aiming at 30 hours, but honestly I have a feeling that it could go for longer than that. We have not yet had the opportunity to pilot this. And another question is, is this course open to all students like non-ESL students as well? Oh, that's an interesting question. We haven't really discussed that one. At this time at our site, it would be open to ESL students only. So at our site, the high school diploma and high school equivalency students, they're working on computers. And so they get a little bit more computer instruction in their classrooms. And then CTE students, a lot of those are also using computers in a very different way. Much higher level to begin with. That's all the questions you have. Okay. All right. Okay, here we are. Everybody has a question for you. Do you have a copy of your screen showing the basic computer curriculum design? There was a link there. Hang on. I came in late. I came in late and I didn't click the link, but it was, it looked like it was the link. To embed that co-op. For the slides. All right. This link here is the, I think this is the spreadsheet. Yeah. You know what? When I clicked on that, there might be something with my computer. I don't know. I don't know. I don't know. I don't know if I'm able to. Yeah, I've got. You have to make a copy of it. Copy. But let me put that in the chat again. This is there. Oh, you just did that. If you make a copy, then you can adapt it for yourself. Okay. Yeah. And then. I don't remember the link of the applied digital skills, but. I don't know. I don't know. I don't know. I'm talking to somebody who's not well versed in. Figuring out what's on the screen, but it's very comprehensive. All right. Anybody else? Jill, you might want to show them the tabs at the bottom of the spreadsheet. How they can navigate through. Sure. Because that's confusing for people who don't know spreadsheets. I've made that mistake. Okay. So here we are back again. I'm going to show you my cursor all the way down at the bottom. Yes. Okay. So I went crazy with resources and I just threw links to everything in there. I'm not going to show you that this is basic scope and sequence. And then here we've got basic tech skills. And then you can navigate left and right. Going like this. Oh, standards. Susan, we didn't talk about standards. We talked about the standard standards. We talked about the ISTE digital citizen standards. It's 1.2. And this is the standards that we've found would correspond most closely with our goals. Okay. So that's the basic tech skills tab. And then over here. Next one is all things Google. And you can see I started throwing some stuff in here. I'm going to show you how to do that. I'm going to show you why do we reinvent the wheel? There's no reason to do that. So I put in, this is the link I was looking for to apply digital skills. And you just click on that. And this is where it takes you to Google. As a teacher, you can sign in for free teacher account and your students can sign in for free student accounts. And again, I just put in the same list of stuff that I had started to put in the Google and we've done nothing here. And then the same thing with Canvas and Moodle. But the format is the same. So assuming we actually get to Canvas. And to teaching our students Canvas, it will be the same sort of thing. So they're going to need to know the vocabulary. Grammar. Probably less. So it's probably going to be a repeat of the same kind of grammar. Tech skills are going to be what they're doing with Canvas on whatever device they've got. And then the assessment is actually doing the thing. We hope at some point to move all of our classes. Well, we hope at some point to move our online classes to Canvas, but we're not there yet. Yeah. Somebody would like you to put that digital literacy link that you showed into sure. Sure. I will do that. You can find it here on the Google tab. And let me copy it for you. There you go. And so can I just, this is Lori. I just wanted to sort of add on. I like that you said that, you know, this is really for all levels because it's possible that your advanced students. Or some students know how to do all the tech, they don't have the language related to it and vice versa. So it really can be done in sort of a multi-level situation and people can be helping each other. But all the goal of the co-op would be to learn the language surrounding it, but they are learning the tech. Of course they have to learn the tech in order to speak about it appropriately. So that's a great, great, great lesson. Thank you. Thank you. Yeah, this was really brought home to us during the pandemic. How much people. How much they know, how much they don't know and where that gap is because we lost so much, just like everybody else, right? We lost so many students and the students who were able to attend, they themselves could knew where to click, or they had somebody in their household who could show them where to click. And yeah, just like everybody else, I spent a lot of time talking to teachers or talking to my students and saying, okay, click here. Now it's going to take you somewhere else. Now you do this. So anyway, okay, Dana, willing to share our instructional materials for our co-ops for this course. Are you talking about lesson plans, Dana? Yeah, that would be awesome. We do two of those 48.1 and the 47.1, this how to be safe online. And, but I'm really intrigued by the other ones that you do. So I would love to see your instructional materials that you have for it. That would be awesome. Happy to share when we're done. Thank you. Yeah, you're welcome. I just put my email in the chat or feel free to keep in touch. Thank you. Yeah. What we want to do when all of this is, we want to say complete, but also if we recognize the, what the digital universe, it's never really complete. But once we've got a product in a package, we want to put this out as an open educational resource. Thank you, Paulina. You said you haven't piloted yet. Do you know when you're going to be piloting this course?  And I only recently found out about this. So I want to talk with them. I've not had the opportunity to do that this week. So that's high on my priority list for next week to see if they would be willing to work with this. I have a feeling they might say, yes, if we can provide them with really detailed lesson plans, because they're a little bit tech nervous. So I think it's awesome that they've agreed to do a computer lab for students. And yeah, north start digital literacy. So I'm not familiar with them, but their name keeps coming up. So I'm going to spend more time with them as well. Thank you for that.


So some big news coming out of the Rafa Nadal camp and from Indian Wells as well, that he will not be participating in the tournament that starts in a week's time. Indian Wells, some called the fifth slam, the biggest tournament since the Australian Open for the men. Let's have a look at the statement from Indian Wells and from Rafa's Twitter. So having a look at the Indian Wells tweet, they said three-time BNP Paribas Open Champion Rafa Nadal has withdrawn from the 2023 tournament due to injury. Tommy Haas came out and said, we wish Rafa continued healing and hope to see him back at the BNP Paribas Open next year. Rafa also came out with a statement confirming that he won't be playing Indian Wells and also won't be playing Miami. This is what Rafa had to say on Twitter. I'm sad that I won't be able to compete at Indian Wells nor Miami. Very sad not to be there. I'll miss all my US fans, but I hope to see them later this year during the summer swing. So there it is confirmation that Rafa is not going to be playing Indian Wells or Miami. And of course, his ranking is at risk. He's number eight in the world currently, and he's been in the top 10 since he was 18 years old. Since 2005, a streak that no one else can even touch on the ATP. But that's in jeopardy. The streak might end for the first time since 2005 because he does have 600 points. From the Indian Wells final last year, that is going to drop off his ranking now. And I guess besides the ranking, where is he going to come back? Is he going to come back in Monte Carlo for the Claves? Is he going to come back in Madrid? I remember he didn't play Monte Carlo last year because of what happened in Indian Wells when he got injured there. He didn't come back until Madrid. And then, you know, he did win the French Open, but he didn't really get the preparations that he's used to having. So let me know down in the comments below. When do you think Rafa will come back, but he's not playing Indian Wells and he's not playing Miami again this year?


Once everybody's chasing for Jasper's case brace calm We just sold out another filler for the $15 basketball mixer with a 2021 And you need Prism multipack cello break number 81 So first we do the break randomize customer names and teams the ship of the hits out and we're no better in common ship and again Once we finish the break will randomize the 30 customer names that bought in and Customer at number one gets a spot in the mixer. So good luck guys Here's the dice really is a customer names teams home roll it One of six seven times good luck Check the website why I don't know if we have any spectra up there So I don't know which website you're talking about Jasper's case breaks calm seven times one two three four five six So this is just for the pack filler first China I'm down to mark. All right seven times seven times here now one two three four five six seven Six and one seven times Cavs down to the Dallas Mavericks All right, so there you go. That was the way it came out guys now. I'm gonna alphabetize it Quickly show you guys your teams. I'll do the quick pack break Yeah, why so if you're looking for a picker team We have picker teams available on our website You just click the link right there that I just dropped and you check out what you like But yeah for what we're doing here. I know you may not understand it, but it's for a big mixer But like I said if you're looking for something pick your team style click that link You can check out the website three times in a roll chat like in these pack fillers Pacers definitely follow you Jeff Teague Andrew Wiggins and Tyree's Halliburton Emergence With Josh Green Ruggie Emergent Halliburton Sacramento Kings Bertens Jalen Brown and Desmond Bain Well, you know for these fillers I mean obviously the main chase isn't something out of the pack But the cool thing about it is you could get something out of the pack and yeah You got a red-white and blue-urban and you know I got it off the call of Herbie So it's not like you haven't hit anything great, but yeah, like I go just saying all right the last three It's like how can I get the Pacers three times in a row? Just doesn't make sense Let's see maybe your pastes team right here gets you the spot into the break So good luck everybody. Here you go one spot being given away Here's the dice for ladies original customer names again mark Donna Dmitri roll Four to four eight the hard way Eight the hard way one two three four five six seven eight Boom eight times Wow, no way chat you cannot complain ever again You could not complain ever again at numero uno. There you go. Congratulations You just want to spot in the 15 dollar basketball mixer after eight times I'm gonna post one more guys. That'll be the last one that sells it out plus the one spot straight up Appreciate it guys. Jasper's case breaks.com