Oh, I see they got that in there. Aaron holidays had himself a week joining us now on running back. Aaron, when I'm not watching the spurs, I'm watching the Knicks. So I'm watching on Monday night. You know, we have to get right into this. All right. That call at the end of the game where Jalen Brunson gets called for the foul and we were heading to overtime. I'm thinking, Oh, this is exciting. Things are happening. Then you hear the whistle. And there's controversy where you felt.  He bumped me in my chest and I turned my body, but you just don't know how the rules are in that situation. But it happens.  Were you shocked? I mean, because it first of all, it took forever to figure out what was going on. But were you shocked that thinking, Oh, we're heading to overtime? Or did you realize, Oh, I have a chance to just seal this thing up and keep it moving. So I was focused on making the shot. I didn't really hear the whistle. And then obviously he had his hand up and I knew I had three free throws coming. So I knew I was going to make two of them and probably miss the third. So I was shocked, but I'm just happy we got the W. Did you ever think to decline the free throws and say, No, sir, I'd like to go to overtime and settle this like men. Okay, I was just checking. And that same game you had a monster dunk. You had a monster, monster dunk that went viral. It was only your sixth dunk, believe it or not. Was this, was this, were you thinking, you know, all the way through this play? What was going through your mind right here? This play? Yes. I was thinking about dunking it the whole time because I had one previous in Atlanta. Our game might be for this, I believe. So I just, Oh, yeah, I was thinking about that. That's got to be your best dunk ever. I wouldn't say that. I've had a few in high school that were pretty good. So yeah, but you on two minutes was your phone blowing up more after this game because of the dunk or because of the how it ended with the with the Jalen foul? A little bit above. It was a good mixture. Obviously the dunk every my family was very excited about it. And social media wasn't well at all. I just I looked at social media, obviously it went viral. And I just had a good game too. So I feel like all that put together really, really just have helped everything go viral. No doubt. So Aaron, this season, 24 and 30 for you guys, you guys have already surpassed last year's win total. So what do you think has been the biggest key to your guys success already as a young team that's that's growing have some veteran players, including guys like you? I feel like the organization did a great job of just putting a lot of group, a lot of vets together with this young team. We brought in probably four or five good vets that could help us win and understand the game and help the young guys as well. So credit to them there and also bringing an email. He's a great coach. You saw it in Boston and he really gets his players to play well. He holds them accountable and on defense is he's probably one of the best defensive coaches I've been around. So all that mixed in with the young talent, the veteran talent and a good coach. I feel like we were able to put something good together. That's what I was going to ask you.  You said defensively he's one of the one of the better coaches that you've been around. But what has his impact been other than that? And you guys locker man, he's just a great leader. He installs confidence in us. I remember in training camp, he came to all of us and pretty much said no matter what points you are at your career, you can always get better. And that really stuck with me because I'm a guy who works and throughout my career has been up and down, but my work has stayed consistent and just hearing that just it just gives you confidence. And he also breeds confidence in us by obviously allowing us to play our games when we're out there on the court. But just holding us accountable with that that goes a long way and growing as a team and as a as an individual player. You guys added Dylan Brooks in the off season. It's just a joy to watch him instigate people. So what's it like to play with him versus playing against him? I've never had problems playing against him. I played him at Oregon as well. So he's always been a good dude to me. But you really see how good of a guy he is off the court when you're around him in the locker room. He's funny. He has a little Canadian accent. So it amplifies everything. Everything's funny that he says, but he's just a good dude and a great leader for our team. He brings that edge that we need. And especially for me and the young guys, like we need to see somebody out there going hard so we could follow up with that and go hard as well. Has there been a moment or something specific that you've seen him do where you just realized like, Oh, I'm glad he's my teammate.  He obviously defensive effort. He picks up whoever the best player is full court and doesn't care if he gets cross scored on. He's going to give you that effort and that goes a long way for me because I'm a guy who likes play defense and go hard as well. So credit to him. He got us. Our defense started off and it's going to a good start. Aaron, there's also your current team teammate Bobon. And when he's on the mavericks, he kind of wanted to fight you at the end of this game. What have you guys talked about about this? Yeah, he's got it before. We all laughed it off, honestly. But yeah, I remember that against Dallas and the playoffs. I think they just beat us for the series. But I mean, there is no bad blood there. We're all we're pretty good teammates. He's a great guy. And I'm I'm a great guy as well. So we talked about it. Aaron, what did you what did you do? What did you do to Bobon? I know Bobon. He's the least confrontational person I've ever shared the locker room with. What did you do, man? What you say? Didn't play anything. I I don't know. I was just trying to play basketball to the end of the buzzard and they threw it to him. And I stole it and shot it three made it. And I think that's what ticked him off because I stole it from him and shot it. But I don't know what he's going to do. I've never seen Bobon get mad. I yeah, I never got to play with him.  Man, he's hilarious. He's a great dude. Like you it's crazy going to city to city and everybody's yelling Bobon, like during the games, like they want to see him out there.  He treats everybody like family and he's just a great person to be around. But the dancing, we can we can tell him to stop dancing, right? I mean, it's the tick tock stuff is weird. It's like, I mean, he's the only player I know in the league that gets a chant no matter what building he's in. And that's that says something. It's so good. Bobon's a rock star. He's a rock star. He really is. You've got two other brothers playing the league, which, first of all, is amazing. So to play against your brothers, is there trash talk? What is it like pregame, postgame? How do you guys handle that? There's no trash talking. We just hang out honestly. Like I'll try to get to their house when I'm in their city or they'll come to mind when they're in mind. And it's just a time for us to be around because we don't get to see each other that much. So I really take that time to just hang out and be a brother, honestly. So pregame, I'll watch them work out. They'll watch me work out, we'll chat then. And then after the game, we'll pretty much do the same thing. But playing against them, it's a blessing, obviously, that my other brothers in the NBA with me. But those are probably like my best and most one games that I play in. So awesome. One on one tournaments, holiday times, do you guys have those? And if so, who wins? I mean, we've played. A few times, especially when I've gotten older and gotten to the league. But it's honestly who gets hot that day, because obviously, we all could play defense and we could score the ball, all three of us can. So it's it's really whoever gets hot that day. And they'll usually take the W for the day. You play with Justin to separate stops in your career, spending some time together, growing up. Is it better to play with your brother or without? It's better to play with my brother. He's my best teammate I've ever had. Not just like off the court, you get to hang out and spend time with your family. But on the court, I know every movie wants to do where he wants to go. And I'm the point guard. He knows where I'm going. I know where he'd be at. So even on defense as well. So it obviously works out for us both. And I just got one. I got to play with Drew one year. Hopefully we can get happen. But we'll see. Your parents also both play basketball. And your sister, Lauren, played basketball as well. I mean, was was not playing basketball, even an option for you. I know you guys had a lot of backyard moments growing up. But like, what was that like growing up and just a push to to who? Just competitive. There was no push really. My dad, he didn't really force me to play basketball. He said, if you want to, I'm here. I go to the gym and I'm not doing what I'm supposed to. It pretty much just say we can go home right now. He's not going to force it. But we played every sport like baseball, basketball, football. Hockey, sometimes soccer will compete at everything. Like card games, like you can name it, it will be competing. And that obviously helped me grow into the person I am today. Always competitive and have that edge. I'm just picturing a garage full of sporting equipment. So much equipment. We always like to ask everybody, you're welcome to the NBA moment. Do you remember yours? I probably have a few, but I know I played against Alec Burke. I forgot what team he was on, but he came in. He was already had. I came in the game had to guard him and he ran off. Like three or four straight buckets. I'm like, man, this is crazy. Like this is what the NBA is like, and just got to get better and get used to it. It's awesome. Aaron, we appreciate the time. Thanks for playing along at the beginning, even though I was the next hit on that one. Keep going. We'll talk to you soon. Best of luck. Rest of the way. When we come back, we're going to ask Lou about his favorite topic of all time. The 2020 bubble would run it back returns.


All right, folks, it's almost the end. But here we are again.  That's checkmarks, Google and Offensive Security. Thank you all so much for helping to make the AppSec Village happen. We could have done it without you.  Also, if you're interested in making sure that this is a lasting thing, go out and become a super fan for us. That would go a long way towards helping to make sure that hopefully if next year's DEF CON is in person, AppSec Village will be part of it. All right, without any further introduction or me talking, we are going to hear a talk from Mehmet Ines, a managing partner at Invictus in Cyber Intelligence. He's going to be talking about a Haven for Hackers, breaking a web security virtual appliance. With that, please help me welcome to the stage Mehmet. Let's talk about finding a zero-day vulnerabilities. In that presentation, I'm trying to take you all to the journey with me to finding different vulnerabilities in a security solutions and combination of them will give us a remote code execution with a root user. This is Mehmet. I've been doing vulnerability researching since 2005 and I'm working for a company in Invictus Cyber Security and Intelligence. And this is my Twitter address, mdisec, and PanTest.blog is a web page where me and my teammates are sharing our technical research. In here. Okay, so Haven for Hackers, third edition. Actually, there's a story behind of that title and it has started back in 2017. And I was doing a PanTesting for a company and there was a blue team members and they were telling me you are doing this, et cetera and et cetera. And I was start thinking about what happens if we somehow managed to break in into your team product that they are using and write a custom rule in order to become a totally invisible which are because they are telling us what they are seeing the product and if we become invisible, that would be so nice. So that idea led me to defining a remote code execution on a various different team and the log management solutions back in the 2017. And after one year, I was trying to send an email to friend of mine and that dude was not receiving any email from me at all. And it turned out that there was a problem on the email security gateways and they managed to solve the problem and eventually we started sending an email to each others and I was thinking that all right, there is a email security gateway products and what happens if I managed to break in into your email security gateways so that I can read all the emails incoming and the outgoing. So that idea motivate me to finding a zero-day remote code execution vulnerabilities on Simon Tech, Micro Focus and the TRANC macro. And previous year, I was working at another client and the project was hardening the client's network in order to finding a data acceleration scenarios. And they were telling me we have the web security solutions and only that device can connect to the internet. So all the clients has to go through that box and if you find a different way to exaltrate the data, that would be nice. And I was like, okay, so what happens if you find another zero-day vulnerability on especially the web security and the content filtering solutions. So when the attacker managed to execute a code on the client network for the data exaltation and the CT communication phase, they can explain the content filtering solution. So this is the today's topic. We are going to talk about these really vulnerabilities that I found on a very, very interesting product. And I have a case study for you. There is a product from the Trent macro, interscam web security virtual appliance. And I have done the vulnerability research on specifically that solutions and we are going to see what kind of vulnerabilities that I managed to find and using all of those vulnerabilities together, we are going to see some sort of code executions in the end. But before diving into the case study, I would like to a little bit talk about what is the content filtering in order to make it crystal clear to everyone. As you can see in the picture, there is a computer on the left which represents a client's network of the company. And those devices don't have a direct internet access. They have to go to the proxy service first and that proxy service goes to the internet so that the organization can do some sort of analysis and the rules on the client's network. So content filtering is happening in here right now. We can imagine that the content filtering solutions, they are kind of spatially implemented proxy service. And the term is given to do controlling the type of web content that employees, guests, customers can access while they are connected to the business wired or wireless network so that the business may want to apply control over the type of a content that can be accessed to stop employees by restricting access to certain type of web pages. And on top of that, also the content filtering is quite a good place to ensure malicious web pages cannot be accessed such as those used for phishing, malicious, distributing malware, et cetera, et cetera. So we are targeting that kind of products in this presentation. So at the beginning, I was like, I have a too many motivation like a targeting web filter solutions. Why we are doing this? And first and foremost, obviously, all the clients network are going to the internet through that solutions. That means if we manage to break in, we're gonna see the whole client's network internet traffic of the organization. And second motivation is, as I told you before, clients come to don't have a network access to the internet, they must go through the web filter. So we need to find a better way to see communication in the red teaming scenarios. And I believe web filter solutions is a quite a secure and stealth way to make a city communication. Of course, there is a loss of difference approach like a DNS beaconing, et cetera, et cetera. But I believe that is a very secure and stealth way. So all right, that is the brief introduction to do idea and the main motivation. And this is the methodology that I usually follow for my vulnerable to research projects. And if there is a seven steps and we're gonna see every single step in details throughout the case study. And first and foremost, we have to find a way to get a free trial of the product that we're going to do vulnerable to research on it because you have to, you know, break into operating system level and you need to find all the source going on, et cetera, et cetera, and you have to test your vulnerabilities and eventually you're gonna implement the explicit for the vulnerabilities you found. So you have to find a way to get a free trial and it's not quite easy guys always. It's not quite easy. It's sometimes, and most of the times it requires to have a loss of meeting with the sales team. And if you find the free trial of the product, I strongly suggest you to start by reading the documentation because there is administrative documentation of these type of solutions. And there's a huge technical information about the product itself. So after that, we are going to find a way to have a roofed SSH access to the box because we are going to do the vulnerability research and most of the case, there is operating level hardening and we need to get rid of all of those hardening stuff. And after that, you are in a situation where you manage to install the software, I mean the solution, you read the documentation and you manage to overcome the operating level system hardening. And that is the moment that you need to start using product itself like a regular user because you have to understand all the features because those information will become so handy when you need to define a possible attack vector. So after that, we are going to talk about enumeration and the configuration step. And the most important phase is the defining possible attack vectors because you got all the information you need. It is a time to building attack scenarios and then find a vulnerability is a final step. We are going to see every single step throughout our case. And in that case, I mean the trunk micro, interest again, web security virtual appliance, 6.5 version, you can do all of it from the vendor web page. So getting a free trial was quite easy in specifically in that case. If you go to the Google and looking for the administrative documentation is an important keyword in here for the Google search, you can directly find the administrator file which is usually like a 300 pages. I strongly suggest you to read administrative documentation because you're gonna see very, very helpful information about the product. As you can see in here, administrative documentation tells us there is a different modes of the product. It can be transparent breach mode. It can be transparent breach mode with high availability, forward proxy, reverse proxy, ICAP, WCCP, et cetera, et cetera. So that product can be installed very different modes. And on the right side, you are seeing the forward proxy mode which tells you that product can participate in the proxy chains, forward all the traffic to the opposite stream proxy servers. And you will be seeing lots of graphics on the administrative documentation which will help you to understand about the product itself. So we are reading the funny manual as well. And we, of course, for the third step, after they're reading the documentation, you need to install the solution into your visualization system. During the installation, there was an admin user and password has been set during the installation and the product gives you opportunity to do SSH connection to the box with the administrator user. But the problem is there was a restricted shell on the SSH. There is a very, very limited tools that you can use in the SSH interface of the product. We need to find a way to have a directly SSH connection with a root user because we are going to do remote debugging. We wanna try to find out all the source codes and we're gonna do further analysis, et cetera, et cetera. So there's a little bit of a step before starting to the vulnerable to research. In that case, it was like quite easy because the product was distributed by the vendor as ISO file. So you can directly install it into your VMware or virtual box. And when you finish the installation, the idea is you can detach the VMDecad disk from the virtual machine that you just installed and then you can attach it to the difference links machine. And then you're gonna mount new disk and you are going to find a graph file because there was a password protection on the graph file and I wanna get rid of that protection as well. And you just need to remove the password protection line on the graph file. And after that, in order to get rid of the restricted sheltering, you can go to the SHT config file and you can enable to remove root login. And if you do that, you need to go to the ETC pass video file and add BIMBesh for the root user, which will give us a direct SSH connection with a root user without having any restricted shelter at all. And we have to undo every single tick that we have done so far. So that means you need to unmount the disk, detach the VMDecad file and attach it back to the original VM and reboot the machine actually. And in that case, you are going to have the direct root SSH connection to the box. This is important. We need to get rid of operating level hardening. So we are kind of ready to start using product itself. In that case, I choose the reverse proxy mode, but I believe all the vulnerabilities that we have found it exists no matter what is the installation mode at all. For the fourth step, I certainly suggest you to use a product for a day to get used to about the features itself because there is a lot of functionality as you can see in the picture. There is a URL access control, HTTP decryption. Right now we know that product can offload SSL at all. That means we can deploy SSL through the administrator interface. And there is an advanced threat protection on the left side of the menu. As you can see, I hope you are seeing my mouse pointer in here. There is advanced threat protection. That means all the HTTP or HTTPs traffic will be analyzed by the product in order to find out malicious activities because of that feature. So later of that presentation, guys, we are going to see how important it is to understand and getting familiar with the product interface. Yeah, it's quite important. Just use it like a normal user. So we have such access with a root user. So the initial step is always enumerating the services. This is what I'm doing. Of course, that would be a better way to do it, but this is my way to do. So I always looking for the nested command to find out what kind of services we have in the product itself. As you can see in here, there is a UWSGI which listens to port 6011. That means we are doing some sort of assumptions in that phase. So that most probably means there is a Python project running in the internal system. And there is a Java process which listings exact port of the administrator interface. That means we are going to deal with the Java when the times comes to do doing a research on the administrator interface. There's another UWSGI in here. And that is another important thing because as I said before, that product acts as a proxy service. So that must be as some service on the product itself in order to handle incoming HTTP connections from the user. So I ask IWSSD process that you are seeing in here, which listens for 8881. This is responsible for all the incoming connection from the client's network. So this is the majority part of the product itself because that is the one who is communicating with the clients. All right. So those are the services that we have in the product but we need to find which of those services are allowed to communicate with the different computers in the network because in the end we need to explain at least one of those services. So what I'm doing for to find out that information, I usually run an M-Mapscan from my main host to the product IP address or you can just use the IP table slash this command to find out the IP table's rules. So according to that rule, most of the internal services has been forbidden to network traffic from the outside of the machine. You guys are remembering the IWSGI service. If you keep doing enumeration, we are seeing very interesting information in here. As you can see in here, there is a supervisor of the which responsible for starting the solar service. So right now we know there is a purchase solar and lots of Python services in the box. So what is a purchase solar? It is an open source enterprise search platform written in Java. It's a major feature is included to full tech search, highlighting the time indexing, dynamic clustering, et cetera, et cetera. So that means that Python project that we are seeing in here is responsible reading and writing the log file into the purchase solar service. So most probably whenever the request comes to the proxy service from the clients network, that proxy service is sending some sort of signals to the Python project that we have seen in here. It's something like an internal microservice. So that Python project is taking the information and writing it into the purchase solar service. So whenever the administrator user tried to query something through the administrator interface, that request will be coming to the Python project as well because the naming convention in here is says the dashboard parts, main, stats parts, summary parts. There's a lot of log parsing and writing the those purchase solar service. And whenever it needs to be the access by the administrator interface, and that Python project is taking the responsibility again. It is quite important to know there is a purchase solar service within the box, but unfortunately, due to the IP tables rule that we have in here, we're not gonna be able to directly communicate with the purchase solar at the beginning, but later on the presentation, we will find a way to do it. So all right, let's talk about IWD SSD process. If you grab it from the process tree, you are seeing the full path of the binary. And if you look for the file type, it is a symbolic link to the IWD SSD process, which is SUID LFI binary. And there is a 61 module in that binary. So it's a very huge binary and we can of course target that process, target that process, but it will be requiring lots of reverse engineering. So of course we are going to do that at some point, but one of the most important attack surface, as you can imagine, it is a process service itself. So far, I believe I just spent 20 minutes, I guess, and we managed to collect enough level of information about product itself. So it is time to define attack vectors in a light of those information that we got so far. So we know that administrator interface is written with Java. And there is a process service, which is written with C++. I haven't told that before, but it is a C++ guys, it's my bad story. And there is a loss of internal services, but most of them are not accessible from outside of the box. And you guys are remembering, SSL, the encryption and advanced track protection features of the administrator interface. So we know that it does offloading the SSL, it pars HTML contents, scams files, et cetera, et cetera. So my idea at that phase, my idea was, okay, let's start with the administrator interface and we can go after process service if it needs to be, you know, let's start with administrator interface at the beginning. But there is a loss of possible attack scenarios as you can imagine, you know. One of two, if you wanna, let's say target the HTML parser of the product, like a browser exploitation, you can just send that phishing email to one of the employees of the company that contains a link. Whenever the user clicks on that link, that request will be sent to the process service and process service gonna take that request from the clients and it's gonna send exactly same request to do destination server, which is a web page that attacker can control. And whenever the process service gets the response, it performs analysis. It has to parse HTML content as a scandal file. So that means you can directly attack to the HTML parser engine of the product, you know. There is a loss of difference possible attack vectors, you know, that was just one example that just popped in my mind right now during the presentation, but we are going to talk about the administrator interface and then we're gonna talk about the process service.  And I don't wanna live in an SSH connection during wall vulnerability research. So we need to find that all the location of the jar file by using just find comment on the step two. And then you can copy all of them to your main host to further analysis because we are going to deal with loss of jar files. And I strongly suggest you to use IDEs. I used to use GDI for the compiling or the jar files, but those kind of project has hundreds of different jar files. And if you put all of the jar files into the GDI, why it wasn't working for me, it was just crashing or freezing because it has to compile all the class and the functions and they need to find all the cross calls. So I strongly suggest you to use IntelliJ or Eclipse for that purpose. And if you are up to use the IntelliJ IDE, there is a Java the compiler jar file under the compiler library, which comes by default with IntelliJ, I guess. And you can compile all the jar files under the lib folder. You can change the name, of course. And we are going to put all the compile files under the lib dash, the compile folder. And if you go to the IntelliJ interface and look for the project settings, there is a library section in here. You can import those libraries and sources altogether which will tell the IntelliJ to, this is my, you know, Java software. IntelliJ will take the rest of the job. It's gonna process all the classes and you're gonna be able to just, you know, finding a function that you are interested and you will be just clicking it to go to the definition. And also you can find a very interesting function that might be some problem in the definition. You can just by using the IDEs, you can find all the different locations where the specific function has been called. So I strongly suggest you to be a friend with IntelliJ or Eclipse if you are up to a wonderful research on Java application guys. So, I beg your pardon. So we have access to the source code of the administrator interface. So we are ready to do for the last step which was finding a vulnerability. There is a difference approach to do it like a, you know, top to bottom or bottom to top, you know, bottom to top means you know the potentially vulnerable functions on the Java let's say and you can directly search those function within the code base. And if you believe that you just find a very interesting, very insecurity use those potential vulnerable function you can start from the bottom to go to the top in order to find out whether you are controlled to parameter that passed through all the function calls or you can start from top to bottom which is like, you know, start by reading the filter or the middleware definitions and the classes look for the authentication mechanism and then search for all the controller or the request handler definition which will be an important because that is the location where you can see the user controller parameters, et cetera, et cetera. In that case, I was being top to bottom approach. I choose that approach for because of not very specific reason I was like, you know, doing fun funny time on the Sunday and I was just start reading the source code and it was like a top to bottom approach. I wish I could show you all the code bases and everything but I believe I don't have enough time to do it. So I just grabbed a very specific function definition which name is a month device. It has to be a post request to be able to execute the function definition. And there is a very interesting if statement in here. It tells you if the request is coming from the local host, it is okay. But if the request is not coming from the local host I'm gonna validate your session and your privilege as well. Since we don't have the username, the password, you know this is going to be a problem for us because it is a password protections if the request is not coming from the local host. And there is a one function call in here, get token which will have a very important role on our exfoliation, we will come back in later. So that was the important part of the function and we are moving to do more important stuff. So it tells us that the request must be a post request and the post body it is taken from the request and it is a GSM object. And we're gonna get the one device string from the GSM data and that part is quite interesting because it performs some sort of escaping. So if the one device contains a double code it will be escaped. If it contains a back tick dollar sign it will be escaped by the backslash. But the problem is if it contains backslash it will escape backslash one more time. So if we have the double code it will be escaped one time and it will be escaping backslash one more time in here. There isn't some sort of problem in here. And after that there is a function call which is a Israelut mount device and it takes our parameter that we can control. And if we manage to pass that if statement we are going to see as a UI help for CMD which is tend to execute operating system command with a parameter that we are controlled. So we need to skip that if statement it has to be returned through. So let's have a look at that one. Israelut mount device it is just like a very weak blacklisting. It tells you it cannot be contained bash, bnsh, Python slash pearl, Python, et cetera, et cetera. It validates, it performs some sort of blacklisting on that one. But the problem is it has the vice face at the beginning of the pearl and the Python command in here. It's a very weak blacklisting. We can bypass that without having any problem. So we have to keep that in our mind if we've managed to find a vulnerability. So all right, we can pass that part and we can reach in here. So it is time to read the XAUI helper CMD. XAUI helper CMD it is going to execute UI helper binary with a sub CMD which is a command that we can control. So what is UI helper? It is located in here and it has a root privilege and there is a SUID bit. So all the commands will be executed with a root user. So if you find a way to execute our command that command will be executed with the root privileges which is something very, very important for us. And finally, that function calls XACMD which is basically calls runtime.getRuntive.exec. So obviously we have command injection vulnerability in here. So we believe that we have the vulnerability in here and we need to do the proof of concept. Thanks to do reading a funny manual and the product feature steps of the methodology we know where is which administrator interface I mean, which many of them it is going to execute that specific endpoint. Of course you can build it from scratch but this is more easier for me. As you can see, that is the post request and there is a month device and we can inject our command in here because the dollar sign it will be used for the execution and the dollar sign escaped one time and the backslash escape one more time which means there is no escaping at all that backslash escaping did another one and there is nothing related with the dollar sign which will helping us to inject our command. So basically we are executing sleep command with a 15 seconds with administrator, with a root privilege. So let's talk about the exploitation of that vulnerability as well. I'm one of the meta-split contributors and I usually using the Python dropper for the exploitation when I especially exploiting the Linux machines but there's a problem about the Python dropper from the MSF venom of the meta-split it has to be include the double code that wraps up our dropper command in order to pass it to the Python process. So that means we're not gonna be able to directly use it because as you know, double course has been escaped on the backend service. So the idea is that we can use Perl because Perl can take a parameter with a single code which is allowed to use and basically the idea is simple. I want to execute Python dropper but I'm gonna put that Python command into the Perl command. So basically during the exploitation we are going to execute Perl which is going to execute first step of the Python dropper. When the Python executed, it communicates with the handler and how it sends the second stage. So there's a, you know, plus of execution one and after and there is a Ruby code as you can see in here that we can build a Perl command which includes which contains our Python command. So it's a quite nice trick. So I reported that vulnerabilities to the ZDI and of course ZDI told me that the authentication is required to exploit the vulnerability but we are going to see that the exploitation can be bypassed guys. So we have to bypass authentication. Those are the initial ideas. We can find a stored cross-executive vulnerability because we can force authenticated user to send HTTP requests to the month device endpoint where we have the command injection. And since the user going to be manipulated by JavaScript, that request will be sent to the endpoint with the authenticated user. So we don't have to be thinking about authentication request, authentication stuff. And another idea is it would be handy to find something SSRFish vulnerability, some sort of some type of SSRF vulnerability quite could be handy in order to communicate with internal services so that we can send a request from the localhost to the endpoint or you can go directly after the authentication bypass. I don't have too much time. I'm just gonna show you how I find a stored cross-execupting on the administrator interface. So as you can see in here, that is a very basic HTTP request to the proxy service. It tells to the proxy service that I'm gonna, you know, that I want to send a GET request to the pentas dot below and proxy service does the job and sends the response back to the user. So that activities is being written into the administrator interface. Guys, remember the Python and the Apache Solar stuff that we hope that we have talked 15 minutes ago. You know, that activities has been written to the Apache Solar database, which is represented into the administrator interface. So the idea is that we can control that data in here because we can tell anything we want to the proxy service. So the idea is quite simple. As an attacker, we are going to intentionally download a very, very known malware through the proxy service.  But the data will be written into the Apache Solar, which is being used in the administrator interface and very, very specifically in here. So when the system administrator logs in and checks what's happening, we can execute JavaScript code on the system administrator browser. And thanks to that JavaScript code, we can send an IX request to the vulnerable endpoint that we have found in the first place. So, you know, there was a quite interesting XSS vulnerability because whenever the browser sending requests to the proxy, they are performing the full URL encoding in here, but I'm manually crafting the request to the proxy service. That means there will be a no encoding and that data is not being encoded on the administrator interface. Basically, we have a cross-site scripting spatial, the store cross-site scripting vulnerability in here. So instead of popping up other bugs, we can just call IX request to the endpoint that we have the command injection. So that was, I reported that vulnerability to the ZDI as well. And as you can see in the vulnerability description, attacker can leverage this in a conjunction with other vulnerabilities to execute code in the context of the root user. But guys, you know, cross-site scripting is a cool. I'm not underestimating any kind of vulnerabilities, but it is just not enough for me because there is a huge setback which requires the user interaction for the exploitation. I was like, okay, I just find something very cool, you know, intentional downloading of malware, etc., etc., that is what's simple and cool. But I need to find a better way to continue the exploitation. But, you know, I got another idea while I was spending a time to find the excesses through the proxy service. So the idea is targeting proxy service itself. So as you can remember from the previous slides, that is the HTTP request, the very simple HTTP request to the proxy service itself. It tells the proxy service that I want to communicate with the Pantheon stock block. Proxy service sends requests, get the response and send it back to the user, right?  In that case, it told me there is a, you know, self-referential request to proxy are forbidden. And I was like, all right, that means there is some sort of controls and lots of if statements in the proxy service itself. What happens if I manage to trick the proxy service to communicate with an internal service? That was the main idea. So that is the function, get end user authentication function. I set a break point in here, which produced exactly same error message that we have seen in here. And I just sent the same request and it hit the break point and it tells you that get user notification or the notification has been called by the preparer proxy loop rejection, which has been called by the handle proxy loop, which has been called by the due processing. So we're going to read all of those functions. So within the due processing, there is a one function call, which is a ease-reverse proxy. And the function is the member of the htproxy config cache. So basically product try to understand like am I being placed as a reverse proxy? And in that case, handle proxy loop has been called, this function that we have seen on the previous slide. And that function calls TM socket address is same ADDR. That is the important part because that function performs full URL comparison with a URL of the proxy service with URL of the user try to communicate. So if it is a same address, it calls preparer proxy loop rejection call and we are seeing that error message. So I just changed the port number to the Apache Solar Service. And due to that changes, there will be a no match in the full URL comparison on the proxy service. And there is administrator interface of the Apache Solar Service. I'm just can communicate with it because of a very interesting bug in the proxy service. So as you can see in here, I'm allowed to communicate with the Apache Solar Service administrator interface. So all right, that was another I'm very, very, very important vulnerability because we can, we are going to leverage this vulnerability to the bypass authentication on the systems. And in the end, we're gonna chain all of them together guys. So Apache Solar Service in the box, I mean in the product was very old version because it's not quite easy to upgrade your third party dependencies like Apache Solar or database servers. And in these type of solutions, it's quite hard to upgrade to newer versions. So there was a very, very old vulnerability in Apache Solar Service, but it is exactly what I need. It is arbitrarium file read vulnerability. So that is the name of the collection and there is a replication endpoint and the command has to be a file content and you can try was back to the root folder and then you can call whatever you want and that will gives you to reading any content of the file. So at the beginning I wasn't, there was no way to communicate with Apache Solar Service, but we find a very interesting bug and by exploiting that bug, we are going to read anything we want. So far, so good. I want you to remind the get talking function. It was like a way behind of our presentation. Guys, all right. Do you remember that get talking function? It is going to help us what we are going to achieve in here because let me, yeah, because that function takes cookies from the HTTP request and it returns the value, but the problem is it's pre-taught the value and the name of two cookies, but the job application is running by the Tomcat process. So those standard outputs, data will be written into the log file, which is a Catalina dot art file. So due to that little function, all of those valid station IDs written into the log file and we have arbitrary file read vulnerability. So what we are going to do that, we're going to exploit two vulnerability together in order to get the content of the Catalina dot art file, which contains a variety of session IDs. And then we are going to collect all the session IDs together and we can go to administrator interface in order to exploit command injection vulnerability with the active session IDs. So the idea is actually quite simple, guys. We are going to, in the first step, we are going to exploit a comparison bug in the proxy servers, which help us to communicate with the Apache solar service that is running within the product itself. And this is a very old software which has a vulnerability and it is arbitrary file reads and combination of that vulnerability, we are going to read Catalina dot art file and we're gonna, by using regx, we're gonna extract all the session IDs that we have. And there is a check session endpoint. I haven't talked about it because it was quite easy. There is a check session endpoint in the product. We are going to test all the session IDs we have in order to find out whether it is still active or not. And if you find the active session, we are going to exploit the command injection vulnerability and we are going to be executing operating system command with a root privilege, which will give us a C2 reverse shell to our command and control server. That is the idea. And of course, I have implemented a method split module that performs all of those steps automatically. And I have a video for it. I guess, yeah, yeah, time is good. I guess I still have a minutes. So let's see. And by the way, that method split module has been merged to do master branch of the method split project.  So when we run, as you can see in here, it's try to, it's exploits reverse process service and extract the Katerina.out file. And that was, of course, this is a demonstration. There's only one session IDs in the log file and it's not active. And by using the session IDs, it goes to the command injection vulnerability and it's execute operating system command, which is a pro command. Pro command contains a Python command, you know, and all of those steps has been automatically done. And as you can see in here, we have a root session on the back filter solution of the company, guys. That's it. Thank you very much.


We're going to go ahead and push in, we'll go with the ANA commander, seems to be a bit of an issue in the town, break. I personally have done this multiple times, almost every deployment that I've been part of and I've over 78 months deployed. This is different. This is specifically, the SFAB is specifically resourced in terms of both personnel and equipment to accomplish that specific mission. So it's no longer ad hoc. We are trained with respect to advisory skills as well as force protection skills in order to accomplish the mission. And the people that are doing it are the people that have volunteered to do it and want to do and believe in this mission. That's the difference. The mission statement is something I absolutely believe in and I think it's something that is needed as far as the Army having a dedicated unit to do the advise and assist mission and so I volunteered for it. So the SFAB, as a mission statement is to take our conventional forces, apply them against a long-term problem of improving partner capacity in our foreign partners. And so in the SFAB, you'll do what you've been doing as a conventional force soldier but you'll be focusing on providing your skills to your foreign partner. It's a great opportunity, one you're going to be surrounded by other folks just like you that are wanting to do your job, that are masters at their profession and focused on the task at hand with minimal distractions. You're going to be going to environments where they're going to want to hear what you got. They're going to want to be like you. And so it's a great opportunity to kind of grow as a soldier and grow as a person. Our manner of performance, our measure of performance, if you will, is how well our partners do in combat or in Afghanistan. It starts with war fighting competence. So everyone of the folks we hire in this organization are experts in their field.  But what we rely on is within that person already is the ability to, as you said, display empathy, to have some patience, to have flexibility, to be able to communicate complex ideas within a cultural environment to make sure it resonates with their partner. And then with that technical competence and that kernel of personal attributes, you then build on that through training. And the training we have for science talks about how to communicate, how to influence, how to negotiate. Because in a lot of ways, working with your partner is a day-to-day negotiation. The amount of realism in a level of detail down to the smell. I mean, literally there were times I thought I was actually in Afghanistan, whether it be you're in a local village, you're conducting a sure with key leaders. The storylines that went behind it to include the role-players. Honestly, if there's one huge takeaway I'd say about the training and resources at GRTC, it'd be the role-players. As far as teaching, coaching, and mentoring as a non-commissioned officer, it's in my blood. I think as far as the tactical piece, the maneuver piece, especially as an infantryman, I'm pretty good with doing that stuff. The intellectual piece, however, that comes with advising a host nation security force or the individual that I'm advising is really the next piece. I've been in the Army for ten years and I've been on the line the entire time. So I feel like just my experience of how I dealt with being in Afghanistan and what things I can possibly change when I used to help them train, I feel like I have a bigger role here to actually affect that and see it. We talked about the art of advising and we always talk about the science here and how we use culture in our advantage by acknowledging our differences but also finding commonalities in ways we can move forward together. I totally trust my soldiers. We've hired the best. We've resourced them. For the mission that they've been assigned, we've trained them against the hardest aspects of their mission. The time for us to deploy is now. We are ready. I've never felt more ready for this particular mission set, especially. I mean, it's a great opportunity to do something different, work with some great soldiers, challenging environment.  I'm ready. 100% ready.


here. So we'll have two recordings. If you're honored here, Odile, we're gonna do two recordings. Okay. For what it's worth. So when in English and when in French, right? That would be a feat. That would really be a feat. Subtitle. Okay. I got three after. So I think we should get rock and roll and then people will join as they come along from their previous meetings here. So with that, let's get started here. Welcome everybody to the 22nd of July, Hyperledger Supply Chain Special Interest Group webinar or standard meeting here. And this time, we're fortunate enough to have Odile from Rene from Renault here to talk about certifying the compliance of vehicle components from design to production. So I appreciate Odile you joining here. Before we get started, a couple of things. Our next session on August 5th will be a working session for our small projects, small projects, one around use cases that Eric is leading up, as well as one around RFI questions, RP questions that Yari Bourbon and Blanca in Europe are heading up. So if you have any interest in joining or those groups, please contact me and I can put you in touch with both of them. Also, next week, there is a session from Simba Chain on Connecting Supplier and DOD blockchains for transparent part tracking on Wednesday, July 28th. That Hyperledger is sponsoring, so you can go out to the Hyperledger website and you'll see that session out there. So with that, oh, one last thing here. I put in the chat Hyperledger anti-trust policy link so that governs our meeting today here. This is open. Please don't share anything that is confidential. I know Dio, I'm sure you won't here or anybody else who's asked any questions. And no deal is asked for questions to remain until the end. Please type them into chat and then we'll come back and we'll grab those here. So before we begin or before I turn it over, I have two questions for Odeo because she's a car person. She was very specific about that. That's great. That's great that she works at Renault. Odeo, what was your first car? My first car was Renault 5. Wow, you're at the right company then. Yeah, absolutely. And it was because I come to Renault very early. So my first car was a Renault Renault 5. Wow, okay. And what is your current car that you're driving? Espace. Renault, of course, Espace. Okay, okay. So we can all go out to our local dealer and site, see what the Renault Espace looks like. Okay, Odeo, it's over to you. I'll turn it over to you here. Okay, so hello everybody. My name is Dilpan Ciatissi. I'm blockchain vice president at Group Renault. And I spent, as you mentioned, most of my career in vehicle engineering, design cars and all that. I do also some quality strategy and digital transformation more recently. I've been very lucky in my career because I had the opportunity of working on very innovative projects such as Twingo, maybe you hear about it, or Logan, very famous car. And I've been head of vehicle engineering until 2015. And after that, I focus on digital transformation. And in 2018, more specifically in blockchain technology, I also represent today French automotive industry for blockchain. And I have the great honor to be coordinator of the first blockchain automotive development scale called Exyn. And we will come back later on this project. But I would like first to share the current context of her industry. If it works. Everything else is work. So this is going to work too. Oh, there you go. Okay, so we have a big evolution of society and industry. A society is becoming more demanding, responsive, connected, smarter. And we have a strong desire of authenticity. And the severity of regulation imposed by authorities are increasingly are increasing rapidly and pushed by the demands of citizens. And we can see for ourselves, more of them, of us are making corporate responsibility of company as an absolute priority in purchasing criteria. And in automotive industry, the competitive landscape is changing with new entrants. And many times not coming from automotive industry. And we have new collaboration for offering other forms of mobility and not just cars. At the same time, we have an increase of the level of technology. And we have connected cars, of course, but we have autonomous cars. So, of course, we face huge investment for technological development. And at the same time, the amortization is not that evident, because the volumes due to customization and product diversity are decreasing. So high investment and low volumes. So to face these societal challenges, we need to be more collaborative within the ecosystem. And it's really a condition of surviving for our industry. So let's talk a bit about the customers. We know very well, and we have seen the last months that we're living in a vucal world, volatility, certainty, complexity, ambiguity. And the word of mouth becomes more and more important and amplified by social media. We see the demands of customers following some trends I would like to share with you. Everybody wants to keep its ownership of data. And the monetization, the personal monetization becomes usual today. Today, customer wants seamless experience and put company responsibility as top priority in buying criteria. Fraud is quite fearing. And particularly what we have seen with the COVID crisis, this fear is increasing a lot. And the reinforcement of authentication is really a must today. Customer want to be protected by regulations such as GDPR in Europe, but many other regulations also and more and more numerous and more severe each day. So for car, what does it mean? Just to give you some figures, to be approved for sale, a vehicle must be compliant with all the regulation needed in the country of sale. And we have more than 100 of regulatory domains covering the car. And for example, a domain is a frontal crash, for example, or CO2 emission. And each regulation impacts each part and component until the end of a supply chain. And for a car, for example, we have more than 6,000 regulation characteristics under the responsibility of the global supply chain network. And of course, the compliance of the vehicle depends on the compliance of each characteristic. And the game will not be that funny if the updates and new regulation were not coming frequently, such as 300 changes a year impacting new models or all applicable in specific due dates in one country and not on the other and so on. So regulations are more and more numerous, more and more severe, and interactivity between all the members of the ecosystem and the supply chain needs to be more and more reactive and efficient to answer to those new regulations. So this regulation status has been the starting point of the project exceed. In 2018, we have seen the coming in September 2020 of a new regulation including market surveillance. So we were used to conformity of production in the plants. But we have since last September 2020, an additional request on market surveillance means that each country of European Union will pick some cars on the market, no matter where and when it has been produced. And they will check the compliance. And we are not talking only about CO2 emission, but the scope has been extended to 61 regulation domains. So you have seen that we have in total 100, so more than 50% of domain. So it means that 1,000 of regulation characteristic, and we must be able to provide without a new delay the detailed result of certification. It means that once or two time a month, we will need to produce in one week the complete information of compliance result, no matter when and where the car has been produced. And I can ensure that it's a tricky exercise when we need information in the depth of the supply chain. And the risk here is, of course, financial, because if we are not able to answer within one week, we have a penalty of average 30 kilo euro by car. But more than that, the reputation risk in case of lack of reactivity, look at what happens in the Volkswagen gate. So if we take another regulation, we can talk about material in each industry. Everybody knows for Europe rich European regulations since 2007. And rich means registration, evaluation, authorization of chemical. And the implementation of this regulation has been very painful in 2007. And why? Because we need to ensure in this wonderful database that has been created international materials data system, we need to be to ensure that real time we can we are compliant with the declaration of all the substance material for component, sub component car and blah, blah, blah. So this is clearly not that easy. I was exchanging some days ago with one of the supplier rank two of painting with pigments and all that. And obviously the respect of this regulation remains really a pain point in term of resources needed for being compliant. And to complete a material scope from beginning of this year, we have a new regulation on conflict minerals. I think that you have in United States already this kind of regulation involving Cantal, tungsten, gold and tin. And this regulation imposed to have a traceability of mineral origin, of course, but also the logistic flow being sure that the flow will not pass through Iran or things like that or conflict country. And in 2022, we must be fully compliant using those material. So I can ensure that tin is included in a lot of vehicle parts and components. So it will be a tricky exercise. And with connected cars, let's talk about the connected cars. Authorities are enriching the scope with the need of implementing a real cybersecurity management system to be able to answer to new audit requests. Here we are talking of a real end to end compliance with all the complexity of 100 of calculators of a car that will be updated over the air. So we have also the link of onboard software and off-board software with different life cycle, but with the same need of cybersecurity compliance. And of course, this future regulation, because it is planned in 2022, will impact not only the OEM, but the entire supply chain. So as a conclusion, you can see that regulation context put a high pressure on automotive industry, particularly, and requires new processing tools at ecosystem level, not at company level. And this is how the idea of Exist was born. So Exit are the initial for extended compliance end to end distributed. So now I would like to share a short video to explain very quickly what Exit tool is. So today we have a very sequential organization in the event of ODIT. The authority request is addressed to companies and to factories and suppliers rank one, rank two, and the path is the same for the answer. So it takes a long time. And the Exit platform, the idea is to implement a platform used in a continuous mode, fed automatically or manually, in real time by each company, regardless of rank, when the compliance information is needed, the response is directly available. So you can see a short demonstration to have a visibility of the component and subcomponent and having the status of the, at one glance, you see if it is red or green, and you see what kind of test of monitoring plan are not okay. So what has been the journey until this Exit platform creation first, the framing phase based on pain point as a regulation severity and at ecosystem level. Then we launch a proof of concept and we make an industrial test of this proof of concept successfully in a runaway plant with six supplier side first. The test allows us to identify the points to be completed. Okay, sorry. So this test allows us to test the governance process, of course, and the ability of working in co-petition and gives us confidence for passage at scale. Then we move forward to classical MVP at scale, developed following the agile methodology, and of course we are in progress with several release in the coming weeks. So let's focus on the current status today. Maybe you have seen some press release and articles in media about Exit project. Exit deals then with the increase of regulation, but also customer demands about transparency of conformity and compliance. So the Exit project is all about collaboration through the supply chain. It answers really a day to day ecosystem concern, and particularly in this time of crisis where we may have some parts missing and we have run a stop and go in the plants and it's very difficult and it's a very fragile context for quality in that time of crisis. So this platform aims to increase quality and competitiveness. It's and that's very important. It's an inclusive platform. So it's really an opportunity to boost the digital transformation of the anti-ecosystem and not only for big players, but also for small companies. With Exit we have the opportunity to enhance technological sovereignty clearly with blockchain technology and the ambition we have is really to create compliance conformity traceability platform for the anti-ecosystem of the automotive industry and not only I can ensure that I have some requests from aeronautics industry about this platform. And so this platform is secured by blockchain technology. I already mentioned that, but we have defined other steps about big data and also artificial intelligence. Because here with that kind of platform we create collective intelligence and instead of executing artificial intelligence algorithm on a company sample of data we can execute it on a sample of ecosystem data. So very very rich and very powerful. So this platform will use sovereign cloud of course and so it's a promise of high quality traceability and it brings real time. That's a very important to be real time instead of having a very sequential information. This platform will allow digital continuity of supply chain because everybody is bringing its part of the wall, its brick to build the wall and it's quite interesting because what we have seen is that small company like SME may not have or can't afford information system on their own and they have here access to a powerful blockchain system at low cost. So this platform ambitions to onboard first wide European automotive industry and it's clearly an opportunity to boost automotive industry competitivity and technological sovereignty. So let's sum up now the value brought by Exid. First you get performance. You increase efficiency within the ecosystem with automatic and real time access to data and automatic checking and alerting of data thanks to smart contract. The interesting added value is to create this digital continuity within the ecosystem and at that step we implement operational excellence not at company level but at ecosystem level and it's very powerful because each member of the ecosystem is winner. Then you get reactivity in implementation of blockchain as it is not very intrusive technology it's a sort of mesh above the data system so not very intrusive in information system of each company and it's also reactive in usage because it facilitates real time exchanges and the reactivity also allows to increase customer satisfaction. You have of course certification, authentication and anti fraud by design and it's very good to give this trust to our customers they are very demanding on this subject and another important thing is the certification of data owning because each member of the supply chain deals with a lot of information protected by IP or confidentiality and this blockchain system is really managed by each data owner and the certification of data owning is by design with this blockchain technology. So last but not least the opening of new opportunities with new data generation, new business opportunities and business model transformation thanks to the new data offered and the important thing and the center of the value you find trust within the working ecosystem in the supply chain but also outside for the customers and it's very powerful in term of brand image for each company of ecosystem. So Grupreneur is at the origin of this project and as mentioned we tested exit project successfully in 2019 in a web plant with six supply of sites and we have during this test lots more than one million document at the speed of 500 transaction by second. I will share just after the lesson is it no okay so just after I will share some lesson learn thanks to this industrial test so after this first test we quickly propose first to French then to European Automotive Industry to the collaboration on this project and despite of COVID crisis we signed in the year the partnership contract with the first partners so when you work in collaboration and co-petition you change from customer supplier relationship we have in supply chain today to a partnership and this is very powerful in the in the world evolution and in difficult times COVID crisis for example the collaboration is really the only way to continue progress and continue innovation so blockchain projects are collaborative projects and it means also share the expenses and shared risk so very interesting because one company has some difficulty in crisis time to afford all the risk on its own so I would like to share now a short video made with the partners with about the project so we supply more than 500 000 parts a day we deliver 15 000 door panels a day it's not enough just to do things good it's not enough that we deliver other competitive price we need to do that but also we need to be faster we need to be more flexible we need to be more efficient in what we are doing cars are more and more complex and the supply chain is getting longer and longer we are a company in many countries and many continents the regulations in each area are different and in addition each car manufacturer has its own demands non-compliancy is not an option we have to be compliant and it is critical that we are avoiding potential records because on the end this will damage customer and supplier reputation if we want to evolve and want to be faster and more successful collaboration need to be done to accelerate the whole process that's what XCID is giving you XCID is the first big blockchain project in the automotive industry this project has the ambition to create a compliance and conformity traceability platform for the entire ecosystem based on IBM in blockchain technology with XCID we can improve our quality reuse our costs our waste and that we can anticipate the problems it's bringing together all the good of sharing information without the bed you have the ability to share data with the right partners it's still a secure and you're not sharing with people who are not in your channel and this is really an enormous advantage IBM is a technological partner since the beginning and with XCID we have transformed the customer-supplier relationship into partnership XCID will enable greater transparency and trust within the ecosystem but its trust and confidence will be also given to our customers we are proud to join XCID because XCID is proposing this end-to-end control of the value chain and to identify the risks that we may have and around the non-compliancy XCID is a real opportunity for the european automotive industry for Renault to confirm its innovation skills and for me to have the pleasure of coordinating this exciting project I'd like to share now briefly some lesson learned thanks to the usage of XCID so the first point is think big begin small you you see a lot of proof of concept what I call mushroom here and there to test an ID but without a prior global vision of what will be the final target the proof of concept could lead to a dead end so you need to be clear on what will be the next step after the proof of concept if you want to scale a blockchain project otherwise you may develop proof of concept on the unsuitable protocol for example and not able for scaling up and so you are not getting the information on the poke experience and you don't see the value you need because when you you need to scale up you need to calculate a return on investment and if your proof of concept has not been done with the right technology and with getting information for confirming the value it will be a fail so you need really to think a proof of concept as a first step towards the final project the second important point is to choose the right use case blockchain technology is generally not needed within one company a lot of existing digital technologies are sufficient to make the job and for example you don't need to for pressing supply chain to have blockchain you you need it when you work with external company when you need to certify information in a trustworthy mode without a third party certification or when you have very complex processes then I can ensure that in automotive industry we have very complex processes with several actors and when it costs time and money to reconciliation data so in that case blockchain is really the ideal solution the blockchain may be really considered as a sort of mesh above the processes and the database of all the members involved in the network because today when we work in an ecosystem each company has its own process to exchange data and information and then it means we define today a transformation matrix between the respective processes and we spend more time in defining the means of exchanging excel file or things like that and we don't work a lot on the data itself we lose time on working on the format and not focusing on data and data model so that's really what the blockchain technology brings as a huge value creating a lean ecosystem process and focus on data and data model instead of exchange format and due to this very security mode of data exchange what we have seen in the in AXID project is that a partner may become very quickly the best one has been within two months all the contract has been signed and the link has been done within two weeks so very efficient so third recommendation focus on pinpoint solving it's quite easy to to say that but I can ensure that look at what the all the proof of concept you can find on the market many times you you don't see exactly what is the pain point solving so blockchain project to be sustainable must bring value to each member of the ecosystem so when we have launched the blockchain program within Renault we have done a lot of workshop with each function of the company and everyone thought about the relevant use case but we defined the priority based on pain point solving so that everybody was convinced of the value of the project an important need the support of the top management it's really key it's key for each big transformation and blockchain technology brings big transformation within each company you can see how difficult it is today to make the digital transformation in some cases because you break the silo through the function of one company and imagine breaking the silo through several companies with different culture so the collaborative work and co-petitive work is not that easy I can ensure so the decisions are taken in common for global optimum and no more by a single one you change supply your customer relationship into partnership it's really huge changes so if you are not supported at the top level it will be almost impossible to put a project at scale number five developing a project is one thing making it resilient and sustainable is another one so you need to think ecosystem for that because the more people are involved in blockchain project the easier it will be to create standards and to create evolution of features and this is possible thanks to the trust wrote by blockchain that what this technology can bring compared to other digital technology sharing the cost of development and implementation and pushing the standardization through ecosystem for more efficiency and sustainability very important the legal aspect when you work in collaboration you have to manage legal issue between many partners and I can tell you the the a sentence from a French author who wrote we all know here that law is the most powerful school of the imagination never as a poet interpreted nature so freely as a jurist you can imagine the result of the combination of the imagination of several jurists so the recommendation here for the legal issue because you will have legal issue when you develop a blockchain and a partnership project the recommendation here is to define among the partner a pilot legal department which will ensure the two by two convergence and provide a summary for the group and this is really a guarantee of efficient convergence last but not least the governance key point in the project success at scale in case of permission blockchain particularly you may have the most wonderful project of the world if the government is not able to fix rules and to make it respected the project will be in a difficult position so that was some lesson learned I want to I wanted to share with you before sharing the next steps of exceed of course we are on boarding widely all the relevant actors of automotive industries through wide Europe first but through the world at last and today we have of course a member of supply chain but of course we have more and more technological partners that are coming because we have the blockchain project of course but we have all the links with the legacy system of each company and so we are working also and we have created a specific status for these technological partners that want to to join the initiative then once we we will have the finish the good level of on boarding we we plan to enlarge the scope of features today we are dealing with safety and regular regulatory characteristic with geometry and with raw materials but of course we will enlarge because compliance is covering a lot of domain we will have with the over the year update of software software module that is particularly valuable we expand when we talk about and to end we expand the time phases not only in production today but in design and after sales because we have more and more requests from authorities to ensure the compliance and conformity of repair and maintain cars but the more we go on and the more we enrich the new modules battery traceability of course but here we have a specific topic because battery traceability is I think it's the longer chain only for traceability of cobalt you have 16 ranks so here we work in interoperability with other industry we have a chemical industry mineral industry and so we are working with other OEM to define the right architecture of this quite specific module battery because we have the realization of the battery on the car and this will be clearly on exceed but after that you have a very long and a very numerous type of industry so we are working with all this industry to see the best cutting off of this this chain to be more efficient then we we talk also about recycling of course and also say with two footprint so that's clearly the what we what we have in mind but we have many more to come we have about capacities of course when we live what we live today with electronic components of course we think about adding a module of capacities and each day we have new new idea so exceed will contribute of course to the future of automotive and will serve the acceleration of time to market because the stake and the challenge of tomorrow will be the speed and the quicker you you will you will be on the market and the best way you you will be so the important point is to as I mentioned already to think ecosystem and the customer must be known at ecosystem level and no more at company level if we want to go fast if we want to improve our processes we need to have this global ecosystem thinking and of course for customer and of course as at the partnership level also so of course external growth are key for the future of industry for being sure to deliver relevant and integrated products and also new services for new usage and for that we will need agility at ecosystem level to do that so we have a long and tough path in front of us but we have the keys for going on now and blockchain in is one of these keys because it is an enabler to collaboration and co-petition so that's all for the presentation thank you for your attention and I'm sure you have a lot of questions I have seen a lot of questions in the chat I would be pleased to answer and I can only ask a blockchain expert if Michel Le Porcher that is with me who is with me excuse me to join for answering your technical questions so ladies and gentlemen floor is yours thank you very much for a great presentation and sharing all the wonderful stuff that you guys have done with exceed here so in the interest of time I'm going to get right to the questions here and the first one here is can the end customer view the evidence of compliance if they can couldn't competitors also view this information so in term of visibility of course the the visibility is only for one channel means your competitor will not see your information that's clear then do we open it to the customer not at that step but we are quite sure that in the coming in the coming years the request of customers are more and more important about the transparency so we it really it will be surely something to add in the coming years not today but in the coming years quite sure yeah that probably informs your statement there the customer customer must be known at the ecosystem level that's a pretty bold statement yeah okay next question why did you decide on IBM as your development partner oh so very simple so I start the CEO assigned me the mission in April 2018 in May 2018 I identified that exceed will be it was not exceed that that's that but a blockchain project about trustability of compliance it would be a great project and then I go and and see the big service provider and see which which one will be interested in in developing this first co-innovation and of course we choose the best one so IBM because IBM of course we know that we have some links between IBM and Hyperledia but IBM is the the most advanced partner in development of project at scale and one more time we didn't search a partner for proof of concept we were searching a partner in view of this big platform so that's why we we choose IBM and we as Renault we develop and we test in a web plant with the MVP developed by IBM and when we launch the partnership we we do again a competitive analysis and there is a tough competition we identified 10 companies able to to develop this type of project we make a selection of four and then we have the the last tough competition between the four the last four bigs and IBM has been chosen in the partnership as the best one and not only for the development but also for the the running of the solution because it's not only to develop a platform we need to take care about the cost the running cost and the ability of scaling and taking in account all that so we have defined today two steps in the in the current contract the first one is before the creation of consortium we are today in a partnership not a consortium and we will create in the next year a consortium so probably a specific society and and all that and but we we want to test first all the governance process and all that with a limited number of partners to be sure that the consortium we launch next year will be sustainable and will be profitable for each member of the partnership and not only the big companies but also the SME so we are working a lot with SME because if we want to have a total view of supply chain it's not only the rank one that is interesting we have it today the important point is how we we onboard SME and how SME can see value in bringing information in the in the blockchain and that's a key point I love that you're using the word SME so much that's great all those players out there are trying to figure out how do I use blockchain and get some value out of it so that's great so let's go on to the next question here how long did it take from the moment you decide to use blockchain to the end of your first successful POC oh we I mentioned that the ID was in May 2018 we begin to to work with IBM end of 2018 we so we have the the first proof of concept by Christmas 2018 then we have an MVP that we test in 2019 so quite quite and after that of course the COVID put some delay in what we want to do because we have some companies that are in very bad situation and the first partner we have have no more resources for for joining us so we we have changed the partner during the 2020 year but what takes a long time is really the the contractual phase because as I mentioned you you have a lot of legal department and everybody wants to to change a word and all that and what has been very let's say tough and next time is to be clear on when you make this kind of collaborative project about IP about confidentiality and all that so we take about six months for for converging in the in the contract well and this is not the contract between you and IBM it's between no no it's yeah IBM and the other partners yeah okay and that was the most difficult point because you know everybody has his own view on the intellectual property and confidentiality and blah blah about the number of years and so it takes time you are making up the contract along the way that's great okay good let's go to the next question here how should exceed of all from proof of compliance conformity to actually secured by blockchain open parent cyber security protection of all the vehicle connected components to intelligent transport systems how yari you might want to hop on and explain that a little one little bit okay so you know it has been a long path and a tough path you you you need to be resilient and you need to be to be sure that all the you need to be sure that your project has value that's an important point so if you are convinced like that you have to implement the three phases we we just share I think we can go back to this slide maybe this one so you you have some cycle to to respect project framing program solving and you know it's I make a lot of cars in my career and what is very important is the first phase of framing if you don't frame well your project it would be a very long path but after that when your your pre-contract is quite good after that you have some proof of concept to be done then MVP and it's business as usual I think okay good thank you let's go on it because we have four minutes left here so question about is IBM hosting all nodes of the blockchain if so when do you plan to extend the network of additional nodes from different parties to bring in a degree a degree of decentralization and a similar question what version of hyper ledger fabric are you currently using okay so I leave the the floor to to leave Michelle all right you everyone currently we are using version 2.x of protocol if you want deeper I think it's 2.4 and the first half of the question could you please repeat sure uh let's see here the nodes the nodes yeah is IBM hosting all the nodes of the blockchain so when do you plan to extend the network with additional nodes from different parties to bring in a degree of decentralization actually depends on the way you create your architecture on one side and the resiliency of the system on the other so indeed we use Kubernetes to make it smart and nice at first and second point actually because it's a multicloud we use the consensus and in the in the way so there's a special shooting for that so that we can send it to several clouds each person having it but please note as you know that on my apology you have two kinds of of nodes to be certain that we reach a certain level of efficiency you cannot put committing nodes on everyone so yes you have replicas just for reading data that correspond to the to the to this um how can I say distribution phase but as of today with 2.x please note that there is a limitation on how much you can how can I say distribute the system maybe what I can add also that during the taste phase in our industrial test as Renault with some suppliers we have tested and confirmed the fact that we can have we implement a node within Renault to test how it works and of course we have defined the architecture and I see some comments the right architecture is not in cluster well it depends I think you you have to think about the the volume of data there is some tricky things because when you talk about compliance the the volume of data is quite important so we and IBM has been very very helpful thanks to his experience on the on the subject to define the right architecture adapted to the need we have because as we mentioned compliancy of of a car we are dealing about uh uh terra of data so it's a tricky exercise and the important point in to is to think not only of the beautiful object but also the running cost in production mode when you have worldwide you have 100 and 100 of plants and 1000 of 1000 of terra so it's a tricky exercise need to to think a bit about that beautiful thanks for those responses last question here can you guys stay on for a couple more minutes here can I give you one last question okay great so uh let's see here can you please explain briefly if you request a certification for each member of the exceed network and then the second part of that is would this partner be audited by a certification company like bureau veritas and on which aspect uh so uh it's funny that you you mentioned bureau veritas because we uh we are working with them and they want to uh to on board on the on the project of course not as a partner because uh but uh as a as a sponsor uh so we uh because blockchain certified things uh what we what we uh put when we talk about compliance of vehicle we have uh seen that we have characteristic and in the production uh in the production mode we define monitoring plan during the production and we have some characteristics that we uh monitor during the production for uh for ensuring and satisfying the conformity so we have all these tests that are done 100 percent for 100 percent of the part or a frequency test and uh the result we we are talking about the results of this test that are uh implemented in uh in this platform so uh here it we have uh the the partners uh can link directly through api uh their system if they have a database uh with uh with the result or they can enter that uh manually if they have a manual process and uh of course uh the certification will be uh done once to check uh if the uh the end to end process is uh correct and uh if the certification of the process is okay but after that uh of course uh we uh as uh as usual in blockchain uh garbage in garbage out but we have the history and uh for example if I take the example of the the cobalt uh of course you have a lot of uh mineral producer uh that thought that uh putting the uh fake data in blockchain will uh will be a good solution but uh with that we can have uh it doesn't prevent from having physical audits and make some uh test of consistency with uh the physical audits so um of course uh the the more the trust uh will be done and the more consistent the physical audit will be with uh uh information in blockchain of course the more trust we we will have but uh it's um anyway uh you can it's uh immutable uh data so uh that's really uh a huge improvement and uh one important thing is uh you have automatic check and alert of uh not realization of a test for example uh that we don't have today now uh so it's uh it's a more uh trustworthy uh tool than what we have uh today because today we can discover and sometimes what we have seen we we had uh last year I think a concern with a supplier because uh it didn't do anymore the test needed uh in the monitoring plan and we we don't have any uh alert uh on this uh on this point and we uh of course we we discover that with uh uh non quality result so uh it's more systematic it's more automatic and uh the added value of people in charge of quality generally uh will be more focused in analyzing the result instead of getting the information of the result and that's today the the main point great great thank you um there's a couple more questions here but I'm going to pass on those are you okay with people contacting you with questions if they have it yeah of course of course beautiful beautiful so merci odio morci eve here thank you very much for uh taking your time you guys have a great project we know now that you've been working on it and you still are smiling since april 2018 here absolutely three years in a few months so thank you very much for sharing this with us uh we really appreciate it and with that everybody thanks for asking your questions and uh joining in and for those on the recording uh hope you enjoyed this recording also so with that good day good evening and have a great weekend everybody bye you too bye


The leaves on your calathea may be curling for many different reasons. So let's just talk about these reasons and get to the bottom of this so you can fix it for your plant. The first possible reason for curly leaves on your calathea is under watering. Remember, the calathea mosaica likes the soil to be moist at all times. And not that I'm saying moist but not wet. We don't want to overwater our plant. But yes, we want to make sure that the soil is moist at all times. So what I would recommend is that you have a stable watering schedule. I usually check twice a week and generally I water once a week during the growing season. In the winter, when the plant is a little bit more dormant, I don't water as often. But very important, I always check before I water. So I stick my finger in the soil until the second knuckle. And once I feel that the soil is drying out, then I water. Also, the quality of the water is very important for this plant which takes me to the next point. As a calathea, this plant is a little bit more sensitive to tap water. This is because depending on your location, tap water may have some chlorine or some salt or minerals that may be too harsh for your calathea mosaica. And if this is the case and you're using tap water, the leaves will curl and maybe also dry up a little bit on the edges like here. So yeah, it's very important that we use good quality water for this plant. In my case, the water in Berlin is really hard for my plants. So I usually filter it before using it to water them, especially in the case of the calatheas. Another thing that you can do is to leave the tap water in a bucket for about 24 to 48 hours. And during this time, the chemicals or at least some of the chemicals will evaporate, which will make the water less hard for your plant. But of course, you can also use the still water or rainwater just to make sure that it is okay for your plant. Okay, you guys, the third possible reason may be temperature. This plant comes from Brazil, so she likes stable, warm temperatures. This is usually between 18 to 20-something degrees Celsius or 25 or 27 degrees Celsius, but not higher than 30 degrees or lower than 18 degrees. So if you see that your plant has curly leaves and you know that it is actually in a place close to a window, for example, where you open the window and you have many cold drafts coming in, this may be a reason why your plant is not looking the healthiest. In that case, I would recommend that you move your plant to a warmer spot. Very important, don't place your plant close to heating vents. This is because of the next possible reason for curly leaves, which is lack of humidity. The calathea mosaica is a tropical plant, so they will be happy in high humidity levels. In my experience, I have seen that my calatheas will thrive only when they are at 50-60% humidity. So we don't want to place them close to a heating vent because the air there tends to be really dry. If you feel that your calathea is lacking humidity, one way to raise it is to put her on top of a humidity tray or you can put her close to a humidifier. And another way that you can do it is always placing your calatheas all together because these plants will help each other with humidity levels. Now, if you have any other experience or you have encountered any other reason for this, make sure to comment below. I can assure you the whole community will appreciate it. And if you're watching this video, go down to the comments because you may find other reasons there. And as always, I will see you in the next one. Okay. Tau.


Good question. This is a new plan that sets out how the area between the A14, the railway line and the guided busway will develop over the next 20 years. The main area that will be transformed is the current sewage work site as that will be relocated. This is a huge area of land. It's bigger than Cambridge City Centre that already has good transport links and lots of jobs on the business and the science parks. And yet at the moment there are only three homes within the site boundary. This is a big opportunity for us to create a new city district that's different from anything we've seen before around Cambridge. Somewhere that's genuinely sustainable and designed in a way that we can all be proud of long into the future.


A limited enter into a contract with a customer to sell a machine for 100,000. The total contract price that 100,000 includes installation of machine and two years extended guarantee, another warranty. So machine cost, installation cost and the warranty cost, total package is 100,000. From that A limited determined, there were three distinct performance obligations. Number one is to deliver a machine. Number two is to install it. And number three is to give a warranty after installation for two years. So there are three distinct performance obligations. And staying along, selling price of those performance obligations were as follows. If you buy a machine, then you will get it for 100,000. If you install it, then you will have to give it for 14,000 separately. And if you want to take an extended warranty, then you have to give it for 20,000. Now look, this total becomes 109. Determine the amount of revenue to be recognized by A limited on satisfaction of each performance obligation. Now to aggregate the standalone selling price, this comes to 109. Exceeds the total transaction price of 100,000. It means that you are giving a discount if somebody is taking the pack of 9,000. And that discount inherent must be allocated to each individual performance obligation based on the relative stand alone selling price of each obligation. Therefore, the amount of 100,000 transaction price is allocated to each performance obligation as follows. 100,000 total and 109 and multiplied by the machine cost. So 68807 for the machine delivered so that revenue you can recognize. Installation again 14,000, so it is 12,844. Once the machine is installed, you can record this amount as revenue warranty. Since it goes on two years, so you can't record it there and then you have to wait for each year. You may take 50% first year and 50% next year. Or maybe at the expiry of two years. The entity would recognize as revenue the amount allocated for each performance obligation when and as performance is satisfied. Thank you very much.