Ah, come back here. Why does that keep doing that? All right, great. We are here and ready to do securing in path testing, great spaghetti monster, as I like to call it, or Kubernetes. This is who I am, Kat Fitzgerald. You can find me on Twitter at Rainbow Cat. I've been doing this a long time. I'm the CEO of B-Side Chicago. I was COO for Diana Initiative last year, part of B-Side's Pittsburgh. And also, my first DEFCON was DEFCON 3. How many other people remember that one? There were 16 speakers there, if I have to remember that. I have an emphasis on the blue team, however, I'm a formal purple teamer and all this stuff. And I'm in Pittsburgh now, but moving to Kirkland, Washington very, very soon. You will always find me sipping Grand Mayan extra Neho, or in this case, it is Casa Noble and Neho. So cheers, let's kick off DEFCON. Jason already did a great job. And also special thanks to the entire red team village, all the staff, all the volunteers, everybody for kicking butt and making this happen. A lot of my favorite stuff are honey pots and refrigerators. On Saturday, I'm doing a talk for IoT security, so check that out too. But this is one of my favorite ones because I just finished writing this particular presentation just about a month ago, made some changes to it and so on. Remember, please, the views and opinions here are mine and mine alone. They do not reflect anything from my employers, past or present. Anything that I show you, as always, please use with a grain of salt. Don't go breaking into things that you shouldn't be breaking into. And those of you with an overwhelming fear of the unknown, you'll be happy to know that if you, there is no hidden message in the disclaimer if you read it backwards. Yes, my jokes are that bad. All right, let's get this thing on the road. So why are we not here?  I wish I could. I wish Kubernetes and containers and everything were secured by default. They are not.  And common sense went out the window decades ago. Think about that. When it comes to information security, cyber security, hacking, whatever you wanna call it, I honestly think we lost common sense quite some time ago. Why really are we here? Well, Kubernetes, I don't know, I still think it's fairly new. It's fun, it's crazy, it's a lot of things. You can deploy it in clouds, you can deploy it in, I have Raspberry Pi sitting down here. I was gonna be showing that, there've been some demo problems and also some timing issues. So I won't be showing my Raspberry Pi cluster today, but you can build very extensive Raspberry Pi clusters and do all the things that I'm gonna talk about today. Containers, containers are not new, but people seem to have forgotten that they have anything to do with security. They get all hyped up on Kubernetes security and they're forgetting about containers. We're gonna talk about containers because it's important, it's in fact very important. And always remember this, security is for everyone. Common sense is required. So please disregard the previous slide, throw it out the window. Why? Because if we're not using common sense in security, then we're definitely not gonna get where we need to be. All right, just some quick security facts. We wanna know this stuff. In 2018 alone, $114 billion were spent by companies on information security, on fancy software, fancy hardware, things with blinky lights and all of that, but breaches kept on going up. We're doing something wrong here. Security appliances and software have vulnerabilities that we're not dealing with or that are need to be dealt with by the vendors. Kubernetes itself has had a few issues. We'll talk about that, but so has Docker. So don't forget your containers. Also, I've actually had people say to me, we have a very unique security architecture. And I'm like, no, you don't. We all do the same stuff. So remember, your architecture is not unique. I love this quote. If you don't have this book, Offensive Countermeasures by John Strand, go out and get it. It's a small book with a ton of information, so get it. But he said, instead of brilliance, we've standardized on mediocrity. And that seems to be what information security is about these days. And I kind of have issues with that. So let's talk about that some more. First of all, let's get a common definition of what is a breach. Or maybe we'll call it what is an incident. Let's not necessarily call it a breach. So most incidents are not caused by zero day fancy stuff that you find on the internet. Typically, they're done because people have made mistakes and so on. Most breaches are not coming from your vulnerability scanners, especially when it comes to Kubernetes. You're not gonna run a vulnerability scanner and go, oh, look, fix this one thing and we're done and ready to go. No, it doesn't happen that way. Most breaches are going to come from configuration issues. This is something I want to emphasize. In fact, I'm gonna show you some examples how configuration issues tend to cause most of the breaches. A close second is compromise credentials. When I say credentials, I still go out on GitHub. Well, maybe not every single day. And I think Jason even mentioned it too in his previous talk on bug bounties.  See how many times you find the word root. Yes, thousands of them are invalid. They don't make any sense. It's probably gonna find the keyword root or password and it's not gonna get you anywhere. And yet I still find where people hard code credentials into variables that say password. And right next to it, there's the key. There's the whatever the password is. Also, trailing in third place for most incidents is overprivileged users. This is incredibly important in the Kubernetes world. I'm gonna show you this in just a second or in a couple of slides here. So keep these three things in mind. Configuration issues, compromise credentials and overprivileged users. Kubernetes itself, we have to deal with all three of these compromises or these types of incidents. They're going to cause issues in Kubernetes. But first, think about this. We think about the Capital One hack that happened recently. Well, that was a combination of compromise credentials and access that should not have been granted. We see how Tesla, they had poor access credentials and so on. Equifax, we all know about that one. Go back and check if you don't. Equifax was hacked not only by a simple vulnerability that had not been patched, but also because they had very, very poor lateral movement detection on the inside. Once they got in with more compromise credentials through the vulnerability, they weren't detected for quite some time. This is going to be critical. And one other thing, I was bored this morning. I decided to throw this up here in this slide. Why? Well, I put up a new spice rack in my kitchen. I really liked how it looked. So I took a picture and I added it to the slide. There it is. Isn't it a great spice rack? Come on. All right, you all better be laughing. All right, let's talk about containers. Quick review of containers. They are not secure by default. Now, I'm really focusing more on Docker containers for now because that tends to be the norm. And one thing to think about when it comes to containers, containers are not like a VM. A VM is actually more isolated and this is something that's gonna be important coming up here. So a container is a grouping of stuff and the stuff that we like to call it are resources. Well, the resources are grouped into namespaces. If you are new to containers, remember this. Namespaces are critical.  All of this stuff can be controlled and locked down within namespaces. Resources are exploitable. I was sitting in another web broadcast just the other day on containers and I was surprised and because it was supposed to be a more intermediate presentation on containers and yet all of the people were asking, is there a way to prevent process abuse such as CPUs and memory and so on? And again, this was supposed to be an intermediate class on containers. So it confused me a little bit that people were asking that because that should be something that you know from the very beginning that you get into containers. Using namespaces and the next most important thing is control groups or C groups. These are the limits that you are going to be putting on containers. If you don't put limits on them, you're going to run into problems. Every time I do a pen test of a new application deployed into a container, I would say that seven out of 10 times I find that the author of the application who has put it in a container has not put any limits. I'll get into the application in whatever way possible, whether it's a SQL injection or an RCE or something like that. And once I'm in, I can take over not just the container but the entire system that it's on because there are no C groups applied to the container. The other thing to remember about containers is think of a container as an image or more correctly, think of it as a file system snapshot. So who decides what goes in that image? If you look at this particular picture, you'll see, you know, here we have namespaces, the control groups that I show, you might, it's going to possibly be routed if you've set it up correctly. You know, and here's the application. There is a Docker client that you might use to launch this. There's a Docker registry. This is critical to the security of your system. If you're new to Docker, you may not know this but Docker Hub was compromised two years ago. I believe it was. I've lost track of time during COVID. I don't know anymore. But you want to have a secure registry where you keep your images because if there are somewhere that you don't have control, you never know what's going to happen. But here's the difference. Notice that we have a host OS and hardware down here. Unlike a VM, in a VM, you would see the entire operating system within the VM here. You would not see a shared OS. Yes, there's a host OS, but then you also have the guest operating systems themselves. And that's where we get into how a VM is much more isolated and contained than a container is. So don't think the word container means that you're more secure. It just means that we have some work to do. So that's why I say right here in this slide, container isolation, is it really isolated? The simple answer to that is no, it is not. So let's talk about some container best practices. I should have also said at the very beginning of this talk, this is an intro. I can't show you everything. I'm trying to get people to start thinking about how you secure containers. Then we're going to jump into how you secure Kubernetes at the same time. So remember, we have a base image. That means that base image has to come from a secure repo. If you do not know what CIS is, definitely go to CIS security dot org. Check it out because you want to use CIS benchmarks for locking down your base image. I'm going to talk about that in a little more coming up.  By default, if you do not set a username, your container and your application in the container is going to run it as root. I have found so many who have deployed WordPress applications in a Docker container via Kubernetes and they don't set the username and WordPress is running as root. So is the database and everything else. So of course, once it's compromised, you take over everything. Also, visibility, you need monitoring within your containers. Your containers put a lot of information out and they can log it, but you have to capture that. We're going to talk about that in a minute. Also, think of it as a domino. If one container is compromised, I guarantee you the rest of them will fall over like dominoes. When you start to get into containers in Kubernetes, you're going to see this. Also, we want to set some controls. Besides setting a username that is not root, we also set privileges and we set certain attributes to those users where it says no elevated privileges or no new privileges. You don't want user accounts or IDs to be able to escalate privileges and I'll show you some examples coming up. This one, my God, this is near and dear to my heart, secrets management. I still find, I would love to say by a show of hands, but I can't do that right here, how many people put the secrets and tokens and things like that in their Docker YAML files? So when they then deploy the Docker image, if somebody gets ahold of their YAML file which describes the configuration of that container, well, the secrets are right in it. I've worked with a lot of developers and a lot of engineers and I get them, you have to start thinking about putting your secrets in another place, whether it's HashiCorp Vault, whether it's a cloud secrets management system, something, but get them out of the apps and get them out of the configuration files and stop allowing SSH into your hosts. When we get into Kubernetes, coming up in a couple of slides here, one of the key constructs of Kubernetes is you have a master node or master nodes and then you have worker nodes and I still find worker nodes with SSH enabled on them so people can SSH in and quote, fix things. No, no, you use the management tools to fix things and redeploy, stop allowing SSH into your systems. Also, I can't stress it enough times, name space limits. Go read up on how to control namespaces. That is going to be one of your best efforts and best practices for containing and controlling and securing a container before you distribute it to or deploy it via Kubernetes. This is one of my favorite tools, it's called Docker Slim. If you've never heard of it, if I were to create a container, let's say I create a container and it has a boot two in it or the base of a boot two and then maybe it has WordPress running in it for whatever got off a reason that I wanna do this, let's say that entire image ends up being three to 400 meg. You know, it's still manageable but if I were to run that through Docker Slim, not only will it add some extra configurations and namespace limits and so on, but it shrinks it down and something that might be three or 400 megabytes deployed into a container will get shrunk down to maybe 10, 15, 20 meg. This makes it even that much more manageable, it's easier to deploy, it's quicker to deploy especially if there are requirements for scaling. So think about this, take a look at this. I also mentioned in Discord that my slides will be available in my GitHub repo and I'll get them to the red team village so they can add them to the Google Docs location after my talk. And always remember, apply SE Linux or app armor. One of the things that Docker Slim does is it will do that for you. It's very easy to enable SE Linux or app armor within a container. If you can do that, you're going to make it that much more secure, it's not on by default but you can set it up so it will be. All right, and remember the infrastructure and as I put it, ding, ding, ding, ding, ding. Yeah, you can't forget that all of this stuff is being deployed on an infrastructure of some sort and that infrastructure better be secure. I mentioned SSH, people keep allowing SSH into their environment. Be very aware that your infrastructure itself should be secure and I will remind you later about that. All right, here's a quick picture. Picture is worth a thousand words, right? If you look at our first example, this is our monolithic operating system here. We see hardware and operating system in run apps. Here we see a VM, so we see hardware operating system. There's a hypervisor involved and then there's going to be virtual machines but when you have virtual machines, you have additional operating systems, you have additional libraries. They're very much isolated. I should have used a different picture where there's a big line through it that shows, yes, these are isolated and so on but that should not have happened. Nope, go back, sorry. Okay, but when we look at using Docker or a container, we go hardware operating system, there is a container runtime, there's no real dividing lines and then we see containers. The only thing that is unique between the containers is that being in the library, the things that are going to run and then the application. So there's not a lot of isolation there and people want to think that there is but there is not. So please keep that in mind. I do love this comic. It came out a couple of years ago. The great defense is, we'll inundate them with quarterly Kubernetes releases. Yes, they do update Kubernetes a lot. That's why you have to pay attention to your environment and the tools that you're gonna use so you can do upgrades to your Kubernetes cluster. So let's bring on the orchestrator. Let's talk about Kubernetes. All right, here is Kubernetes 101. In one slide, I'm gonna teach you at least the basics of how Kubernetes works. We have a master node. The master node is critical. It manages all of the Kubernetes worker nodes. It manages the clusters. It deploys pods. Think of a pod as a collection of containers that are grouped. A pod might be the way that you decide, I wanna have a pod that supports a particular client or maybe it's a WordPress instance and that pod has WordPress. It has a container, a separate container for the database and so on. So the pod is how you can group things that are various containers into certain groupings and those groupings are kind of defined by you. But stop and think about how you want to deploy pods. It's gonna be important. A worker node. The node is where all the containers are gonna run. You have other Kubernetes components that have to run there. But the important part is, this is where the containers run. If the worker node is not secure and not patched and I can get into that underneath the visibility of Kubernetes, then Kubernetes has no idea that I've compromised a node. I found numerous Kubernetes sites around the internet where there's additional applications running on worker nodes because they've been compromised, of course, of Bitcoin miners. But the master node has no idea that it's running on there because they got in via SSH and they launched the application that the miner underneath the visibility of Kubernetes. So you really want to lock down these worker nodes. A pod I already explained, it's a unit of deployment and it's also how you address things from Kubernetes. And a pod will have an IP address. So that's important to remember. But it's gonna contain one or more containers. I like to think of pods as even though it might have its own IP address but think of it like a VLAN in a way because I've isolated it in one way. Services are various things that run within Kubernetes that communicate, that balance, that do a lot of work. We're gonna look at services coming up. There are various components that are used, three that are critical, the API server. You're gonna have kublets and you're also at CD. The one concept you should take about at CD is this is the database that describes and builds everything that is your Kubernetes cluster. The at CD environment should actually be walled off and firewalled and controlled very, very securely. If you do that, you will have a much more secure Kubernetes cluster. So keep that in mind and you can see it here by looking at a picture. So we take all of those concepts that we just talked about. We see here's an API server, here's a controller. This is all part, the kubectl app. Stop doing that. Come on. kubectl is the command you use to control everything. And even though this is a disk kind of a representation of at CD, I like to say, you know what? This needs to be off on its own firewalled and separated and it can be done that way. Here's your worker node and you can see how you might have multiple pods on a worker node. This pod might be talking to this pod. It doesn't necessarily have to talk to that one or they may not talk at all. These are some of the other services that are running the proxies. This is where we are exposed to the internet not over here, okay? So the only place you're exposing Kubernetes is at the worker nodes. Now, Kubernetes is not perfect. There have been problems. There was, I need to update the slide again because there have been a couple of other Kubernetes. These are more for reference. One's a little older. This was back, there was the backdoor that involved the API server. There were some others. These are only for your reference so you can go look them up and see. And there are more. The whole point I'm trying to make here is Kubernetes is not secured by default and it's not perfect. Well, let's try to make it perfect. Let's take a common Kubernetes cluster and say, you know, if we were to threat model this and that is very, very important. First thing we wanna do is to say TLS everywhere. Yeah, I know I have too many exclamation points but I'm trying to make the point. If everything within your Kubernetes cluster is using TLS and is encrypted then it's that much safer. I still have engineers come to me and say our application is completely internal. Why do we need TLS? It's never gonna be exposed to the internet. So really? So what happens if Joe's application over here which is exposed to the internet is compromised and then they use that as a pivot point to gain access to this environment and then they compromise your system. Oh, is typically the response.  Yes, I'm saying it again but you're running this thing on your infrastructure. Make sure it's hardened. And very important, two concepts. There's RBAC which is regular role-based access control. Set that up, make sure you're doing it right. Disable ABAC. ABAC is incredibly difficult to manage. You will spend days and hours and hours trying to do ABAC access controls which is more granular but it's not worth the effort. Make sure you use RBAC and manage it correctly. And I'm gonna show you a couple of tools coming up on how to check it. Also, check out this blog entry. This is, I mentioned this previously about monitoring. This is one way to audit Kubernetes. So keep this in mind. Take a look at that blog entry from Wazoo and it's an excellent, excuse me, an excellent place to start when it comes to monitoring your environment. Also, kubectl, get roll binding and all your namespaces. You should do this periodically in your environment especially if you have engineers deploying their own applications. Make sure that all the namespaces have good controls in their RBAC accounting. Also use third-party authentication for the API server. Again, something like HashiCorp Vault. Yes, I love that tool. If you are not familiar with it, get familiar with it. It's a great tool and it integrates very, very well with your API server and Kubernetes. I already mentioned this, separate and firewall your Etsy cluster, make sure it's protected. That is the keys to the kingdom. It's the entire configuration of your cluster and rotate encryption keys. Yes, use Vault. And by default, turn on security policies in the pods. It's some simple lines of configuration in the ammo files. It's not hard to do or use Docker Slim, that tool that I mentioned earlier because that'll help you set this up. All right, let's talk about risk. Kubectl, get secrets. That is the one that I just mentioned where you can look at the secrets from pretty much everything. But here's some tools that I absolutely love by cyber art. One is called Kubernetes RBAC audit. The other is called KubiScan. The RBAC audit does exactly what you think it does. It audits all of your RBAC roles. The KubiScan will look at all the permissions that are granted from the roles. These are two great tools that you want to put into your toolbox for securing Kubernetes clusters. Because remember at the very beginning I said, it's all about configurations. It's the number one area that Kubernetes clusters get compromised. Also, we wanna take a look at GitHub. Go out and make sure that, take that away, go out and make sure that your own configurations are not being shared up to GitHub by your engineers. Accidentally, how many times does this happen? It happens. I've had it happen by engineers. They don't do it on purpose, but they upload code and in the code are secrets. And oops, oops, it's not a good thing. Also, you need a locked down secure image repo and create gold images.  No, you need your own repo and registry for your Docker images. Make sure that happens and please secure the libraries. That's another big one. We also, I need an entire slide on just the applications. I'm going out on the limb. This is my personal opinion, but I wanna say that nine times out of 10, okay, maybe eight and a half. Eight and a half times out of 10, Kubernetes clusters and containers are compromised because the applications themselves were poorly written and not tested. And that's what gets me is I have environments where I see the engineers create an application. They do so much work to lock down Kubernetes in the container, but they do a poor job and there's a SQL injection vulnerability in the application directly. So then the application is compromised and then the container is compromised because oops, it was running as root and so on and so on. Remember the dominoes, everything falls over. Also, remember your pods. Another common mistake that people make when they're new to Kubernetes is they don't stop and think, how can I group things into pods and secure those pods? At least if a container falls within a pod then maybe there's another couple more containers in there, those containers that get compromised are going to be somewhat limited within the pod itself. Typically a pod is not going to fall over when another pod falls over. It's usually containers within the pods. So you wanna think about grouping things. Also, Jason mentioned this in his talk earlier, but showdown, if you have never used showdown, get familiar with it, even for Kubernetes, you can go out to showdown, you can start searching for Kubernetes, you can search for API clusters or API servers, you can search for XED servers and if you find one of yours, oops, but they're out there. I did a search this morning for some XED exposure and to be, well, there were over 6,000 that I found that were exposed. I don't know how many of those have vulnerabilities that would have allowed me to compromise them because I was just curious what the number would be. And yeah, it goes up and down on a daily basis, but you should be aware of that, so use showdown. Let's talk about the configurations. Said this before, most of the breaches come from configuration issues. Use CIS hardening, Center for Internet Security. It is an amazing place. It is done by volunteers and workers within CIS. You can get benchmarks for Docker and you can get benchmarks for Kubernetes. You can use these to configure your environment so they are indeed hardened. Stop ignoring them. I still see people that tell me they've never heard of CIS and it makes me very sad when I hear that because it is such a great resource. The whole point here is we have to harden the environment from the standpoint of the basic configuration but don't forget the application. Also, I know a lot of people have environments that are CICD when it comes to Docker and Kubernetes. That's why we have them. It's for speed, it's for development, it's for putting things out quickly. Okay, great. A lot of people use Jenkins. Is there some way to automate all of this? So at least I can look at my images, I can look at my containers all within the CICD pipeline. Yes, there is. There is a great tool called Anchor. Anchor is, as it says here, it's a container image scanner plugin. And what it does is you put it into the pipeline, it's a plugin for Jenkins and it actually does security scans against the images that you're trying to deploy. This is a great way to get testing in before you actually deploy it to production. So let's talk about some additional tools before we get into the pen testing because we're still trying to lock it down. Kubbench, we want to run Kubbench. What it does is it runs against your CIS benchmarks, it deploys or I'm sorry, it displays a configuration that shows you what has passed, what has failed. I'll show an example in a minute. There's also Kube Audit. It's a little more granular than KubeSec. And if you run Kubbench and Kube Audit, it will give you a report that shows you, oops, my system is insecure. Here's an example of a report. And when we look at it, we see allow privilege escalation is not set. There's a very first one. Oops, that needs to be turned on. Remember, that was the one that I mentioned that allows users to do privilege escalation. We don't want that. Oh crap, we have run as non-rude as not set. We don't have a read-only file system set. There are so many simple things that can be done. Again, no app armor, no security comp, it's not being turned on. These are things that are just so easy. And this is from every single container within the environment that is being deployed under this particular. It's much longer, it goes into it. This is just a quick snapshot. The whole point here is you run this against your environment before you deploy it. And you go, oops, let's go back to our configuration file and fix all these things. Here are some more tools for you in the environment. Clare, another great tool for doing static analysis of applications. Clare does, it integrates Clare and your Docker registry so it can automate that a little bit. Falco, I need to put huge stars next to this one because this is actually one of my favorite, favorite tools. It was developed years ago and then it kind of morphed off and became falco.org. It monitors behavior within containers. It can detect if a container has been compromised because suddenly the container starts acting weird or there are commands being executed inside the container like cat, Etsy password, probably not a command that should be showing up in one of your containers. So if anything of this entire talk that I'm giving today, you get out of this, go look at Falco, this is one of the best tools out there. Kubhunter is another great tool. We're gonna talk about that. It's used more so for looking at doing some pen testing. We're gonna take a look at that in just a second. All right, ready, set, attack. If we were going to pen test an environment, this is an example of all the ports and all of the things that are open in a Kubernetes cluster, now they're open, but are they open by firewalls and so on? Well, we don't know. The API server itself is, yes, it's HTTPS and better damn well be protected. At CD on 6666, that should be protected wherever it happens to be. This just gives you an idea. All of these ports can be changed. These are all the defaults in most cases. Just be aware of the ports that are out there and exposed that you need to make sure are protected because as an attacker, what am I gonna do? Well, one of the first things, even Jason was talking about in his talk, looking at ports, running in map, running mask scan and so on. This is exactly one of the things that Shodan does. It looks for all of these things that are exposed on the internet. So please make sure you're aware of all the ports within your cluster.  This is one of the ways that I'm going to start to attack a Kubernetes cluster. I want to first and foremost check access to the API server, make sure that is protected. I'm going to be looking at at CD, making sure that's protected. If I find it exposed, I'm going to get keys and kingdom in that case. What about the kublets that are communicating in the command channels that are there? They should be read only, but they should not be exposed. There was actually a vulnerability exposed about this. I want to say two months ago, I'm probably off in that sense, but take a look at that and it allowed, even though it's a read only port and it's supposed to limit what you can see, there was some vulnerabilities that allowed for a lot of exposure there. Also container vulnerabilities. What about, do you have files in that container that the application needs that you should be protecting? Well, that's where I would set up Falco and tell Falco, hey, there's a special file over here. This application is using it, but keep an eye on that, make sure that the only thing that is reading that file happens to be the application and Falco can monitor that. Privilege escalation, nine times out of 10, once somebody compromises an application in a container, they elevate privilege because there's some other bugs in there. Go back to the Kubotic slide, where it showed privilege escalation was not set. All you have to do is set that configuration variable. It's not that hard, okay? Vulnerable applications are critical. Can't say it enough times, especially because there are so many people using Kubernetes and Docker to deploy WordPress. And WordPress is, of course, one of our favorite things to deal with. All right, so your final threat model, when it comes to pen testing and looking at the environment that is Kubernetes, you think of your workload, you think of that security within your pods. Can I set up my pods so they're indeed secure? The container security itself, the configuration for that container, the more hooks I put in, run as root, no, privilege escalation, no. These are the things that we want to make sure that are set. Also, file storage security. Maybe there's a particular file system that has to be read right, but the rest of the file system can be read only. Those are other things. The network security, remember the infrastructure. Put firewalls in, put controls in there that detect lateral movement. If somebody does compromise one of your applications, make sure you have something monitoring. I gave you that slide way back about the blog entry from Wazoo. They talk about how to audit and monitor a Kubernetes cluster using their tool. I love the Wazoo manager and agent. Take a look at it if you haven't heard of it before. So remember, most breaches are not zero day. I can't say it enough times. Everybody's always trying to protect against this stuff. They're not fancy. Most of these things are being broken into because people make silly mistakes because remember common sense, whatever happened to it. The breaches are gonna come from configuration issues. The CUBE audit was a very good example where it was showing all the problems that would allow someone to get in. Compromise credentials, make sure your credentials are stored in a secure place somewhere and don't allow for privilege escalation. Kubernetes and Docker give you the tools in the configurations to prevent that just turn them on. And that's what we're not doing. We have to turn on the configurations. So your key takeaway is from today. Common sense, please go back and stop and think about where is the exposure? Where are my pods exposed? What about my SED configuration that is so critical to any Kubernetes and always remember containers. Containers are the linchpin of a Kubernetes environment. And if I don't secure my individual containers, then Kubernetes, I don't care about the security of Kubernetes because the container is insecure. So stop overthinking this stuff and think about security basics. Remember the CIS benchmarks. Can't say it enough, the basics. I still think as security professionals, hackers, whatever we wanna call ourselves, we have forgotten the basics of how to secure an environment. And that's why things keep getting broken into.   Secure the environment, please. Use the CIS benchmarks for the containers, for Kubernetes, for the OS that your stuff runs on. If you're gonna deploy this whole Kubernetes cluster on Ubuntu, then pull up the CIS benchmarks for Ubuntu or Red Hat or CentOS, whatever you're using. Remember, RBoc is your friend. ABAC is not. Your infrastructure better be secure. Your pods better be secure. Containers themselves, the network. Still a lot of people forget the network because they forget about TLS everywhere. Threat model your applications. If you don't take the beginning effort to threat model your applications, you end up within the secure applications and all the security of your Kubernetes cluster is useless because you have insecure applications within your environment. Access controls go along with RBoc, but access controls into the environment, kind of referencing SSH. I found one worker node configuration in an environment, probably nine months ago, but for some reason on the worker nodes, they had FTP enabled on all the worker nodes. And my head exploded. It allowed me to get into everything, but oh well. Yes, did I mention RBoc though?  Why? Because people tend to ignore it. Remember the tools I mentioned earlier about monitoring or auditing the RBoc roles and also the permissions. And finally, not quite finally, remember to patch everything, the infrastructure that goes along with that, logging and auditing and monitoring. I still see people set up their environments. There's that blog entry again. Please take a look at that. It is well written. It's a great tool. You'll learn a lot about Wazoo. I use it on all my systems. I deploy a lot of honey pots with Kubernetes and containers and things like that, but I monitor them all with Wazoo, okay? You can't have a secure environment if you're not monitoring that environment. That is the biggest thing. So that brings me to the end. I thank you for your attention. There's contact info, there's my Twitter account. I will get this to the Red Team Village and they can upload it to their environment, but I'll have it on my GitHub later in an hour or so. I'll update it there. Thank you all very much. Hopefully you learned something today.  Thanks to Red Team Village and have an awesome DEF CON. Awesome. Thank you so much, Kat and amazing presentation. As always, thank you for supporting DEF CON. Thank you for supporting the community. Of course, the Red Team Village. For those of you that just joined or are looking at the presentation in Twitch or YouTube, please look at all the activities that we have going on. Go to the website that is in the description of the stream. Please also join the conversation in Discord. We're gonna go in a brief break and the next presentation will start in a few minutes. Thank you again and thank you, Kat.


What's up everybody?  There's all the letters there. So here's the dice roller Here's the customer names and the numbers Let's click roll to six into three nine times one two three four five six seven eight nine six three nine Tony Donna Jerry nine times here one two three four five six seven eight nine You oh with Shaden Sharpe wouldn't be in this one Dennis. He'd be in 22 23. This would be the previous year Just remember that D down to EF, but there are other great blazers though. Alright, so Tony with D Tristan with M Kurt with P Tristan with H Kev and O Oliver B Gabe with R Adam with a Tristan with K James with T Benjamin with Z Simon with W Adam with V Gabe with C Ryan with S Tristan with J G I Tony Barker Barkie sorry XL and then Jerry with EF All righty guys. Well, you're like 30 seconds, but there hasn't been really any trade So I'm actually Matthew just bought the Denver Nuggets straight up in number three Tristan got I don't think it's me trade so TWC All right guys left and right one two three four five six for the right since we only have two stacks left Last four boxes would be for number eight It's a four one two three four five six. So the stack right here will be for the next one Later tonight, yeah Later tonight All right for Boston College MacGyre Ashley Langford, Mari Bailey, Xavier Worthy and Kyle Philopsky then we got Dante beyond wicks for letter D Go into Tony Barkie We have a out of 75 Nick Singleton for letter N Going to Kev a nice Nolan Smith another one for letter M and Kev This is Bowman at University in September Gigi Jackson, Mikey Williams, KJ Jefferson and Trace Jackson Davis And we have about a 75 Julian Phillips We have a Trey Alexander and Tyler or Tiger Campbell 55 out of 99 55 so T is James Actually, both of these were T's going to James Then Julian was J going to Tristan Dracovic fellow Dracovic Chris Murray Kiki Rice Spencer Sanders All right, we got Matt's Bozellus to 299 And Emma is Tristan Out of 75 They quant fin letter D Tony Barkie and then Jaleel Billings Let her J going to Tristan. All right. Let's walk through that Chris Livingston Jamar Gibbs, Chance Westerie, Ernest Yuda Jr Then we got Hendo Hooker to 199 letter H Tristan You get Cade Plubnik letter C going to Gabe and Then Jalen Hood Shafino letter J going to Tristan. So J dominated this break And then let it go gave a little something here at the end for you. All right. Here you go guys Oh So again for more boxes left in this case number eight almost sold out in the store You're running back a little bit later tonight. Appreciate you guys. Jasper's case breaks.com


What's up everybody jason for jazzy's case brace calm 1920 panini contenders basketball three box hobby break random teams number three Just sold out guys and again chase them Kobe Brian on card autographs Zion jaw RJ and much more three boxes of contenders hobby So we're no veteran common ship, but all teams are in guys So again guys this is actually one of the last live products that Kobe was in before he passed away So hopefully we can get a nice little Kobe autograph like that one right there. So there you go dice roller here Here's a customer and so from Patrick down to Alec you got those spots straight up then Joshua down to next over got those from Donors four and five So there you go Roll it and we got ourselves a five and a two lucky number seven seven times one two three four five six Seven what's up liner? How's it going man? seven times Barry down a Rick Also guys, I mean I've been saying it for mostly every single break, but our studio lie above me Lights went out late last night. We couldn't order order some in time to get here today So they should be here tomorrow or the day after that so Lighting's gonna be a little off today not anyone like usually is but still pull some big fireheads for you guys All right seven times here now one two three four five six and seven Bucks down to the nuggets So stick right here Bear with the bucks Robert the Pacers Joshua the Knicks Dylan the other trailblazers Christian with the Mavericks Ella with the Celtics Patrick with the magic Joshua with the Clippers Colin with the Wiz Warriors are Jigar With the Wizards Joshua with the Thunder Nick with the Hornets as well as the Rockets was our with the Bulls Nick with the Hawks Robert with heat Aaron You have the Utah Jazz Joshua with the Lakers and with the Cavs Joshua with the Kings Nick with the T Wolves Joshua You have the Pelicans Nick with the Spurs Derek with the Grizzlies Joshua with the Raptors sons Dylan with the 76ers Michael with the Pistons Chow with the Nets and Rick Thomas with the Denver Knights So if anybody wants to trade, I'll give you guys a quick minute. If not stick to what you got Long traveling nice man Hope hope you were enjoying it man Showing the clothes guys all right guys, so looks like the peony one fillers are gonna sell out which is gonna unlock the promo and Pretty much guys. I know That's pretty much the closest break that was gonna sell out for the promo And it looks like it just sold out So that'll probably be the last break guys and then just call it for the night Nothing. Nothing is nothing is super close So that moment Jeff H. We got to do it two fillers and we haven't even sold out the first one that's there on the website So That'll probably be the last things we do here, but we'll jump back on it tomorrow, of course guys All right. Good luck everybody Tender's basketball. All right first box guys. Good luck See what we got here. You got at least two autographs and we got team quads there for the Charlotte Hornets Yandre A. We have lottery ticket Cameron Johnson We have to 1 49 Tobias Harris Semi-final ticket Then we got a job or rant superstars die cut For the Memphis Grizzly is going to direct very nice Rui Hachi Mora lottery ticket Stephen Adams Kobe White LeBron RJ Barrett We're gonna start getting some autographs, right? I feel like we're getting to the end of it. We haven't got any autographs yet PJ Washington, Jr. Kyle Guy So off-center on the back Contenders rookie ticket. It's like a hollow Michael Porter, Jr. Number to 1 99. All right. There you go. Alrighty guys. Good luck Jared Colver and we got team quads featuring Zion Jackson Hayes Lonzo ball and Brandon Ingram Deondre Hunter and we have LeBron James superstars die cut Lakers, it's going to Joshua Kobe White and Lonzo ball to 1 49 to my final ticket for the Pelicans All right guys, let's get some nice hits going Jackson Hayes Darius Basely rookie ticket for the Thunder Going to Joshua and Fiondhu Cabinelli for the Clippers Romeo Langford Tim Ardoway, Jr. All righty Avery, we do have some hockey on the website jazbeastcasebreak.com, but I don't think it's gonna be breaking tonight So you can kind of maybe get some teams for tomorrow potentially We have some black diamond pick your teams up on the website. I don't think they're gonna be going off today All right, last Box here guys. Good luck. All right. Good luck guys. Next box either a hero Rookie ticket.  That's been a Nick Stover. And there you go, man. This is the first auto guys right there Lottery ticket Jared Colver only we can hold for maybe some numbered cards potentially or some lottery ticket or die cuts Let's begin with a third autograph. I doubt it though Team quads out of 65 Gordon A word. That is the finals ticket Cam Johnson John Marant lottery ticket. That's not bad and Zion superstars. Dica. Very nice pelicans We have Anthony Davis I think that's not numbered but it's just MVP contenders Cam Reddish We got DeMar DeRozan. DeMar DeMar I say it the less I like it Team quads here and there you go Very nice Good boxer there guys. So yes, there is only two autographs a guy. So it's gonna be tough to hit But some nice stuff here guys I remember this is contenders basketball, this was a three box hobby break round teams number three I'll do a quick little recap You're a Tyler hero Kenny Smith lottery ticket John Marant Superstar Dica Zion. There is Basley Fiondou Kevanelli. We got LeBron James superstars die cut We got Kyle Guy Michael Porter Jr. And Superstar Dica John Marant. So appreciate you guys JaspysCaseBricks.com


Well, we had a really good opponent. And I thought we played inconsistent. We played really well at times. We were up 24-23 if we'd have taken that second set. It would have been a completely different match. Unfortunately, we didn't take it. And they scored the last three points. Third set, we got way behind. And I really was very, very encouraged the way we fought back. We were down 12-3 and came all the way back and tied the game at 17-17. So again, kind of inconsistency. And we're trying to find out how we are best. And the goal is to be playing our best volleyball in October, at the end of October. We passed well. We passed so much better. And we were in system. And when we're in system, we're a dangerous team. Just like they were in system most of the night, and we had a tough time stopping them, they hit for a very good kill percentage. That particular game, we passed. We did not pass well in that first set. And the second set, we passed much better. And we got some good swings. And we were able to match point for point. I really think that we can thank the girls that weren't in the game, that were cheering. They never stopped cheering. Everybody just still stuck together, even though things weren't looking too good. We could have just kind of given up, but we didn't. And that's a quality of a good team. I'm disappointed for the girls that we weren't able to pull it out tonight. Marymount's having a great season. And we caught them on a ninth. And they played real good. We're just going to get better. We want to get better as the season goes on. We are 5-0 in our conference. So that's a good thing. And these are nine conference games that we're using to get better by the end of the year.


It is a joy and unspeakable blessing to be Scott Hahn's wife and the mother of these six incredible children and 21 amazing grandchildren. We just had our first child who's married move back to the area. And I told one of my sons after sitting at mass and cuddling the three-year-old the whole time and kind of telling her about the mass and having one come up close on the other side and one on the other side, I said, something has awakened in my heart. I never let be there, which is how much I long to be with the grandchildren. I've just never let my heart go there because I figured there wherever God wants them to be. And I said, I want you to know my heart is not satisfied. I have awakened a hunger that now I want them all here. No human pressure. I'm just telling you I want them all. So anyway, all right. Here in Steubenville, we have a lot of change going on. And when my youngest son was seven, we were going up Sunset Boulevard and I noticed that an old car dealership was being dismantled and there was a sign coming soon what was gonna be built there. And I said to him really, not intending an answer, it was more rhetorical, but I said, isn't this exciting? And he said, it's very sad. I said, sad?  I wrote it down because it's an unusual response. He said, my children will never know the town of my youth. I said, you're seven years old. The town of your youth is still being built. But you know, many of us feel that way about the church. Don't we catch ourselves thinking, my children will never know, or my grandchildren will never know the church of my youth. But the church of our youth is still being built. And as lay people, we are a part of this. Jesus is using you and me to build his church. Now the scripture read by every presenter is Luke 4 quoting Isaiah 61 at Jesus' first homily. The spirit of the Lord is upon me because he has anointed me to preach good news to the poor. And I loved Father Lewis's comment last night. That's us. That's not pointing at the poor out there, but us because we desperately need to hear the gospel. This talk is called How to Be a Contagious Catholic. And I want this to be in two parts. The first is how do we receive this good news and let it transform us, our hearts, our marriages, our relationships? And then secondarily, how do we imitate our Lord by proclaiming the good news? How have we received this good news? Through the word and the sacraments, we may have had faithful parents who brought us his babies to baptism and then nurtured our faith so that we could respond to the Lord. Or some of us heard God's word through a faithful witness and we received power to become children of God responding in faith and following up with baptism after that. Open your Bibles to Acts chapter two. On Pentecost, when the Holy Spirit filled St. Peter, he preached powerfully and he concludes with this Jesus whom you crucified. Verse 36, let all the house of Israel therefore know assuredly that God has made him both Lord and Christ, this Jesus whom you crucified. And they were cut to the heart. They were cut to the heart. And they cry out in verse 37, when they heard this, they were cut to the heart and said to Peter and the rest of the apostles, brethren, what shall we do? And Peter said, repent and be baptized every one of you in the name of Jesus Christ for the forgiveness of your sins. And you shall receive the gift of the Holy Spirit for the promise is to you and to your children and to all who are far off, everyone whom the Lord our God calls to him. And that's us. We are those who are far off and our children and our grandchildren. Now once they were baptized, how did they grow? Just look down a little further to verse 42. They devoted themselves to the apostles teaching and fellowship to the breaking of the bread and the prayers. These new believers learned the faith from the apostles. They met together, building the church. They had mass together, they prayed together. One of the toughest things about COVID is how scattered we have been, how isolated people were, and how much we have longed to be together, together at these conferences, together at mass. The apostles teaching would have included the Sermon on the Mount where Jesus says to the people, if you turn to Matthew five, you can read it for yourself along with me. Matthew five starting in verse 13, you are the salt of the earth. But if salt has lost its taste, how is its saltiness to be restored? It is no longer good for anything except to be thrown out and trodden underfoot by men. You are the light of the world. A city set on a hill cannot be hid, nor can men light a lamp and put it under a bushel. But on a stand and it gives light to all who are in the house. Let your light so shine before men that they may see your good works and give glory to your father who is in heaven. You and I have been called to be salt, to season, to preserve. I like to think of movie popcorn salt when I pray about my witness to others.  And of course before you even open the doors you can already smell the popcorn, right? I mean, it just emanates out of the movie house.  I'm not paying that much for a diet coke, you know.  You ask your husband to go get you a drink. Okay, and they know that. They salt the popcorn to make people thirsty and that's my prayer. Lord, I wanna be salt to make people so thirsty they have to know you. They have to be introduced to you. We've been called to be light, to shine. Not like turning on high beams and blinding somebody, not shouting with the truth but shining with the light of truth to draw others to the light. This is too good to keep to ourselves. Now how do we do this? We do it by the power of the Holy Spirit through whom we were baptized, in whom we've been sealed through confirmation.  There is no way he can do everything needed to bring the world to Christ but he doesn't have to do it alone. This isn't a message simply for priests, does include them but it's not just for them, it is for every Christian. St. John Paul II made this clear in his encyclical to the lay members of Christ's faithful people. Number 14, to be baptized into Christ means we have been baptized into Christ's own mission to redeem the world. He is priest, prophet and king and so he has drawn us into his priesthood as we offer our lives in union with Christ's offering in the mass to consecrate the world to the Father. We participate in his prophetic witness as quote, we have the ability and responsibility to accept the gospel and faith and then to proclaim it in word and deed, end quote. And we extend his kingship as we bring quote, Christ's kingship to bear in worldly affairs, administering justice and charity. In this we sanctify the temporal order being in the world but being different from it, end quote. You and I are directly connected to Christ's saving mission. Turn to John 15. I'm so glad that Ted referred to this passage already. John 15, and I wanna read verses four and five. This is Jesus to his disciples quote, Abide in me and I in you. As the branch cannot bear fruit unless it abides in the vine neither can you unless you abide in me. I am the vine, you are the branches. He who abides in me and I in him, it is who bears much fruit. For apart from me you can do nothing, end quote. Christ is the source of our life and we need to be intimately connected to him. We will be fruitful if we abide in him and his life flows in us and then through us. We don't just belong to the church like we belong to a club, we are the church. He is the one who has called us from death into life. He is the one who has made us his children by virtue of our baptism. And then he is the one who sends us out to be his faithful witnesses. That sounds great, doesn't it? So why don't we do it? Well, I think there are three things that stop us. A lack of love, our fear and a whole lot of excuses. What's our lack of love? Well, one thing I call the little bo peep syndrome. If we just leave people alone, they'll find their way home. How many people have stopped coming to mass through COVID? They found it just as meaningful to watch mass on EWTN or some other place. They can DVR it and have the Sunday to themselves and then just tune in. They don't know what they're missing. Many Protestants have stopped going to church because they found a better sermon, they found better music. A significant number need to be invited back and our wordless witness is not sufficient. It's not enough for us to just live our faith. We've got to find the words to welcome them back. Or on the other hand, we don't just let them alone, we become theological pit bulls, okay? Triumphant, triumphalist, it's you versus me and we get inspired and we wanna give it all to them.  So I think a lack of love keeps us from sharing effectively. Fears diminish our courage. Fear of the unknown, I don't know how somebody's going to react, what are they gonna think of me if I start talking about Jesus? Or a fear of failure, I don't know how to do it perfectly. Will I remember what to say? What if I can't answer their questions? And so we opt out. We let the fear overwhelm any love that God could place in our hearts because they need to know Him. And if we are the one in relationship to that individual, how do we know God is not asking us to share with that individual? And then we have so many excuses. I'm either too young or I'm too old. I'm not well, whatever it is. Or faith is just private. Some people's faith is so private they don't even know it exists. But perfect love casts out fear. And so we need to come up for the Lord and say, who do you want me to share with today? And it may be very random things. I didn't intend to give this illustration, but I just wanna throw this out there as just one example that God may put something on your heart and just go ahead and share. You're gonna come back with hearts very full from this conference. And someone might say to you, where did you go? Why did you go to Steubenville, Ohio for days in the middle of the week? What are you gonna say? Okay, so I was at the store and I was shopping for one of my children's birthdays and I noticed a great sale on China. And I have looked at these little cups. They're Lenox tea cups. They have hydrangeas and butterflies. They are so feminine. And over the years as we've had grandchildren, I thought I would love to use as an illustration of the importance of purity these China. I'd like to do something with China. And our friend, Michael Ann Martin, who is Curtis Martin's wife, wrote a book about dates with her daughter and she used this as an illustration taking her daughter out using a paper cup on one side and a China cup on the other and talking about which one was so much more valuable. And then she got to keep the tea cup. So I've always thought I would love to do that with my granddaughters. Well, here was a great sale on the very cups I liked. So I bought 16 and I already have 12 granddaughters and I know there will be more. So that's only three married kids, you know. So anyway, I went up to the cashier and she said, wow, you must be really into China. And I'm thinking, do I tell her lie? I'm buying these cups? Absolutely. And so I said, well, purity is really important to me and I have a unique relationship with my grandchildren. And so this is what I'm gonna do. And I explained the whole thing. And I looked at her and she immediately said, up top. And she gave me a high five and she said, this is awesome. I'm gonna go buy some. I've got neighbor kids that are really important to me and I'm gonna share this with them. We don't know what fruit God will bring. We don't know, but he will give us the opportunities. I wanna talk briefly about Jesus' final words to his disciples and how that gives us a path forward in sharing our faith. And of course the last word someone says before they're gone are usually very, very important and significant. First, I'm gonna look at Acts 1.8. Acts chapter one, verse eight. You shall receive power when the Holy Spirit has come upon you and you will be my witnesses in Jerusalem and Judea and Samaria and to the ends of the earth. We also receive the power of the Holy Spirit to be witnesses. So let me talk first about how to be a witness and then where. First, we need to embrace the idea of ongoing conversion. We need to preach the gospel to our own heart each day. It helps us be thankful as we recognize what God has done. A very holy priest who was giving me spiritual direction, Father Ray Rylan said this, sleep is like a little death and getting up in the morning is like a little resurrection and when we get up we can, we can wake in without remembering who we are as a son or daughter of God. And he said, so it's important to do an act of consecration for the day and to fill your heart with thanksgiving for who God is and what he has done in you. Second, we need to share the good news with others. And we can just talk about how God's at work in our lives, praying about something and seeing that answer to prayer, trusting Almighty God with something very difficult. I wanna give you five steps about sharing. So step number one, share about his work in your life. And you don't need to have had a dramatic conversion. You know, I was a baby who was prayed for, my parents baptized me, they taught me the faith and I believed that God existed because I believed them. But at a point in time, when I was very aware of sinfulness, God used a powerful message that connected my feeling of shame with Christ's offering on the cross. And I realized I needed to say, I believe you. And it was a moment of conversion for me, even though I wasn't a really bad kid, but I needed to know God personally. And that was a conversion moment. So if you've baptized your children, that's awesome. You have placed them in a state of grace, but we have to all respond to that state of grace. And there will be ongoing conversion moments. You may be sharing with somebody who was baptized at one point in their life, awesome. But how has God at work now? How are they responding to grace now? Number two, let them know that God loves them more than anyone ever could or will. And he wants a real relationship with them. Many people know God the way I know the Pope. If Pope Francis walked into this room, I would recognize him. He would look at me and say, who are you? He does not know me. I know about him, I do not know him, but God wants us to know him. I love this illustration. And I think this really brings it into a beautiful focus and maybe you could use this illustration when you share with someone. There was a little boy who loved to whittle. And one summer, he whittled a little boat and then in his backyard, there was a creek. I'm from Pennsylvania originally, so might call it a creek, but we called it a creek. Anyway, he would take his little boat and set it in one part and then he would just watch it meander down and then he would pick it up and do it again. But one time, it got away from him. He just, he couldn't find it. Later in the summer, he was passing by the downtown toy store and he saw his boat in the window. And so he went in and he said to the shopkeeper, that's my boat, I made that boat. And he said, well, you'll have to pay for it. Without another word, the little boy raced home, cracked open his piggy bank, counted out the money, raced back to the store and put the money on the counter and when he went over to the window, the shopkeeper heard him say, now you're mine twice. First I made you and then I bought you back. That is what our Lord says to each and every one of us. First I made you and then I bought you back. And at what price? Step three, what their appetite, they may not know their need. Even if they're basically good people, everyone knows they have violated even their own sense of right and wrong. They haven't always told the truth. They haven't always honored other people's possessions, however it would be. God's standard is perfection. We've all violated that standard. And that includes not just sitting against God's laws. We've also failed to obey all the laws, to love God with all our heart, our mind, our soul, our strength. When I thought about my own sins, I knew I needed Jesus.  It's not one and done. We need our children and grandchildren and God children to understand it's the beginning, but then those graces have to be responded to. And sin has consequences, broken relationships with God, broken relationships with others.  Don't hold back the truth. It is not kind or gracious to not tell them about hell. There was once a milk ad, I don't know if you remember this, where it's like you have flames in the background that are definitely depicting hell. And you've got someone with chocolate cake who is searching for milk.   For me, the two worst ways I can imagine of dying are drowning or burning.  Continually drowning in a lake of fire.   It's crucial truth people need to know. That's the bad news. And loving them is not withholding it from them, but the good news is that Jesus wants to forgive sin. He's provided for it. That's why he sent Christ out of love for us to restore us to a right relationship. And for those of us who are Catholic, the confessional door is open. Jesus wants us to seek forgiveness. My husband had a teaching with our kids that when they hit the teen years that they ever needed to go to confession, all they had to do was say, please find me a priest. They did not have to reveal why they needed to go to confession, but it was such a great insight. And confession restores us. The priest is ready to say the words of absolution if we ask. Step four, we need to give an invitation to respond. This is a moment of grace for deciding. How do we share as a Catholic?  Like, can we shorten it? How do we evangelize as Catholics? And I didn't hear a voice, but what kind of shot through my mind is, why don't you share the whole verse? Well, I used to use Revelation 320, but I used the first part because the second part didn't make any sense to me. Revelation 320 says, behold, I stand at the door and knock. If any man opens the door, sorry, here's my voice and opens the door. I will come into him and eat with him and he with me. And I thought, that is so weird. Like, I understand opening the door of my heart. Why are we talking about eating? So I didn't use that part of the verse. And as I thought about it, I thought my whole goal in sharing that verse was to try to describe to someone the intimacy that God wanted to have with them, that he wanted to come into their heart and make a dwelling place in which he reigned as king and Lord of their lives. And I realized in the church, we're talking about even more intimacy. He wants to come in not just as host, but as the feast himself. He wants to feed us his very self. That's the level of intimacy that God desires with us. And step five in sharing with others is we need to understand Jesus is not simply asking someone, will you accept me as your savior? He needs to be acknowledged as Lord. And this comes with the other other verses in his final words, Matthew 28, 18 to 20. Quoting, Jesus came and said to them, all authority in heaven and on earth has been given to me. Go therefore and make disciples of all nations, baptizing them in the name of the Father and of the Son and of the Holy Spirit, teaching them to observe all that I've commanded you. And lo, I'm with you always to the close of the age. We are called to go out and share the word so that people seek baptism and then we are to teach them everything Jesus commanded. We are not to hold back truth that seems inconvenient and goes against our, goes counter to our culture. Jesus promises his power, he has all authority. So there's nothing he lacks that he cannot grant us in terms of the power of the Holy Spirit to be able to do what he has called us to do. And he promises his presence, he's with us. This is again, not something I have to do on my own, but I pray, I've talked to my son who's a priest and I said, please wear your cassock out in public. Walk the blocks of the parish where God has assigned you. Meet the people, take possession of it. Let them know whether or not they're Catholic. If they ever have a need and you're walking by, they can stop you and ask you to pray for them. Be Jesus out in the public. We want to invite people to walk with us together with Jesus. Now that's how to become a contagious Catholic. Where should we be a contagious Catholic? We read in Acts 1-8, it's a Jerusalem, Judea, Samaria to the ends of the earth. How do we do that? Well, Jerusalem is beginning at home. It's our family, our extended family. This might be the toughest place. People in my home could probably fill out my confession list just as well as me. They know our weaknesses, but that's part of God's plan to help us grow in humility, right? Don't give up on your relatives who seem to have abandoned the faith or never embraced it. You have a natural love for them. Pray for their conversion. Look for opportunities to share. We realized at one point in time that we'd stop praying for Scott's father to ever come to faith. He'd actually gone from attending church sort of perfunctorily to deciding that that was sort of hypocritical. And when we had all these little tiny grandchildren, he stopped going to church and we would all go to church when we were visiting and he wouldn't go with us because he felt like that was more honest. And at one point we realized we need to pray for his conversion. We love him in a way that very few people in the world love him. We know the truth. He needs to know the Lord. And so we began to pray every single day for his conversion and it was years, but it did happen. It happened before he died and God brought him to himself. We can witness to the world as individuals through our marriages and family life as God establishes this civilization of love in our own homes. If we embrace a life of generous self-donating love, our families can testify to God's grace in the world. And then we can reflect this beautiful relationship between Christ and his church. Just being able to share when someone says, oh, do you have grandchildren? How many? Now it's not a numbers game and there will always be people who have more. But what a joy to be able to say 21. One person said, do you even know all their names? I'm like first name, middle names, birth date and I can tell you their age. These are some of the most precious people in the world to me. In our families, we share the faith the way Jesus did through our words and through our deeds. We baptize our children, we cataclysm, we teach the faith and we continually challenge them to choose Christ. We share our own ongoing conversion moments and we let them share theirs. We expect faith, we look for signs of faith and we celebrate faith. Now sometimes we can miss what God's doing in their little hearts. We had an experience when our oldest son was five, Michael was five, Gabriel was three and Hannah was about maybe six months. We heard that there was a bad weather report and so we went down to the basement and sure enough a tornado came very close to our area to actually destroy the tent that was set up for graduation back in Illinois. And so that was only a couple blocks away from us. Well, of course we were praying very fervently in the basement and then after that, it was a Saturday and we needed to get up to have our baths and get ready for mass the next day. So we're up there and I'm trying to get Michael undressed to go into his bath and he's like, it was just like, you know, it was like the Holy Spirit was coming and saying, open the doors, open the doors.  It's time to get ready. And all of a sudden he was still trying to explain it and Scott said, wait a minute, wait a minute, what are you saying, Michael? And he said, when I heard that sound, it was like the Holy Spirit was saying, open the doors, open the doors of your heart. And Scott said, I'm gonna talk to Michael for a minute. You go ahead and baby other kids. How cool is that? That God is touching the heart of one of our children and using the sound, the fear, the prayer to make a very personal call to him. And there are many little conversion moments like that. We need to have eyes to see what they are. Dr. James Dobson was playing with a very, paying basketball with a very famous basketball player. His name was Pistol Pete Marovitch. And he said to him at one point, how are you feeling? And he goes, great. And he died of a heart attack the next moment. Literally fell on the floor, not able to be revived. And he shared with his radio audience when he came home, he just really embraced each one of his children. And he said, it's so important that we know where we are with God so that we can be in heaven together forever. And so Scott, who always said a little blessing over the children, adjusted it. And he added that little element. And I wrote it out and let's see if I can find it. Well, okay, may the blessing of Almighty God, the Father, Son and Holy Spirit be with you now and forever till we're in heaven together. And he still, I recently, our son who's almost 40, was leaving with his family and he asked Scott to pray over him in this blessing.  Likewise, pray over their children every single night, that prayer of blessing. A homeschooling family who suffered a terrible loss of a four-year-old who drowned, their son Peter, said this to me, we didn't have time to teach him math facts, but he knew his prayers. We know where he is. We need to be heavenly-minded enough to be earthly good. St. John Paul II said, quote, the faith-filled witness of Christian families is an essential element in the new evangelization to which the Holy Spirit is calling the church in our time, end quote. What's Judea? That's Jerusalem is our home, Judea. Surrounding area, friends, neighbors, fellow parishioners. We're called individually to be evangelized and to re-evangelize those within the church who are not faithful and then to reach out. Can we invite people back to mass on this side of COVID? Let's pray for a growing hunger for our Lord. I think many, many Catholics, I know we did, sitting there watching mass on TV, you just felt the divine absence, you know, not being with Jesus. And wow, when we were able to return, to be close to him, to receive him. It is such a gift. And we need to find the way to reach out and draw them back in, you know? Pick a Sunday, you've got donuts, bribes work, you know? Just, hey, join us for mass and we'll have donuts and coffee afterwards. I wanna give you one example of someone who really challenged me on this. Her name is Susie. She and her family moved to a new neighborhood and she decided to go around her cul-de-sac and introduce herself to all the families. She made sure that she mentioned she was a Catholic. Many of them had a Catholic background. She began to invite them to come with her to mass or she would drop off a confession schedule, information about confirmation classes. If they weren't married yet, when the pre-Kana classes were gonna happen or if their children weren't baptized when baptisms would happen and many of them responded in two years out of four of the homes, these were the results. Wife confirmed, two kids baptized, husband received first communion and confirmation. Number two, first baptized adult and then he received first communion and two children were baptized. Number three, two children received first communion. Number four, two children received first communion and their parents' marriage was blessed. That's one woman, one cul-de-sac, four homes. What holds us back? Have we not received the pearl of great price? Have we not been set free, liberated from the bondage of sin and death? What holds us back? I'm at a priest who was assigned to a new parish up in Minnesota. He was Hispanic, he was fluent in Spanish, there was a large Hispanic community there and he had a lot of anticipation as he went to have his first mass. 14 people showed up.  Can I bless your marriage? Have your babies been baptized? Has everyone been confirmed? And he said, three years later, there were 1,400 at mass. Praise God, praise God. And Archbishop mentioned in a small group of us that were gathered around that he's about to close 50 churches. And I said, I think there's another solution. And he looked at me like, who are you? But I thought I'm just gonna say it. I'm just gonna plant the seed. I said, we can evangelize the baptized. We can go through our roles and everyone who isn't attending mass, go and knock on their door and invite them to come back and let them know that they're missed. Then we can evangelize all of those who are not Catholic. And I said, and then we can teach faithfully, open this to life and fill the pews with large families. I said, well, we can do those things but I'm still gonna close 50 parishes. How many of you are God parents?  It's good that you pray for them but are you sharing with them? Are you challenging them? Jesus said, love one another as I have loved you. And they will know we are Christians by our love, our love for each other. Are we witnessing to that? And then we're to be as witnesses in Samaria, to our countrymen, our fellow citizens. As lay people, we have many avenues for witnessing to the gospel, especially as we are faithful in carrying out our duties in our families and in the workplace. In our culture, we defend the poor from injustice and we work for respect for all life from preborn to elderly. We're to evangelize our culture. We are to speak the truth in love. All law expresses someone's morality. We need to have it line up with truth. Romans 13 once says, let every person be subject to the governing authorities for there's no authority except from God and those that exist have been instituted by God. If we have good leaders, we thank God for them. And when we have lousy leaders, we pray for them. We bear under the hardships and we work for better leaders and we pray that God will change their hearts. We can be subject and still share wisdom. The mayor of Steubenville, the whole time he has been mayor has asked us to have prayer before we officially start the council. So no one can fault us. It's all volunteer. It's not part of the meeting. And yet he asks either pastors or he has asked every member of council to lead in prayer. I've led numerous times and I'll quote a scripture first. I'll lead us in prayer. And then he always asks us to lead into our father. And so we are all praying together. It's powerful. James 3, 17 and 18 says, quote, but the wisdom from above is first pure and then peaceable, gentle, open to reason, full of mercy and good fruits without uncertainty or insincerity. And the harvest of righteousness is sown in peace by those who make peace, end quote. And we need that wisdom and grace and peace at our city council, at the state legislature, in Congress and around the world. Steubenville is known for our nutcrackers. I don't know if you've heard this, but in the last few years, we have developed something 150 nutcrackers that are six feet tall and it's a beautiful sort of outdoor display of art. And I won't get into more detail, but during COVID, we weren't sure what could happen. And they decided to put half of them on 4th street and half down at the fort, kind of really spaced out so that people could still enjoy them. I got a call from someone who was very upset. He said, I wanna know who's going along and spraying down the nutcrackers after people touch them?  Keep spacing between families and our police watching? And I said, you know, we're going to allow for personal responsibility here and we're putting them on 4th street. So if all you can do to enjoy them is to drive slowly by, we hope you'll do that. But I said, no, no, we're not. He said, this is just irresponsible. And I said, you know, there are worse things than dying. And he was like, what? I said, dying outside a state of grace and none of us have to do that. And there was this pause that I could tell he was thinking, I am talking to my counsel woman, right? But why not say the truth? The worst thing that can happen is not death. It is death apart from Christ. We can't remain uninvolved in the affairs of culture in which God has placed us. A lot of pre-evangelization is needed. If we can't even talk about being a man or a woman, a girl or a boy, how can we talk about being a son or daughter of God? God created each one of us. He did not make a mistake. Our world is languishing for lack of truth. And we've got to find the loving way to deliver it. Proverbs 3.27 says, do not withhold good when it is in your power to do it. So as citizens of our state, we have to find the way to do good, to take part in a powerful way. Even if our culture turns away from God, we still play a vital role in our prayers. 2 Chronicles 7.14, quote, if my people who are called by my name humble themselves and pray and seek my face and turn from their wicked ways, then I will hear from heaven and will forgive their sin and heal their land, unquote. That doesn't say 100% of Americans. That says, if my people, we can effect change through our humble prayer, confessing sin and asking for forgiveness. And then finally, to the ends of the earth, do we care that beautiful Christians do not know the fullness of the faith in the Catholic church? Truth Jesus wants them to have. Grace, he knows they need to live the Christian life to the fullest. Do we care that some Catholics have wandered out of the church and need to be restored? Do we care that many people in the world do not know Christ? We've got to become mission-minded and to inspire our children to be mission-minded, to read the lives of the saints who were missionaries, to find out about effective orthodox missions and support them, to contribute to the Franciscan mission trips or to mission trips done by focus. Scott said, how do you wanna celebrate our 25th wedding anniversary? I said, could we do a mission trip? He's thinking. I said, look, our children aren't engaged, they're not connected to anybody else. This is the perfect time to take our whole family and let's build a house in Tijuana. And so we paid for all the materials and all the flight for ourselves and two workers who really knew how to do all of this. And we built a very simple house, a very simple structure. And when we gave the keys to this little two-bedroom home that had no running water, had no bathroom, it was just two rooms. The mother of the family, she couldn't speak English, I couldn't speak Spanish, but tears were just running down her face in thanking us for a home that they never would have had. And we found out 12 people were going to move in. It was an amazing experience. What weakens or destroys our witness? Life out of home, sorry, home life when our walk isn't lining up with our talk, okay? We can't be overly spiritual. We need to be the same at home. And we need to ask forgiveness when we're not. Synicism about the church, watch your talk.  If something is set at mass that you do need to clarify for your children, do so, and then lead your family in prayer for your priest. You want a better priest, pray for your priest. Not just a new one, pray for him. Three, imbalance. Proving we're right versus the truth in love. Make love our aim. Four, ingratitude for all the grace we've received. All the grace. Five, uncontrolled children. We need to know how to parent because that can really hurt our witness. And we've got to watch the influences of secular education, of television, of culture. They will still make their own choices, but we need to be engaged parents for our whole lives. Our whole lives. Number six, cafeteria Catholicism. It weakens our witness when we decide that we will be the magisterium. I like the church's teaching on this and this. I don't like the church's teaching on this and this.  He has placed you in the heart of the church and our hearts are to say, Lord show me the way and to respond. What strengthens our witness? Grace. Grace is available. I need to get to confession more often. It's not very convenient. Isn't that ridiculous? I remember how much I longed to be able to go to confession during the COVID months. And now I find, oh, I'm not even thinking about it. So that's my commitment to you. I'm gonna get to confession more often. Eucharist, draw close to Jesus' heart and ask Him, give me your love for my neighbor. Give me your love for my child, my grandchild, my husband, my wife. As beloved sons and daughters of our heavenly Father, we're members of Christ and His body, the church and temples of the Holy Spirit. So we need to learn the faith, to live the faith, to love the faith and to share the faith. This is our time. In the great providence of God, this is the century in which we have been born. These are the relationships God has given us. And we need to say not, why now? Why is this falling apart? This is so hard. It's what do you want me to do, Lord? And I will do it, just like Ted said. Mary's response, be it done unto me according to your will. He's already promised us His power and His presence. And He will give us the grace. So as you go forth today, after we have this wonderful mass that will again give us even more grace, I hope and pray that your heart will say, Lord, who do you want me to share with about you? Who needs to know you? Our world is dying to know Christ. And so let's return home to our families and our neighborhoods, our parishes, our workplaces, our towns and states and countries and be the salt in life that our Lord has called us to be. And by the grace of God, He will do this work in us and He'll do it through us. Let's close in prayer. In the name of the Father and Son and Holy Spirit, amen. Oh, dear Lord Jesus, I thank you for your mercy that has touched our hearts and drawn us so close to you. As your beloved sons and daughters, you have loved us, created us and redeemed us. And it's too good to keep to ourselves, Jesus. Please help us to imitate your son by proclaiming good news to the poor. Give us eyes to see those around us and the courage by your Holy Spirit to say what you want us to say. We pray this in the precious name of Jesus, amen, amen.