Hi, I am Gustavo Ortiz with CaloES, following the January 2024 storms that recovery efforts continue in San Diego County. CaloES had led those efforts to respond to and recover from these widespread storm impacts. People living in San Diego County who sustain losses still have time to register online at disasterassistant.gov using the FEMA application on your smartphone or calling<PHONE_NUMBER> or visiting the two disaster recovery centers open right now in San Diego County. And as we recognize woman's history month, you will hear through the list as campaign preparedness tips from women across the state, like Calvin Secretary Lindsey Seen, who during her eight years in the Navy, learned the importance to always be ready for any disaster. Finally, a spring season is here and the California Governor's Office of Emergency Services wants to ensure you are taking steps to stay safe as you head outside. Enjoy the sunshine, but remember to be prepared for changing conditions. To see more from us, please visit news.caloes.ca.gov and follow us on all our social media channels.


Thank you so much for joining us today for Top 10 Tactical Tips for Giving Tuesday. My name is Becky Wiegand and I'm glad to be your presenter for today's webinar. And your host, we are joined today by Robert Wu who is the CEO of Cosvox, a leading crowdfunding platform for nonprofits and social good projects. He has raised over $200,000 for his own social good crowdfunding projects and his work has been recognized by The New York Times, CNN, Forbes, and The Wall Street Journal. We're really glad to have him joining us. He's presented at places like the Nonprofit Technology Conference South by Southwest and the Clinton Global Initiative. So he will be sharing some of his expertise on what you can do to have a successful Giving Tuesday campaign for your organization this year. And you'll see on the back end joining us with Chat, Alibaz Deakin, TechSoup's interactive video, and Events Producer. She will be there to help you throughout. We are here at TechSoup's headquarters Rob is traveling right now so he's in a hotel room in Nevada joining us for this webinar. We're glad to have him there. Feel free to chat in to let us know from where you're joining today. While you do that, I'll do a quick introduction of TechSoup. We'll have some poll questions where we can gauge what you, our audience, have experienced with Giving Tuesday in the past, and what role you sort of will play in it. We'll have Rob go through his 10 tactical tips for planning and success of a Giving Tuesday campaign. We'll share some crowdfunding and additional resources and have time for Q&A. TechSoup is a global nonprofit with 63 partners worldwide serving 650,000 nonprofits in 121 countries. We are everywhere you see a dot on this map soon to be serving people in 194 countries within the next few months. So we're really excited to be everywhere in the world that's not embargoed. And we have served organizations with donation programs, technology grants, to the tune of nearly $5 billion. I'm proud to not only have been a TechSoup user before coming to TechSoup, but also TechSoup staffer. You can learn about our programs at TechSoup.org. So on to the topic of the day, what role are you in at your organization? And this is just to help give us and Rob a little bit of insight into are you coming at this from a position of being in the fundraising team or development person? Are you a decision maker, a leadership person at your org? Are you on the communications or marketing team? Or maybe you run the social media.  Or maybe you run programs for your organization and you are helping with fundraising as well. Are you joining us from a library today? Or perhaps you work in the administrative office. And of course like many small nonprofits, charities, nonprofits, libraries, churches, maybe you wear many hats at your organization. And if there's something I'm not including, go ahead and include it in the comments in the chat. I'll give just a few more seconds to allow everyone on the line to participate. We have about 100 people on right now. And then I will show the results. You should be seeing them once you click submit. You should be able to see those results moving around on your screens as well. I have some people commenting that they are the only staff person, another person commenting that they are on the fundraising committee. We realize you can't see the comments that are coming into the chat window. But if you have experience with Giving Tuesday or you have successes or things to avoid that you've had happen to you before and you want to share those, and we think that's valuable information, we'll also share that back out with the rest of our audience. Some folks are commenting that they are a nonprofit consultant. One person says they are an executive director. Another person comments Many Hats, mainly Library, Fundraising, and Admin. I'm going to go ahead and show the results. A third of you wear Many Hats to your organization which is not surprising. Having worked in small nonprofits, I've been in that same position of wearing Many Hats in many different roles. And almost another third are doing fundraising and development work. And another 20 are leadership and board. So that's helpful to know. Now have you participated in a Giving Tuesday campaign in the past? And we are kind of casting a wide net with this. Maybe your organization has not had a campaign but you've helped promote Giving Tuesday or you've donated to a Giving Tuesday campaign in the past. Go ahead and click on your screen and let us know. And again this is just a gauge of who's got which kind of expertise. If most of you have not, then maybe we'll spend a little more time covering some of the basics. And if most of you have then that would change our results. So 65% have not participated in Giving Tuesday in the past. So we are happy to have you on and hope to help you plan a campaign that can help your organization earn some great new funding for the end of your campaigns. Last question, are you looking for a fundraising platform? Now before you click on this just know that if you are that we will share your information with Rob and Cosbox for a one-time email that they can send to you to ask if you'd like to opt in for more information. If you're not, that's okay too. But go ahead and click on the screen and we don't like to share anybody's information without having your explicit permission. And even if we do share your info you would get a one-time email to say, here's some information about Cosbox. Let us know if you'd like to subscribe to get more. And Cosbox is a donor partner of TechSoups and I'll talk a little bit briefly at the very end of the webinar about the offer that they make for nonprofits and libraries. It's available to you for their fundraising platform. So just a couple more seconds and I will show the results here. And then we'll move on to having Rob take us through his Top 10 Tactical Tips. So thank you for responding to that. And let me go ahead and just pop us into Rob's slides and welcome him to the program. Thank you so much Rob for sharing your expertise today. We're really glad to have you on. And as somebody who has really personally run a lot of successful campaigns and online campaigns especially, but also been involved in Giving Tuesday and helping other organizations do so, we're really happy to have you joining us. Welcome to the program. Thanks Becky. Thanks so much for the intro. So really excited today just to share with you guys more about Giving Tuesday. As Becky said, a lot of the insights that I'm going to share today are from my own crowdfunding experience, raising funds not only for nonprofits, but also for good projects. But also looking at the 35,000, 40,000 campaigns on our platform and seeing what they do for crowdfunding and online fundraising as well as what they do for Giving Tuesday. So with that we came up with 10 tactical tips. So really excited to share with you so you guys can really get started with Giving Tuesday this year as well as to make it a success. So Becky had a great intro. My name is Rob Woo. I'm the CEO of Cosvox. Cosvox is a crowdfunding platform as well as a peer-to-peer fundraising platform for nonprofits and social good projects. And nonprofits use our online software to easily create fundraising websites. And then they use these fundraising websites for crowdfunding campaigns, donation pages, and peer-to-peer fundraising campaigns. Our platform features very easy customization. So a lot of you are small nonprofits or wear many hats. So you can easily change the look and feel of your campaign site without needing to know how to code as well as without an IT team. So it's really built for a small nonprofit or a small library so you can have a powerful enterprise-level tool with a price point that doesn't really break the bank. But even though we are an online software, we like to say that we're more than that. At Cosvox we help organizations that do even more good in the world from saving abandoned babies to educating kids in Africa to protecting the environment.  Our whole goal is to have you guys spend less time on fundraising and tech so that you can spend more time on your mission. At the end of the day, we're not just about helping people raise funds, we're about helping people do good things and have those good things flourished. So let's jump into it. I do apologize that some of the text on our slide today is a little wonky. It's mainly from the fonts being used. If you do have trouble with PowerPoint that is being provided, feel free to let us know and we'll be happy to help you get that clarified. So what is Giving Tuesday? It sounds like all of you are interested in learning about Giving Tuesday. Around 70% of you haven't launched the campaign before, 30% of you have had or participated. So this will be a great overview section of what Giving Tuesday is. So Giving Tuesday, what it is, is three years ago the 92nd Street Y in New York City and the United Nations Foundation were trying to figure out how they can bring back the spirit of the holiday season and really cut through the noise of retail, of Black Friday, of the post Thanksgiving's push that retail stores have. So they created Giving Tuesday which is a one-day annual movement focused on charitable giving. So in three years, as Giving Tuesday has been around, the campaign has engaged more than 30,000 organizations all around the world and raised more than $45 million among nonprofits worldwide. And last year, collective reporting from a segment showed that around 36% showed increased 36% of online giving compared to previous year and a 63% increase in total donations. So Giving Tuesday has been growing like crazy and it's wonderful that you guys are here today just to learn a little bit more. So from the high level, we seem like a lot of success in Giving Tuesday but for more of the nonprofit level, we seem like a lot of great successes as well. For example, the National Domestic Violence Hotline, they're a small nonprofit based in Austin. What they do is they fight against domestic violence through calls and chats and services that they provide to people. So last year, they launched a campaign on Cosvox which is what you see on the screen and they raised over $52,000 for some of their services and programs. From a smaller level, we've also seen some success too. From a first-time nonprofit, Great 2K, what they've done is last year for Giving Tuesday, their whole goal was to set a $5,000 goal for Giving Tuesday but at the end of it, they doubled that and raised more than $10,000 through Giving Tuesday. So it's been a lot of great success from organizations that are well-known, organizations that are not well-known, organizations that are small, and those organizations of all shapes and sizes. But in order to do Giving Tuesday correctly, in order to really see this success, there come some challenges. Some of you might be thinking, how do I really start a Giving Tuesday campaign based on the poll that Becky provided? Around 70% of you are probably asking that since you haven't done a Giving Tuesday campaign before. For others of you are saying, hey, we've done a Giving Tuesday campaign in the past and we really need to take our Giving Tuesday campaign to the next level. So you're trying to really take it from point A to point B to increase how much you raise, increase your impact, and increase how you guys really run the campaign. As well as some of you might be asking, hey, we're a small nonprofit or we're a small library and we don't have a lot of resources. I wear mini-hats and I don't really focus my time so I can really cut through the noise. Well, I'm glad that some of you might be asking those questions because today we're going to go over the 10 tactical tips that you can do right now in order to really make Giving Tuesday a success this year. Just moving forward a little bit, before we dive into the 10 tactical tips, I know that I may be a little short on time so I do apologize if I speed through things. We will pause in the middle after tip 5 to ask you guys if you have any questions as well as we'll have some time at the end for any questions that you have. We have some free resources too that I want to give out in the beginning since I know that some of you may not be able to stay the whole hour. The first one is we have a Giving Tuesday resource center. It's Cosvox.com slash Giving Tuesday resources basically has a free e-book on how you plan a Giving Tuesday campaign weekly tips that you can subscribe to as well as a weekly newsletter that you can subscribe to as well. Plus, we'll be launching a video series on Giving Tuesday tips. All of this is free so feel free to take a visit if you have a chance. So let's dive into it. So tip 1 for the top 10 tips. Tip 1 would be to set an impact metric. So what is an impact metric? So a lot of times when we're running a fundraising campaign or crowdfunding campaign we get to evolve in how much we need to raise, like the dollars. What we've seen is that when people run and order a campaign on Cosvox at least a lot of the donors don't really care about how much you're being raised. They really care about what the impact is that you will have through your campaign. So one thing that we encourage all organizations to do is to rethink the perspective that they have on their campaign to shift it from raising a certain amount of dollars to move towards a certain amount of impact. So for example, World Bicycle Relief. This is a nonprofit base in Colorado. And what they do is provide bikes to people in the developing country so that they can get to school faster so that they can get to work faster. And they found that it costs around $100, $150 to provide one bike to one person. So instead of saying we need to raise half a million dollars, such as in this screenshot they're saying we want to count the number of impact that we're having as part of our campaign. So for their fundraising campaign for every $150 if donated then it will count an additional unit of impact. You can actually take this unit of impact and then set a goal. And then people that support you, board members, supporters, and donors can actually take a look at that and say hey, I want to support three bikes or five bikes as a way for them to donate. Another example, we have Team Christian over here. This is just a social good project that someone created for the neighbor to raise funds for medical expenses. And they did the same thing too. So for them they were trying to aim for physical therapy sessions for the young child that needed it. And they set a goal, they set an impact metric and then the impact metric really counts the impact that they've been having. So for you guys in order to set an impact metric there's three easy steps. So the first step would be to identify the unit. So figure out what is the unit of impact that you want to create. If you're a library it could be the number of books that you want to provide. If you're a clean water organization it could be the number of wells that you want to dig. If you're a research organization it could be the number of reports that you want to create or the number of tests or trials or studies that can be created through the funds, through the campaign. The second step would be to determine the unit cost. So the unit cost is the amount of money it takes to actually service one unit of impact. So if you're a library it could be $5 per book. If you're an organization serving students and kids it could be $50 for a project or program. Or if you're doing clean water it could be $25 to serve clean water to one family in the community. So figure out what is the actual cost it takes. And what you can do is you can ask your program manager or your project manager for the budget that they have and then really figure out what is the impact that they've had in the past year and then do a simple math which is cost divided by impact will equal the unit impact. And then the last step for your Giving Tuesday campaign would be to calculate the goal. The goal would take the unit cost times a certain number of impact that you want to create to actually have the goal that you can create for the Giving Tuesday campaign. Alright, so that's the impact metric. The second tip would be to use peer-to-peer fundraising. So peer-to-peer fundraising is a method of fundraising that leverages your supporters to fundraise on your behalf. What it does is let's say you have volunteers, supporters, board members, and even staff. You can get them to create a personal crowdfunding page or personal fundraising page that is part of your Giving Tuesday campaign. And then what they'll do is they'll send out that personal page to their friends and family through their own social networks, social media, or email to really drive traffic and donations to your campaign site. One of the key benefits that we've seen is that when we use peer-to-peer fundraising, the campaigns on our platform raise twice as much as the regular campaigns without peer-to-peer fundraising. So it's a great way to not only extend your reach, but also to drive more traffic and awareness about your campaign. One of the things that's also really beneficial from peer-to-peer fundraising is that it allows people to share stories that are highly personalized. So how it looks like more visibly is on the screen you see a Giving Tuesday campaign from Project Renewal. Project Renewal is a charity based in New York City. And what they do is they help the homeless get off the streets. So this is Martha. She's on staff with Project Renewal. And she created a personal fundraising page under the Project Renewal Giving Tuesday campaign site on Coswalks and set a goal of $1,000. And you can see that she raised three times as much last year. You can also see the impact that she's been having as a result of the $3,000 being raised. So you can use these pages as a way to get people to take more ownership of the Giving Tuesday campaign. So you're not just relying on your own email list or your own Facebook page that you can really leverage the people that know about your organization to become amplifiers and advocates for you guys. When you look at the campaign site, there's also built-in tools when people use personal fundraising pages like a leaderboard search tool. So it makes it really fun and easy for people to participate as well. But doing peer-to-peer fundraising isn't just throwing up a campaign site and asking people to join. You also have to shift your perspective too. So if you choose to use peer-to-peer fundraising, one of the things that you should think about is to become a coach rather than a fundraiser. So what this means is really empowering your fundraisers to go out there and solicit for donations. And we call that creating a toolkit. So creating one sheet of logos and social media tips that they can have in order to really go out there and raise funds for you guys. Also one of the cool things that we've seen is that on average, when people raise funds on personal fundraising pages, they tend to raise around $500 to $600 per page. So if you think about how many people can get signed up, multiplied by a data amount, then you can kind of see how many donations and the level of donations that you'll get from using peer-to-peer fundraising. All right. Speeding along, tip number three for giving to use is to create a campaign-specific Facebook page. So this tip is all about creating a community. One of the hardest parts of giving to use is to really quote-unquote own the airwaves to cut through the noise to really get your story and your message into the eyes and ears of the people that need to hear. And one of the hardest parts is that a lot of us are small nonprofits. I ran a small nonprofit for about four years before Cosmox.  You might have a couple thousand Facebook likes, maybe just a couple thousand like Twitter followers, and a couple thousand people on an email list. So it's really hard to get your message across to a wide audience. One of the things you can do is to really focus on a core group of community. So for example, there's a campaign on Cosmox that recently ended not too long ago called Moxtropolis. It has a very unique feel to it. Basically it was started by this board game company in Seattle. And they got their community involved in a gaming tournament where companies and individuals will compete as part of a board game tournament. And then they were raised funds for a nonprofit called HopeLink based in Washington. So they were able to raise three times as much as the original goal, mainly because they focused so much on building community before they even launched a campaign. So what they did is they created a campaign-specific Facebook page. So this is in addition to the existing Facebook page where they can get people who are very vested into the success of the campaign and the people that are very passionate about the cause to really join the Facebook page so that they can have a way to not only see who is joining, but also to see the demographics behind the people that are very highly interested. When you get people to join a campaign-specific Facebook page, they have a couple of benefits too. The first one being that you get access to Facebook Insights which is a really handy and free tool so you can see the demographics of people who like that page, the people who support that page, as well as you're able to leverage their audience as well. If you decide to use Facebook ads or Boost posts, then the people that like your campaign-specific page become conduits for you to access their friends and family networks on Facebook. So it's a great way just to spread out the message really easily. And the last benefit too is that it provides a very easy watering hole so that people can get information and get stories about your campaign so they can ensure that with their own social networks as well. Now, if you don't have the time or bandwidth to create a campaign-specific Facebook page, what you can do is find alternatives to your watering holes. The first one is an email list. This is very, very simple. So this is kind of the thing that you should do if you don't have the time to do anything else, which is basically to create an email list. You can do this in Excel. You can do this in your own Outlook or Gmail accounts, and then to basically tell people that a part of the community to join the list. The second alternative that you can do is to create a Facebook group or a Google group. A Facebook group is basically a campaign-specific Facebook page but more focused on the people within your own social networks. So it's a lot easier to manage because more of a discussion community. A Google group is about the same thing. People can join through email so they can get updates about what's been going on as part of the campaign. And lastly, if you are looking for something more robust where people can have discussions and have resources and files and articles and things like that, then you can create a Basecamp. Basecamp is a free online tool. It's a project management tool but you can also use it for discussions, like a file repository so you can have and store those campaign toolkits that you give to your peer-to-peer fundraisers. Tip four is to have a call to action. So there was a recent study that I read about. It basically looked at two groups of college students. The first group, there were people that were rated by their peers as being generous. The second group were people that were rated by their peers as not being generous. And what they did is they gave a fundraising appeal to the groups. And for a group that wasn't rated as generous, they gave them a fundraising appeal that has specific instructions on what they should do to support the organization. And studies show that the group that was given the specific steps to support the organization ended up supporting the organization more than the group that was determined as generous. So what that really means is that when you have a call to action, when you have an onboarding or an on-ramp, then people would tend to complete the action a lot more. So onboarding can really yield more results. So let's take a look at an example. So never thirst their charity on CauseWox that run a lot of crowdfunding campaigns. If you look at this Facebook post, I kind of edited it a little bit. What it says is, what if you knew every dollar you gave matched? Every dollar given towards Watt for Water unlocks one for the same amount of up to $155,000. And it shows an image of their cause. And that's great, right? You can react to the image. You can react to the text. And it's a great story to share. But this story isn't as effective as if you look at, for example, if we put in just a call to action and on-ramp. And then we say, hey, you can turn a $25 gift into $50. What do you give today?  Chances are that the people who see this second post with an on-ramp with a call to action would actually click on it and complete the action rather than the first example that I showed you. So in order to create a call to action, there's a framework that we can follow. It's super simple. The first one is you define the calling. The calling is basically your cause, your mission, the purpose of your campaign. Is it to educate, to provide clean water, to do advocacy or research? What is the reason that you guys exist as an organization? And then the second step would be to put into action. What do you want people to do? This is typically like a verb. It's either to share, to donate, or to fundraise. This is the typical three that we see as part of Giving Tuesday campaigns. So what you can do is you can match some type of statement about your impact or the problem or the solution that you guys have, match that with an action that you want people to take, and that can be your call to action. All right. Speeding along, tip number five is to create a unique hashtag. So some of you might not know what a hashtag is, so let's talk about that first. A hashtag is basically a pound symbol. I still call it a pound because that's how I grew up, understanding what a hashtag is. It's used to mark keywords or topics in a tweet. And it was created by Twitter to really organize messages, organize tweets because there are a lot of things going on. So not only can you use hashtags now for Twitter, you can use hashtags for Facebook, for Instagram, as well as a lot of other social media channels. A hashtag in another word is basically a way for you to tag a post so that it becomes very searchable. And for example, Shower Strikes their campaign on Coswalks that provides clean water to communities in Africa. And what you see here is a Twitter feed of a Twitter search of the Shower Strike hashtag. So what they do is they ask people to include a hashtag in all their posts, so it provides a way for them to not only organize the different conversations going on on Twitter as well as Facebook, but also allows them to engage with the posts that people are posting. So for Giving Tuesday, even though you guys might be using the Giving Tuesday hashtag, you should also create one for your own so you can easily organize and look at what people are talking about as part of your campaign. On Facebook, for example, Maria Shriver, she tagged her posts with the Shower Strike hashtag. So this is just to show you that hashtags are not limited to just Twitter. And one of the interesting things that we've seen is that when you do use hashtags, especially on social media, then you'll get more engagement. A study done by Buffer App said that tweets with hashtags receive twice as much engagement, twice as much favorites, or twice as much replies, or twice as much engagement because they use the hashtag, because people are able to really organize and see the hashtag posts. And the second interesting thing that I mentioned was that tweets with hashtags with one or two of them really receive more engagement. But then if you include more than that, then you actually see a drop in engagement. So what you don't want to do is you don't want to spam people with hashtags. Then it becomes something that's not really relevant and becomes really, really just noise. So what we encourage you guys to do is to use one or two hashtags in your social media posts on Facebook and Twitter. So some tips. So in order to create a hashtag for your own Giving Tuesday campaign, you have to have three basic savings. The first one being that your hashtag must be unique. So the worst thing you want to do is you come up with a great hashtag when someone else is using it for their own campaign or some other organization has been using it in the past. If you do see that, then it becomes not unique, so it becomes very difficult to really see for you to see which messages are relevant. So what you can do is you can search on Twitter or use a tool such as hashtag If I Me to really see if a hashtag is being used. The second tip is to be relevant. So for example, in Shower Strike, the whole campaign is about people not taking showers and raising funds and doing that activity. So they call it a Shower Strike. And it becomes really relevant to the campaign and organization. So you want to figure out a hashtag that is reflective of what you guys do as a nonprofit. And lastly, to keep it short, especially on Twitter, because Twitter is limited to 140 characters. If you have a hashtag that maybe let's say it's called Giving Tuesday Clean Water 2015, then you're basically taking away half of what someone can actually tweet in a message. So you want to be able to shorten your hashtag as much as possible. So it leaves room for not only you, but also your supporters and the people know about you to include messages in their social media posts. So we're at tip 6, and I just want to pause right here and hand it back to Becky for a short break for questions. Thanks so much for that, Rob. Lots of great tips coming in. And we have quite a few questions in queue. One, just to clarify quickly, the fundraising pages that you were showing some screenshots of earlier, are those built on Cosvox or are they built on Giving Tuesday's website or someplace else or a variety of places? Can you clarify where those live? Yeah, that's a great question. So the screenshots that I'm showing you today are presumably from campaigns on Cosvox, just because I know about the campaigns, I know about the charities and the great work they're doing. So for the personal fundraising pages, that one is a campaign on Cosvox. Giving Tuesday, they're more of a resource, so they don't provide a software or a platform for you to launch a Giving Tuesday campaign. So if you guys are interested, you can check out Cosvox as a handy tool. Great, and we will talk a little bit about tools and resources to find tools, Cosvox included, and others beyond that as well later on too. We had another question. Barry asks, I'm confused. For his recommendation to create a specific Facebook page for each Giving Tuesday campaign, does that mean you'd be starting from scratch with your audience? Should you be creating a website landing page instead? How do you capture your audience if you're creating a fully new page if you run a very specific campaign for Giving Tuesday on Facebook? Do you have to rebuild that whole audience? Yeah, that's a great question. One point about creating a campaign specific page on Facebook is really geared towards finding out who are your core group of supporters on Facebook or the core group of supporters for a campaign and having them have a place where they can get resources, have conversations, as well as see specific stories. Your own existing organization Facebook page would be more general. So one thing that we do see people do is if they're running a campaign year after year, they'll just create one campaign specific page. For example, Shire Strike has a campaign specific Facebook page. But then as an organization, they have more of a broader organization page called Well Aware World. So when you have your own, you're able to just post messages that are relevant to the community for that campaign.  So what you can do is you can create a group instead, which is a lot easier, or you can just create an email list or even a landing page as well and then just use that. So it really depends on what your community really needs and providing them a tool and channel for them so their needs can be met. Great. And kind of piggybacking on that, Portia asks, would a Facebook event suffice in lieu of an entirely new Facebook page? I'm sure about events. Events, maybe. It depends on your campaign. The good thing about events is that you can invite your own social network. But as an organization with a Facebook page, it becomes a little more difficult. You can do that, but then you can post updates to it. But the whole point about creating a campaign specific Facebook page is so you can get insights. So within events, you only get insights about the people that are going to your event. But with a campaign specific Facebook page, you'll be able to see the age group that people are part of the page or how often they post, how many likes you're getting. You're also able to post Facebook ads, boosting posts so that you can get more awareness and get into the social networks of the people who like the page. Terrific. Well, we do have a lot more to get through in the next few minutes. So I want to move us forward. Don't worry if your question is in queue. We will still have hopefully a few minutes at the end to get to some more, and we'll be helping answer those in chat as well. So let's dive into tip number six. Thanks so much, Rob. Alright, tip number six. Let me speed it along. It looks like we have a lot of great questions, so I want to make sure we have enough time for that. So tip number six is to post the right type of content on social media. So if you ever looked at some of the insights that Facebook gives you, if you go to your Facebook page, then you may be a little disappointed because when we look at our own Cosmox Facebook page, even though we have a number of followers, only a small segment of them actually see the posts that we put on them. So those numbers can really shock you compared to how many followers you have or how many emails you have. And one of the things that we've seen is that the key to really winning social media is to post the right content, to post content that is really shareable. And we have a really interesting secret. And it's this. It's Pac-Man eating a pie. I'm not just kidding. It's a pie chart that shows you the percentages of what kind of posts that you need. So the first one is that the great majority of the posts should be in educational, entertaining, or aspiring. So the majority of your posts that you post on Facebook should be about perhaps an inspirational impact that someone that you serve has had or the benefit of your programs and projects or sharing photos and videos and images that are very inspirational. It can be also educational and educating an audience about what the problem is that you're trying to solve. And then the other 20% should be salesy. That's kind of what we call action-oriented Facebook posts like donate to my campaign or share this post or advocate or join our event. That 20% of which is just the minority of the whole percentage should be more about yourself. So for example, of an entertaining post, this is a project-aware foundation. They're a charity on Cosmox. They run a campaign called Finathon. And you'll notice that they use hashtag Finathon. And they created an entertaining post. And the post that says, from a shark, how can I keep my reputation as a blood thirsty killer when you just casually swim beside me? So their whole mission is to help protect the oceans. And one of the things is protecting sharks. So this is an entertaining post because what it does is there's not a sales component to it. There's not a call to action to donate or for people to kind of give something. It's something that is very interesting and educational. An example of another entertaining post is from World by School Release. This is a more of a testimonial story from a 13-year-old supporter. And it talks about what she's been doing as part of her support for World by School Release. So kind of entertaining doesn't always have to be humorous. It can be something inspirational. And then very lastly, an example of a salesy post. We've seen this a few slides ago. Basically something that is more about your campaign and your donations. So tip number seven is to practice social listening. Social listening is basically a fancy term created by ad agencies to communicate observing what goes on in social media. So one of the best ways to really figure out how to craft your messages or how to target an audience is basically just to search on Twitter to see what's going on. So one of the things you can do that's free is you can go to search.twitter.com. You can search for hashtag Giving Tuesday or you can search for some certain keywords about your organization or your organization name. So you can actually see what's been going on. As part of Giving Tuesday, this is really valuable because there's a lot of social media activity. So one of the things you want to do is to monitor the conversations that people are having about your organization. So not only can you engage back with them through replies, but also you can use that as testimonials or you can use that as inspiration to create additional content. You can also search on Facebook as well. So just go to Facebook.com, log into your account. Go to the search bar and see the same keywords or hashtags as you type into Twitter. And then you'll see a listing of different posts. So certain queries you should be thinking about. One is hashtags. So definitely search hashtags that are relevant to your campaign or your organization. The second one is to search your organization name to see who's been talking about you. And then lastly is to search for certain keywords. If you're into clean water, you'll probably want to search clean water. If you're into education, find certain keywords that are about that as well. So you can then start to find maybe there are other organizations using certain keywords. You can start participating and injecting yourself into that conversation. Tip number eight speeding along is to create and post content. So I want to share a few interesting stats with you. If you're really struggling with cutting through the noise, or if you really want to get more attention then tip number eight is really for you. So studies have shown that companies that blog get 55% more traffic. So if you post blog updates on a regular basis then you'll get 50% more traffic than before. And more traffic means more awareness and more awareness means more donations. 36 of consumers say that they share content primarily because it promotes causes or issues they care about. So this means that a third of all people are on Facebook and Twitter so that they can share your content, your posts. So what you need to do is to create amazing shareable content so a third of all of these people can promote your campaign. If you were to look at one example of why sharing posts with a born is let's say someone gives you a fundraising letter in the mail. Do you want to share that letter with your friends and family? Probably not. You want to share something that's inspirational something that you really feel passionate about. So that's why creating content is important. One of the advice that we got from our charities is called an agile approach to content creation. A lot of times people get hung up on how to create content. They say, hey, we need to create a month's worth of content. It has to be perfect. It has to have an iterative process. So the first step would be to populate content. Danielle Festa from Great2K says she creates a weaker content or even a half day of content such as social media posts or blog posts. Then she puts it out there. Then what she does is she reviews and monitors the content. She sees which Facebook posts or which Twitter posts or which blog posts get the most traffic and she adjusts her strategy. She says, okay, these three posts are gaining the most engagement. So then what I want to do is to create more of a similar type of content. So that's what you can do as well. Tip number nine. So we're almost done and we'll have some time for some questions. So tip number nine is to follow a storyline. So when you're creating a campaign it's not just about asking people to share or donate or to fundraise. It really is about telling a great and compelling story. So there's a few storylines from Hollywood that you can actually borrow from to really communicate the work that your organization does. So I want to share with you three of them. The first one is called Overcoming the Monster. This is a story when there is a hero and a protagonist and they set out to defeat a deadly force or antagonist that threatens his home or community. So you've probably seen this in a movie like Avengers who fight against the aliens and the heroes when they save New York. Everybody's happy. When it comes to a nonprofit Earth's Rights International they're a charity on Cosvox that raised funds through a campaign before and they raised over $24,000 because what they do is they fight against corporate rights abuses. So from oil companies abroad abusing the privileges or work environment, they fight against that. So what they did is they follow the same storyline of Overcoming the Monster.  Another storyline you can follow is called Rats of Riches, Order Rebirth. This is basically when there's a protagonist that starts out as poor and downtrodden but then they rise through the world through wealth status, love and more. So one of the movies that you guys have seen before probably is called Pursuited Happiness. This is one of the guys named Will Garner by Chris Garner played by Will Smith. He competes competitively for an internship for a full-time job to provide for his family. So he goes from living in a shelter to getting a high-paying job. This is kind of a story that you can use. Prodigal Newell, a chair that I mentioned before featured a story from a guy named Harry and for the Giving Tuesday campaign Harry spoke about how he was transformed from being homeless to getting a job and getting his own apartment. So it's a story about transformation. And then there's a campaign that raised over $73,000. The other storyline that you can follow is called The Quest. The Quest is when the protagonist and the campaign is set out to acquire an important object and reach a certain destination, but they encounter perils and overcome those hurdles along the way. So for example, you've probably seen this in a movie like Wizard of Oz when Dorothy is sent to us meets the Scarecrow, the Tin Man, the Lion, and then has to talk to you to Wizard to get back home. For example, we've seen this storyline used in the Gauntlet campaign when their journey is about raising funds for a nonprofit and they invite the community along in their journey to do that. And the last tip that we have is to use great tools. So there are three tools I want to share with you. The first one is Pablo. It's a free tool by Buffer. Buffer is a social media scheduling tool. And what you can do is you can easily create images that you can share on Twitter and Facebook. And what we've seen is that these images when you use them on social media tend to get more engagement. So it's a super easy way for you guys to create how you engage in content without having to hire a designer. The second tool that you can use is called Canva. This is another design tool. So you can create tool kits with this and create logos and images as well. It's free to use and they also have a nonprofit discount. And then lastly, to use CosWox. So we're a crowdfunding platform and peer-to-peer fundraising platform that you can easily use for your crowdfunding campaign or peer-to-peer fundraising campaign without needing to know how to code. And you can easily launch a Giving Tuesday campaign in minutes without having to hire an IT person or a designer. So it's a great way for you guys to raise funds and we have all the tools that you need including donation receipts, site settings, a site designer, personal financing data, all that stuff wrapped up into one tool. And very lastly, before I transition it back, Becky just want to put up our additional resources GivingTuesdayResources CosWox.com as well as you can find our weekly newsletter GTWeekly.CosWox.com to sign up for some tips. So Becky, we're going to kick it back to you. Thank you so much, Rob. I appreciate you zipping through all of that in time. Before I open up to full Q&A, I just want to go ahead and mention as I said I would do earlier just talk about some of the CosWox and crowdfunding resources available to you on TechSoup's website. We have techsoup.org slash CosWox is where you can find out about the CosWox donation program that substantially discounts their online fundraising and crowdfunding platform for a one-year impact plan subscription or a one-year pro-plan subscription. And you can find out more details about either of these and the eligibility restrictions at techsoup.org slash CosWox. And that is available to both nonprofits and libraries. So check that out if you're looking for a platform to use. We also have a bunch of resources that we've written and done webinars on in the past. So if you're looking at tools and you want to know which crowdfunding platform is best for your org and you want to use a platform that's out there, there are some free, low-cost ones. There are some that charge, most of them charge some type of processing fee which is charged by credit card companies and they may add on something to that so keep that in mind and do some comparisons. But we have resources we've created on both GivingTuesday and year-end fundraising strategies. We have crowdfunding specifically for libraries talking about which types of campaigns work for that community in particular, peer-to-peer fundraising, a lot of different content out here. And I know Allie also just shared out some resources on storytelling because we understand that storytelling is one of the best ways to reach your audience and help them really understand the heroes in your own community, in your own work and what will inspire people to want to open up their pocketbook and donate to your organization with their end-of-year giving. So again, I'm also just mentioning some other crowdfunding tools in our catalog. So again, the Classbox Pro plan and Impact plan. But we also have tools like Teespring which are available that if you want to try and sell t-shirts for your cause, if you want to have a storefront for your cause, these are also available through TechSoup's catalog as additional tools that you can use to help your constituents and supporters help you fundraise and support your cause. And I'm going to open up to the questions that we have in the queue and feel free to ask more. Continue the discussion in our digital engagement forum beyond this one hour that we're spending today. We have folks there that can help answer more questions for you and share their expertise and tips. And this is a great place for you to share your own. We'll include the link to that in the follow-up email. So diving into some of the questions in the queue, we had quite a few people early on that were asking about the how to set an impact metric. And so one person mentioned that they're an advocacy or research organization and you sort of addressed that in one of your answers. We also had somebody ask, well what if we provide multiple different services like we're a domestic violence agency and so we have a shelter, a hotline, permanent housing programs. How do you pick the best one to use or do you use multiple ones? What's your best advice for people when they try and develop impact metrics? Is it to just test it out and see what people respond to? And one other person had mentioned on the same vein that their work is more incremental where they're showing steps in a process and that's kind of the impact that they make is advancing through a process. How do you show the impact metric when your goals are a process rather than a final destination? Yeah, those are great questions. So with an impact metric, it can be tricky if the work that you're doing is more long term or the work that you're doing is more broader reaching. So one of the things about the impact metric that you can think about is to make it as specific as possible. So even though you might be in a process or you might have dozens of programs, you can have an impact metric for each one of them. And what you can do is when you launch a campaign for Giving Tuesday, let's say, a campaign overall for something else, you can have a specific impact metric for a specific campaign. So you don't have to use the same one over and over again. Now for Giving Tuesday, because it's a little more broad, what you can do is you can pick the one that people will most resonate with and the one that you need to raise funds for to use that as an impact metric. If you can't do that, then what I do recommend is to look at if there are any kind of proxy measures as a way for you to create your impact metric. So instead of directly saying, hey, you know, we're... each unit in fact is like a person or a bike or a day of housing. It could be more about perhaps a number of communities being helped or the number of reports being generated or the number of partnerships being created. So that can also work as well. But typically we see that the best functioning of that metrics are super specific related to the direct impact that you have as part of your work. Terrific. That answered a whole bunch of people's questions, hopefully, in brief before ending. I want to go ahead and wrap us up here since I recognize we are at the top of the hour and I know we started a couple of minutes late, but I'd like to invite you to join us for other upcoming webinars. And thank you so much, Rob, for sharing your 10 top tips and tactics for a successful Giving Tuesday. And we hope that people will take some of this and work through it for your own organization's needs. If you're not on a fundraising or development team and you do have those folks internally, a lot of times you're talking about your impact and every grant proposal that's written for your organization. So connecting with them if you're the social media or marketing person may help you identify some of those impact metrics as well that you can pull out and externalize for your audience when you're doing outreach. So let us know in the chat window what things you've learned today that you may take back and try and implement and work on for your Giving Campaigns this year and the end of your fundraising. Join us next week. We'll be talking about disaster-proofing your nonprofit or library technology. It is National Preparedness Month so we hope you'll join us to learn some key things you can do to better protect yourself and bounce back quicker in the event of any disaster, whether it's a natural disaster or a server that goes wrong or an employee that goes wrong, right? After that we'll also be talking with libraries specifically about device checkout and how to manage those mobile devices in your libraries. Then we'll have some time talking about getting started with grant writing and really making those grant requests sparkle. And this is a webinar that normally is an $89 charge to participate in directly with GrantStation's CEO. So join us for that one. It's a freebie and only available to those of you who attend live. And then we'll be talking about the world of donated and discounted technologies where we're bringing together TechSoup Independent Sector and Good360 to talk about all the different ways that you can access donations for your organizations and get discounts and donations that you deserve and need to serve your communities. So thank you all so much for joining us today. Thank you Rob for your time. Thank you Allie for helping on the back end. Join us at TechSoupGlobal, TechSoup.org on our Facebook and on our Twitter. And lastly I'd like to thank ReadyTalk for the use of their platform. They sponsor these webinars by providing this tool for us to use. And you can check out their donation program at TechSoup.org slash ReadyTalk. When you close out please take a moment to complete the post-event survey and let us know how we're doing and how we can continue to improve our webinar programming. Thank you everyone so much. Have a terrific day. Bye-bye.


Before we get started, is there anyone here from China? China? Anyone? Anyone speak Chinese? I know there's a lot of you, but you may not understand the way I'm asking it. The reason I'm asking is because we, Seth and I wrote a book on windows.net server security, and a translator from China just wrote to us and said that he's translated it to Chinese. And it's a pirated copy, so we encouraged him to, we said we put a link up for anyone that wants it. We'll forward you to him, and you can get a copy of this book in Chinese. Some of you, and if you want a free copy, get the Chinese version because you don't have to pay for it. And also this book is for sale at Loom Panics. We're going to be out there. If you want us to sign your copy, you can read it and then sell it on eBay for a small profit right after that. So you won't lose any money. By the way, the Goon staff just told me that I had to give this software, this hardware way up here. So we're going to ask a couple questions of you guys when we're done, and whoever gets it right will get this ancient decrepit equipment. We have no idea. He just said we're giving it away, but you're welcome to. It's doubtful that it will run.net server though, because the .net server takes a very high footprint. And for just some bookkeeping items, if we could get the next slide please. I'm Cyrus Bakari, and this is Seth Foggy. And for those of you that want the slides are available online, and they're also on the conference CD. So you guys should not have to take any notes at all. You can just relax and enjoy. And there's also a paper that goes along with this talk, because we don't have enough time to go into everything. So we went into more detail on the paper, and that's also available on your conference CD. So we encourage you guys to skim through that, or you can download it online, and we'll give you the URL again at the end. And we're also going to leave time for questions. We'll probably talk about 40, 45 minutes. And we're not going to be at the Dallas Con table, because our table was, last time we checked, piled high with refuse. So it's not very usable, but we're going to be at the Lumpan X table afterwards. Next slide. What is .NET server? Well, first of all, how many people here use Linux? There's your hand, everybody? Okay. So you're here to find X-Files probably. Who here uses... What evangelizes open source? Exactly. Evangelize open source. Who uses NT? Okay. Who uses Windows 2000? A lot of people. Is there anyone using .NET server yet? A few people. Well, then let me ask, does anyone here work for Microsoft? You don't have to reach your hand. That's not a smart thing to do here. Well, .NET server is the next version of Windows 2000. It has been... It's the enterprise operating system that's going to go head to head against Linux. Before you laugh, we're going to go into some more about the architecture. But it's basically Windows 2002 or 2003, if you want to think of it that way. It's been re-engineered from the Windows 2000 code base. And it's actually been delayed several times. And this is significant for our purposes. Because the latest word is that it's going to be expected out mid-2003. Although Microsoft recently retracted that in the last few days. And they said that it's probably going to be out at the end of this year or early 2003. And in fact, the release candidate, one, is going to be out in a couple weeks from what we've heard. It's out now. Okay, better go get it. And Microsoft most recently, the delays they've been saying is for security reasons. And it almost seems like Microsoft's become a little skittish. Because of all the exploits that have been found in their software. They keep pushing it back and pushing it back. And this is... Ultimately, it's going to reach a point where if it's in beta any longer, it's going to be obsolete before it's released. Next slide, please. We're going to just hit a very few of the points of .NET Server security. We're going to talk about some of the architecture and some of the policies surrounding .NET Server. Which we think are going to hurt Microsoft's perception of security even worse than it already is. We're going to talk about Windows product activation, Kerberos implementation, remote desktop and remote assistance vulnerabilities, and wireless support. And again, the policies. Next slide. Well, WPA is Windows product activation. And it is the default anti-piracy scheme of .NET Server. And this is actually first introduced in XP. And because of public outcry, Microsoft has been somewhat backing off from it. But it looks like they are going to ship it with .NET Server. Maybe they'll change their mind after our talk, but we doubt that. And there... Can anyone think of... Does anyone... Well, first of all, let me explain what it is. WPA... Well, let's get into that later. But there's some serious privacy concerns with WPA. And a lot of these center around the BSA or business software alliance. And who knows what the BSA is? That's good. A lot of you will know afterwards, after this talk where it is and will investigate it more. The BSA is the kind of the hired anti-piracy enforcers of Microsoft. And also, they work for other large organizations such as Adobe and Symantec. And what they do is they hunt down businesses that use pirated software and pressure them into paying a fine using various means. They're similar to the Canadian Alliance Against Software theft or CAST. Next slide. Well, the way Windows product activation or WPA works is when you install the operating system on your machine, it takes a hash based on the specifications of your unique machine. So it's a fingerprint for your individual box. And based on that, you obtain from Microsoft a activation key that will only let it work on that operating system. Otherwise, the OS will expire in two weeks. It'll lock and you won't be able to use it. It's been said that WPA phones home at intervals in the final release, but we haven't seen that yet, so we're not going to... We don't know for sure, but we'll have to watch it. One problem with this is if you change out enough hardware, the operating system again will lock, and this could be your production server or your backup server. And all of a sudden, you've got a locked operating system and you're stuck. You have to go through Microsoft, which if you read in the paper that's on your conference CD or online, we describe one administrator's nightmare when he tried to get WPA activated on his system. Can anyone think of any other software that uses something like WPA? Does anyone? It's Windows Media. It takes a hash of your... AutoCAD. AutoCAD? I don't know. XPE? XPE, definitely. That's where it's introduced. Pardon? Yeah, work. I don't know that one either. The Quark Express takes a hash and record as a hardware downloadable. So apparently Quark takes a hash and requires a hardware dongle, which is basically a hardware, almost like a key, except it's a protection algorithm that's hardware you have to buy, and it's usually very expensive for that. I believe that EI products actually do this also, but I've been too polite to reverse engineer them because they are our partners. But if anyone looks into that, let me know. Next. Some of the abuses of the business software alliance, and we've been talking about this for a couple of years now, but most people don't know about the BSA. The BSA are anti-piracy hired enforcers. They're supported financially by Microsoft to go chase you down. And there's been complaints of heavy-handed tactics that they use. And I'd talk about these in the paper some more, but for one thing, they'll hit your city with a radio campaign trying to get your employees to report you for using unlicensed software. Based on that, they can get a warrant and raid you, and they do it all the time. Or any kind of anonymous tip is enough for them to get a warrant. In Great Britain, it's been reported that they'll approach the company and say, we've put you on a list of violators or pirates on our website. If you want to get taken off, then you have to run our special software which scans your network drives for any licenses that have expired. Now, a lot of you laugh at this, but companies actually do this. They're so scared by the whole BSA spectacle that they voluntarily submit and end up paying hundreds of thousands of dollars just so they don't get exposed or raided by the BSA. In fact, the acronym BSA sounds like a federal agency. It's a three-letter acronym, and they show up in your office with suits and usually a police officer and a warrant, and you think it's a government agency. But the truth is you can just turn these guys away unless they've gotten to the step of getting a warrant. But most of the time, the companies will just roll over and say, okay, come in, audit us, give us a fine, we'll be happy to pay it, just don't report us, which is really silly, but it happens all the time. And in fact, the BSA themselves report that they've collected $75 million in this way so far. Now, if this kind of thing concerns you, the only site that I've seen that really gets into this that I've seen is stay-legal.org. You should check it out. There used to be an anti-BSA.org, but I haven't seen that up for a while now. Next slide. This is Kerberos, and this was actually drawn by a friend of mine for a book. And this is the three-headed dog that guards the entrance to Hades. It's also Cerberus in later mythology. And Kerberos was designed at MIT in the 1980s under the project Athena. Now, this is a review for most of you, but for those that don't know Kerberos, I might do a brief review. The project Athena tried to implement all three heads, which were authentication, authorization, and auditing. And in fact, later implementations, including Microsoft's, eventually got all three heads working. And it's been thought up until recently that Kerberos was pretty unbreakable. Next slide. And just to review the Kerberos authentication, if I can, I don't remember it myself.  First, you have to go through a key distribution center, or KDC, which is up in the upper left corner. And the client first has to request from the KDC a ticket granting ticket. And all domain controllers, by default, are KDCs. The KDC responds with a ticket granting service ticket. And when the client presents his TGT back, and based upon that ticket granting service, the client can finally access the server up in the right. And if mutual authentication is specified, the client can ask the server also to authenticate back to it. Next slide. Well, many of you have seen this. This is Frank O'Dwyer's show that there's a potential attack against Kerberos. And this doesn't work if you've used PKI or smart cards. But in our paper, we review some of the well-known attacks that have already been described against PKI and how to reverse engineer smart cards using hardware reverse engineering also. So I encourage you to look at that. But this method is to use, first you have to sniff a login session and capture that. Now, in Kerberos authentication, you use an encrypted timestamp and a cryptographic checksum using a key derived from the user's password. Next slide. Now, the timestamp that's used in a pre-authentication step, that first step one and two, which we showed between the client and KDC, the timestamp is ASCII encoded prior to encryption. And it looks like this. The timestamp looks like a year, month, day, hour, minutes, and seconds. And the RC4 key we know is derived from the user's password. Now, that timestamp is important for brute force cracking because O'Dwyer talks about how to theoretically build a point and click device password cracker that will work on this. Next slide. So how do you know with a brute force password cracker if you've got the right password? Well, because of this ASCII encoding, you can just decrypt, and if you see a string that looks like a timestamp, you're pretty sure that you've got the right password. So you don't have to go through the additional step each time of computing the processor expensive embedded cryptographic checksum to make sure you got it. Because if you get it something that looks like a timestamp and you're almost certainly right. Next slide. Now, Seth is going to talk a little bit about remote assistance. Has anyone used remote assistance yet? Yes, I'm not too many. Before I do this, I want to give away one of these things, and I'm going to ask this question again, and whoever acknowledges their answer the loudest will get this. Son, SparkStation 10, who works for Microsoft? Bill Gates! No, no. Who of you works for Microsoft? All right, you got it. We can't write. I got another... I don't know what this is. It's just a computer with no CPU. It doesn't even have a CD-ROM. It has a floppy. So I'll ask you all, and who again acknowledges the loudest or most distinctly, we'll get this. Who here has pirated software? All right, you got it. Come on up. Whoever that was. Yeah, in a dumpster maybe. Are you a fed? And I have one final thing here. It's a Meritech technician handbook. Who here works for Meritech? Right here! All right. It's yours. I hope you didn't fly. All right. I'm going to talk about a couple things. First is going to be remote assistance. If you haven't... How much did you give them to take that? All right. Many of you have heard of it, and some of you have used it. If you haven't, remote assistance simply provides a way for novice users to get help from their technical gurus that work at their location. Or their friends, or their fathers, or their sons, or whoever. It allows us assistance through voice chat, video at times. It only works with Windows XP and .NET. There's several security issues around remote assistance that I've found that aren't even that technical, but they're just kind of like, I don't know, oversights. The beta3.net server relays its remote assistance request through Microsoft's website. Now, I haven't had a chance to get into the RC1, but if you've used the XP version, which I'm sure those of you have had to use remote assistance to probably use it there, it sends it direct to without Microsoft's intervention. This to me seems like a serious privacy issue, and I'm not sure why they did that. Firewalls? Is why they did that? It's a reflector. Okay. Does Microsoft collect any information? Okay. Yeah, they would never write. The BSA collects that. The password is optional, which to me also is another issue because if anything, people take the path of least resistance, just like many of the physical properties of our universe. The cry for help can be heard by all, and we'll get into this. And there's also a potential 180-degree attack method that can be used as... I thought about it when I was sitting in the DC phone home talk that remote assistance can also be used that way. This is how remote assistance works. You open up your help screen, you click on the link at the top, and it opens up a remote assistance screen. From here you can either send a request through email, through a chat, or through just a file. And the XP version, it creates an XML file, which is all right, but that still has some problems. But in this version, when you send it, we'll get into that. But right here's where the password entry is. You can simply just de-check that. And you are pretty familiar, I hope, with security issues, but if you are in charge of a company's computer department, you'll know that people hate passwords and names they do use passwords are lousy. All you have to do is uncheck that box. If you do uncheck that box, and then you send the email to the other person, I'm using email in this case, and if someone happened to be running a sniffer on a network, they would easily be able to capture this. And you can't see this too clearly, but it is in our slides. The highlighted portion there is a hyperlink, which is the link that goes to Microsoft. With a little massaging, anybody can take that hyperlink, plug it into their browser, and pull up the same remote-assistance connection screen. From there, you just simply click the button. I mean, script kids can handle this one. So now you're getting the Microsoft.net connection screen, and up comes the little box. Hey, this person's coming to ask for help, and I mean, coming to help you. Are you going to let him help you? Well, if you're a Josh Moe user, you're probably going to, because you sent the request in the first place. And now anybody can have whatever fund they want. They can... I mean, you name it, they could do it. Yeah, I'm Josh Moe. I'm your tech guy. Let me format your hard drive for you. So now anybody can reverse that... Yes. Yeah, well, yeah. This basically says, what do you do now?   Call them names. Again, this problem, as I see it, is threefold. The password is not required, and I understand helping the user out, making this world room user-friendly, but that doesn't seem like security conscious behavior there. Again, it's an insecure method of transferring it. It didn't take me long to figure this out. Anybody could grab that off the wire, and maybe this isn't going to exist in the final version. Maybe they'll switch back to XML, or maybe they'll do some more further encryption or something like that, but at this point, that's what I have to go with. And again, Microsoft is in there for the firewall relay, but I don't know many people that are too excited about having Microsoft putting their foot in our lives. Does the password field is filled out? We want to answer the password, because the password is not passed at all. When the password field is filled out, at what point will the attacker have been notified? And the password is not sent at all. They have to call. They have to send it well. If you send an email, you send the password in plain text anyway, so that kind of defeats that. Unless you're using PGP, but if you're using PGP, you're probably not asking for help. So, again, the problem is free-fold. What can we do about this? Security policies as unuseful as they are, and as everyone ignores them. I mean, it's a place to start. It covers you with your hand. End user training, if you do have people that like to use this feature, make sure that they call you at least or do something to get you a password and that they do use a password. Or you could just, you know, stick the VNC, PC, anywhere, or back or first for all that. Now, remote desktop. And I will say remote desktop. I do like it. I use it. It's a very friendly piece of software. It just kind of concerns me because it allows a person full control of your computer. It's something worth bringing up, but not something worth getting all excited about. So, I'm just going to bring up on this slide. The purpose is basically, how many of you use remote desktop before? So, I don't know, 30% maybe have used it. For those of you who don't know, it's just like PC anyway. It allows somebody remotely to get into your computer and to take it over. You have full control over it. It basically, it's an invisible interface remotely to operate a computer just like you were sitting there. Again, it's basically a legitimate trojan, except that it works pretty good. Security issues. Because it runs on a dedicated port, anybody can port scan for it and you can easily detect that it's there. Once you detect that it's there, then you can move the next step and you can try and brute force it. Because most people who own computers like to put strong passwords in, it might be a difficult thing. Not. So, you know, put one, two, three, four, put admin in there, put password. Eventually you're going to get it. What to take the right script to scan a bunch of computers and test for this. This does allow full access to the computer.  So, unless the original user notices you logging in, which kicks them out if it's at night, I mean, there's nothing stopping them from getting access to anything else that computer is connected to. It is disabled by default, which is good and that's smart. But when you enable it, it typically enables a cell phone administrator account if you're using an administrator account, which most people do. Now, one thing that is worth mentioning is that IPACs, you can get software to connect it with your IPACs.  You would think they're updating their tasks and they're taking over your computer. Another thing, TS-Web, which is an active scripting that downloads an applet to your computer and you run it there. It allows any computer without having a desktop client software installed to be able to connect up to another, to be able to connect up to the actual host from a desktop computer. It's a very nice thing to have if you are in the library or something and you want to connect to your home, but it's also a possible insecurity. Again, in my desktop is an excellent tool. I do say that because I do appreciate it. It is arguably free because it comes with OS. And there have been relatively few posts about vulnerabilities to it, most of which are not on service. The next thing I want to talk about is wireless networking. Dot... I'm sure it's on time. Okay, wireless networking. Dotnet supports wireless networking. It's a good support for web and it comes with support for 802.11x. Dotnet, wireless security issues. If you haven't... If you use dotnet, to get connected to DEF CON LAN, what do you have to do? Plug in your card. It automatically found it, it automatically connected to it, and automatically made your computer part of the network. And then you probably got scanned by 50 other hackers out there to put... I understand the point and I understand how that works, but to put such a susceptible technology in a server device seems to me it's a little scary to do. Because of war driving, well, we all know what that is, and for those of you that aren't here, you're probably at war driving on the contest right now, and you aren't here even to acknowledge that. Web is crackable, and we know that. But I want to talk about Web for a minute because I note that a lot of people already know what Web is, they know it's crackable, and they know that the tools exist and maybe even know how to use the tools. They don't really know how Web is crackable. And because we're talking about a server here, I just want to talk about two-fold, one to let you know about Web and that people are interested in it, and another that... I forget the other. But there's another. And so Web. Web is the wire equivalency privacy protocol or scheme. It defines security and the transmission of data. It...Cryption is based on a 5 or 13 character password. It uses the RC4 algorithm which is a fairly common encryption use. It is weakened by initialization vector collisions, and we'll get into this, and weak initialization vector. It is crackable in two hours in best of conditions, and that is usually the case. It's typically a lot longer, and it can take several weeks on a home user network where they're only sending email across it. RC4, again, it's an encryption type. It uses symmetric key, which means it has one key, not like a public-private key, like a PGP. It uses a streaming key, which means it has a different key for each packet of information, so you have a different password for each packet, which is a pretty strong method on the surface. Each packet is protected with a unique password. This is a general overview. I'm not going to go into it. You can look into the paper. Initialization vector is one of the most important parts of understanding why RC... why a web is crackable. Its purpose is to create, again, a unique key, and it does this by combining a packet with initialization vector value, which is three characters, and I kind of illustrate this here where a packet one had ABC games, packet two had DEF games, and so on. So, web's key is 24-bit or three characters. RC4, this is a general... where did my little pin go? This is a general way it works. You have the initialization vector value right here, combined with the password to create your secret keys, fed into the key scheduling algorithm, which then creates a streaming key using a state array value for those who are familiar with arrays. It then is merged with the data through an XOR calculation and outcomes the ciphertext. And this is the first part, the key scheduling algorithm, is responsible for creating a random array. This array is with the current version of web, is zero through 255, and it scrambles the numbers. So you can have any sequential from like 255, next one could be 13, next one could be 12, next one could be 68. It creates it randomly to be used in the creation of the streaming key. And it uses the initialization vector plus the password to do this. The PRGA creates a streaming cipher key and that again is explored with the plain text to create the ciphertext. And it performs additional swapping, which is the swapping is how you end up with the pseudo-random state array. And this is the basic overall encryption scheme we showed just before where the things are... where the IV and the password are merged and passes on down to the encrypted text. This is the decryption, the initialization vector, and this is the biggest weakness, is that it is sent in plain text with the ciphertext. So any hacker or anybody really with a sniffer can easily grab that first three characters of the packet when they already know the initialization vector. So they have this, it's on the decryption side, this is merged with the password which is shared previously between the user and the client and the host. And it gets fed back through here, back through the KSA, back through the PRGA to recreate the original data by X-Waring it with the ciphertext and then it goes through a CRC calculation and if it's good, the data is accepted. Now the weakness is, summarizes if you know any two XOR values the third can be deduced. It's just basically a simple comparison. You'll understand what I mean if you know XOR, I the first iteration of I and I is just a variable that holds the value. We'll hold let's see, it's always equal to one for the first iteration of the PRGA and the PRGA is just a continuous loop that loops through until there's no more data. Again, merges the streaming key with the it creates a streaming key and emerges that with the plain text to create the ciphertext. The first byte of the plain text file is always a snap header. There are other ways that you can do this that increases the chances of cracking it faster but using most tools that are out there there's a 5% probability that the state of array values between 0 and 3 will stay the same after the first four iterations of the KSA and again this is explained in that paper. The link although you can't see it probably, is up there to the paper and that will be at the end of this slide show. Really quickly these are the things that are important to know they will assume values and is an index value it just keeps track of how many times it goes through a loop basically. These values right here indicate a weak key. This is the byte of the password that you're cracking. This indicates the weak key and this could be any value and when you're collecting data tools such as web cracker or whatever they collect all the data as much as they can find and then they start doing a statistical analysis on the data that's collected and the one that comes up the most common is probably going to be your key. So it just collects the bytes so it will collect 1 through 255 on this. The secret key again it's a combination of here's your key this is the key that we use in the example this is an initialization vector again the secret key is the combination of those two you'll see a modulus if you start studying the code it's a modulus operator if you're familiar with programming or you like mathematics you'll understand what I mean by that and again you assume the state array value is swapping as a 5% chance when you're working with it this is what I came up with to make things easier to keep track because you start getting a lot of values going on this is my key array that if I was testing it or if a program was testing it if you wanted to do a paper if I was testing it I would have this set up and then I list my original state array values with my original i and j values this is the equation that's used to create this value which is used in here to swap values right here and again I'm going to cover this real fast because we're running out of time it's in the paper, please read it when you come to loop 2 you go through the same equation process and the same swap loop 3, same thing and now the important thing to note it's all been key 0 which is used right here to key value key 0, key 1 and key 2 are the only ones that have been used in here which can be again sniffed off the wireless network so anybody can do this anybody can recreate the first 3 the first 3 loops and combine that with knowing that the first 3 loops don't know the state array values and the first 3 we combine that with the fact that the state array values KSA don't change 5% of the time you have a pretty big hole which we can work with to find the key and this would be KSA loop 4 if we did know the key now if we're looking at it from a hacker's point of view this is what it looks like we don't know this part of the key but we do know that XOR has a kind of a weakness in which we can recreate the first byte of the PRGA and you do this by combining our snap header which we know exists with the first byte of ciphertext to create a value, in this case it was 15 now we can work our way back through the PRGA and we end up with the S of 3 value being equal to 15 at the KSA loop 3 or iteration 3 and now it's just a matter of going backwards and plugging it in and doing some simple calculations and we can recreate that value right here so now we know the first byte of our key and you just basically continue this through the whole process and again, this particular example is one that works, it is going to be recreated I didn't want to take a chance because there's only 5% probability that I would get it right so I found one that worked again, this is just an overview of wireless networking Windows.net supports it Web is crackable so you have a possible presentation point where you can only rely on Web for your security in your wireless network so what to do, there's many other things you can bind with Web to make it secure and even Web itself, it is a fallback point in which you can be claimed that you're not liable against people who hack, if someone actually breaks Web you know they were trying to get into your network the only other option is don't use wireless networks next year, at this point, they're going to release a version that should take care of this problem and hopefully seal it the whole again, the slides are available there and I think we're back on you now that we have your attention Seth has written more about that actually in a book which will be coming out later this year on wireless security and he talks about the default XP use of that and how it can get you into some bad legal troubles I want to talk about policies and many of you or some of you some of you have in the past partnered with Microsoft for security they used to have a Microsoft security partners program or MSPP where they would let smaller security consulting groups like many of you all partner with them and they would send you business and you would help them find vulnerabilities and things like that Microsoft terminated this last November without any warning and they rolled it into their Microsoft Gold Certified Partner for Security Solutions or CPSS the problems with this is it kind of showed out the smaller guy the smaller security consulting group which is a shame because a lot of the best vulnerabilities are found by the small independent security groups and now if you want to be a Microsoft security partner you have to have at least four MCSCs in your company which very few smaller guys do you also have to pay Microsoft now to be a member in the United States it's currently $1450 a year which puts it out of the range of some small independence you also have to inform Microsoft about our details including what you're working on and who you're doing it for which in our industry a lot of people don't want if you're consulting for someone doing penetration testing they don't want you to be telling other people that you're doing it and now you have to sign a full disclosure what I call a gag rule I don't think Microsoft calls it that but it's basically says that if you want to work with us you can close your vulnerabilities publicly unless you follow our protocol and that puts it out of the range of a lot of people I want to talk a little bit more about this gag rule next slide well the gag rule as we talked about last November Microsoft formed a coalition with five security companies and these were BindView, FoundStone, Guardant, AtStake and ISS I'm sure there's several but you're not raising your hand I actually, not to bash them I actually have very good friends that work for a lot of these companies and they're really smart guys but one thing that they had to do to get into this coalition is they had to agree to spare Microsoft from public embarrassment with vulnerability disclosures so they had to sign a gag rule to be a member but now what's the problem with this why is such a policy bad for Microsoft and why do we think that it can raise some negative security issues for Microsoft well here's one example a lot of you heard about ISS releasing a severe Apache vulnerability to bug track last month actually in June how many people know about that everybody okay that's all over the media and the problem with this and for those of you that do run Apache on Windows does anyone do that am I the only one in the world who does that it's actually pretty good if you have to use Windows in your environment Apache is a lot there's a good alternative to ISS as a lot of other people are pointing out the problem is that there's many distributions of Apache especially on Windows it's a binary install and it wasn't working and ISS only gave one day or less than a day notice before they posted this vulnerability publicly and for those of us that stayed up past midnight trying to get this patch to work and didn't get any sleep that we're not going to forget it any time soon so there's no grace period and what's the problem how can we possibly blame Microsoft for what for ISS's faux pas how's that possible well we can't directly blame them but if we get the next slide actually back one slide down the bottom the problem with this is ISS signed this gag rule to be a partner of Microsoft they said we're going to spare you vulnerabilities for 30 days at the same time ISS turns around and attacks one of Microsoft's biggest competitors in fact their biggest competitor in the server market and that's Apache with no grace period so here they're favoring Microsoft with a gag rule on one hand turning around and hitting their competitor balling that same gag rule on the other hand is that illegal? No but it does potentially raise some ethical concerns and the question is was there any pressure from Microsoft for them to do this to exert anti-competitive pressure now I'm certain the answer is no there is no intentional anti-competitive pressure but the fact that there is a relationship between ISS and Microsoft raises that issue of conflict of interest because ISS is presumably gaining benefit from being a partner such as free publicity or leads from Microsoft they are benefiting from Microsoft so to turn around and attack and open source competitor those raise some issues so this is going to hurt Microsoft more than anything indirectly if they have a gag rule which they probably shouldn't that's very controversial to begin with but if they do they should ask their partners to make it apply equally to their open source competitors to avoid raising such an issue next slide well in this talk we've discussed some potential attacks against the architecture I have to say that we haven't found any severe vulnerabilities in the implementation itself and so overall for those of you that did admit to working for Microsoft you can pat yourselves on the back believe me though there will be exploits and lots of them but that's okay they can be fixed what you don't want to do if you're Microsoft is try to patch things by enforcing gag rules and other policies like that if you have a vulnerability the best thing probably is just to admit your mistake and give credit to the person who found it then fix it and go on the public is going to respect you a lot more in the long run than if you try to influence industry standards by creating RFCs against full disclosure which has happened so I think more than the architecture I think Microsoft policies should be overhauled next slide so are humble recommendations to Microsoft not that they will pay any attention but here is some suggestions for improvement go ahead and move to final release of the operating system because if you keep being scared to release it it's going to be obsolete it will already have been in beta for two years almost and it's actually makes you stronger to be tested it's nothing to be afraid of number two we would recommend immediately and totally removing the WPA because if you're Microsoft all of your hard work making this operating system is going to be flushed down the toilet because no self-respecting administrator is going to put up with this if you read about what we talked about if you read that comment in the paper that comes with this talk you're going to see what I'm talking about it's extremely humiliating the WPA concept and finally we would again change the gag rule and finally terminate association with the BSA or business software alliance the truth is that people who pirate Microsoft software if they do it commercially and it's a large pirating ring that's something different but to go after the honest companies or the honest small system administrator who's just doing his best job and may have one license somewhere expired and using heavy-handed tactics against such companies that's only going to hurt you in the long run and I think Microsoft's been lucky so far because people don't really know about the BSA too much yet but if there's one message we want you to take home after this talk is to read more about the BSA and to make your own informed decision next time again we'll be available to take questions for just a few minutes and then we'll be at the Loom Panics table if anyone wants to get their copy of our book signed so that they can sell it on eBay for a profit and here are the links thank you very much


Dimensionality reduction techniques have been shown to simplify complex hand kinematics by reducing the number of degrees of freedom required to control a high-dimensional hand. Training practices that make the relationship between the low-dimensional controls and the high-dimensional system more apparent can improve learning of an autoencoder-based controller. Three studies are presented which explore different factors that contribute to learning difficulty when using a low-dimensional controller to control a high-dimensional hand. Computer mouse and myoelectric control are compared as one factor contributing to learning difficulty. Training paradigms are explored which include full-dimensional tasks, implicit 2D tasks and explicit 2D tasks. It is found that myoelectric control does not pose a large challenge to learning the low-dimensional controller and is not the primary cause of poor performance. Implicit 2D tasks are found to be as effective as direct training on the high-dimensional hand, while explicit 2D tasks are found to be the most beneficial for improving learning. Establishing an explicit connection between the low-dimensional control space and the high-dimensional hand movements is key to successful learning of the controller. This article was authored by Alexandra A. Portnovariva, Fabio Rosolio, Mora Casadio and others. We are article.tv, links in the description below.


Here we go. I believe this is the first ever skiing breakdown I've done. Shout out to Dan for sending the request over. These two dudes are racing for first place. Norway's in first, Russia's in second. It's a relay race. It's the World Cup of Skiing. If you didn't tune in, where were ya? They get tangled up a little bit here. It seems accidental to me, but I don't know anything about anything about anything about this sport. But the Russian dude isn't happy about the entanglement right there, and he just throws. Man, tries to hit him. I think he misses completely. So here's another look. The feet get tangled. Russian dude not happy. Tries to hit him with the pole. I think he misses, because I think otherwise the guy would have had a reaction to being hit with the pole. Now he's just stewing mad. He's gonna come in second place. The mascot running down, just oblivious to what's going on. That doesn't mean we're in a heated blood race at this point, and the mascot's just throwing the flag. He comes out, he celebrates with his teammates for getting first place, and the Russian dude makes a beeline turn right into him and just tackles him. I mean, just skates right into him, tackles him. His buddy's got his back.  So it's good to have friends like that. And then he's like, what? It was his fault. He was in my way. And the guy who won and got hit and then tackled, he doesn't seem to care at all. And the guy that came in third place is like, oh, what did I miss? Come on.