Our first presenters are from Bangladesh. So I'm very pleased to be able to welcome Dr. Shah Ali Akbar Ashrafi, who is the Chief of the Health Information Unit for the Ministry of Health in Bangladesh, as well as Hanan Khan, my apologies, with his Bangladesh to share their work on the integrated surveillance platform and strengthening of the COVID-19 system in the country. So I believe it is over to Hanan to share his screen. So welcome to the session. Thanks, Rebecca. So Dr. Ashrafi, we'll start right now. Can you see my screen? Rebecca, can you see the screen? Yes. Okay. Thank you. Thank you for inviting me in this session. That is the National COVID-19 System of Bangladesh. That is the DHS to Surveillance Package and the Piyong. Next please. You know that Bangladesh is a small country, near about 147,000 plus square kilometer of area with 160 million population and mostly dense country in the world. And when the COVID-19 outbreak began in December 2019, health officials of Bangladesh and development partners are getting ready under the leadership of our Honorable Prime Minister and after the first COVID-19 case detected on March 8 in Bangladesh, Minister of Health and Family Welfare realized just that the need for an integrated COVID-19 system and accordingly his Bangladesh are stepped into for the assistance. And initially started as COVID-19 Surveillance System. The national COVID-19 system now serving as a core COVID-19 data platform for the COVID-19 related informations and playing a vital role in controlling the COVID-19 pandemic. Next please. Now the highlights of the integrated COVID-19 in system of Bangladesh. All the COVID-19 informations in one place including our vaccination program related to the COVID-19 ICU and the associate logistics. More than 6 million tests already done and counting and COVID-19 samples are collected and being entered in the system from the more than 1,000 public and private sample collection facilities and hospitals. Those are tested through 126 PCR test laboratories for 46 gene expert lab and 356 rapid antigen test facilities and data are entered into the system. The test results are notified to the suspects through SMS automatically from the surveillance system immediately after test done and a self-service report printing system is also available in our DGC SOE portal. And providing the COVID-19 certificates with secured electronic verification system that is the QR code and the test certificate validation are integrated and being widely used by the civil aviation authority, port and airlines and immigration authorities worldwide. The test results and certificates are providing within 48 hours for the outbound travelers. Epidemiological analysis, geodistribution and GIS are providing critical aid to the policy makers to make various decisions and feeding the national COVID-19 dashboard portal in the justice of Minister of Health and Family welfare and also to the Honorable Prime Minister, Sir Fish. Thanks. So please, Mr. Annan Khan, we continue. Thank you, Dr. Ashok. So here's the background. The COVID surveillance system of Bangladesh is based on the actual DHS to COVID-19 package, which is developed by University of Oslo. His Bangladesh customized it for Minister of Health and Family Welfare Bangladesh, the base of the national department by consultation with the national COVID-19 technical committee and the DHS experts. The first version was released in March 2020. Though deployed as a surveillance system, his Bangladesh were requested to help on various COVID-19 issues to support distance support system, public awareness, prevent forgery of testing, in testing, additional system components are built upon DHS-2, which is now being used as a core DHS core COVID-19 test. So this is not actually a whole DHS-2. We built up on many components on the DHS-2. So this system is continuously updated and supported by his Bangladesh team. At the beginning, these systems financed by his Bangladesh only, later from August 2020, was partly funded by himself. His Bangladesh is the key support and implementation team for national HMIS based on DHS-2. Few of them are among the largest implementation in the world. For example, our MNCS tracker now have more than 48 million entities. So some technical highlights. So the main components of the whole COVID-19 ecosystem is the COVID case-based surveillance system using DHS-2. This also includes the vaccination status, vaccine logistics, or BLMS. Initially, we started with the AstraZeneca, but later on, more vaccines are coming up in Bangladesh. So now it's total four vaccine types of vaccine are available. Already, we are asked to be ready for the four types of vaccination. COVID-19 hospital status including ICU and associated logistics. It's also included quarantine and isolation status. COVID-19 certification for outbound travelers with secured verification validation. Alternative reporting system with validation for port and immigration within near real-time reporting data backup system. This is due to if the DHS-2 is unavailable, then the immigration will not stop. So that's the idea. Even the DHS-2 system unavailable for a moment for an hour, half an hour. By this time, this data backup system actually pushing the same the report data to that system. So they're actually two parallel system. One is that is backing up the main DHS-2 component. So in next diagram, we will see that in the process flow. More than 1,020 sample collection facilities and the 528 test laboratories, not only from public means from the government is also from the private facilities and commercial facilities are also there. Though not all are entering in the DHS-2, few are entering in Excel, which later we import through the PHP system. So we make a generic API interface middleware, which is designed to facilitate integration of the different systems, apps, and pre-formatted Excel sheets. The test results are notified to the suspects through SMS automatically from our DHS-2 surveillance system. Immediately after the result is entered, a QR validation and validation system is integrated within the DHS-2 system for security validation and verification. A self-service reporting printing option also we provided through the OTP so that people can take their own report from anywhere they want. So that's actually reduced the load on the facility as well as as well as reduce the people's to come to the facility. So there will be to prevent the COVID transmission. Providing COVID certificates with security electronic verification, QR code make them acceptable locally and internationally by the airlines and immigration. So this is actually we in a communication with our Minister of Foreign Affairs to broadcast to the all over the all immigration and airlines. So this is actually the flow. So it's very complicated. So in the center, this is the DHS-2 system, which is our standard DHS-2 package, what we customize for the validation. But upon that, we build many systems. So that says that.NET system self-service reporting system, which is actually for the report distribution, the report verification QR, the sexual bi-directional means that from DHS-2, the data is sent to the QR, the generator QR and embedded in the DHS-2. And same as well as support for the reporting system and the immigration for the verification validation. And we have a backup system for near real time. So this now is set up and finished 15 minutes. They backed up the new addition or any update of the test result to that system to the SQL script. This is done automatically. Each 15 minutes, they are synchronizing this data, test data from that server. So anytime if the DHS-2 system is down, their system can back up the all external systems and the immigration and the force so that there will be no chaos. So to facilitate all those, we have a regular application, those actually initially play crucial role. When the pandemic started, there is a lot of enthusiastic app development. So we have near about 300, more than 300 Android, iOS, Windows app and the web's based self-service systems. There is for the screening app and there is few sample app is coming up. So we build a national Corona care gateway. So through that is data come through the middleware from the middleware go to the sample collection and this come to the main COVID-19 surveillance system. So there is private facilities. They are sending through the Excel-based system. So this actually compared to the PHP-based front of that, but this actually gradually reduced and we are gradually shifting to whole thing with the DHS. So on the right hand side, you see the public health, public hospital, private hospital and private laboratories, public laboratories all are reporting through the DHS-2 systems right now. So this actually the data feeding to the many subsystems or dashboard. So the most important is the honorable prime minister of dashboard. So that she is aware of what is happening in the COVID situation. Also the national COVID dashboard and real-time COVID dashboard in our DHS system. So what is the challenges? So there is a lot of challenges. First challenge is the moving target. The continuously changing of the environment is actually make a thing quite difficult for us. Some of the labs and hospital have difficult different types of systems and they don't want to use the new system. So that is also a problem. Almost every day there is a new air for the COVID. So we make a middleware. So who wants to send through theirs from their system? So we have the middleware application to integrate. So recently we have directly integrated the DHS-2 system with a few labs which have high volume of the lab tested. Due to the change in requirement, keeping historical data and metadata clean has become a very challenging for us. Identification of tracked entity is challenged as the government decide to use mobile number as one of the key identifiers. And one mobile can be used by family. So that's also a challenge. Visualization requests are not available on in DHS-2. So we make several portals to visualize the data as they want. So deciding on the attribute data element for analysis, this is also challenging because you are aware that attribute and multi data element for multiple stages is not yet possible. Tracker performance issue is the most challenging part for us. So we overcome the challenges by developing the API platform, National Corona Care Gateway, which actually make a middleware for every external application. For immunization should have, we actually have the data intake process right now. But in future, we'll do through the API when their site, the API will be available. Available will make the integration. Test certificate. So there is several counterfeit companies come up. So we have embedded the DJQR system, which is PHP based and the JavaScript embedded in the DHS-2 with the secured government from subdomains. So that has the authenticity of the validation of that specific site. So ensure system availability to the airlines and immigration. So that's, we already said that, that's who has a backup reporting system. So that if the DHS-2 unavailable for a few minutes, hours, then it's not appropriate. Yes. Yeah, thank you. So this is some example of the external visualization. And finally, the acknowledgement. The DHS-2 system performance is a more than 5.8 billion track tentative was a huge challenge. We are incredibly grateful to the University of Oslo team, especially Bob, Marcus, Juire, Sunbold, Luciano and others. This initiative was initially funded by HISP, but later on funded by UNICEF. So we are also grateful to them. Government of Bangladesh, especially data general health service officials, Minister of Health, Reserviced City and the telecommunication, the grammar form. We are also grateful to HISP team because they are giving support 24-7 because without that 24-7 support is become actually very challenging for us to support the government of Bangladesh. So thank you in time. Thanks. Thank you so much, Dr. Ashrafi and Hanan. We really appreciate you taking the time to share the complexity and just the impressive rollout, more than 6 million tests in this national architecture. So the next presentation, we have colleagues representing from Indonesia. So we have Taufiq, Sitombul, Saifira, Sausadilla and Lalo Lian. The floor is yours for your presentation on contact tracing. Welcome. Hi. Thank you, Rebecca. We are from Indonesia. We focus on contact tracing COVID-19 platform in Indonesia. So next, Lian. So the team of Indonesia, we contribute and have contribution for MOH, especially for Infection and Emerging Disease Unit and Data Information Center, WSO Indonesia and SS2 Indonesian team. We are many teams and me, Taufiq, Sitombul and Yornbra. Next. Okay. So platform for contact tracing COVID-19, we call it like Indonesian's local language, silacak, it's been tracking. And this is the SS2 platform. And this is to NY silacak. So that's why there has been three times changed by adjusting the SOP, especially from the minister regulation. And this is to include it to adding metadata and justify for that. This is to SS platform. So this is the Indonesian's implementations and national wide. So hosted and managed by MOH in Data Information Center and national and regional user. And we spare the contribution to national report contact tracing, especially for the MOH and national task force. Next. So what is the COVID-19? So SS2 is the main of a platform, especially for the COVID-19. We already built and a success to build because like the WhatsApp book. So you can see later the explanation what software to register new user and new stakeholders to use the SS2. So this is very important and we can discuss later. We contribute to national ID system integration. So that's why national ID just enter to the SS2 and get the attribute, many attributes for national ID system. And we reduce the cost of time of the data entry. So it's very important. So the second, we at the third point, we contribute to integration, the red line, contribute to cases system integration, because like the additional other resource, so that's why it's very important to integrate with the contact tracing. The fourth items, we built the applications focus on contact tracing, Indonesian language, especially and very, very small application and very easy to manage, especially in Indonesian context and local people and facility type user. And the five, we built the Android packets. We didn't use the SS2 packets, we built from the from the scratch using the, especially from the mobile technology and especially to reduce the confusing from the SS2 person and non-SS2 person at the facility and DSO or PSO level. In the last, we implement superset dashboard, especially to make a real-time data connectivity presenting. All application is connected with the SS2 system or dashboard. Here, we will share the information of the two cases, especially the WhatsApp book, because it's like self-registration. And the second, we contribute the knowledge implementation, especially to support the local user. The other application you can see and you can join to the next session, like a buzzer or another discussion. Next, yeah. So the implementation, we start from November and March 2021, because the group of users is very, very, very changed. And so that's why it's very implemented, it's very small. We have been the 10 provinces and now from April until the next, the total users is 28,000 and we build, we implement in 30 provinces. And we receive many additional users from police officer and military officer as the contact tracer. So next, we can continue for the next presentations. Next, yeah. So our friends from here, we will introduce and present about Knowledge Hub and Registration System. Over to you, Shevira. Okay. Thank you for Mr. Tauvik. Hello, everyone. My name is Shevira. So for the next, we're going to talking about the Knowledge Hub. So what is the Knowledge Hub? So this is how we manage the knowledge from central level and to end user. So Knowledge Hub is a connecting and sharing platform. This is sorry, sharing platform that is innovative and a great tool for collaboration. So the member join group for various reason and they can clearly define how they use them. Adjusting to the pandemic situation, it was complicated to mobilize through Indonesia by gathering user in particular place. Therefore, the transfer of knowledge is chosen by using the online method when the participant can be trained in real time without considering the location as long as they can access the internet. So this one, it is to solve the internet issue. We have to record the activity, create ebook, our guidance in PDF format, and provide the video tutorials so that the user will have a signal program can choose the media to study or repeat the materials. So next, we have Knowledge Hub users and Knowledge Hub products. For the Knowledge Hub user, for the national, we have from Ministry of Health and National Task Force. And for the regional and facility, we have district health office and public health office. So there and then local government, local security officer and facilities. So we have about the Knowledge Hub products about the portal FAQ and publication, training server and activity user from many groups. The digital learning material poses ubiquitous and robust nature. They potentially allow more efficient facilitation of knowledge transfer and other advantage compared to traditional face-to-face learning materials. Next. So what is lesson learned? We can, for the first, about the technical obstacle and management constraint. It's about the many incoming requests from user and constraint. So the second is about the user constraints that are often faced is about the need face response to face the user, repetition of the session because of new user and user paradigm. And the last is about the connection can run offline and online. So to solve the issue, we have a record activity, create creative e-book in PDF format so that the user will have a signal problem can choose the media study. The digital learning material poses ubiquitous and robust nature that potentially allow more efficient facilitation of knowledge transfer and other advantage compared to traditional face-to-face learning materials. So for the next slide, we'll be presented by my friend, Mr. Lalulian. Time is yours. Thank you. Thank you, Shapira. Okay. Hey, everyone. My name is Lalulian. So I will be sharing about one system we build, registration system. We call the AMICA. AMICA is a WhatsApp bot for the user registration. So the system makes it easy who wants to have the access for a DS2 as the one, the main platform for the copyright research. Sorry. The motivation is the assigned April 2021 by the chance the police, the entity didn't grow the user. User can request for HAPDES. We have the HAPDES to have the people have the user to create like a troubleshooting or create the account. Request can reach 4,300 and 950 for the user request for every day. So if we create the manually, it's so hard. So that's why we create the one simple product. We use the WhatsApp bot because in Indonesia, literally digital is still not very good. So we make use the WhatsApp bot because the easy for the people in Indonesia use the WhatsApp. So this is the process. The process that I will be explaining the first times our HAPDES can make the code, unique code based on user role and the group. So the invitation will be created by a system and we send to the new users and there will be there will be a registration use the invitation. So after that, after they following the direction based on SOP and based the system we create the manually, sorry, we create the base system, they can get the account two and three minutes after they followed the process. Okay. This is the, what's the look, our system, amika, separation. You can see in the ones is the how do we create the invitations, invitation and the second picture, you can see how the process, the one the process from the new user use the set registration and we have the dashboard, the dashboard, like the monitoring and so, how many users for every this, every provincial, we can look and pointing where the position. Okay. So the from the listener on we see because the problem in Indonesia still load for the digital iteration. So we find many new user can have the error waiting for the standard password and the error to share location use the WhatsApp. So for this, the problem we improve the system make like the notification if they get the wrong like the password or they not use our standard and we make the video guides step by step the progress for user. And the next step, we make the new separation but now we and the registration we use the webs. So that's for me. Thank you. So much. Thank you so much to the team for sharing using incredible innovations and particularly around being able to reach and expand on the support networks to users. I think that's just a really fascinating story for many of our implementers here. So our next presenter, I will invite please Dr. Talia Shagai, who's the EIS fellow from US CDC, who will give us a presentation on challenges implementing DHIS to for the COVID-19 response within the South Sudan context. So please welcome Talia. Hi, thank you very much. I'm Dr. Talia Shagai with the CDC and the United States and I'll be presenting on an evaluation of the implementation of a DHIS to COVID-19 module in South Sudan based on work with my co-authors from CDC and the South Sudan Ministry of Health listed here. South Sudan is a landlocked country in Eastern Africa. Its capital is Juba. It gained independence in 2011, making it the world's youngest country. Since independence, South Sudan has suffered protracted civil strife and humanitarian emergencies, including food insecurity, outbreaks and flooding. The Ministry of Health has very limited human and financial resources and primarily relies on NGOs and donors. The Emergency Operations Center was activated in March 2020 and the first COVID-19 case was identified in South Sudan on April 6, 2020. In between then and June 13 of this year, they've recorded close to 11,000 cases and 115 deaths with peaks in May to June of 2020 and January to March of 2021. This shows the structure of the high level COVID-19 response in South Sudan. I'm not showing this to walk through every piece, but to highlight how multi-layered it is. The response is based in the Public Health Emergency Operations Center in Juba, shown in the top three boxes are the several Ministry of Health committees coordinating the response, and the middle row shows the technical working groups in charge of aspects of the response from points of entry to case management to logistics. Shown below the technical working groups are partners that implement the response work. Reporting and decision-making is a comprehensive process. Each technical working group overseen by the Ministry of Health is comprised of different implementing partners, each on its own funding cycle with its own internal objectives and processes. The exact number of implementing partners is difficult to report because there is a lot of turnover. At the moment, there are at least 10 partners actively implementing COVID response in South Sudan. There are five sources that feed into the COVID-19 surveillance system. These include points of entry, testing people entering the country, a network of Sentinel site health clinics conducting testing, an alert hotline where symptomatic people can call in and have a rapid response team come to them for COVID testing, pre-travel testing for people leaving South Sudan and requiring negative COVID certificate for their destination, and a contact tracing system testing those with known exposures. For people meeting certain case criteria, a sample is collected and tested either at the National Laboratory in Juba, a mobile laboratory outside of Juba, or at a private lab. Any positive cases identified or managed at home or in a COVID-19 clinic based on symptom severity. Ideally, all positive cases should have their information passed to contact tracers will list it and test all close contacts creating a small feedback loop. Accord COVID-19 data is captured beginning with a case form and lab request form. These are filled out for anyone receiving a COVID test. These films are formed on paper and attached their sample and sent to the lab, who then prints and attaches the results to the case and lab request forms after testing. All data are sent on either on paper or via email to the emergency operations center where data management personnel enter into the main South Sudan case database, which is maintained in Excel. Data on positive cases are sent via email to case management and contact tracing teams who return patient outcome data to the public health emergency operations center either through email or a phone messaging system. South Sudan can then report total cases to the deaths and case curves. In March 2020, South Sudan received funding to implement a COVID-19 DHIS II module. The DHIS II already existed in the country as it was first developed for HIV surveillance. However, the HIV module is still under development and has not yet been implemented. DHIS II development for COVID-19 was undertaken with the immediate goal of improving the COVID-19 response, the higher quality and more accessible data, and with a longer-term goal of overhauling and unifying the health information system by completely transitioning to DHIS II. The DHIS II COVID-19 module is planned with separate forms for each group that will use a system, one for the alert hotline to screen people who potentially need to be tested, a case form and lab request form for all groups collecting COVID tests, a lab form for labs testing the samples and producing results, and a form for case management groups to report case outcomes, and finally a form for contact investigations starting from each case. Ideally, the system would be customized based on existing forms that reflect the current movement of data through the system. However, the flow shown here is highly simplified. Remember that because of how the response is structured, multiple independent implementing partners collect these data, and there are no standardized and universally accepted data collection forms or sets of variables. For example, patient outcome data is collected by two different implementing partners conducting home-based care for mild cases, and at least three different implementing partners running COVID-19 clinics for more serious cases. That's a total of at least five independent groups collecting patient outcome data. Each of those five partners has developed their own internal data forms with their own variables collected and their own data management system. There's also no mandated standardized or regular data reporting across a system or an easy centralized way to report data. After more than a year of development, DHIS-2 is still not in use for COVID-19 in South Sudan. While most of the necessary steps have been completed for each component of the DHIS-2 system, system training and rollout has not yet begun. Why has this process been so hard? While I've already hinted at some of the main barriers, I'm going to describe here important challenges that have slowed the implementation for DHIS-2. I'll also talk about major successes that have come out of the development process. We evaluated the development of COVID-19 DHIS-2 module in South Sudan through a series of key informant interviews to identify the most important barriers and successes. We interviewed 13 people within the Ministry of Health among implementing partners between October 2020 and March 2021. We then synthesized common themes to better understand the development process, starting with barriers to the rollout. The first challenge identified was inadequate funding and capacity. For example, there was no funding to hire in-country back-end developers or existing capacity to make modifications to the back end of DHIS-2 within South Sudan, and development was outsourced to part-time Tanzanian staff without firsthand knowledge of the system in South Sudan. This has led to major lives in implementing changes and difficulty communicating needs to developers who don't understand the first system in person. There's also only a single epidemiologist in South Sudan with data management training who has been hired to work on DHIS-2, which is insufficient to facilitate and manage the development process, and he also has no back-end training to be able to develop the system. This has meant that changes to the DHIS-2 back-end happen slowly with variable quality. To address these issues, there's been a push to train technical staff in South Sudan to manage the back-end, and the Tanzanian developers were brought to South Sudan for two months to work in country. The second challenge identified is limited buy-in and willingness to share data across the implementing partners. It's been a struggle to convince partners to share data when there is no precedent to do so. To switch from a data management system they already use and know, and to take time out of their already busy days to actively participate in the process, even getting responses to emails can be difficult. This is exacerbated by high partner turnover as garnering buy-in has to start from the beginning each time a new partner enters the space. Even when the Ministry of Health is ready to proceed, lack of partner participation has slowed things down. To help address this ministry has started implementing weekly group meetings with the data focal person from each technical working group to create accountability and space for regular communication. Third, as I mentioned, each implementing partner has their own non-standardized data system, even when partners are willing to transition to DHIS-2, data are often not interoperable or easy to share. For example, the three forms shown here all show different versions of the case investigation form that should be filled at time of testing, all asking different questions with different sets of variables. This has added a large complicated step for implementation process as the Ministry and partners had to agree on standardized forms and variables that all parties would use. It's been a long iterative collaborative process to arrive at standardized forms and variables. Finally, South Sudan has poor infrastructure, security, and resources outside of Juba. It's difficult to implement DHIS-2 when you can't tell how a state's current process operates and visiting rural locations is often difficult through the lack of roads, lockdowns, and security concerns. Even communicating virtually is hampered by unreliable internet and phone service. Additionally, resources are spread even more thinly outside Juba, and other priorities often take precedence over COVID surveillance. For example, addressing immediate flooding concerns, as shown in this photo here, or impending famine. This has led to the role of DHIS-2 being concentrated in Juba, although with COVID restrictions looser now, travel outside Juba has begun with the goal of expanding COVID-19 surveillance. Now I'll talk about some of the exciting successes that have come out of the implementation process as well. First is the creation of a Ministry of Health Data Management unit. This is the first time the Ministry of Health has had a dedicated data management unit and has created the infrastructure for more regular coordination of health data through a central system. The Ministry of Health has dedicated full-time personnel to data management. A couple of the key people are photographed below and is making a long-term commitment to building stronger central health information system. Second, the process of implementing DHIS-2 has forced the Ministry of Health and Partners to build up capacity. Training has begun so the Ministry of Health staff can maintain the back-end DHIS-2 system. The process of participating in a DHIS-2 development has led to improved data management capacity among implementing partners. And funding for DHIS-2 has supported monetization of data collection forms from paper to tablets, and funded personnel within the Ministry of Health for the data management unit. And third, this process has set an important precedent, that health data in South Sudan can be more centralized and standardized. The Ministry of Health has taken major steps in playing a more central role in collecting and coordinating national health data. Through this process, the Ministry has now taken steps to mandate standardized data, regular reporting, and reporting through a centralized system. Inclusions while the DHIS-2 COVID-19 module is a powerful system for surveillance data management, rapid implementation requires minimum prerequisites that South Sudan just did not have. These include in-country technical capacity for back-end development, stakeholder buy-in to use the system, a sufficient number of trained human resources. However, the process of implementing DHIS-2 has helped build capacity and data infrastructure in South Sudan. It is a worthwhile investment for improving public health surveillance, even in countries with these challenges. And update the current target rollout date for the DHIS-2 system in the country is July 1st, so just in a couple weeks. Thank you to all the support I received from the Ministry of Health and to all my co-authors. Thank you, Talia, for sharing this incredible story. I think it's so important for us to remember all of the enabling factors and environmental factors that enable the strengthening and the rollout of these electronic systems. And I think this story around South Sudan really helps to pinpoint those challenges, but also some of the gains that you were able to make in a more systemic way despite what was happening. So we were really quite on time, and we have some time for actually question and answer. If anybody would like, you can feel free to just add your questions into the chat. We have our presenters here. I will also take a quick look into the community of practice. So let's see. Also feel free to raise your hand if you have a question for any of the participants here today. So I might actually start, and since you're here, Talia, I had heard through our HIST network around some of the work that was going into the interoperability between the laboratory system and DHIS-2. And I think we've also reached sometimes the similar types of challenges in being able to resolve those sort of non-technical bottlenecks. And so I was just wondering, based on sort of the experience out of South Sudan, was there anything that you would believe is important for other countries with similar complex operating environments? Or if there were an alternative approach that might be able to strengthen a level of system use that's perhaps less complex? We do see many countries with COVID-19 vaccine delivery kind of struggling between how to roll out individual level trackers at scale versus kind of relying on some of those paper-based aggregate reporting that works well. So I didn't know if you had any reflections from your field experiences. I think just similar to what I already presented that when there were groups that really wanted to make this transition and they didn't have the capacity to do so, we also just didn't have enough people to support them. We had to be in a million places at once. There were a time of competing priorities and what really needed to happen is to have someone sit down with them, go through their system, and figure out what variables need to be switched, how to make the systems interoperable, what steps need to be taken. And we just didn't have enough time or people to do that thoroughly. And having more people on our team would have made that much easier. Yeah, thanks for reinforcing that point. I think we talk so much about interoperability and we have a session after this one actually today and also I believe tomorrow. And one of the things that we often run into is this sort of this kind of top-down standards-based approaches and sometimes we forget the very, very basic surround actually knowing what our data variables are and are they consistent across different systems and how do they map to another. So to me that's a really great reminder. Let's see. I don't know if we have Hanan still on the line. Hanan, are you still here? No, I think he actually probably had to move. I know this is in the middle of their transition time moving back from work. Are you still here Hanan? I see your name. Okay, perhaps not. You cannot unmute. Let's see. Now I can unmute. Thanks, Rebecca. I'm here. I realized I cut you a little bit short because I was worried about time but we actually ran out of a presenter. So I just wanted to ask if there was anything we felt that we rushed you through on your experiences in Bangladesh. Hello. Yes. So if there is no question for COVID related issues, we actually have you see our challenges, the moving target. The capacity is also one and the area where actually we're facing significant number of huge challenges. For example, when it comes to the DHS training requirement is very minimal because DHS too, all of the country, they know what is DHS. But the private facilities and the outside, the government facilities, the new user. So what we did, we make an online training for two hours in the night so that they can teach on the DHS too. But the problem is the system is very long. So initially, with the help of UNFPA and UNICEF, we recruited data entry operators for helping them and gradually take out from those data entry operators to handing over those systems to the government. But still, the government is struggling to recruit and to facing the data entry and the interpretation challenge. So there are actually several recruiting process. For example, the government doctor recruiting process actually bring forward and try to recruit a set of doctors in the field as well as who has the informatics background to place with us. So this is actually government try to minimize. And we also try to minimize the recruit through the donors. For example, the defeat, the UK aid, UNFPA, World Bank, ADB. So all our helps to recruit short term people so that we can intermediary help those people. But the system and we always have a problem to hand over the systems gradually. Also, the funding support for his also running out in June. So this is but the most difficult is the chance. So if there isn't chance, we need it tonight. So which is impossible. So they have to understand that this time and carefully check with the earlier data effect how we implement and how to affect the system. So we need to take this test is fast with our test environment. And this takes some time. So understanding those is very difficult, especially in the political and in the media, because there's anything wrong is going to the media. Okay, we not get report two hours delay, we have to waiting in the queue, etc. So we try to minimize in technically, for example, the report printing, we're not drinking a record printing for the facility, so they can report print anywhere they want. We ensure that their QR is embedded. So certificate value. So when we started by remotely printing, they're actually they come there. Some some people come up with the first certificates will change the name picture and everything. So put it in for their own. So we have to put the QR embed with the government, our government supplements so that every QR is verified from that. So that's how we try to mitigate. So it's not there is a thumb rule, how we mitigate that. So when the challenge came, you have to find a way out how to why you want to mitigate and how fast you want. That's my suggestion. And for the the the the last presenter, what the manpower human resource challenge, that is technical channels and non technical channels, non technical channels, there's some mitigation way. For example, in laboratory, we set them to record in the paper and send the paper to the letter on to the race to the system. But the sending the paper is sometimes very difficult, because lab doesn't want to send any anything outside, because if the people know, they have to go to the media. So this kind of issues. So technical and non technical both challenges are there. But human resource in the government sector is a really very, very challenging and very difficult. Thank you. We appreciate that. Extra, extra few words based on your many, many years supporting begladeshen in the field. I do have a question from Jim in the chat. I think this is directed to South Sudan, but the need for DHIs to back and development. So I think perhaps this was maybe just a clarification of what what type of support does it maybe the core functionality the the database itself, the middleware development, or is it simply configuring the DHIs to system? I'm not sure if Talia, if the question is clear, if you're able to speak to that or not. Yeah, I can tell that nobody on our team has capacity for back end development, because we use the word back end development when clearly there are many words for different pieces of this. But we mean just configuring the DHIs to system. So what would happen repeatedly is a system would get customized, we do a review of it, we come up with all of these things that we need to be adjusted or changed. And then the process to actually get those changes made would take a month, six weeks. And it just was too slow for things to happen in any kind of reasonable timeline. Very clear. So that makes makes a lot of sense. I'm sure that's a familiar challenge. Taufiq and our Indonesian colleagues, did you have any last words? And then we can close in two minutes and have a little transition time. But Taufiq, anything else to add before we close the session or Lalu? I have a question to Taufiq. Hi, Anand. Yes, Taufiq. So I want to add something about the implementation. We implement a new model of implementation, especially to engage technology and synchronize what MOS does, especially to real-time data and connect with new technology like database. Taufiq? Thank you. Anand, last word or? No. A question to Taufiq. Because the content tracing, how they implement in Indonesia, I see the WhatsApp integration. So how you work with the WhatsApp as a support system, for example, in our system, we use WhatsApp as a support platform. So we have a Facebook support platform for various, but for a specific COVID, we have WhatsApp support group for the supporting the all-user, end-user, field-user. So anything problem, they type in the WhatsApp and a specific person will attend it. But you're using WhatsApp, I see your presentation. So what actually, how you use that actually? So is there any technical integration from your side? You're just using simple. Yeah, we are using WhatsApp, but it's meant to support what the supervisor or MOH request from the facility and the SO. So this is why it's the automatic boot, if based on the request from facility end-users. And we have been integrated, we use the web API, especially connect with the API, what the function needs, especially if the registration system, we connect with the API for the user creations, user group and user roles, and user organization unit, for example. Okay, thanks. Yeah, thank you. Yeah. Well, a huge thanks to our presenters. I just find this work just so impressive. It takes many years to really stand up strong surveillance systems and seeing all of this local innovation to strengthen COVID-19. I am sure is going to translate into strengthening the overall integrated electronic systems and be able to really reach into more timely reporting and better data use and better coverage, even in complicated environments. So I thank you all to the presenters with this. We can close this particular session. I think the Zoom will stay open for the next session in line. But at this point, Max, I think we can stop the recording.


Space weather this week gets incredibly busy as we take a look at our earth-facing disc You can see a lot of regions in the north and in the south But take a look at the regions particularly in the north is where a lot of things going on in fact back on the 24th You can see region 3229 firing off an m3.7 class flare This solar flare actually also launched a solar radiation storm and an earth directed solar storm In fact the halo that we saw in coronagraphs was partially earth directed which meant it was kind of going off to the west But then another day passes and late on the 25th way I'm right there the region once again fires yet another flare this time was a M6.2 or 3 flare if I recall and it was an R2 radio blackout And this is a reasonably large enough blackout that we have to worry about Aviation and we do have to worry about those IKO advisories and on top of that We had yet another solar storm that was launched along with another radiation storm this time the chronograph show a full halo So this one is definitely earth directed. In fact, it should be close to a direct hit So we've got a one-two punch when it comes to solar storms We've got stepped up radiation storms that are occurring right now and that are ongoing and will continue to go And and stay elevated until these solar storms reach earth before things begin to calm down Meanwhile, we still have a lot of active regions on the earth-facing disc that are big flare players And we have a coronal hole that is rotating in through the earth strike zone and is giving us some fast Solar wind to boot. So my goodness everywhere you look there's something going on and that means we're gonna have earth effects Both in the day side the night side and at the poles For more details on this week's space weather including how these solar storms and these big flares might affect you Come check out my channel or see me at space weather woman comm


TLO what's poppin?  Oh my god We are not going to it or any of that with vlogging right now something real quick something real quick man. Just got finished bringing y'all Some heat now I got to try something Y'all keep telling me about this I keep seeing it Hey, y'all told me Hey, y'all keep telling me something to try.  I know y'all go crazy about your toast Some of y'all probably got the six-slot toaster or whatever, but you know, I don't need that type of energy I need a little bread Okay See what we doing here, can I post that up? Nope sure can't Sure can't buddy. How we look right? Okay. We look cool Keep my face in there. So basically a lot of y'all asking about my My PO box. Oh, why is it in Florida? I do live in Chicago.  Let's let's let's not play them type of games But you know remember I told y'all remember I did that pole Where should I be moving to Chicago a different neighborhood or should I move to Florida? Plus my parents my mom live in Florida and some of my cousins. So I've made my decision We're going to Florida, South Florida Miami. My lease here is up April 30th and That's in that's in that's in honestly, that's in 28 days on 28 days. I'll be in Florida, man. I took y'all advice I gotta get up out of here Everyday I wake up here. I'm like I just don't feel it. I don't feel it. Okay, so I'm gonna go get a toast on there boom Get that on there like that Yeah, man. I just don't feel it Like I'm going out. I'm having a good time But I go out here too, but in the back of my mind. It's like Man, I'm always watching my back 24-7 can't go anywhere without the block the block can't Can't I rather take the risk than you know what I'm saying I'm gonna put a little bit of butter on there Got some butter And my baby mama brought some baked beans for my daughter Got some baked beans some beans for my daughter. I just realized Oh, yeah So I'm gonna I'm gonna go ahead do this I'm trying to get real nifty on 50s Trying to encrypt my I gotta try this for the culture, man Y'all putting it in my comments way too much Y'all talking about toast With the beans the Heinz beans these is Heinz too.  I don't got a slice of cheese. I got cheddar cheese I don't know if that's the cheese y'all be using or not, but I'm gonna try it right.  There we go. I don't know how people vlog with their phones. I got a whole camera I should have used my camera We're here now Maybe I should use my there we go. I'm gonna use my left hand So y'all can get the good sound If the sound was messed up for the first two minutes my bad, gee I'm out of breath. It's here That's another thing I feel like Because I'm from Chicago like I'm doing a lot of great things obviously, you know, I'm saying with the help of y'all I'm doing a lot of good stuff But I feel like I can get to that next level if I'm like not in my environment if I'm taking if I take myself out of My comfort zone, you know, I'm saying I'm not saying I'm So I'm contradicting myself. I'm comfortable living in Chicago, of course because I'm from here. I lived here 30 something years You know what I'm saying, but but I feel like when people move out of their hometown, they flourish You know what I'm saying? So I want to try to flourish somewhere else, man So this enough beans because that's all I got Okay Boom. Got a good piece of toast The lit one cooks. This is hilarious Got a good piece of toast. Let me Microwave this real quick Gotta get a good sear on there Just got my butter gene Y'all hear them beans popping? Whoa chill in there That's the worst toast bread that you'll ever see. This is the worst.     I gotta melt this I can't just eat cheese straight like that. Yeah, so uh My daughter's coming with me as well and just yeah, man Gotta get out of here, man It's not like like every time I go outside the door like I don't fear for my life I just know my life is in the balance. You know what I'm saying?  Let's do this Just give me a headache just looking at this.   This should actually hit Hold on man.  Y'all which I'm trying to convert me. Dude. This should good Oh Hold on G hold on. You got to get leverage when you're eating something that's decent for the first time This seems like it would like be like like why haven't I tried how haven't we tried this decent as hell decent it need like some more like It's a little bland, but it's not bad. Like if I hold on Hold on G my bad.  I need some it's a little bit Hey shout out to y'all for watching me For watching me try beans and toast and cheese I'ma tell y'all about the aftermath too of my bad things.  This is good This shit good man Shout out to y'all man To y'all love me and leave a like comment subscribe turn on your post notification bells man Let me know in the comments and try to think about the move man. I'm still gonna be sending Chicago to the uk.  I'm going


Hello everybody and welcome back welcome back to another John Hammond YouTube video on the John Hammond channel I'm your host John Hammond that makes sense that Matt checks out. So here we go. Hopefully we're gonna have some fun today Hopefully fingers crossed. I'm super excited about this one I started to kind of pull the thread and I thought it seemed kind of fun and kind of interesting and kind of cool So I wanted to showcase it. I don't know how far we're gonna go with it But today's video is coming to you hot off the press by a wonderful anonymous Donator that was sending me a message. He said hey John. Hey, what's going on? I don't know a whole lot about reverse engineering. Look me either. I've been following your videos though. You're pretty entertaining to watch Thank you. I super appreciate that. Thanks so much. Anyway I got a juicy request to my HTTP server with the juicy elf payload And I thought I would send it along to you. Hey my bad if this isn't appropriate. Look bro people everybody I Can't say this enough like I am loving this I think this is hilarious and awesome by the way keep keep growing the content farm, please I'm gonna have it like on my tombstone. It's gonna be my yearbook quote I'm gonna have to just say my mantra like please send me malware Please send me malware.  Ladies and gentlemen, so take a look at this request I think this is kind of neat. This is supposedly maybe a spooky wookie attacker IP address so we could totally go look that up Today Yep today Hey, I got a get request to a setup dot CGI I'm assuming CGI file extension. Maybe maybe the attacker or whatever bad guy might be thinking like Oh, is there is there shell shock? Is there any availability for me to run commands? I don't have obviously no Perview as to what is running on this fellow server. Thank you anonymous donator for anything that you're willing to offer here But it Includes these arguments these HTTP arguments that say hey Let's get a file net keer dot CFG net gear config and to do is a CMD probably a system command right and the command is RM tech RF temp Everything in the temporary directory is going to be removed and deleted and then we will W get down This IP address 21136 174 137. Okay, and that is the same IP address here So that must be our bad guy on that port for 379 Mosey dot M Mosey Mosey, I don't know if I'm pronouncing that right TAC capital O flag right to save that output into a file with W get and it throws it into temp net gear And then we try and run net gear with sh and we have the current path Being root in current settings dot htm equals one It looks like this returns a 301 response code, which I think is HTTP response codes pretty sure that's a redirect, right? Let's just take a quick look Yeah, three three one move permanently This and all future requests should be directed to the given URI, which I think is just included it so it must have been a redirect but That straight up tells you like hey, let's uh I don't know if that command was succeeded But we still got some pretty interesting artifacts and kind of tell tales to explore and take a look at So the interesting thing here now that I want to know about is Is that file still live? Is that a does that exist? Is that a thing? So let's grab this And uh, I'll hop over to my Little Linux virtual machine here. There we go. I'm uh, I got my xfce rolling back up in here So I'll zoom in and I got a directory malware That I like to keep all my personal documents in So let's make a directory for mozi mozi.m You guys are gonna yell at me in the comments about how I pronounced that but that's okay You you yell at me for everything the way that I pronounce everything. Let's kind of let's try and W get this down Shall we let's W get that guy It's cruising. We got it. All right, so, uh The generous anonymous e-mailer told me that that was uh An el file. So we're going to get to do some Linux stuff today But uh, let's take a look at really what this is It is an el file, right as they say 32 bit MIPS, I thought was kind of interesting. So the MIPS architecture now I am not educated whatsoever But some of you folks that may have sat through a computer science degree You're probably a little bit more familiar with MIPS than I am So hey, I'm putting this video out there. So I can learn it just as much as you can maybe if you do but Knowing what that thing is now. Let's just kind of experiment with it and explore it. Um, I'm not positive though Is like is this already going to set off the alarm bells and whistles like yo This is a virus This is malware. So, uh, let's just toss the thing the way that it stands right now into like virus total Um, so let me get there to virus total dot com And we can upload a file That I have this malware And It lights up like a christmas tree That's pretty that's pretty slick Like obviously horrendous and bad but also kind of slick. Uh, Linux Trojan. Oh a lot of community posts Ooh 21 minutes ago Dude, this is like hot off the press guys taking it right out of the oven Yep More Shady IP addresses. Oh, we should look at that IP. We should we should do it Um, I'm gonna have to like blur it out when it shows my IP address again IP locator Um, I'm pretty sure I used this one. Did I?  I pasted it in ooh That IP address is country korea And city is sold It's okay Take that for what you will ladies and gentlemen Let's close out of that tab before I accidentally leak my IP address repeatedly as I produce public videos on malware analysis and just general malware things I don't know if I'd go so far to say malware analysis because I don't know what I'm doing So we've got this file here, right? It's a MIPS compiled binary 32 bit. Let's just kind of you know do the only thing that we know how to do run strings Uh, so I'll pass that in And I immediately see some oddballs of upx Um, let's pipe that to less and see if there's any goodness in there. Yep immediate header with upx Scrolling down down Baby, you're going down swinging. I don't know how that song goes It's sugar sugar. We're going down swinging by uh Green day The the greatest crossover between green day and Beyonce Lot of nonsense in here ladies and gentlemen And nothing actually interesting so far. However, we did see upx So I'm waiting for that like upx telltale that like hey This is packed with upx Just letting you know I love that. It's just so generous and tells us like hey Okay, seriously, where where's the good stuff? Where it All right, I promise we'll get to something soon If not, if not, I'll skip ahead Whoa I saw I saw like a watt A lot of quotes in there blah blah blah This is kind of what I do though I'll just pipe the strings output to less and then just scroll through all of it no matter how awful and bad it is Um, because you might you might find some good stuff in there At some point you could obviously like trim this output down If you were to use like a strings tack n, uh, you can specify like the number of characters That strings will return to you or like the minimum number of characters So if you were to say strings tack n eight, then you could only get things that are eight characters on length or longer And that is typically good and you can kind of CDN CGI HTTP with the little user agent header socket roar Which means a var directory. I'm assuming that's half of the word config Some of these things might be kind of broken because of, uh The way that it's packed. Yeah All right, so I see a By uw and looks like this looks like seemingly a schema like a colon slash slash It's like an HTTP schema. Maybe is it trying to go to a website? Are there any comms around? We could like use a forward slash while we're searching through less or something if we really wanted to but Nothing gonna be run Good old letters the old alphabet Okay Okay My attention span is falling down. Uh, so I would assume that yours is too Let's scoot on ahead here. I see a new I see a search um OS oh that's got to be like a post That ost he must have been a post G-pun form dyke and a host looks like it's going to be the start of Local host one two seven zero zero one connection. Keep alive a low name More HTTP schemas something.xml This is packed. So honestly, we should just probably unpack it. Hawaii. Whoa. What did I just see? Okay, okay We'll take that for what it's worth dot com Etc etc etc etc. Oh, there we go. There we go. There we go. There's smoking gun Prott exec and prott right failed. So are there like messages to like Explain how it's going to end up allocating memory if it does some prox self exe some prox self in there So it might be doing some interesting stuff But okay, uh, if you want to wear by the way before I just immediately steamroll right over that The slash prok file system that portion of the file system in linux If you go into self you can get some kind of neat and interesting Peculiar as you guys know is my favorite word Uh, you can see some really interesting stuff on like the current running process So if you have local file inclusion, if you're doing some like red teamy pentest ctf bug bounty stuff Uh, you can kind of get an idea of like, what is the command line that was used to invoke this process? What does that look like? Um, you can get like look into memory sometimes you can look into the exe the current directory Etc. Etc. But this file is packed with the upx executable packer that you can go find online So we should go do that Um, I do already have Uh, upx already downloaded and installed Um, but if you don't I'll just kind of cruise through how you can get it Google it And then go to their website Uh, get the source on github and then you can like download any of the releases if you want I think the web page actually yeah, there's a button to download the latest release, which is what you want to do Uh, so grab whatever operating system architecture thing that you're working on. I was a amd64 on linux so In my op directory, I have a good old upx program in the upx folder. So I could Um, let's actually make a copy of it because I don't want to clobber the original Um, so let's copy mosey to spooky dot elf because I think that's appropriately named opt upx upx tack d to unpack or like decompress, right? Uh, spooky dot elf I'm gonna zoom out real quick because I realized that output is kind of getting clobbered um Can't unpack exception P info is corrupted. So it tried to unpack it, but it erred I have never seen that happen Why why did you do that? Why did you fail? Is this Is that because it's like MIPS or something? What is that error? Uh, you can see that my links are purple here because I have recently visited these pages So this is what I said. I kind of like pulled the thread on here. I kind of like just wanted to see Hey, is this going to have some really good runway? Turns out it does. So, uh, You can see that I've gotten this far but uh Let me let me explore through some of these articles because actually this is this is where I cut myself off I saw this and I was like, oh We have something here boys An elf file was recovered from the following g-pawn router authentication bypass and command injection attempt so we saw that g-pawn reference in the strings and Take a look at this The wget Is kind of the exact same like structure in a weird way I mean, I guess whatever you could really say that. Oh, yeah, they're just running a wget command the syntax for that's not really going to vary It's a wget httpx the url on a port to download Um a mozi dot m, but it was the exact same file name exact same location Outputted to another temporary directory And invoked with sh the same thing ours was neat That up act elf file has 36 out of 58 detections on virus total and what did ours have like 40 out of a gajillion No 40 out of 62 Everyone's like that's bad. Hey, if you don't know That's a bad one some uh some cool Details though like shah hashing, etc. Anyway, let's get back to the good stuff They decided That uh, they would do the exact same thing that I did and I haven't fully read through this I just kind of saw like oh that's enough breadcrumbs for me to realize we're looking at the same thing here uh Thread analysis t serve vini tsr vini Kudos to you and thank you. I don't see a date on this article yet But I think you might help me here because when you try to unpack this Executable this el file with upx you get the same error p info corrupted Turns out and this is me learning right? I haven't done this yet, but I want to see if I can unpack it the same way that they do P info is a 12 byte section in the upx packed program header below it can be inserved filled with zeros So that's going to be at hex offset 80 to about the last Four bytes at the end there. So let's see if ours has the exact same setup. I will hex edit Excuse me I don't think even have hex edit installed here This is the virtual machine on my new rig. So I'm a little uh I'm kind of a fish out of water right now But we're still making content. We're still still hanging out on the youtube's. Okay, so um Um, they didn't exactly, uh order the Hex edit decided not to give me the flat nice, uh, ranges here that I would have liked Maybe I need to zoom in or out a little bit more. No It's just gonna do whatever. Let's just get to hex 80. You can see it kind of down at the bottom there Let's go to hex 80 Also filled with zeros 12 sections uh-huh Okay, so we know what we're up against Let's uh, let's get back to that article here P info is the size of the unpacked file P info and p file size contain the same value P file size is found at the end of the file shown in blue hex Is that a location? No, no, no that is the those are the bytes that I find Okay so Five through 12 in p info the last eight Need to be the exact same value that we would find in uh The p file size at the bottom right That's the way i'm understanding this so far So if I go down to the very very bottom of the file look for that hex 50 Kind of denoting that end there and then Let's see the four bytes before it They use a and then it's gonna be an endianness. So all right. Let's go to the very end of the program How do I get can I get to the end here? Yeah, new position the very end. Thanks. Oh, come on.  Come on My alt end my alt is not working We're almost at the end We'll just Whatever We're at the end. Okay So They have these zeroes up to an 80 right good and then This tack a and then three no that three They only have a two two zeroes there and then a 50. So I don't have a 50 Do you have a 50 if you have a 50 go fish or like bingo, whatever So the bytes there I'm assuming are the size. So c8 e three zero five zero zero Um, let's keep track of that Boom giant terminal. Let's just get nano open. Um, and it should be Now that I've totally resized my screen c8 e three and like this is a guess I could be wrong and if I am I'm sure you guys are screaming at your computer as you always do to tell me that I'm wrong but uh now Let's go back to very very top And get back to our hex 80 where the p info starts and The five through 12. So the last ones here Need to match what we just saved, right? That's exactly what they had done. Yep seven c2 a zero four zero zero. They added that there There's a four background there. So let's try it. Let's do a c8 e three zero five zero zero c three Oh, no I was wrong I caught myself though That's what they say if you fail Try try again And fail again Okay, I've saved it And now those values are there Okay, um Let's try to unpack it again. Ladies and gentlemen to a little upx upx tactee spooky Unpacked one file. We did it success I like doing the like super smash brothers like I like their voice of success That makes me laugh. All right. So now we got spooky And we don't need that nano over there on the side anymore. So he can die Let's check out what we got now Okay Now we should not have any of those obfuscated or like the crazy pack random strength So now we should be able to at least kind of make sense of it a little bit more Or be able to see those other strings like as they are in plain text Obviously, I'm just looking at strings right now Like if I were to hop this open If I were to crack this open like hopper or something then maybe we could understand it a little bit more I don't know exactly how much of that I want to dive into because we have yet to research What this thing is truthfully If there are already blog posts examining how to open this up with upx what we just did I'm sure there's going to end up being some other research on like What this thing is, especially if it keeps distributing itself with this name mozi.m or Again pronounce it however you want, but we can see the post requests there clear plain as day var dot ipds dot config Host here Some other I mean google dns. What is this one? Is that a dns resolver?  I'm in the spooky part of the internet again guys All I did was google Is that like their own? Warning notification regarding the abnormal operation of How did I get to amazon customer support? Did I click? Oh, no, that's genuine What What is this? Let me read this to you. Let me let me put a quick bedtime story on this one Can you explain why the camera sends data and sends back to Chinese servers via ip address 114 114 114 almost all the time? Asked on july 13 and 2017 Answer Because the chinese camera hard coded this feature into the cameras. This is a udp dns server That's what it's supposed to be. You can mask port 53 to do anything even provide data such as video to an application server in china I don't want to panic that the chinese are watching us since they have sold so many of these cameras the us consumer But i'm not sure what data these cameras are sending back to china or whoever is behind this product to test and see What ips are being used put the camera behind a firewall and check the firewall logs, etc, etc Did you find this helpful? So look look uh, let me let me add my disclaimer Let me say this is all for educational awareness helping cyber security professionals become less professional um I don't know. I don't have the answers. I have no idea what this is or what it's doing yet Um, so i'm i'm gonna learn i'm here to learn. We're we're still following along Here we go. What is this thing? Ant pool What is ant pool? Mining devices worked abnormally due to the failure of the mining address resolution I don't Know about that one What Nor do I exactly care in all honesty um Ant pool world-leaning bitcoin mining pool. Did you see my title up there just changed to something completely different I saw some uh, I saw some peculiar characters Let me go back to that. Can I can I like follow that request if I had f12 Can I see like where that might take me go? I didn't I didn't look I didn't see it. I didn't I didn't stop to see how it looked, but I think Uh, you know, I don't want to go down this rabbit hole truth be told. I'm not I'm not exactly positive But I swear to goodness we can like Replay the video and freeze frame slow motion or something like did my did my HTTP title there changing to something really wonky. Anyway, we don't need to be mining any bitcoin in today's video So let's keep going File system stuff downloading binaries octet stream Potentially looking oh, I just dragged myself away on accident Okay crisis averted. I was just trying to like highlight this uh potentially anyway getting our ip address What else we got GPON 8080 real tech are these like a list of default passwords or something? I don't know. I don't know. I might just like like have that thought in my head. Maybe I'm a bad guy Potentially persistent stuff stuff to uh kickstart right when the computer begins cfg tool internet gateway to my what is this What is this again? I'm literally just looking at strings. This is not taking any any skills whatsoever I just tend to do this to explore equip.sh Wi-Fi.sh Wi-Fi performance.sh all these other files. Are they being referenced or like called and included? destination port Is it just turning on turning off firewall rules dropping those ports? Removing a web shell cmd Send commands I assume that that is functionality that we just have baked in via this malware to set Manage What just to set like command and control step? I don't know Either way, it's spooky hence the name spook Hence the name spooky dot elf data stuff et cetera opening up firewall Actually that time though except except except passing in the port via some format This note doesn't accept announces All these other potential callbacks timeouts This is just straight html and javascript though What is that doing there? Is it genuinely going to end up doing some like Mining stuff like crypto miner. I don't know speculation. I'm over here in speculation corner everybody I'm turning on IP address forwarding. I'm assuming that's why they would have that path again I still don't know what they're doing with it yet Everyone's screaming at me like john Just open the thing in in hopper or ghedra or something other than strings in your terminal No dad you're not my real dad um busybox What is it doing dd Is it like destroying files? No What busybox dd block size 52 count of one uh input file is bin ls Or busybox cat bin ls Or wow read i do print f i These are all just to get the just to get the ls command Or wow read i do print f i done busybox Why are you doing that? Why are you getting the contents of the ls binary? Whatever a lot of w gets Wait, what is all this? Telnet session now an established state remote management console some other potential routers Hostname stuff Telnet sessions telnet sessions samsung electronics com trend gigabit dd wrt What is all this? Maintenance shell welcome visiting hawaii home. Yeah, is that so? List of potential usernames and potential passwords. I'm thinking again All right Don't show those Why are these in the binary? I mean it makes sense right? It makes sense get mosey dot six What is that a thing and mosey dot seven? What Let's I want to see if those exist real quick Do I still have that w yet? Oh Sorry Is there a mosey dot six? Is it the exact same thing? Let's do a shot 256 some on mosey everything. They are they are they are the exact same hash How about a good old mosey dot seven? Do you exist? Why are there like duplicates? What is it mosey dot like anything is there a mosey dot z Or f f in the chat Oh, sorry f Okay, you know what we're moving on How much further am I in these? Yeah, there's a mosey dot a And a mosey dot s and r and b Why are these all here? They're all the same file Okay, okay, let's Let me put my money where my mouth is right. Sorry for that. Uh, sorry for that Oh That's the exact same Syntax we saw in the article user agent is hello world Let's What echo death Excuse me That's a lot of echo deaths. It's probably something to do with that soap protocol HTTP pure networks hnappy. I was getting to an idea. I genuinely was I was genuinely Thinking to myself. I should put my money where my mouth is look at all these get requests. I keep getting distracted I'm sorry. I was generally thinking I should just open this up and hopper Although I don't think I actually have hopper like installed and downloaded on this box yet But okay, we're at the end. We're just about at the end. We literally we're literally at the end I'm pretty sure We did it We successfully scrolled through all of the strings output of that malware sample. Um, let's find out if this Is uh going to actually get more or less Detections 39 What's that community tab say?   Actually, I think I still have a hopper license Um, let's get the dead package Yeah That's downloaded capital H for that hopper And we're cruising No, we're not there was an error You need python 2 What are all these things that you need? Why? Uh Is it is it fixed broken fixed actually spelled out broken that I need to do.  And yeah, just disassemble it dude. That's not hard Look at that string. That's lovely um procedures Is there an entry point or anything immediately worthwhile that I could use Maybe gijo would be able to do a good analysis on this too Probably better than maybe better than what hopper is trying to do because I would like to be able to see If anything else comes from this but Um, all of these strings I think I told it like hey, it was an intel processor when I think I should have told it. It was mips I don't know if that'll actually do anything or not though And I realize this is kind of hard to see So forgive me Is that does that have an href? Is it actually being called anywhere or used? Hey, uh, john hammond from the future here. I was editing this video and uh, I thought you know what? I should really kind of do the due diligence to open this up in gijo and see if I can get anything out just to showcase it Uh, so it obviously is a mips thing. It's mips processor And I don't actually like have that on my desktop computer. I think so, uh, maybe I'm again wrong in that So I would appreciate your input your feedback your constructive criticism constructive criticism in the comments But uh, I don't know if I'd really be able to showcase that Look, look at this. Look at this. I don't know if uh, all right.  It tells me like look, I don't have actually a provider for that. So Big sad the big cry Anyway, that's kind of just me wanting to cover my bases before everyone's like john you didn't do Uh, whatever. I'm sorry. I'm sorry.  Uh, let me get you back to the video. Peace Again, I don't know exactly how far down the rabbit hole I want to go in this and hopper right now because I think the more fun. Yeah I think the more fun and cool and interesting stuff is going to be that what comes from the research Truthfully because I think this is already a well-known But malware so I'm just clicking around and hopper to uh Say that I did Great we did I should get gdra on this box though at some point. I'll do that after this video because For those of you that want it you can probably download this Still you probably download that binary I don't know how long it's going to be up. Let me finish up this uh This article here Yep They Checked it in virus total. They they they checked their unpacked version And they found the same domains that I had with floss Just looking at strings. That's really the only malware analysis route that there is I'm kidding. I'm kidding. That's a joke. Please I pee addresses those commands that we saw Yeah, dude. We saw that same not itms We saw that same one for the management server I was our password the same Let me look for that. We had a strings on spooky Uh, let's go for less one more time Was our password I not Not itms. Yep Where's the password um does it Does it not include it in this in the sample? Because those are the same exact commands. No, no, no, they were using config tool Cfg tool Is that referenced? Yeah Create request password acs mozi and that is the same Nice See how much you can pillage just with strings Okay, so jeep on real tech netgear all those exploits are the same things that we had seen We saw the ip tables commands to open the firewall and that's craziness Literally just running strings Don't obfuscate malware authors. Who cares? What else did we got here? Mozi yep, everyone knows about this thing. This is back in like what 2019 Uh upx Okay, cool. So we all ran into the exact same wall. That must be like a known trick That must be some of their ttps their tradecraft techniques and procedures um They fix it up, but they did in a crazy way with visual studio Oh, I don't know Now they know they just kind of actually figured out what upx is doing there smarter than me Okay Yeah, mal share has it too Is that the mal share one now? Is it different one? Let's check out malware Operators have moved away from you being using upx for obfuscation Or this was just uploaded without packing without being packed by mistake YAR rules to detect this sort of stuff Okay, okay, that's enough on that one Malshare.com has a secure connection filled. I don't know if I like that That's giving me the uneasy feeling Primer on packing this is basically doing everything that we had just done as well. Yep info corrupted and corrected Yep. Yep. Yep mosey Okay, this is a prevalent iot malware In 2020 Is it I mean obviously it's still going on because we found this thing today. Thank you anonymous donator. Please send me mail um Not that I've really done anything interesting with this. I just kind of wanted to put it in the spotlight Oh, they're using redare too. Oh these guys are late. Okay. Okay, that's the end The Still spooks me Mosey mazai malware What do we got a lot of there's a lot of stuff out here for this thing I just kind of want to scroll through some of these What did this get released 2020?  Well now you see proof ladies and gentlemen you saw it here We saw it today March 1st 2021 It's still alive and well Peer-to-peer botnets are uh still kicking it Oh god that title a new botnet just mosey'd into town. Oh I want to pry my eyes out Hey, uh, john hymn from the future again I actually went back to go take a look at that a security intelligence article the one with the Funny name that I was laughing at that actually has some really cool and good behavior analysis And like breakdown uh much better than kind of I did in this video. So if you're interested, uh, you can go take a look Hitting that continue reading button will give you a little bit more technical depth as to what the thing does You can see kind of that original stager that we had found to begin with Uh, and then it's sort of the breaks down into the other cvs or vulnerabilities that thing tries to take advantage of Across all these different devices You can see some of the actual file paths that we saw and what it would end up doing with those like hey It'll try to kill the things that are using the ports that it might end up using later on looks for python changes process name sshd, which is kind of interesting and drop bear as another okay kind of ad hoc in place sshd It's service. Um, it does some elliptic curve digital signature Algorithm cryptography, which is interesting. Um, and then you could see again that list of uh indicators or those URLs It might reach out to um It does list for files and stuff or I think that's just their yeah Yeah, that's just their analysis of some of the files hashes, etc But uh, the peculiar things that it will get into actual geedra code that I was unable to get into Uh, truthfully that's because I suck and I'm bad and I just kind of want to Showcase and uh put this in the limelight for you all Uh, those ip tables commands that we saw right, which I think is is crazy cool Uh, grabbing those ports that it might end up using And there's some other neat stuff in here. Yeah, the static analysis you can see the config file And how it's going to end up putting that together. It actually uses xor to kind of somewhat obfuscate some things But of course, it's a hard coded key. So you could see really the same thing that honestly, I think we saw At least the structure like those beginning and ending tags in our string output And uh, yeah those multiple commands that it could end up using within that neat neat stuff that xor key yet again And the telnet login information or the enumeration that I ended up grabbing Actually does have that hard coded list of credentials. So that was right on the money what we were thinking earlier kind of neat to see all these in here And uh, hopefully that goes to show it just we'll try to brute force these and see what more it could get into Uh, those other different file names that we saw mozi.a mozi.m etc etc Once it's unpacked you can see all these different user agents that it might end up using other Interesting strings that's config file that it creates etc etc etc So that was super cool that was super good and I would just steam rolled right through it But I didn't want to bring that to your attention Because truthfully that did much much more than what I was able to showcase in this video But hey, I'm all for it. I just want to put this in the limelight. I just want to showcase I just want to bring this and unearth this even if this is september 17th 2020 There's some really great stuff in that so thanks back to the video Wow Oh, yeah malo has been active since late 2019. Oh, he's still um still active I mean supposedly it's not I don't know. I can't say like hey I see this one server that got hit with it and now I know that it's a widespread attack The world is in chaos. I can't say that it's just We kind of stumbled across this sample but Ladies and gentlemen if you want Host some http servers and just see if you get hits on this Just throw out your honeypots and see if the bees come All right, I think that's all we're gonna end up doing in this video We've been cruising for a little bit and truthfully I didn't I didn't end up doing anything New or innovative other than that up x trick But it's kind of interesting to see the conversations and the The discussion around this yet. So we saw some yara signature or something we could do about those up x tricks We kind of understood what this thing was it told us right away It all seemed to be using similar trade craft and the way that it's downloading itself and other We could see remnants of persistence in the strings. So there was a lot I think still interesting in this I hope hopefully you're not going to scream at me for like john You're just using the strings command. Look, dude, if it's not obfuscated You can at least get a lot of potential insight as to what that thing is doing. So That's it That's it. That's all Yeah What else do we do now ladies and gentlemen, I don't think that there's anything left I think we just kick it to the outro. So hey, thank you so much for watching this video If you guys like this video, please do all those youtube algorithm things Please do like the video. Please do type in the comments, you know, I would super appreciate that It helps the youtube algorithm engagement stuff and subscribe if you'd be willing If you actually click the bell hit the bell smash that bell Destroy literally annihilate the bell It will notify you when I post new videos like this So if you're interested if you're having fun with these if these are entertaining and educational and I don't know. I I really would appreciate that and thanks for helping the channel grow. So That's it. Thanks everybody. I love you. I'll see you in the next video.


Let's see what's on thinking man's mind today. Your hat says safety on it. What does that mean? That's a great question. Come on in and let's talk about it. But first, I want to wish Door Hardware Nerds a big, happy birthday. It's their two-year anniversary, two-year birthday, and it's been a wonderful time being able to share Code Corner with you every third Wednesday of each month. To get to the point of the question, why do we have codes and standards in the first place, and what is safe purity? Well, one of the items when it comes to codes and standards is to provide a minimum requirements for safeguarding life, health, public welfare, and property protection. And the main threat that the building codes work against is fire, if there's a fire situation. But owners do care about security, not just for theft of items, but security of the people that they're trying to protect. And so we have to walk that fine balance between life safety requirements as well as security requirements, especially now that we have more and more active shooters at schools and other locations and things like that. So we can't throw out 100 plus years of building codes just as reactionary for what's going on in the country nowadays. So life safety is important. Security is important. I've seen schools that barricade using two by fours or they put chains on. That is not safe purity. Safe purity is that balance between life safety and security where you still provide free egress or maybe one additional operation as long as first responders can still get in. Or just being able to provide electrified hardware for access control that can keep track of where people are in a building, things like that. We still have free egress. We still have a way to get out if there is an issue, but we have the security that's needed for the building. For more information and continuing education opportunities, please visit Asa Abloy Academy by clicking in the link in the comments below. You can also please click like and subscribe to this channel. You can follow me on Twitter at art consultant and or connect with me on LinkedIn for updates. And if you have a code question, feel free to email me kathryn.flower at asaabloy.com. Thanks for joining me in the code corner today. My name is Katie Flower, and my goal is to help you achieve safe purity in the built environment.


Who is the individual who has done the most to promote liberty, who is undervalued in this regard? Ooh. It has to be someone fairly terrible in my mind, because it has to be a counter-example. I'm going to go with Joe Stalin. Please explain. It's a pretty good example of what happens when you don't have it. Some of us might think it's a more relevant example than others. I'm not revealing anything that you might not know. But I think counter-examples are probably more powerful than anything else. That counter-example of what happens when you take liberty away, I think will be with us for a really long time. And I don't think we're near there yet. I might be a raving lunatic, but I'm not that much of a raving lunatic. But I wouldn't have wished it. It wasn't worth the cost. But he's helped the cause of liberty. Thank you. Joe.