Is there a chat to Okay, we're live Yes, there is a chat Dave. It's on the left side. You click the button to the left. It looks like a sort of dialogue box The green arrow so screen share. No the one above that Anyway, go ahead. Okay So thanks everyone for coming today. We are lucky to have with us Dave wickers Dave is one of the founders of the open web application security project And also founded aspect security. He's a well-known security evangelist and security practitioner Focusing on software security and he's been around in the community for a while He's one of the people who welcomed me into the fold and into the practice of application security like 11 years ago now and Dave is he's been the he was previously the sort of like project steward of the OWASP top 10 and he is Going to present to us this in this presentation about the 2017 OWASP top 10 which Dave did not steward but Has intimate knowledge of and is able to speak to and I thought it'd be useful to have an outside expert Come in and give us some of their ideas about the recent changes in the top 10 So I'm going to hand it over to Dave right now Hey, thanks So I can share my screen somehow Yes with this green button And then I got to find the presentation Which I don't see No, I'm not a There you go. You guys see my screen see my presentation. Yep All right All right, so thanks for the introduction. I have a little bit of news to which is kind of interesting So as was mentioned, I was the top 10 project lead From basically its inception through the middle of last year for various reasons Jeff Williams and I was my colleague we decided that handing the project off to new leadership was In the best interests in the of the project and ourselves actually So we handed it off to Andrew Vanderstock and some other guys and they did a great job at taking the release candidate that we wrote and Stewarding that to a final release And so that's what I'm gonna be talking about today is the final version of the OWASP top 10 Which is similar to but not identical to the release candidate that we originally produced. I was also on the OS board for about 10 years. I Am or now was a co-founder of aspect security But we were just acquired by Ernst & Young so I now am an executive director at Ernst & Young So anyway, that's a little bit about me. I've been doing a sec for 30 years ish 2027 anyway a long time. So I have a little bit of background in this space So the slides that I'm going to present by the way, there's about 40 of them and It's way too many to really present them in the detail. They deserve so I'm going to highlight What I think is important particularly focusing on what's new and I'm happy to provide a copy of the slides to you guys, so I'll send that to someone in the Foundation and they can distribute it to the attendees or posted on your website or how we want to distribute it and in fact something similar to this might get posted at OWASP as a You know the description of the of the top 10 from a presentation perspective So what is the top 10 at OWASP? It's not a standard although a lot of people treat it as such. It's intended to be an awareness document of the 10 Most important risks you should probably focus on first and there's certainly many more Including things that fell out of the top 10 over the years It's been around since 2003. It's it's a de facto standard now because most of the application security community Or at least the web security community specifically looks at it as like the flagship Thing to focus on and it's been released about every three or four years since its inception So this is what is in the top 10? 2017 There's a lot of familiar faces here. In fact some of these things have been in there since the 2003 release Which is kind of disheartening Like cross-aid scripting and injection and so on and so forth But there are three new ones this year two of them are XML external entity injection and Insecure deserialization Hey Dave good.  Are you in presentation mode or I am Can you so maybe the presentation doesn't is it? What slide do you see now I still see like The slideshow view well, I see like I just see PowerPoint. I see like the sidebar with all this Wonder if I have to tell Google somehow to share that I just tell them to share my entire screen take it off presenter views No, if I go to screen share can I just say share entire screen? You can do share entire there's full screen there. Let me try that and then let me go here And let me go Here is that better? Yes much better And so now you see this transition When the red box came up. Yes. Yep. All right. Thank you for chiming in and tell me I wasn't doing it right So a for which I'll go into detail later are Kind of good meaty new technical security issues That we've been seeing a lot of lately And so having them show up at the OS top 10. I think is a great Edition Because it gets some focus on these particular issues, which is the whole point of the OS top 10 Obviously some things fell off like cross site request forgery and Unsecure redirects and forwards, which are still of course important security issues That you should deal with and avoid in your web apps, but they didn't make the top 10 list this time But I think that's okay because giving some sunshine to some of the newer issues Uh and these are based on risk the top 10 is not based on prevalence Or how new it is But it's based on The risk to the application and the data that it processes And so xxc and deserialization vulnerabilities are Big deals. I mean even if they aren't incredibly common When you do have these risks they introduce a lot of risk to the Application and its data. So it's a risk-based analysis that caused These two items to get added to the top 10 And a third item got added to the top 10 this year. So this is not common to have three New items in the OS top 10 But that's that's okay And this last one's kind of a interesting risk It's not really a vulnerability. It's about the fact that applications Frequently have insufficient application layer security logging And of course then the correlation that you also Probably don't have good monitoring now. Obviously if you don't have any logging then there's nothing to monitor. So Clearly logging is a prerequisite to good monitoring but the lack of This logging and monitoring introduces risk Because attackers can typically attack your application with impunity Until they find an exploitable vulnerability Which is why a 10 got added to the top 10 list Uh in this release of the top 10. So I'll talk about all these in more detail in a moment As I mentioned, it's about risks Not just vulnerabilities. And in fact, the Number 10 that I just mentioned Is technically not even a vulnerability. It's a lack of a security feature it's not even A control per se in the traditional sense But I actually think it is a fundamental security control that applications need And frequently don't have or or just barely have And they're nowhere near sufficient to what they really need to be doing to Reduce risk to your application So the top 10 is as I said, it's based on risk. So we have a risk rating methodology That's based on a generic OWASP risk risk rating methodology that's been out at OWASP for years And we basically came up with a very simple formula That says hey looking at the threat agent and how it works. We're going to look at the likelihood That you have this vulnerability in your application The likelihood that an attacker could Detect it And then the likelihood that the attacker could Successfully exploit it So we give a ranking from one to three For each of those ratings And we average those numbers. So that's what these first three columns here are So we give you a score. We average them. So in this case, we're doing injection, which is A1 and that was the most severe risk in the top 10 And the average ranking of these three is 2.6 and 2.6 out of three is a pretty high number And then of course if the attacker successfully Finds and exploits an injection vulnerability The typical impact is very high or we call severe in this case Which is also a three. There is no higher number there So that causes this to have a very high risk rating, which is why it's number one in our list And all these numbers and these risk ratings are listed on every Page of the OWASP top 10 itself And in fact if I let me jump out real quick and go to a browser and See if I can bring up the top 10 document itself So go here Go here So the top 10 itself is a pdf document. That's about 30 odd pages There's some introductory material and there's some conclusion material But the bulk of it is the The 10 pages of the risks and each risk is documented on one page So for example if I go to the next one You can see that it's got a score of three to two On the likelihood factors and an impact of three Which is why it's ranked number two instead of number one now these of course risk rating factors are completely generic They're independent of any particular organization Or application or the data So when you're doing risk ratings You need to think about What these risk scores make sense and for your applications or your organization And that might cause the order of these risks to change for you And that's totally fine because You need to do your own risk analysis and your own risk decisions We've just sort of done a generic one to give people a sense of the priority But I wouldn't get too hung up on the order Of the top 10 They're all pretty important But of course, you know things you know the top are usually more important than things towards the bottom So anyway, we added three risks We merged two into one to make some room and we moved the priority of three of them That's not a big deal The methodology for producing it keeps evolving We've been doing more and more data calls getting more people involved in Providing there both broad data and their in their opinion The new top 10 team led by Andrew Did a data call when Jeff and I had already done a data call, but that's okay More data is is good Allowed in the doom with some deeper analysis We're also making this data publicly available So we can imagine people doing other interesting analysis on this data And in fact, I think this is the first time we've really made the data public through olas before the contributors made their data public But the format was inconsistent and wasn't all together so it made it hard to analyze the data Now it's all publicly available in a single source in a single format That allows people to do some interesting analysis Uh on that data Um, so this is a picture right out of the olas top 10 that just shows the changes Between the previous version and the current version And as you can see, you know a few items just transferred straight across no change Three of them moved around two got merged and these three brand new ones Showed up This one this one and this one and those are the ones I'll tend to focus on Um, so that's what's changed So let's the the rest of the presentation is really and it's like 40 odd slides and I can't spend You know a minute on each slide because we go way over on time, but in each one I go through, you know, what's the basic risk uh an example And then what are the best? You know the current techniques for avoiding that particular risk And so some of these are going to go through quicker than others because they're Probably old hat to you guys Um, one of the things that's changed a lot and so I'll skip ahead for a second. I'll come back but over the years OAS has been really whoops OAS has been really focused Uh on producing this series of cheat sheets We wrote the first OAS prevention cheat sheet or defense cheat sheet. There's an inconsistency there, but um These are cheat sheets to help developers learn the most brutally effective and efficient techniques for avoiding vulnerabilities And we started out with one on cross side scripting way back and like I think it was 2007 not about 2010, but I think it was 2007 And then in the last 10 years that's grown into like 50 cheat sheets on various topics not all of them are Great and wonderful, but a lot of them are really good And they allow you to really focus on that particular issue and the best way to deal with it so You know, I can say stuff in this hour that we're going to be talking Um, but in terms of a takeaway if you just learn, oh, there's a series of cheat sheets on the top 10 topics And in fact many more there's 30 or 40 of them Knowing that they're there going out there using those cheat sheets telling your friends about them And in fact providing feedback to the authors of the cheat sheets would be fantastic, particularly if they don't An address a kind of technology or issue you're dealing with um, let the author know and frequently they'll Do some research and they'll get some friends and they'll figure it out Give you an answer and they'll add it to the cheat sheet. So everybody benefits From that research and knowledge being in in one place. So And pretty much every item in the top 10, there's at least one cheat sheet Related to that topic and in fact in some cases there are a bunch of them like this one for example lists four kinds of injection Uh defenses for each in a different cheat sheet, which is a fantastic resource So let me go back real quick So what is injection? I mean Most of you if you know anything about software security at all are familiar with SQL injection as like a big big deal Uh, and it is from a risk perspective. It's also very very easy to avoid Because there are very straightforward techniques for avoiding SQL injection So the generic generic problem of any kind of injection is you're using an interpreter to process a command Like call the database or shell out to the operating system or what have you And you're combining user data with the code of the query or command And that user data is added unsafely To this command in such a way where that data can become code And now you have user supplied data Executing as code in some interpreter somewhere and that obviously can be really bad pretty much game over depending on the interpreter you're using Allowing the attacker to completely take over the server or the application or both and in fact Frequently then being able to pivot off that server and go off to go after everything else on that same subnet Or wherever wherever that application is hosted So we we typically think of this as SQL injection is the big problem and it certainly is But there's many many other kinds of interpreters as I've mentioned So be be very familiar with The interpreters you're using and make sure you're using them safely So here's a very simple example of a SQL injection You know you've got a form is taking two parameters from a user and account number in a skew The developer blindly appends the user supplied data To the query in this case is the red text that's being appended Uh when that query gets past the database the database doesn't know that the black text Is from the developer and the red text is from the user It treats it all as one string that it assumes is safe It executes the query and if any data comes back it sends all that back to the application Then the application might in turn send the first row of data in this example back to the user Or I might send all the data back to the user depending on how the application is is coded So this is the classic SQL injection issue Luckily, it's very easy to avoid this problem first off The primary recommendation in all cases is can you avoid the interpreter entirely? Is there some way of doing the same functionality? Without calling an interpreter or a shell Uh, that's the obvious best answer like why are you shelling out to the operating system? Can't you do that natively in whatever programming language you're using for example? um If you can't avoid the interpreter then look for an interface to that interpreter that's aware of data versus code And use it like in sequel they have the concept of prepared statements That have bind variables where you're making it very clear. What's data and what's code? And no matter what you pass in as data, it's going to be treated as data and never executed Uh, there's other things you can do of course input validation Uh reducing privilege so on and so forth But the primary thing is making sure that data is always treated as data However, you can do that in that particular interpreter So that's the classic risk That's injection that's been number one in the os top 10 for the last three or four releases of the top 10 Two is a combination well as is the was broken authentication It was also called broken authentication and session management before It's the same exact thing as it was before, you know, how strong is your authentication? You store the user's credentials safely through strong hashing Are those credentials protected in transit properly? Um, what about all the ancillary functions related to authentication? You know create account change password recover password Uh, you know secret questions for second factor authentication or machine binding or whatever You got to think about all of those things and in fact, of course one of the best things to do with to have Good authentication is to of course build one authentication system And use it over and over and over across many many different applications So you're not trying to rebuild the same security control Over and over and of course that's true of Any kind of security control anytime you can standardize And minimize the duplication of effort for that control The safer you're going to be and the less re rework you're going to have to do To secure the same thing Again and again So here's an example of Session management issue There's a zillion different authentication problems you can have there's no way to do justice to the examples here But in this case they're putting a session ID in a url That's obviously a bad thing You should not do that instead. It should always be in a cookie Anyway, there's many many examples of authentication issues So how do you avoid authentication problems again?  Do you have six simple controls? Are they standardized? You know, have they been well vetted? Maybe you're using a third party product That might be typically stronger than something you build yourself Or maybe it's provided by the The container or you know the system the framework you're using so you don't have to reinvent the wheel And then anything you've had to build yourself, you know, you should assess I mean, you should of course assess things you're using too But clearly anything you've built yourself you need to assess to make sure it's done correctly And in fact, we have lots of guidance from well wasp on various factors related to authentication and session management Um, so I list five of them here These are probably the most important ones on this particular topic But there might be some Other ones as well One of the things I just want to mention real quickly for example is there's one on credential stuffing You might not have heard of this before but it's actually a pretty common attack For an attacker to steal someone's password database that they've implemented weekly So that the attacker can Get the passwords out of it And then what they simply do is try all those same usernames and passwords On other web applications To see if the same user is using the same credentials in another site, which is a common behavior Of users because users are lazy And so you're going to get A series of login attempts on your site where there's one login attempt per account So it's not going to look like a Cracking attempt where they're banging, you know hundreds or thousands of passwords They're just going to try one so they're not going to trip your You know three strikes and you're out login policy for example Um, so the question is can you even detect that attack? And if you do Do you do anything about it you block That attacker Well, you know if they're doing a distributed attack then I don't know how you block them So that's an interesting new problem That we're dealing with in the last three four years related to authentication So us put together a cheat sheet to give you some basic Ideas on how to get started, but this is still a very new area that deserves additional research Um, but at least you can be aware of this problem and think about do I care about it? Am I going to try to defend against it? What does oas say? Um, and certainly that's not a definitive article So if there's things that are weak or missing of confusing about that article, let us know and we'll Try to make it better for for everyone. But anyway, that's just one example of Some of the resources we've got available at oas Sense of data exposure is about protecting sense of data in transit and at rest This is a relatively obvious topic For the most part these days we're telling everyone to always use SSL for everything or hdps Whatever you want to call it, you know transport layer security That way your authentication tokens your session cookies your credit cards whatever is all being Exchanged encrypted on the network. Well, what about data at rest? This is where a lot of organizations fall down They don't encrypt data at rest because they don't think it's sensitive enough to deserve it or it's too much of a pain Or maybe they don't use encryption internally on the network because they don't see the risk These are the kinds of things that we're talking about here Ideally, you'd be encrypting all sensitive data wherever it is And it would always be encrypted on the network inside or outside Your environment So this is what a three is about. Here's an example of a credit card example Where maybe the app the app owner knows that credit cards are sensitive. So they encrypt them at rest But they didn't realize that some component was doing some logging And the credit cards were getting logged In the log files, maybe only when there was an error or maybe all the time And so there's a side copy of these sensitive files and the attacker breaks in and steals those From an unexpected location. So In this particular case, it's not even an encryption problem It's really they're logging sensitive data that they shouldn't log And the answer is not to encrypt it But rather is to stop logging the sensitive data in the first place and that way The uh, the data can't get stolen because it doesn't exist in this alternate location So that's frequently the best defense for dealing with uh sensitive data is don't record it Or throw it away quickly There's been numerous situations where like a merchant online merchant gets hacked Their transaction data gets stolen With just credit card information in it and other information that's sensitive and it turns out, you know, they got seven years of data available in this system Well, why why would you have seven years of this data online? Available for an attacker to steal. How much do you need to be available online like that? Maybe One year would be fine or three months would be fine. So if you simply trim that log Then you would significantly reduce the impact of a breach Without requiring, you know, fancy encryption or extra access control or so on so forth Now, of course, you still need to protect what's left in the log But at least by reducing the volume You've reduced your risk. So sometimes there's very simple things you can do to significantly reduce risk related to processing and storing a sensitive data that doesn't involve anything really complicated at all actually So anyway, here's a bunch of tips on um cryptographic storage. I did want to point out the password storage cheat sheet uh A lot of systems build their own password hashing solutions Sometimes those are very old legacy solutions that are seven 10 15 years old They're using really really old hashing algorithms. Um, so upgrading your storage solution So that you're pretty confident that if an attacker did get a copy of it You still have confidence that the attacker cannot reverse engineer the passwords out of it That's where you want to be and if you're not in that situation today Then you need to upgrade your Storage approach and you can do that in place without invalidating all your existing passwords. There are techniques For improving the security of password storage That are transparent to your current users So you can uh improve that without causing a significant disruption to your customer base So this is just an illustration of you know, people are typically using you know ssl Let's see on the internet, but they're frequently not using it And once they get inside their environment And that's a risk that you got to decide whether that's acceptable or not You know, what's the technical complexity of of adding? Internal encryption on the network and what's the risk reduction that you get? You know, is this a risk you're accepting? Or you're not even thinking about Or not so we're seeing a lot of insider threat going on probably 40 to 50 percent of the breaches that we're seeing are still being done by insiders So assuming that the inside is safe and the internet is is the only source of danger is a very bad risk Position to take in a lot of a lot of situations So anyway, here's some guidance on This again, make sure you use good encryption. It could be commercial encryption It could be Using encryption built into your programming language like java or what have you There are some very complex encryption solutions you can use but sometimes very very simple solutions are Just as good and have a lot less complexity The main thing is to identify your sensitive data decide What data needs to be encrypted? When like on the network at rest And then making sure you consistently apply that encryption Where it's needed and again as I said avoiding storage of data is frequently the easiest way to avoid sense of data exposure issues So we got I've already 35 minutes in so I'm going to go quicker through some of these others But I'm going to stop on the three new ones. Here's the first of the new ones So xx e stands for xml external entity And so the vulnerability is like an xxc attack Or xxc injections sometimes people call it xml the standard has this concept of an internal entity. So think of an external entity as either a url And that could be a file url or an htp url or whatever or it could simply be a variable Well, if you include this url or this variable in your xml document and the xml document came from An untrusted source like an external user That url can then reach out to whatever it's pointing to To access Data that it's not authorized for and potentially return that data to the user um, it can also be used to Cause a an xml document to grow Abnormally large and cause you to run out of Memory or disk space or what have you so let me show you what that looks like. I have an illustration here So in this first example, we have this external entity called xxc fun And that's now a variable so I can reference that variable here Um, but the variable refers to a file in this case. I put etsy password So here's the here's the rub here if xml external entities are enabled by your xml parser Which frequently is the case Then when this document gets processed It's going to actually reach out grab the copy of etsy password and replace that right here Now if you then return this xml document back to an attacker Then now the attacker has a copy of your password file Now typically these are caused by the fact that the developer had no idea that this was even a feature They're not using it.  Um, but it's a feature that's available For an attacker to abuse Here's another example where you declare an entity. Maybe it's a abnormally large number of the letter a Let's say this is 10,000 of them and then you have another element that's got 10,000 references to Uh a then obviously this is going to expand in size to 10,000 times 10,000 whatever that is a large number So that's not a huge number, but you can see you can quickly Repeat this process and with a few lines of code create documents that are You know gigabytes or terabytes in size And of course that would exhaust all resources on the on the machine So that those are examples. These are trivial examples of attacks The question is how do you avoid these? Well, typically the basically the way to avoid these is Is either use an xml parser that has external entities disabled by default Which is common in some languages but less common in others Um or disable it yourself. So here's a java example of Parser called Xerxes or which is this in this case a document builder factory is the name of it So there's a simply a feature you can set called disallow document type declarations That will disable the xxc feature And so if it then parses an xml document that has an xxc entity in it It'll throw an exception saying hey, sorry. That's not allowed And you're safe Now in some cases you want to allow These external entities for these entity definitions But you want to say fine, but they can't be external. They can't point to the file system. They can't point to URLs So you can partially disable it without disabling it completely But it's very rare that I see situations where people are even using this feature at all So it's better off to disable it entirely. In fact, I would probably Execute all three of these Set feature commands typically when using this parser just to make sure Now this is just one parser of dozens that exist out there So what we've been trying to do in the xml Our xxc defense cheat sheet is list for every parser that we're aware of across many different languages Is it safe by default? And if not, how do you make it safe? And I've been actually working on that cheat sheet for years And so everything I know about xxc is documented in this xxc prevention cheat sheet Uh, which is obviously a fantastic resource for you guys learning about what xxc is and how to avoid it Um, so here's some basic guidance, you know, first off Are you why would you even accept? An unvalidated xml document from an end user I mean that is a common behavior. So it doesn't surprise me people do it But if you can avoid it, then you solve the problem But if you can't avoid it make sure you're either using a parser with an off by default or disable it yourself In some cases there are parsers that you can't turn it off And in that case you need to replace Your parser with a different parser that can be made safe Or is safe By default. So this is actually a very very easy problem to solve You just got to look for it Set a few switches and move on For the most part. So even though this is a big deal in terms of risk It's mainly because of lack of awareness and I suspect Now that it's so high in the top 10 The awareness will bloom in the next three years. That's the goal of the top 10 And then people will become aware of it and this xx e issue would hopefully Drop significantly for the top 10 in the next release Ideally you would drop off the list entirely. I don't suspect that'll happen in one cycle, but maybe by the 20 23 versions of the oas top 10. I would hope xxc would fall off Because everyone knows about this problem and the easy ways of avoiding it Access control This has been around forever The main thing is you got to make sure that the user is authorized for the functionality they're interacting with And are authorized for all the data that they're interacting with And in the way they're interacting with that data, you know, are they authorized to read it? Modify it create it, you know Destroy it can they grant other people access to that data, etc So it's very very easy to make mistakes in the access control area because it's all custom And tools can't help you at all in figuring out if you've done this right or wrong or what have you This is required a lot of custom Development work and a lot of custom verification work for dealing with access control So i've got some slides here on some examples like Force browsing a directory to get access to functions that you maybe can't see But can still browse to and you should still be denied access. Of course, it's trivial to modify the Identifier of a of an object reference and try to access someone else's account You know, these are relatively obvious attacks You just got to be really hyper aware of all your end points for functionality and data access And make sure you've built that Safely so we've got some examples here on how to do that Right on this slide here Security misconfiguration has been around forever a lot of people argue This doesn't belong to the os.10 because they don't think of it as a developer issue Maybe that's true, although with devops now configuration and It's all developer issue, right? So to me this is even more relevant today Then it was when we first introduced this way back in 2004 or whatever first came out I mean securely configuring your components your web server your app server your database Your firewall your web allocation firewalls Your frameworks, you know struts in spring and hibernate All of these components Have security configurations and people Screw them up. They don't have the the configuration in In configuration under configuration management They can't automatically deploy the same environment over and over Be consistent They don't have a good way of auditing the configuration to make sure it's correct And it hasn't changed in an unexpected way So a lot of work needs to be done around this and because of that this is still a significant risk in a lot of organizations And so anyway, we've got some examples of here and I'm not going to go into them But this is still a big risk and I think it's with devops is becoming even more critical People need to spend even more time on this particular security risk Cross-site scripting has been around forever. It's a complex Topic it has been dropping in the top 10, which is good in terms of risk Because everyone's hyper aware of it and it's been focusing on it But it is a complicated issue I really can't do justice to this topic here because I can spend a whole hour or four hours on this particular problem Um, so I'm not going to spend a lot of time on cross-site scripting I am going to mention that you know sort of traditional cross-site scripting where you include data in a page and That that script executes immediately Is kind of fading away because now we're doing everything with ajax and things like that So the the page is typically static and then we send data to the page using Ajax calls And we can still introduce cross-site scripting when we do that because we're using a javascript method Or a javascript library method That if it's given snippets of javascript, it'll actually build active javascript when it updates the Dom for that page And you can end up with cross-site scripting that way and that's a type of cross-site scripting called dom-based cross-site scripting Which is a very complex topic To talk about and I can't really provide Do justice to that there is Several cheat sheets on the awesome. Whoops Yeah, there are several cheat sheets related to Cross-site scripting. I just want to mention those here The original one is the xss cheat sheet, which was the first prevention cheat sheet we wrote And that talks about you know embedding user data on the page as you build the html and the javascript and the links What have you and that still is definitely a risk and people still do this But that's not the common way of building web apps today Uh, as I said, most of them do dom-based access or dom-based Are ajax based websites whether using uh javascript framework is to dynamically change page on the fly And so we've got another cheat sheet on xss related to dom-based xss which Tries to give you some guidance on this topic Um, so I definitely read it But it is a complicated issue. It's very the solutions are very dependent On the javascript framework you are using so there's no way in this one cheat sheet We can give everyone the guidance they need Uh to for any kind of framework you really need to understand Which javascript methods? Can create active content and which ones cannot And then for the ones that can you need to make sure you trust the data That you're passing into those calls Or you've validated that data to make sure it's safe Before you do so And so it can be very tricky to find dom-based cross-site scripting flaws And then fix them Which is of course somewhat of a good thing because it makes it hard for attackers to find them and fix them too However, there's some really clever guys out there that are really good at this stuff Probably far better than the average developer And so the advantage is definitely in the attackers court In finding and exploiting dom-based xss versus The developers avoiding all of them in their web app that they're building So the second new oas top 10 topic is insecure disutilization So it is not uncommon for applications to take a plain old, you know, like a java pojo or whatever language is which plain old java object So it's a plain old whatever language you're using object And serialize that into json or xml Or could even be binary And then send that object to somebody else browser or wherever put it in database something and then Try to accept it back from the user And then turn it back into the object it originally was The problem is the attacker of course can tamper with that serialized object And frequently if they're clever about it, they can actually get arbitrary code execution as a side effect Of the deserialization process and then it's completely game over So this is a really big deal that Has really ballooned in the last four years as people start focusing on this particular risk I have a few examples. These are all open source Or public examples With with cv's associated with them all these happen to be last year But there's many many more. These are just a few Um And these are all in uh, usually typically in open source components. Some of them might be a commercial products So we've got some javascript libraries. We've got some dot net components. We've got some java components Uh, you can see this is not specific to any particular language In this case the solution to these four specific examples Is to upgrade your component or your product to a version of that product That has a fix Right, so that makes Uh, you know, avoiding use of known vulnerable libraries, maybe even more important Which is a nine the next topic Um, but if you have a deserialization issue In, you know, your code Um, oops. I went the wrong way. Sorry If you have deserialization issues in in Your code then There's a number of ways to fix it. So my first suggestion to avoid deserialization components Are issues is to just don't do it. Don't send serialized objects to your users and then um You won't have this problem, but if you must Then you need to make sure that those components are are safe So how do you make a deserialized? Uh, object safe before actually trying to deserialize it. Well, one way is to provide some kind of integrity seal So in other words, if you send it to them and you're expected to come back unmodified Sign it in some way and verify the signature and if it fails, then you don't deserialize it um, you can also of course harden your deserialization mechanism to only support a limited set of object types and That'll reduce your risk And there's some techniques in the deserialization cheat sheet down below Where they give you specific guidance on how to do that in certain situations like in java, for example and things like that um So there are there are some basic techniques for avoiding deserialization, but a lot of these are very specific to the The technology that you're serializing and deserializing And but of course step one is awareness Are you even aware that you're serializing objects? sending them to users And then having the user send them back to you a lot of times they don't realize they're doing it Maybe it's automatically happening because some framework hydrates and you know dehydrates these objects for you or And you're not realizing it's happening um, so Again, top 10 is about awareness. So step one is are you even using serialization technologies at all? And if you are you intend it did you intend to? Uh, and if you did what steps are you taking to? You know avoid that a particular problem. So this deserialization cheat is very new But I certainly encourage you to review it and make your friends aware of it A9 is about use of non-vulnerable components That's been uh, it was in the introduced in the last top 10 as well There's actually we got some pushback that people thought that was silly Um, and then very quickly people realized now that's pretty major deal Um, and in fact some of the biggest breaches that have happened in the last four years have been exactly because People are continuing to use non-vulnerable components because they have no mechanism for detecting and fixing these issues quickly And in fact the attackers know this so the life cycle of X you know cve is reported in library x to live exploits are happening against that cve Have dropped from you know One to two months maybe 2012 2013 to 48 hours, maybe even 24 hours So think about that. You're using a framework in your web app The cve comes out right now 330 eastern time And in 24 hours The attackers are going to start exploiting that and taking over servers because it's got a remote code execution issue How are you going to fix? your portfolio of applications that have this problem now not every app will have this problem, but let's say, you know, you got 12 apps in your out of your hundred that have this specific problem can you Identify those apps develop a fix You know like upgrade the library to the patched version regression test it and deploy it in 24 hours The answer for most organizations is no not even know as hell no And yet that's where we need to be And so this is a big deal. There are some commercial technologies out there that can help you Detect these issues. There's some free technology like awas dependency check that can help you detect these issues But you also might need some kind of patching technology that allows you to mitigate the issue until you deploy a real fix Because the light the time cycles are getting so quick That actually rebuilding and redeploying an app is just Impossible in the time frames that we're we need to deal with this kind of issue today So you guys heard about the you know Equifax for example uh, they they got hit by a Struts exploit within Few weeks or maybe just a few days of the release of that uh, cve back in like may of 2017 And you know 140 odd records 140 million records got stolen because of that breach So I only got a few minutes left and then I'll take questions wherever wants to hang out the very last one of the awas top 10 is lack of logging and monitoring and as I mentioned before Web apps are frequently very polite They'll let people attack them all day long. They'll simply provide error messages like sorry That didn't work. Please try again And of course the attackers are happy to oblige and they'll attack and they'll attack and they'll attack until they finally find the vulnerability that they are looking for and figure out how to exploit it and then they'll uh Do some damage, right? So why are our web apps so polite? That's nonsense You know, you wouldn't let someone walk up your front door and start chopping away at it with an axe For two hours without calling the police and telling them to take a hike But we don't do that with a typical web application So we need to we need to log security events We need to have standardization. We need to know we have sufficient security events We need to make it easy for developers to comply with this policy Like hopefully build this logging into standard security controls Then they make it easy to add custom events when they have to build custom controls We need able to distinguish these security events from non security events that we need to monitor those events So that we have, you know, real-time or near real-time event detection So we can raise alerts Maybe even lockout attackers um Detect the defined thresholds of events not just single events So that when a threshold is exceeded over a period of time that triggers Some kind of action But there's very few systems that we see that have anything close to what I would call you know, sufficient security logging and monitoring in the typical web app and OS agrees by putting it in the top 10 um One of my favorite OS projects has been around for a decade. It's called the loss app sensor And it talks about this kind of stuff. It gives uh, there's a reference implementation, you know for a java library There's uh guides that are written really well written guidelines to give you advice on how to implement this kind of stuff So OS has been thinking about this problem for a long time It just hasn't risen to the level of the top 10 until 2017 um, but just like you don't have Network like today if you didn't have network layer intrusion detection People will look at you like you're crazy Right, we've we've had that You know, there's been an expectation for network level ids for the last five if not 10 years But there's no such expectation at the outlayer yet We're hoping the top 10 is going to tip that scale and hopefully within three to five years People will look at you funny if you don't have really good application layer intrusion detection um That's really the goal of the top 10 putting this in even though it's number 10 of the list is hey, this is really important This is a big risk If you don't have good security logging in monitor So anyway, I got some summary slides here that I don't have time to cover Uh, and that's all I've got I like I said, I'll make the slides available And I think they wanted to record this session and make that available. I that's totally fine um Is there any questions or I don't know how you want to go through the next part of this Darian, but uh, I know we're sort of out of time But I'm happy to hang out for as long as people have questions. So whatever you want to do Any questions from anyone in the hangout or in the room there? Yeah, I haven't seen any come in through irc or YouTube yet, but if anyone has any this would be a good time And people could send me an email later So I'm not very hard to find But dave.wickers at owas.org works. I'm happy to answer your question Today next week next year I do get questions out of the blue once in a while and I'm totally happy to Help you my typical answer is I point you at an owas resource that frequently I helped write and say Hey, why don't you start here and if you got more questions? ask um Anyway, I'll take questions at any time. So Well, I think uh, I think we can go ahead and wrap up if there's no questions We don't want to keep you too long dave again. Uh, thanks for doing this presentation. It was great Really appreciate you sharing your time with us uh Yeah, it was excellent. Thanks a lot all right It's basic stuff for me, but I think it's getting this awareness out is great So I'm really appreciate you actually inviting me to do this Because that's what the top 10 is all about. We want to spread the word. So let everyone else know about this I think either hopefully watch the recording or at least get the slides reference the cheat sheets And uh, a lot of these again are that hard to deal with It's awareness lack of awareness is our enemy still in 2017, which is really unfortunate Anyway, that's all I got. Thanks. All right. Thanks again. Thanks dave


The Second World War and its consequences. 75 years ago, in June 1944, a young soldier surrendered to American paratroopers in the Allied invasion of Normandy. At first, his captors thought that he was Japanese, but he was in fact Korean. His name was Young Kyung In 1938, at the age of 18, Young had been forcibly conscripted by the Japanese into the Kwantung Army in Manchuria. A year later, he was captured by the Red Army at the Battle of Kalkingal and sent to a labour camp. The Soviet military authorities at a moment of crisis in 1942 drafted him along with thousands of other prisoners into their forces. Then early in 1943, he was taken prisoner by the German Army at the Battle of Karkov in Ukraine. In 1944, now in German uniform, he was sent to France to serve with an Osobatayan, supposedly boosting the strength of the Atlantic War at the base of the Kotlin-Tam Peninsula in land from Utah Beach. After time in a prison camp in Britain, he went to the United States, where he said nothing of his past. He settled there afterwards and finally died in Illinois in 1992. In a war which killed more than 60 million people and had stretched around the globe, this reluctant veteran of the Japanese, Soviet and German armies had been comparatively fortunate. Yet Young remains perhaps the most striking illustration of the helplessness of most ordinary mortals in the face of what appeared to be overwhelming historical forces. Today, it is very hard to appreciate the huge historical forces which killed those 60 to 70 million people. The Poles lost nearly 6 million people, almost a fifth of their population. The Chinese lost more than 20 million. Estimates of total Soviet losses now range from 24 to 26 million dead. Stalin knew in 1945 that they exceeded 20 million, but he tried to conceal this. As David Reynolds, the Professor of International Relations at Cambridge University, pointed out, he settled for 7.5 million as a figure that sounded suitably heroic but not criminally homicidal. Experiences and memories of the Second World War are so different that it's not surprising that each country has their own historical version of events. For Americans, the war didn't start until December 1941 when Hitler declared war on the United States. Russians believed that it began only in June 1941 when Hitler invaded the Soviet Union. Most Europeans, on the other hand, consider that it commenced in Poland in September 1939. But for the Chinese, it started in 1937 with the Sino-Japanese War, or even in 1931 with the occupation of Manchuria. And many in Spain are still convinced that it began in 1936 with General Franco's nationalist rising to overthrow the Spanish Republic. Historians often extend the conflict even further, arguing over what is called the Long War of the 20th century. Some say it lasted from 1914 to 1945, including of course the Spanish Civil War. Others extend the period until the collapse of the Soviet Union in 1990. The statistics of suffering and the sheer size of the numbers are dangerously numbing, as the Soviet Joe Schreiter, Vasily Grossman, instinctively understood. In his view, the duty of survivors was to try to recognize the millions of ghosts from the mass graves as individuals, not as nameless people in caricatured categories, because that sort of dehumanization was precisely what the perpetrators had sought to achieve. But focusing entirely on the dead makes us overlook the way the Second World War also totally changed or marked the lives of survivors. And it's vital that we understand the effect on the individual as well as on the statistical mass. A few years ago, I heard from a German friend that her sister's father-in-law had just died. His most intense childhood memory came from January 1945 in East Prussia, when he was only five or six years old. To escape the indiscriminate vengeance of the Red Army, his mother took him and his little sister on foot across the frozen lagoon of the Fisher's House. The ice began breaking up all around, with many people falling through to freeze and drown. Almost 75 years later, his last words before he died were, I can hear the cracking of the ice. In the mad scheme of such a war, human life was intensely fragile. Survival was totally unpredictable. In the Archive National in Paris, I came across a short paragraph in a June 1945 report by the French security police, the D'Estée. This recorded that a German farmer's wife had been found in Paris having somehow smuggled herself onto a train returning French deputies from camps in Germany. It transpired that she had had an illicit affair with a French prisoner of war assigned to that farm in Germany, while her husband was on the Eastern Front. She'd fallen so much in love with this enemy of her country that she'd followed him to Paris, where he was picked up by the police. That was all the detail provided. These few lines raised so many questions. Would her difficult journey have been in vain, even if she'd not been picked up by the police? Had her lover given her the wrong address because he was already married? And had he returned home, as quite a few did, to find that his wife had had a baby in his absence by a German soldier? A recent book in France estimated that around 100,000 babies known as Enfant de Guerre or, more viciously, Bataire de Bosch had been fathered by German soldiers during the occupation. Some put the figure even higher, but I'm very dubious about that. In any case, the bare bones of her story could almost have been a novel by Marguerite de Haas. It is, of course, a tiny tragedy in comparison to the horrors of the Eastern Front. But it remains a poignant reminder that the consequences of decisions by leaders such as Stalin and Hitler ripped apart the traditional fabric of existence. Many aspects are not as they appear on the surface as I've learned over the years. I remember as a young army officer in Germany during the Cold War, based next door to Kibelsen concentration camp, being horrified by a memorial to the French Jews who had died there. It stated, I found the idea of French Jews dying for glory in the Fatherland in these circumstances quite grotesque. Many years later, I mentioned this to the French historian Henri Rousseau. He replied, I entirely understand your reaction, but you're completely wrong. It was the French Jews themselves who insisted after the war that memorials to their dead should have exactly the same wording as those of all the French. And this was because they would never forget Vichy for having tried to take away their French citizenship. Perhaps the hardest for all of us to comprehend fully is the true experience of soldiers, the conditions under which men fought were so desperate that today we can hardly imagine how they endured them. Even many who were there looked back in amazement. One Red Army officer, Vladimir Ivanovich Tulianov said, nowadays I can't believe that we were able to live in the trenches in the open, in the snow, never taking off our boots or clothes with no water or source of heat. How on earth did we survive all that? Between 1941 and 1945, some Red Army soldiers, those who survived the battles along the way, fought and marched for more than 12,000 kilometers. Red Army soldiers, afraid both of their Nazi enemy and of execution by their own side, were put under a terrible psychological pressure. They and Soviet civilians were crushed pitilessly between the two totalitarian regimes. Red Army snipers at Stalingrad, for example, were ordered to shoot starving Russian children who'd been tempted with crusts of bread by German infantrymen to fill their water bottles in the Volga. The proud brutality of Soviet commanders is simply unimaginable in Western democratic societies. When he came to ruthlessness, General Zhukov even exceeded his master Stalin. On the 4th of October 1941, Zhukov, then commander of the Leningrad Front, issued the following order to make clear to all troops that all families of those who surrendered the enemy would be shot, and they themselves would be shot upon return from prison. Ironically, it did not occur to Zhukov when he issued this order, that under it Stalin himself was in theory liable to execution, since his own son, Yakov Zhukashvili, had recently surrendered. I didn't think Stalin was unduly worried. He simply admired Zhukov for his pitiless determination. President Putin is always the first to claim that the Soviet Union won the Second World War in Europe. According to German sources, the Red Army inflicted just over four million fatal casualties and the total on the Wehrmacht during the war. About three quarters of the total Wehrmacht death toll. So the Soviet sacrifice and contribution to the destruction of Nazism was indeed the greatest. But at the same time, Putin refused to acknowledge the American and British contribution to Soviet survival and to victory on the Eastern Front. The great myth encouraged under Stalin was that the British and the Americans deliberately held back from launching the Second Front with a cross-channel invasion in order to weaken that communist ally. Putin still deliberately ignores the fact that even Stalin privately acknowledged that if the United States had not helped, we would not have won the war. Along with the vast supplies of weaponry, vehicles, fuel and steel, came food supplies, which saved the Soviet Union from famine, especially in the winter of 1942 to 1943. Red Army soldiers in their trenches and dugouts used to joke on opening an American tin of spam. Let's open the Second Front. Even today, Russian historians are not yet prepared to acknowledge, but the hugely controversial Allied strategic bombing campaign against German cities helped the Soviet Union enormously. Whatever one might think on moral grounds about our Chief Marshal Harris, known as Bomber Harris, and his brutal and relentless bombing operations, they did force the Luftwaffe to withdraw the bulk of its fighter squadrons and anti-aircraft guns to defend the Reich. And this gave the Soviet Union air superiority on the Eastern Front. The 88mm anti-aircraft guns were also the German's most effective anti-tank gun, which made a great difference in the ground war, too. The other important side effect of the Germans losing air superiority on the Eastern Front meant that they could not carry out air reconnaissance over the Red Army's rear areas. And this enabled the Soviets to carry out major deception operations, which they called Maskerovka, to conceal their major offensives, such as Operation Bagration, a surprise attack which secured Belarus and eastern Poland and destroyed the Wehrmacht's Army Group Centre in the summer of 1944. Finally, there is one irony which Russian historians still refuse to acknowledge. If the United States had not provided almost a half a million military vehicles to the Red Army through Len Lies, then the US Army would have reached Berlin well before the Red Army. Much has been written about the fighting qualities of the different armies in the Second World War, especially the differences between the armies of democracies and the armies of dictatorships. Much less has been said, on the other hand, about their similarities. If one studies the performance of the average as opposed to elite troops. The evidence indicates that any small proportion of frontline troops truly engaged in combat. An initial study in the British Army was carried out in Italy by Major Lionel Wigrum in 1943. Wigrum estimated that in most platoons of about 30 men, only a few really did the fighting. Another small group of men were likely to run away at the first opportunity. Those in the main group in between would follow the fighters if things went well, or the potential deserters if they went badly. General Montgomery was so horrified by the report that he had it suppressed. The Germans, meanwhile, divided their soldiers' combat performance into four categories. So it's basically the same as Wigrum's breakdown, except that the Germans split the main group in the middle in two. The American combat historian Brigadier General S. L. A. Marshall went into the subject in much greater detail soon after the war. There could be little doubt about the overall conclusion of his work, but only a minority of soldiers in a conscript army actually shoot at the enemy. The Red Army was no different as we found in the Soviet Russian archives. Soviet officers argued during the war that a weapons inspection should be carried out immediately after an engagement with the enemy. All those found to have clean rifle barrels should be executed immediately as deserters, they said. Previously unpublished letters and diaries of the time give us an idea of personal experiences, but they also reveal the attitudes and mentalities holding sway. German officers and soldiers, for example, felt that the Wehrmacht was invincible at the start of the war. It never seemed to occur to them then that the war which they were bringing so pitilessly to other countries might one day turn back against them and destroy their own homes and families. Their triumphalism in the conquest of France in 1940 was buoyed up by relief that this war on the Western Front was completely unlike the battles of attrition in Flanders a generation earlier. We live like gods in France, the German soldier wrote home. If we need meat, we slaughter a cow and take only the best cuts. The rest is discarded. With our rifles and our hands, we then break into houses and our hunger is sated. Terrible, isn't it? But one gets used to anything. Thank God that these conditions didn't prevail at home. The idea that the Fuhrer had spared Germany such horrors, a typical confusion of course and effect became a constant refrain in soldiers' letters. Preparations for the massive assault on the Soviet Union prompted similar hopes of a rapid victory. Forests of birch and fir trees along the Nazi Soviet frontier concealed vehicle parks, tinted headquarters and signal arrangement as well as fighting units. Officers briefed their men, reassuring them that it would only take three to four weeks to crush the Red Army. Early tomorrow morning, Registrar and Imagine Division were off thanks be to God against our mortal enemy Bolshevism. For me a real stone has fallen from my heart. Finally, this uncertainty is over and one knows where one is. I am very optimistic and I believe that if we can take all the land and raw materials up to the Urals, then Europe will be able to feed itself and it will not matter how long the war at sea lasts. This war of annihilation, as Hitler called it, was pitiless. The Russian is a tough opponent, wrote a German soldier. We take hardly any prisoners and shoot them all instead. When marching forwards, some German soldiers fired for fun at crowds of red soldiers hurried back as prisoners to make shift camps where they were left to starve and freeze in the open. Thousands of Soviet citizens died in the bombing of the cities of Belarus. Survivors fared a little better in their attempts to escape eastwards. After Minsk began to burn, a Soviet journalist noticed, blind men from the Home for Invalides walked along the highway in a long file tied to one another with towels. Beyond the repression and the starvation of ordinary Soviet citizens lay the far darker forces of Himmler's murderous SS squads, the Einsatzkommandos. Only a few Jews managed to survive the killing pits, in some cases by digging themselves out from under the bodies on top of them. They were utterly traumatized. On the northeastern edge of the Ukraine, Vasily Grossman encountered one of them.  But the Germans were not invincible. In the autumn of 1942 they reached their cumulative point, which means that they had overextended themselves, they'd run out of momentum and were suddenly vulnerable. After the after the Soviet victory of Stalingrad that winter, the Wehrmacht's retreat began. Nervous breakdown became a much more recognizable subject in Lettuce's home to Germany. Psychologically, wrote a gunner in a heavy artillery battery, I am finding it increasingly hard to manage when you've just had a good chat with a comrade and half an hour later you see him as little more than scraps of flesh as if he had never existed. This war is a crushing war of nerves. Soviet revenge for Nazi crimes in the East caused great fear when finally in April 1945 the German front line began to break east of Berlin. Traumatized survivors ran back shouting Daivan kommt. Local farmers and their families also started to flee. Refugees hurried by like creatures of the underworld, wrote a young soldier. Women, children and old men surprised in their sleep, some only half dressed. In their faces is despair and deadly fear. Crying children holding their mother's hands look out at the world's destruction with shock to eyes. Some fathers, as they left to join their Wolfstrom unit to defend Berlin, thought only of the fate awaiting their families. It's all over my child, one told his daughter, handing her a pistol. Promise me that when the Russians come you will shoot yourself. He then kissed her and left. Others killed their wives and children and then committed suicide themselves. In the Far East before the Japanese attack on Pearl Harbor and Malaya, the racial arrogance of colonial society, British, Dutch and French, had produced a dangerous self-deception. The British convinced themselves that all Japanese soldiers were very short-sighted and inherently inferior to Western troops. In fact they were immeasurably tougher. Far more mobile and astonishingly self-sufficient. They did not need bridging equipment, their soldiers cut sick bamboos, then threw themselves in pairs into the river and bent forward with the bamboos running from shoulder to shoulder in parallel to form a bridge for their comrades to run over. Japanese soldiers had been brought up in a militaristic society. The whole village or neighborhood would usually turn out to bid farewell to a conscript departing to join the army. Soldiers dreaded, disgracing their family and community. Their basic training was designed to destroy individuality. Recruits were constantly insulted, slapped and beaten by their sergeants and corporals to toughen them up. In what might be called the knock-on theory of oppression, this treatment was also intended to provoke them to take their anger out in turn on the soldiers and civilians of a defeated enemy. During the rape of Nanking in December 1937, Japanese officers made Chinese prisoners, kneel in rows and then practiced beheading them one by one with their samurai swords. Their soldiers were also ordered to carry out burnet practice on thousands of Chinese prisoners bound up or tied to trees. Any soldiers who refused were beaten severely by their sergeants and corporals. John Raaba, the German businessman from Siemens, who courageously organized the safety zone in Nanking, wrote in his diary, I am totally puzzled by the conduct of the Japanese. On the one hand they want to be recognized and treated as a great power on a level with European powers. On the other they are currently displaying a crudity, brutality and bestiality that bears no comparison except with the hordes of Genghis Khan. Japanese navy pilots would sit down to play bridge together in what they considered a respectful imitation of British officers of the Royal Navy, but they would behead any shop-down American pilot pulled from the sea. Japan in the 1930s and 1940s have become a dangerous combination of ancient culture and parvenu power. The Imperial Japanese army's process of dehumanizing its troops was stepped up as soon as they arrived in China from the home islands. A corporal Nakamura, who had himself been conscripted as a soldier against his will, described in his diary how they made some new recruits watch as they tortured five Chinese civilians to death. The newcomers were horrified, but Nakamura wrote all new recruits are like this but soon they will be doing the same things themselves. I think that in the course of all my research is the discovery that shocked me the most was the way that the Japanese military authorities did not merely condone but actively encouraged cannibalism especially towards the end of the war. These were not isolated cases. A similar pattern was found across the Japanese army in China and Pacific garrisons who had been cut off from supplies by the US Navy. It became clear from all of the reports collected later by American authorities in the Australian war crimes section that cannibalism was a systematic and organized military strategy. Both locals and a number of Allied prisoners of war were kept alive as human cattle and then butchered for their meat one by one. On the 9th of May 1945 when news of Germany's surrender reached the rifle companies of the American First Marine Division during the battle for the Japanese island of Okinawa their reaction was so what they were exhausted and filthy and everything around them stank. As far as they were concerned the war in Europe was indeed another war on another planet. After the savage fighting on Okinawa there remained even more dreadful prospect of invading the Japanese home islands where soldiers and civilians alike were preparing to fight on to the death. None of the marines knew then of the atomic bombs being prepared in such secrecy. It was not just the nuclear age and the cold war which began in 1945. The consequences of the Second World War reshaped the international order. They also brought world history together for the first time. This was partly because of the global reach of the conflict but also because it sealed the fate of colonialism the British, French and Dutch empires. In the far east the defeat of the Japanese and the advance of the Red Army across northern China and Mongolia enabled Mao Zedong's Communist Party to win the civil war and centralize the country in a totalitarian dictatorship. Although impossible to imagine at the time this would enable China seven decades later to become an economic and then military superpower. The origins of the Cold War lie in the Yalta Conference of September 1945. For Stalin Poland was the key to Soviet security after the war and he was determined that it should be entirely under his thumb. He had suffered a traumatic shock and humiliation on the 22nd of June 1941 when the Wehrmacht invaded the Soviet Union without warning. His paranoid fear of surprise attack afterwards made him even more determined to create a quorum sanitaire of communist satellite states centered on Poland and East Germany to make sure that this could never happen again. On the other hand the Yalta Conference also gave birth to the United Nations which was inspired by President Roosevelt's belief in the possibility of a more peaceful world. In 1945 a war ravaged Europe was left bankrupt and enfeebled. In fact Western Europe might also have gone communist if it had not been for the Marshall Planade from the United States which in 1948 kick-started economic recovery. The horrors of the conflict and its consequences spurred the start of a movement towards European Union. Yet European integration is a story based on the confusion of cause and effect and also the law of unintended consequences. It's long been an article of faith that the move towards unification has saved the continent from another war but this idea is historically false. The real truth of course is that democracies do not fight each other. Peace is a question of governments not unification. It is precisely the undermining of democracy which creates the conditions for conflict and history has shown time and time again that attempts to suppress nationalism make it far more virulent. Now in the midst of alarming global instability social political and economic it is understandable that people look again at the Second World Wars a warning one that can alert us to danger signals. They might argue that we've learned little from history's greatest human tragedy and are blindly headed towards another global conflict but history never repeats itself and nothing in human affairs is inevitable yet we still need to understand the past to make better sense of what's happening around us now and we must avoid the temptation to generalize or to draw bogus parallels. The Second World War was a complex business and our understanding of it must be equally nuanced. We tend for example to reduce the war to a battle between major powers. Some misleadingly portray it as a fight between democracy and dictatorship even though the Soviet Union was certainly very far from a democracy. In fact the war was a conglomeration of conflicts. Some were great power rivalries yet all to a certain degree were influenced by the international civil war between the polarized extremes of communism and fascism. What we are seeing today in Europe especially is very different. The extreme left and the extreme right strongly assisted by Putin are now linking up to undermine traditional parliamentary democracy. The sheer brutality of the Second World War is underlined by the fact that for the first time in history far more civilians were killed than competence and this can only be explained in terms of ideologically fueled dehumanization. Nationalism stirred to a fever pitch and extolling racism as a virtue on one side but also Leninist class warfare aiming to exterminate all opposition on the other. Not surprisingly the Soviet Union fought tooth and nail in the United Nations committees after the war to prevent class warfare from being included in the international definition of genocide. The great Soviet physicist and dissident Andrey Sakharov observed that Stalin may have killed more people but Hitler had to be defeated first and he was of course right. If the Nazis had succeeded in defeating the Soviet Union their so-called hunger plan to reduce the population through deliberate famine by 35 million would have dwarfed even the horrors of the Holocaust. Perhaps the Second World War's most important lesson is a moral one. Even in the midst of the most horrifying conditions there were those who never let go of their fundamental belief in humanity. Their example is something we must try to uphold as we face the profoundly disturbing challenges and potential conflicts of the world today. It is striking that the Second World War as a subject still attracts so many novels poems and movies but then new other period in history offers so rich a source for the study of moral choice, individual and mass tragedy, the corruption of power politics, ideological hypocrisy, the egomania of some commanders, betrayal, perversity, unbelievable sadism but also self-sacrifice and unpredictable compassion. In short one of the most important lessons of the Second World War is that it defies generalization and simple categories. Thank you very much.


Today we're looking at Blackstar's Artist 30 and Artist 15 amplifiers. And what you can see is that they kind of harken back to the Artisan series amplifiers, which were award-winning hand-wired Blackstar amps that were their introduction into the amplifier market. So they have a classic look to them, but the Artist series have been upgraded with a handful of player-centric features. For starters, there's two channels on the Artist series. The Artist series has a channel one with a volume and a tone. And that's meant to be a straightforward way to get to these amazing clean and crunch tones. If you move over to channel two, you have a full complement of EQ, but also Blackstar's patented ISF tone shaping circuit. Now what that does is it unilaterally changes the way the tone stack works. So your EQ still works, but that's the way to completely shape your sound for something that feels distinctly like you and it feels like your home. The other thing it has is an onboard digital reverb. It has an effects loop, and it has an emulated line out. Now that's just the stuff on the outside of the amp. The things that you can't see, the stuff under the hood, also is made to make you feel like you're playing an amp that was made for you. For instance, the cabinet is made out of birch plywood, which is its classic looks, but it also means that it's a solid cabinet with a really great resonance to it as well. So the amp itself sounds great in the room when you're right next to it. It also is a full tube circuit, so 12AX7's in the preamp section, 6L6's in the power amp section. Now 6L6's are unique because they have an American sound. We normally say it's an American sound in power amp tube. What that means is they have this nice blossomy bloom tight low end and a really pristine chimie top end, and we would say that's more of an American EQ curve. But they've configured these in something called an open loop circuit, and it does a couple of things. First of all, it moves the sound towards British Class A, but it also pushes this amp naturally into some really pleasing power amp drive. And if you've been around tube amps long enough, you'll know that power amp sounds and power amp drive are really where the magic happens. That open loop configuration pushes you towards that more easily and in a more pleasing way. The thing about the artist series is it's really made for all kinds of players. Some players like to grab a guitar and plug straight into an amplifier, and if that's the case, the artist is going to suit you really well. With the two channels, you can set them both to clean, both to crunchy, or one clean and one dirty. But you can also use your pedal boards. The thing with the artist series, the 6L6 configuration, the pristine cleans and the full nuanced resonance is it accepts your pedal boards really, really well. So the amp itself sounds great, but it can be shaped in such a way that your pedals complement your sound so perfectly and effectively. The artist series is really meant to be the player's amplifier with a ton of player centric features. It can be your one stop shop for a guitar amplifier. It's tube, it's versatile, it's channel switching, it sounds awesome, and it's Blackstar. For more information on the Artist 30 and the Artist 15, check out BlackstarAmp.com.


Hi friends happy Friday. It is just before 6 30 a.m. And I just got to my WW workshop But before I go in I wanted to fill you guys in on my week let you know how things went So this week this week this week was crazy I on Wednesday filmed my life update that you guys will be seeing on Sunday a lot of you have reached out to me asking if everything is okay and just kind of wanting to know what's going on since I've Alluding to a big life change coming down the pipe over the last couple of months So if finally all worked itself out so I'm able to record and upload that entire life update for you That will be up on this Sunday. So don't miss that video. I'm giving you all the detail I'm spilling all the tea so that'll be up on Sunday So with that being said this week was just really busy a lot of filming I was actually in a class all day yesterday Thursday from 8 a.m. To 5 p.m. So it's just been a really busy week and on top of that I started Shark Week Why wouldn't I why wouldn't I start Shark Week right before I have to weigh in so Welcome to my life. This happens to me. It seems like every single month So I haven't been feeling the best either this week. I've been really tired and run down Which is typical for me. It's just been it's been a week So hopefully the scale isn't bad. I had a good eating week this week for the most part We did a splurge on Saturday, but we worked out in our yard the entire day And I probably burned like nine of my splurge meals So I don't think that my food was the issue this last week. I was on track all week I made good food choices. So I'm hoping that that shows up on the scale But you never know with Shark Week. That's the joys of being a woman once a month You never know how it's going to affect your weigh-in. So we'll see but yeah, I'm gonna head into my workshop I'll be back to not only give you a recap of what we talked about but to share my weigh-in. So cost your fingers for me guys Guys I just got out of my WW workshop it was awesome as usual So I'm really excited about the topic that we discussed. It's something that I think that we forget about We're so focused on our weight loss journey and in order to lose weight We think we need activity which we generally do we need some sort of activity But I think a lot of us end up doing activity that we don't necessarily love or that we're not Excited about because we feel like we have to do the activity We go to the gym every day because we know that's what we need to do to be successful on our weight loss journey We go on our walk every day because it's our routine It's what we think we need to do to be successful on our journey But are we really taking awe in our activity and that was what the topic was this week Seeking awe in the activity that you're doing. So for example if you are a walker and You go the same route every day Maybe change your route up a little bit go in reverse walk the opposite way that you normally do So instead of starting at one point start at the finishing point get a different perspective Walk when the Sun is rising or the Sun is setting and enjoy what you're seeing I think a really good way to think about this is if you were to go on a hike and you're going on a rough hike I mean a long hike hike full of hills trials tribulations It's it's a hike But if there are gorgeous flowers around in trees and animals in scenery You kind of forget that you're on a treacherous hike you forget about the hills you're hiking up You forget about the distance because you're in awe of your surroundings And I think that by choosing activity that makes us feel a sense of awe I think the activity in my opinion is going to be a lot easier So a way that we can do this is start by picking a place that you've never been a new place that you want to explore Or again start your typical walking route in reverse.  What's new that you've never noticed before what's different? Are you seeing different flowers different animals different trees? What are you seeing? That's different Did your neighbor mow their grass? I mean even these small little details Really take it all in and notice the small things Not only does it make the achiness the long walk the tiredness completely go away You really are soaking in and absorbing your surroundings, which I think is really important I know for myself when I go on my walk every morning. I watch youtube. So I'm listening to my phone I'm looking down at my phone. I'm not really paying attention to my surroundings And you know, I live in a gorgeous area and it is very rare that I actually even notice what's going on around me I am a true testament to the bring your phone and pay attention to that So I on Monday on my walk. I'm not bringing my phone. I'm really going to soak up my surroundings I'm going to pay attention to what is in front of me the gorgeousness of my walk every day And maybe I'll see something new or different or something I never saw before and I'm really going to soak in the awe of my activity versus just Doing it to get it done and to watch some youtube. I'm really going to soak it all in And the more you get into the moment on your activity the more you'll be in the moment in your daily life You'll really start to See things in a different perspective You'll start to be more appreciative of your surroundings and the things that are going on in just your day to day life So I think not only is it beneficial for your activity. It's beneficial for your daily life. So My Challenge to you guys is the next time that you do your activity even in a gym setting Really soak it all in soak up your surroundings Soak up what you're doing and really enjoy it Seek awe in what you're doing rather than just trying to get it done so you can see some results on the scale So let's talk about this week's weigh in as I mentioned before I went into my workshop It is my shark week Love it So that plays into of course how your body is retaining fluid and water I feel okay. I feel pretty good when I stepped on the scale though I was up 0.6 and I know that that isn't very much considering it shark week, but I didn't want to be up I was up a little 0.2 last week. So now I'm 0.8 up in the last two weeks So I am clearly not moving in the right direction And I want to blame it all on shark week, but I don't know that it was all shark week I feel like I had a really good week of eating I my activity wasn't as great as it has been the last few weeks Just because everything that's been going on has been really busy So, yeah, I'm a little disappointed that I was up the 0.6 But I am going to take it as a positive thing. I'm going to blame it on shark week Even though I don't know that it's entirely shark week. It is just going to fuel my fire for this next week I'm going to be better on my activity. I'm going to take awe in my activity I'm going to enjoy it and I am going to see mark my words a loss on the scale next week So no if ands or buts you're going to see a loss on the scale next week. So Not the best way in a little disappointed not moving in the direction that I need to be moving in but It's my body. I can't help what it does sometimes We can be perfect angels and on plan all week and not see results on the scale So hopefully it all just kind of picks up and it drops off this next week So this week is going to be a week of activity It's going to be a week of absorbing my environment and really focusing on that In my day to day life as well as in my activity It's going to be a week of being on plan my husband and I still have quite a lot of bark to shovel On saturday. So i'm going to get a lot of activity in again this saturday So i'm looking forward to a fantastic week Again, if you are not part of my facebook group, we just hit seven thousand people you guys That is so crazy to me. Make sure you hop on over I'll put it right there and take part in my facebook group.  There's just a lot of fun things and inspiration and ideas and recipes On my facebook group. So definitely check it out. Also, if you don't follow me on instagram Make sure that you follow me there right there on instagram as well. I do post stories almost daily Show you my food. It's just another good way to stay on track and to stay in touch So that's it for me guys. I'm hoping for a really good loss this next week And like I said, I will have a loss guarantee that I want to hear in the comments How was your week? Did you gain? Did you lose? Was it what you expected? How what do you think about really absorbing and taking in and having awe in the activity that you're doing? So leave me some comments down below if you're new welcome. Make sure you subscribe hit the little bell So you're notified every time I upload a new video Please thumbs up this one and again, let me know how your week went down in the comments below Stay tuned next for a little video of the recipe on the back of the weekly It looks really good and I'll see you guys all in my next video. Bye guys


Hello, thank you for joining me. I'm at Little Hampton today at the railway station. Nice to find a railway station that still has 7-4 signals. That way is of course looking towards London. I came down on this Class 377, as the buffer's down there, it's a terminal station. Today is another episode of Miniature Railway Britain, and we're going to the Little Hampton Miniature Railway, and today is their 75th anniversary gala. So it's obviously a railway that's been there for 75 years. I have been once before, maybe about 10 years ago, so I'm looking forward to revisiting that line. When I last visited, they were running with a local called Lady Barbara, who I last heard was at Statfold Barn, so I don't think that's here anymore, so the railway will be a bit different from my last visit. Last time I came here to Little Hampton Station was also quite a few years ago. It was in maybe 2016. It was on a rail tour called the Bogner Bell. It was Royal Scott under Class 47, so we went down to Bogner, had a couple of hours there, and then we came round to here. There's a free car Class 377, and I remember, so the steam local was at that end, so it worked steam into Bogner, diesel took us round to Little Hampton, steam back up to London. So if the camera is going to pick it out just out of down there, I've noticed the signal has gone into the up position for the train to depart back to London. I'm now going to make my way out the station. We're going to walk along down by the River Arran towards the seafront, and then we head east along the coast, and that's where we shall find Little Hampton Miniatur Railway. Here's the River Arran on its last quarter of a mile before it joins the sea just up there. I can already smell the sea breezes, which is a really nice smell on a nice warm summer's day like this. I always enjoyed this part of the walk from Little Hampton Railway Station down to the beach. I think it's a really pleasant way to walk past the harbour, seeing all the boats and everything. I always remember this bit from my kind of teenage years. There was an episode of The Inbetweeners where they went down to Swanwich for a geography trip, but it was actually filmed here, and it was in here where they got stuck in the harbour when their boat wouldn't start, and Jay set up a flare that was here. Even though in the episode it was implied that they were actually filming it in Swanwich, in between this episode it was filmed here in Little Hampton. So we're going to continue on down there, down to the seafront, and then we're going to go to Mutipa Park, that's where this railway is just up here. So we've just walked on a little way from the harbour. We're almost at the point now where the river Arran joins the sea. Over there are some other seaside amusements, but no minute to railway, so I'm not really so worried about it. Look at there, I must have enjoyed it when I was a child though. Here is where the river Arran flows out into the sea. So we've now got pleasant stroll along the beach to find this minute to railway. There always makes a seaside town that much nicer. Well, any town, actually, but a seaside town, the idea of having a minute to railway. It just seems to really complement it. So there's the beach. Out there, people swimming in the sea. I'm not going to go swimming today. It's about 22 degrees. It's quite a bit warmer in London, so it's cooled down. Perfect weather to go swimming. I'm not going swimming, I'm going to ride trains. And that is just along here, the Mutipa Park station. So after a pleasant stroll along the beach, I'm now almost at Little Hampton Minutes Railway. And I can see something that seems a bit unusual. See over there? There's a steam locomotive. That steam locomotive is Mad Bess. Yes, Mad Bess from Right It Blider Railway down here on a holiday for the weekend at the seaside. This video actually makes a perfect sequel to my last minute to railway, Britain video, where we went to the Right It Blider Railway's garter. And they had Christopher visiting from this railway. So after Christopher's trip up to Greater London, well, funny enough, a beach actually. Greater London's got a beach that rides at Lido. Mad Bess has come down here. And I understand she's not the only visitor. There's going to be another visiting steam locomotive, so we're going to go and find that. In a minute, look at that. There's a sign there that says trains running today. So let's get across the road and we're going to go and enjoy a ride on the Little Hampton Minutes Railway. You can see the steam locomotive. I'm really getting quite excited. So there she is, Mad Bess. Obviously, this is Norfolk Road. Newford Park must be the other end of the line. It has been admittedly a while since I was last here. So let's have a look at Mad Bess. So if you want to see my last trip behind her, have a look at me on the screen now. You can see my visit to the Right It Blider Railway's garter. So there she is, Mad Bess. I wonder if she'll be pulling my train. Or maybe there's another train due to arrive. Whichever train comes next, we'll have a ride up line to the other end. Behind Mad Bess, there's no turntable. So she's going to have to run tender first up the line to the other end of the line. This is going to be an exciting trip. First time I've done this line with steam. This feels really novel to ride behind Mad Bess because I've only ever seen a Right It Blider Railway. I think this is the first time she ever has visited another railway. So it seems really quite strange to ride behind her here. But it was very enjoyable. Now what I think is probably going to be our next location is just here. It's called Rosemary. And she's from the Exbury Gardens Railway. I've not been there yet. Somewhere I very much would like to go to both for the gardens and for its Minutes Railways. That's a video that's going to happen at some point in the future. What I'm going to do, I'm going to ride the train back. I'm hoping that Rosemary will be pulling it. I'm not too sure. And then I'm just going to go for a bit of a walk and do a bit of line siding. Rosemary's an ex-moor steam railway built, though. And I kind of told the story when we were at Right It Blider. But I'll briefly go through some of it again. Christopher, I've had before. When I rode behind Christopher Right It Blider, it wasn't a winning locomotive for me. Because I've had Christopher at the Exmoor Steam Railway in the mid-90s, when Exmoor Steam Railway was open to the public. Now, the railway exists, but they closed about 2001 to public. And they're purely a factory which builds steam engines. So if you want to buy a steam locomotive, they can build one. I think Rosemary was built in 2001. But Christopher used to be called Lorna Dune, and it's been rebuilt, a locomotive takes its identity from the front. So if you want to see Christopher back in the mid-90s, sorry, not Right It Blider, I saw Christopher Right It Blider, if you want to see Christopher in the 1990s at Exmoor, have a look at Link on screen now.  It's going to be a really exciting ride back down the other end of the line. And then we're going to do some line riding. So they've got three loco's in spin. I'm not sure if they're scheduled to work with passenger trains today. So we'll drive back in time for a bit of line riding. So that's my winning locomotive today. We've just gone into the other platform. So I'm not a super truck, I should worry about everything. So now I've been up and down the line, and I've had the winning locomotive. I may have arrived behind Christopher later, this train. Line riding, so we're just going to watch the little steam trains puffing along the coast. A rather pleasant afternoon for a lovely summer's day. Well, I've had a great afternoon here at Little Hampton Miniature Railway. Here's now Bess at Musbret Park Station. This is Musbret Park here. There's a little centre over there. I'm just going to quickly show you the lake. There's a lake with peddlers on it. This railway has that sense of being like a real railway that does function taking you from somewhere to somewhere. It has two fully functioning railway stations. So you can use it as a genuine transport. There's quite a long way, because if you from the other end to here, so if you were in Little Hampton, and you fancied coming to this park, where you can hire peddlers, you don't need to walk, you can get a train and look, you've got this huge lake to hire a peddler and go for a boating ride. So I thought I'm not going to do that today, though, because I've had too much fun with the trains. That's the station over there. So I hope you've enjoyed this video. Thank you very much for watching. Thank you to Little Hampton Miniature Railway, Brite at Lider Railway, and Exbury Gardens. I must go and visit that one for bringing their locos along. That's what's been a really, really good gala. So thank you very much for watching. Please do feel free to like, subscribe and comment from Musbret Park.