I see the love from DC757. Thanks, guys. Hey, I'm Squidley One. I'm going to be giving a presentation on thinking outside of the console. Basically, I'm going to be talking about game systems and how those game systems can be used to leverage access or at least get that initial toehold into a network, a real network. So there we go. The first little bit, I wanted to actually send a little bit of information. If people were interested, yesterday I was wearing a Haxler Red t-shirt, and you can see Mark G, or I'm sorry, G Mark, over at Hacker Jeopardy about that. It's for a good cause. Also, please check out savedarfor.org. It's still a problem over there. Read up on it and see if you can help out. And now for me. All me. All right, who am I? I'm basically, I'm still a computer network defense team lead for the United States Navy, first class petty officer. I definitely unfortunately don't work with these toys at work. I really wish that that was something I could do. I was a former red team leader. Basically got to get out of jail free card to do bad things. And it was nice. It was fun. I'm an independent security researcher, software engineering student, wireless explorer, heavy gamer. Not great, but at least I have fun. A fervent geek, and I'm also a member of the DC757 and the Sploitcast podcast group. Cyber Eagle. All right. Why am I talking about this? With my background in red team, I was kind of curious about covert testing. What is covert testing? It's to be used by, if it's used legally, it's used by legitimate vulnerability assessment firms and red teams in order to better help companies and organizations learn how to protect themselves. The focus of this testing is to find methods to help said entity identify possible intrusions, faulty equipment, software, bad security processes, blah, blah, blah, blah, blah. All right. You have that basically. That's the best you're going to get as far as for covert testing in the most legal sense. Next you have it's used by companies and governments in order to serve for their own gain and not necessarily on themselves, it's on others. Corporate espionage is my angle for that. Oops. All right. In February of 2004, the Department of Justice pulled covers off of previously sealed case of corporate espionage by a former DuPont scientist who stole $400 million in intellectual property from his employer. In 20 April, the register reported that a UK based organization lost a lot. This is corporate espionage. It is every day. It occurs all the time and through various means. So that's kind of the angle I'm going for. All right. And then you've got us. Basically we have no allegiance, no political motive, no fiscal gain. We're just looking and passing through. Okay. Thanks. Bye. Have fun. The true hacker. Have fun. All right. Am I high? I don't think so. Well, I don't think so. You'll probably judge me as so later on, but hopefully not. Not literally. Not literally. No p-test after I'm going back to work. Anyway, basically what happened was I had an awakening count who's in the audience right now had a modified Xbox. I thought that was hot. I wanted one. Excellent. So what did I do? Well, I talked to him. He had a modded one. They had a mod chip in it. And I saw all the goodies that he could do with it. About two weeks later, I found somebody who had a nice little article online, how to soft mod your Xbox. She didn't have to pull that thing open at all. He just ran a save game off of a couple of different games. James Bond 007, Agent Under Fire, and Mike Warrior. Thank you. And I think there was one more. Splinter Cell. Excellent. Splinter Cell. God bless Microsoft. Exactly. It's amazing what you can do with that tiny amount of data, how you can defeat an entire game system. But anyway, I won't go there. I won't dwell. Others have dwelled much more technically in it, and they've done a much better job. I think it was Damke, Frank Damke, over at the Chaos Computer Club Congress. The last two years have just torn that apart. He's done an outstanding job. I highly suggest that you go out and find those archives, download those talks, and watch. It's awesome. Anyway, so I realized, wow, just doing that, I can now load Linux on there. I can do whatever I want to this little system.  Shit. That's amazing. So that was the first thing. And then prior to 2002, there was very little going on as far as console hacking. That's definitely changed. Since then, the game industry, this is talking about the hardware itself, has moved towards using even more powerful main processors and GPUs in order to both satisfy and build up gamer desires for the next best thing. I'm there with you. I'm there with you. We'll be talking about the cell processors a little bit later. Anyway, let's see. Now we have true computers with the ability to network, and you're playing games on them basically.  All right. This is a little bit of food for thought. I pretty much took a look at sixth and seventh generation game systems. The sixth and seventh generation systems are an arbitrary thing that was put on the game systems. You can go to Wikipedia and find this out like you can trust everything you read on Wikipedia, but this is actually true. Sixth generation systems came out, I want to say, what was it, 2003 and 2004? I'm sorry, 2002 and 2003. And then seventh generation systems we've seen in the last year and a half to two years. That was the delineator, what year they were made, not necessarily how powerful they are. And then we have got handheld systems, which you can put on your person anywhere that you feel comfortable putting them. No goat's ears were harmed. And then we've got ubiquitous online connectivity and many thanks to Panera and Starbucks and all those truck stops that I stayed at. Starbucks, I'm sorry, yeah. I'm not giving out advertisement. And then we've got the thought, but it's just a video game console. What can it do?  What the? All right, my goals, now that I've gone through that, my goals are to cover the three key features for a covert tester, what they look for for penetration hardware and why game consoles may fit that bill. Look at available homebrew applications on various game systems, especially those that expand system usage and functionality. Show how a couple of game systems can be used to infiltrate your network and collect data or collect data, I should say. Suggest things that you can do to mitigate this threat. It actually is exceedingly simple in order to defeat everything I'm going to show you today. And then we have open discussion on what the future holds for these systems and that's probably going to flow on to the Q&A session because I may actually kind of go over and I apologize for that ahead of time. If anybody actually wants to carry on this conversation and they cannot stick around like they got a party to go to because I know everybody's got a party to go to tonight, you can contact me at game consoles with a Z at the end at gmail.com and I will definitely get back to you, especially if you've got something that contradicts anything that I've got up here. I definitely want to hear that. All right, the three important things or what is important to a covert tester. Power, you've got your potential. Programmability, that improves your flexibility. What can this device do? What can I make it do? And then you have concealment, which is basically plausible deniability. I don't have anything scanning your network on me. Pet me down, please. I don't have any memory modules. Actually, let me show you this. For those who have not actually seen one of these and I would kind of be shocked that there's a lot of you that haven't, but we now have the microSD chips, which are smaller than my thumbnail and about three hairbrits width. I mean, wide. This is one gigabyte. You can get two gigabytes and larger shortly. Pat me down, please, because you won't find that at all. All right, primary platforms that I actually looked at in coming up with this presentation. There's actually two slides to this, the Sony PlayStation 2, Microsoft Xbox, the original, Nintendo GameCube, the Game Boy Advance DSP, the Nintendo Wii, and those are all counted as, well, technically, the Wii has, when I was first looking into this, there was a debate whether to keep the sixth and seventh generation separate, because we have the Wii and it's considered seventh generation, but it's definitely sixth generation type hardware. It's an outstanding system, and I try to be fairly system agnostic. I have all these game systems, so I love them to death, so I don't want to hear any, get any flames from any fanboys from any particular groups. Please, please. All right, then we've got the PlayStation 3, the PlayStation Portable, which I was carrying on my person, the Xbox 360, Nintendo Wii, which by at least the date standards is a seventh generation system, and we have the Nintendo DS and DS Lite, and all the systems that I own. I ran out, I got lucky. Around Christmas time, I got a PlayStation 2's, sold the other one, and I had a bunch of PS3's, sold those, a couple of them, so I could afford the PS3, and got lucky. Third time camping out overnight, got a Wii. Yay. All right, hardware and potential. Or geek porn. So feast your eyes. Exactly. All right, under the hood of an Xbox, the old Xbox, you have a 733 megahertz custom P3, you have 64 megs of DDRSD round. Now, both of those can be updated if you want to do a little bit of soldering, and you have a lot of patience, or you have a little bit of money and you want to send it out. It could be bumped up to a 1.4 gig Celeron, or 128 megs of RAM. That's all you get, but you can do quite a bit with even that. The GPU, I just list these bits just down for your edification. It has a 10100 Ethernet port, proprietary USB ports, DVD optical drive. Generally came with either a 6 or an 8 gig hard drive, depending on how old the system was, and it has a proprietary memory cartridge port. Danons. That's why I pretty much went over. I'm sorry, it's 1.3 gig Celeron, 128 meg RAM. You could actually get an adapter to actually connect yourself wirelessly to a BRG network. You could add extra hard drives, one extra hard drive, and actually still have your optical drive connected. And the maximum that I found that was practical was 320 gigs. However, yes, you can do 500. I was going to mention that. There's actually a good website, and I have it in the notes on these slides that you can go to. There's hundreds of people that have tried out various hardware, I'm sorry, various hard drives, and they reported which ones worked and which ones worked under which circumstances and things like that, so you don't blow your money trying it and then failing repeatedly because it is very frustrating. That same site also tracks PS2 hard drive sites. It's xspec.com, so XTAC, SPEC, I think it is. But again, check the notes. It's definitely there. And then you can, of course, attach a USB keyboard and mouse, and then the Linux fanboys went, yay. All right. Xbox 360, under the hood, you now have a power PC with three symmetrical cores. Each one I'm running at 3.2 gigs each. You have 512 megs of RAM. And I've got sitting here 500 megahertz Zeno's custom ATI GPU. Everything that I've read about the 360, people are screaming over that GPU. And in fact, there's a lot of heated debate as far as between the fanboys for the 360 and the fanboys for the PS3.   So, exactly.  And I got both systems. So it's an interesting internal battle that I have. You have built into it a 10100 Ethernet, USB ports, DVD optical drive, a 10 or now much larger than 120 gig hard drive. They're talking about putting out a much larger one sometime soon. And that's all vaporware, of course. And then you have proprietary memory cartridge port. Your add-ons. You can upgrade the hard drive to 120 gigs right now. Throw $180 at somebody and you'll get it. You can get a wireless G adapter, a camera for those intimate moments that you want to show everybody on Uno. Please don't do that because I've been caught twice watching people do nasty stuff and I didn't like it. I can thank J0757 for getting one of those guys taken care of.  And then you've got a USB keyboard and mouse and the Linux guys go yay, but it doesn't work for us yet. We're close but not there. And the PlayStation 2 you have under the hood Toshiba 300 megahertz, our 5900 MIPS 4 processor, 32 megs of direct RAM bus RAM, 150 megahertz GPU, USB Wi-Fi, I'm sorry, not Wi-Fi, USB firewire, an optical drive, and you're able to read a punch of different types of memory. No. It does not.  There's some people that are trying to deliver items with the slim version, but it hasn't hit the market yet. And until I actually see something, I won't believe it.  In case you didn't catch that. All right. AdHons. Now, I don't know, I was pretty amazed. I heard about this a while ago. There were 70 PS2s that were all chained together and I'm trying to remember which university did that, but I didn't put it in my notes. Bad presenter. But they were able to actually get surprising numbers off of that Beowulf cluster and it didn't cost them a whole hell of a lot of money. They made it in, I think, 2003 and ran it as much as they could and they're not using it anymore. It's actually been decommissioned, but they did post some of the numbers on it and it was pretty impressive how much you could do with those 70 little machines. The air conditioning unit, however you had to put on it, just kind of was a little ridiculous because they did get hot. Imagine that. All right. AdHons, because the original PlayStation 2 did not come with any sort of Ethernet, you could buy in the attachment that gave you a modem, an HD assembly, which I got from one of the 757 guys. Thank you very much. I actually hacked my PlayStation 2 after that happened and the maximum for the PlayStation 2, shockingly, is you can actually stuff a 500 gig hard drive in there. It's up to you as to why you would want to put that much in there, but hey, if you turn it into a Linux box, then you can use it. And then, of course, the keyboard and mouse. All right. PlayStation 3, the Cell Broadband Engine Processor. It's a heterogeneous CPU. It has one controller and eight computational SPEs or SPUs. I hear them interchanged. Actually, they're kind of interchanged even in IBM's technical papers. So anyway, when you hear... Actually, when you download the discussion by the guys over at the Chaos Computer Club last year, they'll call it SPU. So it's the same thing. All right. You get 256 megs of RAM for basically those processors, another additional amount of RAM for the system itself. And I'll kind of show a block breakout of how that works. 550 megahertz custom GeForce GPU. And let's see. Up to a gigabit ethernet. That's nice. And if you got the 60 gig version, then you also got wireless built-in. USB ports, DVD Blu-ray optical, 2060 gig, now 80 gig drive, and a bunch of different memory that you can plug into it. If you got the 60 gig version. The 20 gig version, I was told that there was an attachment and that actually is recognized by the game operating system. So you don't even have to have the other operating system loaded on there in order to use it. Which is kind of nice. All right. Very quickly, I'm not going to go too much in depth because I'm kind of running long already. This is a very, very simplified version of what the PS3 hypervisor looks like. And you'll notice that there is a gap over the USB. According to the write-ups that I've read, by it's Kana Shimizu, my apologies. She's one of the security architects over at IBM Systems. She wrote a very good paper on this particular process and the security that's unique to the hypervisor on the PlayStation. And specifically the security that's on the processor itself. After I read it, I was bummed because now I realize it's going to be a lot harder to hack that system. And I'll go into that very quickly. All right. You got your game application. Generally, just like any other hypervisor, you have your hardware down below. You have your hypervisor that runs interference or basically runs a virtualized pathway between the operating system, whether it's Linux, another operating system, or even the game operating system that came on the PlayStation and the game application that's running on top of either one of those. But for some strange reason, for USB, there is absolutely no hypervisor controlling what you're doing. All right. This is a very simplified block diagram of the PS3 cell process and security. If you want to read really good technical documentation, I invite you to go over to IBM's CBE section. I mean, it's full disclosure. They give you everything that you need. What's unique about this, and you'll see that you have your main processor. It's a modified PowerPC core. Basically, everything goes through, of course, the main memory, the IO comes across the interconnect bus. The main processor goes, okay, I'm going to split this up. It goes off to SP1, SP2, SP3, blah, blah, blah, to be worked on. Well, each one of these little sub-processors, when it starts processing, shuts itself from everything else on the box. So once you've put something in there, there's no way to modify the thread while it's being processed. So that was kind of bumming. There was another bit of information in those technical documents. Again, they go into great gory detail. I'm just going through it very quickly, is that when the application sends in its threads for processing, each one of those processes, I'm sorry, the application itself is checked and verified as being legitimate. So you can't run arbitrary code, and this is locked down at the processor. So scoop that thing out and see what you can do with the rest of that box. But anyway, it's checked at the processor, and each thread is verified based off of the original verification of the application itself. So everything has to be kosher in order to be processed. And then when it is processed, as I said, individual SPEs, as they are called on, shut themselves off even from the main processor. The only thing they respond to is stop. And when they receive the stop, they clean themselves. There's nothing in the registry to play with. So I was like, uh-oh.  All right. As far as the potentials for the PlayStation 3, I've seen people actually jam in there a 250-gig hard drive. You have to have a 2.5 serial ATA. So whatever the maximum is, you can try jamming different ones in there. I expect that same website that I spoke of earlier to probably set up a database before too long showing people putting in different hard drives. It uses the different types of memory again. There's right now the maximum size that I'm aware of. Last time I checked Amazon, at least, the authority Amazon was, sorry, was 8 gigabytes. So I was all excited because I found out, wow, I can jam that in my PSP also. Woo-hoo. All right. The Infectus firmware, that was thought to be a downgrader. It doesn't work 100% of the time. And there is a certain chance that you will break your PS3 in that blows. All right. It does Bluetooth and has USB and keyboard connections built into it. Tricks. It runs Linux, many flavors. You just have to go online and find the individual instructions on your particular flavor that you would like to run. I advise that if there is a custom version for the PS3, download that one. Don't even play with any other flavor and try to get it to work on your own because it's a huge pain in the butt. And I'm showing a picture right here. That gentleman right there has, I think it's eight, yeah, eight different PS3s. So there's already people that are trying to make clusters out of these things. That is nice. All right. Oh, the last little bit, there was a talk by, I think it was, Garner's Steve Prentice, he fears criminals would use the PS3 for crypto hacking and I have the article at the bottom of this page in tiny URL. And basically he would be correct as long as whoever is creating the anti-encryption software utilized or wrote it to the strengths of the PS3's processor, which it's outstanding at single precision mathematics, double precision, not so good, things like that. So, okay, so Sony as a media server and then Apple for the, was that the ITV? Oh, okay, I'll do that, thank you very much. Whatever I find from what the gentleman had spoken to me about it will be up on my blog. So, all right, here's more sexiness. That is not my PSP, I would never defile it in quite such a way. That was Lixang, may they rest in peace, they were sued into oblivion by Sony. Anyway, you have basically two little MIPSR 400 processors in there, they run literally from 1 MHz to 333 MHz. You can downclock it and you can upclock it up to 333. Sony still maintains that it's not a good idea to run it at 333, but people are now. And various home brews definitely take advantage of that clockability. I know, down, down out there. All right, you can run wireless on B, there is no G. I actually have on order right now the new PSP so I'm going to see if that got changed, that would be nice. You have an IRDA transmit and receive node on top which is really sexy and the reason why I think that's sexy, you need to see major malfunctions discussion on old school hacking from what I think about two or three years ago. Watch that or read his information on that and you'll find why that is so cool. And then I'll show you a couple of home brews as to how you can use that IRDA port. You have a mini USB connection on top which allows you to hook up all sorts of little attachments to it, which I will show shortly. UMD optical drive and memory. All right, your add-ons. You have one unit which is the GPS unit. You cannot buy it in the United States. You have to order it from Japan directly. It's about $60 from good reputable places and you'll get it really quick. All right, oh, the shipping. That's after shipping, shockingly so. All right, you have a microphone and you have a camera. If you want to do some surveillance or something like that, you want to take pictures and it starts looking a little odd when your PSP runs around with extra attachments dangling off of it. So I would advise not to really do something else super spy like. All right, here's somebody who went crazy and decided they wanted to have an external antenna actually hooked up. It's got a high-rose connector on it. The daughter board does. And if you decide to do something like this, just be very gentle with that connector because it has a propensity to just drop right off of the daughter board.  So anyway, if you've got that thing attached to your PSP, guess what? You look suspicious. All right, GameCube hardware. You have the 485 megahertz gecko. It's a custom IBM processor, 40 megs of RAM. You had a fairly decent GPU at the time. You had a proprietary optical disk and proprietary memory cards. The add-ons, you had modchips. In fact, modchips, these guys went crazy. You had Linux running on this thing. All sorts of crazy stuff running on this thing. It was a great system. And in fact, again, the Chaos Computer Club discussion downloaded it. They elucidate greatly on how the GameCube was really cool and how they might have been able to use the same hacks that were used on the GameCube on the Wii. It's really cool. And Linux again. The Wii, we have a little bit beefier. It's a 729 megahertz Broadway IBM PowerPC CPU. That's pretty impressive. 88 megs of RAM total. There are actually several memory banks, but it's basically total 88.  You have to buy that separately, of course. 512 megs of flash memory. SD memory is its primary removable memory source. It has a couple of USB ports and the optical drive, strangely enough. I don't know why. It does not support DVDs or even play music off of CDs. I don't know why. Hardware of the DS Lite, two 32-bit processors. They're both arms. Four megs of RAM. Main RAM, I should say. You are capable of getting on 802.11b and the NiFi. It's the Nintendo's idea of Wi-Fi. You can get on that. This was kind of interesting. When all of these pornographic pictures of circuit boards appeared on the Internet, the most fervent hardware geeks started really zooming in on those images and trying to look up information on the various chips that were soldered to those boards. And one of the things that was kind of weird was, and you can check this on the Internet right now, if you type in Matsumi MM3205B module and that is the wireless module for the DS, there's no information at all about it. The only information you will find is like three hits. It's basically three blogs talking about, I can't find any information about this. Does anybody know anything about this? So it's kind of odd. I'm just pointing that out because of that. It uses SD removable memory. It has a microphone built in. It has a touch sensitive display. And it's got a couple of custom ports for gameplay, both for GBA, backwards compatibility, and the Nintendo DS. All right, add-ons, removable memory storage. I don't know of any memory limitations. Like you can jam it with, say, an 8-gig stick. I don't know if that's a limitation yet. Supposedly it takes everything. There is Linux that runs on it, but it's only sash. It's very limited. I have DS Linux on my system, but it has a very limited, but it is kind of cool. Huh? Oh, Boost Controller? Okay, I'll have to talk to you afterwards and I'll post that on my blog also. I wasn't aware of that. All right, programmability and flexibility, or what can I make this thing do? Oh, hell's yes. Exactly. All right, guys. Basically anybody who's had a PSS, PSense at least release day, firmware 1.0 was in Japan, 1.5 in the United States was what was available to us. I still have my virginal untouched 1.5 system. Those were actually vulnerable to running arbitrary, or I'm sorry, running unsigned code. And that was a bad thing, according to Sony. You now have custom firmwares. Dark Alex unfortunately has left the scene. I privately believe that he probably received a couple of threatening phone calls from lawyers. Season to sister else. And of course we saw the picture of Licks saying and they're gone, so that or else definitely has some teeth. So this was a few weeks ago. The reason why he's actually beloved in the PSP fanboy group is he created one of the best custom firmwares. His last one was based off of the 3.40 firmware. Allowed you to have all the access to all the cool stuff, be able to access to your PS3 wirelessly and to play all the new games. Yeah, yeah, yeah, yeah. And do all the stuff for homebrew. There is another group, M33. It's a Russian hacker group. They have picked up that baton and are running fast. They actually have a newer one that's based off of firmware 2.52. And the newest one that's out by Sony is, I'm sorry, 3.52 is what they have. The newest one by Sony is 3.53. Please don't download it unless you read it. After I put up on the forums, hey, I'm going to show you guys at the Y5 Village how to do all of this stuff, blah, blah, blah, blah, blah. One of the poor guys had actually hooked up to Sony's official site, had downloaded, yes, and they had just changed it. And I said, dude, you should have known better. Come to my website. I've got everything. So, unfortunately, he didn't hear me. All right, gateway firmwares 2.71, 3.02, and 3.50. Why are the gateway? Because you can downgrade from there. And when you downgrade, you can upgrade to those custom firmwares that we all love. Vulnerable games that allow this gateway behavior. Luminous. I have a copy with me, and I actually was pretty damn shocked that right after that news came out, that version 3.50, all you needed to do was download this modified save game for Luminous. The stock in Luminous went through the roof. You couldn't find a copy online for less than $100. And places around town, at least according to the internet, were quickly running out of copies. People were buying them up and selling them on eBay, bastards. Whoa. Well, come back. Come back. That scared me. I'm talking too long. All right, and then you had Grand Theft Auto that allowed you to do other things. You have SDS Lite, you have hardware modifications. You just plug into the end of the unit. You don't have to open it up unless you really want to. I advise not to. And everything pretty much runs. Nintendo's opinion about how it does things with the homebrew community is almost diametrically opposite from Sony.  We're just going after the hackers. Wait a minute. The homebrew community, anyway.  The Xbox, the original Xbox, you use a font handler, and it basically, you can hack it that way. You have to remove the Xbox dashboard. You have the A20 memory handling flaw. Games running, definitely run in kernel mode. That's a problem. And that allows you to run those three games that are listed below and use their save games because now they're in kernel mode to hone that machine. Thank you. The PlayStation 3, you have an internet browser flaw. I had an individual give me a heads up that he had found one. Anathema is his name. But at current, it hasn't gone too much further than just crashing the browser yet. And I saw something just in the last week, somebody was loading an unnamed PS2 game and was causing it to crash and the screen started flickering. And I didn't know whether it was crashing the video because some PS3s do have a problem with syncing video with some televisions and I thought maybe that's really what was going on. But I'm just mentioning it because it was interesting if it's not a hoax then it should be looked into. Current neither of these approaches is all that promising. I'm talking about the PlayStation 3 besides who wants to break the $600 system? I don't. Alright, Linux is everywhere. And generally I'm pretty much assuming that if you can put Linux on something, it is game over for the most part. It's game over. You can use all of the tools at your disposal as a standard Linux user. However, I was reading something about the PS3 that was unusual. You cannot put the Wi-Fi unit or module in the PS3 in promiscuous mode at current. Alright. Game console coding. You have various things that you can use while on Linux. You can program in C, Python, Perl, etc.  There's no modification, however. There are native, they're small, and there's still kind of poof of concepts a couple of them are. But you can actually program in Python on the PSP. Lua on the PSP and DS. There was an assembler for the PSP. There was a C compiler for the PSP. And, of course, there's basic for DS. Alright, Homebrew. It's a term frequently applied to only video games that are produced by consumers on proprietary games platforms. In other words, game platforms that are not typically user-programmable or use proprietary hardware for storage. Sometimes games developed on official development kits such as the NetYaru's or PS2 Linux are included in that definition. Some, however, also refer to all non-commercial home-developed games for open architectures as homebrew games. Though these typically go under Alright, here we go. This is the goodies. This all kind of flies through, actually. I apologize. I'm running long. Alright, the PSP. This is the IRDA capture. I actually got to meet the kid who actually programmed this at Torcon. He came out with this and pretty much dropped the project afterwards. But it opened up the floodgates for grabbing information and turning it into something you can use on the PSP natively. You have a PSP IR commander which supports over 2,000 controllable infrared devices and also its successor, the IR shell, which does more things. Each one of those came with a handful of already pre-programmed pretty much devices that you can actually control from the get-go. You go on the internet, and I have a link in the notes where you can get these. I think they're up to 2,300 devices now that you can download and they're totally compatible. Pone everything. Now we've got a short video. This is the PSP portable VNC viewer. It's based off of a portable VNC program that was created for Palm OS. So here I am. I decided not to trust Murphy while I was here, so I decided to do everything pre-recorded. Oh, my goodness, it's up there. There's my little PSP. All you need is these cables. What I'm demonstrating right here is that systems, you can just plug this thing in and thank God for modern operating systems. They're so helpful. Thank God. It makes my life a little easier. And there I am plugging into an unassuming little hub. Doo-de-doo. Then I fire up my little system and all I'm going to do is I'm going to tell it, go into USB mode, make yourself available to the operating system at the other end of this cable so that it can read and write to you. And the full memory stick in the system itself is usable. And there we go. VISTA is very nice. Look at this. No warning either. Hi, I found it for you. You can use it now.  It's probably coming off that way, but... All right. Here's my little laptop running VISTA. And now that I've got... Unfortunately, I didn't really plan this really well.  So what I'm doing right here is that I've opened up the directory for the PSP and I'm grabbing and dragging tiny VNC. Version 1.29 works flawlessly. I did try the latest version, which is 1.39, and the video didn't come through. You got on the box, but you couldn't do anything. All right, so there we go. I've copied it, moved it over. I'm starting to install it here. It doesn't take very long. And again, the only thing VISTA did was, do you really trust this? Of course I do. Now I'm deleting it just for regular users. Of course, a good forensic analysis would definitely give me a way. And the only thing that betrays that that is on there is that tiny little V on there. I've been... Actually, when I was at the Wi-Fi... Church of Wi-Fi discussion earlier, somebody came up with an interesting idea and he said, hey, why don't you write a little script for the registry? Run it, drag it over with your installation. Run it after you've installed it and it'll take that right off of there. They won't know. The average user won't know that the VNC is running. Oh, God, that's darker than I thought it was. All right, I'm running the application itself. The only thing I've done ahead of time is I've searched for an access point in order to get onto the network. Do-da-do, zoom in, a little action there. And of course I did try... I tried to put a password in there, one, two, three. And there I am. I'm in the box. That VNC software actually works with a number of IR wireless keyboards so you don't have to jack around with playing around with the buttons in order to get the alphabet, you know, somehow, you know, coming through. So you can type as fast as you want. You poem the box. Because basically you've got that box and you use its trust on the network. Move out. Move out from there. PSP has secured text. It's unfortunately just RC4, but it's a good proof of concept that you can actually encrypt and decrypt anything you want on the PSP by itself. You can run the PSP as a web server or an FTP server. You can chat with your friends when you get lonely on those stakeouts, looking at other people using their computers, using AIM, ICQ, MSN, G-Talk, and Yahoo. This is completely in the free. No one does not support encryption. However, this does. PSP SSH, it's based off of Drop Bear, and it is fully SSH2 compliant. And a shout out to the 757 guys, this is your server, which they gave me access to. I did not poem their server. I'm not that late. All right, here we go with the little demo. And this is my 1.5 system that has never been modified. So a lot of these tools you can run on either the modified firmwares or the original firmware. All right, what I've done is I'm running the application. Of course, I've already got my AP picked out, which one I want to actually access the internet with. I've already put in my user information, the server that I want to go to. I'm logging into users. It didn't crash. All right. Unfortunately, it's really, really dark, but that's the welcome screen that just popped up. Next, I'll be typing in IR SSI. I will be screening it as instructed by Count. And from there on, I go on to Splitcast, go talk to the guys at Splitcast, and I log off. And everything's encrypted. We have a Wi-Fi sniffer. This was kind of cool. It was a little project that this dude came out with. Unfortunately, after two modifications, he dropped it. The original idea was it would actually turn into a real sniffer. You could find APs, select the AP, and decide that you wanted to start collecting packet traffic. This is kind of cool. You have the PSP map this. This is a sexy little thing that you can use with the GPS. I would love to see somebody code, but it's not me, a version of map this with that previous Wi-Fi. And start walking around and having little pinpoints on your map, which you download from Google, freely available. And so you can remember and use this as a geocaching toy. I'm going to show very quickly. There's audio to this. It talks to you. And people can drive with it. It's not advised, but you can drive with it. Unfortunately, no. The coder that actually put that in there, I always screw up his name. Please check the notes. He's a cool guy, but I don't want to murder his name on tape. But anyway, he actually had coded that from scratch all by himself, because when you buy this in Japan, you get the entire Japanese map. You get everything. It's very cool. But he decided before this actually was released or available to Americans, he had actually hacked together. I think it was a Hilux GPS and hacked it so that actually would physically interact with the PSP through the mini USB port. And he created that software all from scratch. It's an excellent program. PSP inside was kind of cool. Unfortunately, it's not really maintained anymore. But if you were dying to find out what all the registers were doing in real time, what anything that was pushed into memory that the PSP had to process, you could see it in real time. You could capture that information. You could play it back. You could modify some of it. Can you save for overflow? And here's the luminous downgrader. These were some of the outrageous prices I saw. Amazon, love them to death. Somebody was selling theirs for a penny. That went quick. And then the next one was 144. There were only like four of them for sale.  All right. Now we get into where the DS fanboys can strut their stuff. The DS FTP is actually a server and client. You can set up user accounts on it. And your only limitation is the size of the stick you have in it. Wi-Fi lib test is really cool. I wished I had animated this. I was walking around with this and showing some people because I found out this is actually on the scavenger list. If you could find a DS that was actually doing packet capture. So I have one. You can't take it. You can walk me over there and I'll give you points. So anyway, this was an application by a fellow named Steven Stair. I did not code this. A couple people thought I did. I did not. He did an outstanding job. All of the packets that it captures goes onto the memory stick so you can review them. It's not real fully functional, but it's cool to begin with. I mean, it's just cool to play with. You have Aircrack, which you can see. You have a lot of success running, but when I went on the forums, those that did get it run, it was fairly decent. It actually would attempt to crack web packets that had, or based off the packets that it had received. It wasn't really fast because you are talking about ARM processors, but it was something. You have pointy remote, which is a VNC controller for your DS. I thought that was cute. And we have Leloo FTP server. It's also an FTP server, but it's a bit more fully full-bodied as far as your FTP servers go. I would advise looking into this one if you were going to mimic an FTP server with your DS. And then we have Moongel. I list that only because it's exceedingly popular. It's very powerful, very fast, and it does almost everything that you want as a loading application. Now we got Concealment. Now when I walked up here, I whipped out two game systems. I don't have any more hidden anywhere deviously. But basically in this picture, who has equipment that they might be able to use in order to do a quick scan on any network, whether it's a smartass. I'll get you later. So we know that the games are probably in May, according to the people in the back, have that equipment. But this is another thing as far as for Concealment. When working in corporate offices and stuff like that, I've been in a couple where they're very anal-retentive as to what you can bring in, whether it's a cell phone, MP3 player, all of these things could be used to help leverage either physical access or digital access in restricted spaces. Do you have the same restrictions on video game machines? Do you have a restriction on the games machine that may actually have been purchased from your company and is in your break room? I actually visited two companies I want to say a little over a year ago and they actually had one hooked up to their regular business network and I about fell out. It's like, oh my God, how cool. Not. All right, Concealment for actually digital media. You can basically... I love my Altoids. They burn me horribly but I love them anyway. You can put all sorts of stuff inside of them. I've been searched several times and when I've done some red team stuff and they never looked under the wrapper, they also never checked in my shoe or anywhere else. And especially as I said with that teeny weeny micro SD chip, pat me down please. Are they playing a video game? Or are they doing something to your network? Other little tidbits. I did some really ghetto port knocking or fuzzing with Nexus and found the following ports were open on the PSP. I actually found these open before any of the big homebrew had come out. Nothing has changed but it was kind of neat. The Xbox 360, port 25-110 and strangely enough 1030. It was acting as a web server I don't know why. Honestly, I don't. And then we have for the PS3 only two ports were open. I had another port that was intermittent and I couldn't nail it down so you're only seeing two of them. It was 25-110 and that's not terribly shocking because they really do want to make this thing into an all-in-one box that you could use for your gaming and hopefully not business What? Okay. The other really quick thing on the bottom of these slides for IDS gritties if you don't secure your network at least you can catch these guys by looking at the MAC addresses and they habitually or every once in a while all of these systems will go back and check predictable places so that hasn't been modified by anybody so put those into your IDS logs oops Alright, nothing. As far as ports on the Wii and the DS I absolutely found nothing. Now you can sniff traffic all day long but I didn't see anything that was dependably open and the reason why I think this might be true or why this is is that the wireless on both the Wii and the DS Lite literally shuts off when it's not in use so I thought that was kind of cute. For the DS Lite it's a great way to save power and then we have really alternative ways this was on TourCon I went downtown to meet some friends at the sidebar being new to the area I had no idea where the sidebar was and luckily for me all the proprietors were nice enough to put the names of their businesses and their SSIDs so I had my PSP with me and started just checking around because actually the PSP is directional the antenna runs along the top part so all you have to do is just kind of like wave it around and you'll figure out where everything is so I found the sidebar strictly by using that it was about five blocks away it wasn't like it was a big thing these are all of my, most of my sources the rest of them are on my blog but these are the ones that provided me the most information I thank you all for sitting through my horrible talk my blog my blog is Haxis H-A-K-S-Y-S dot and then I'll have to spell this for you schlepping squid S-C-H-L-E P-P-I-N-G squid.net, sorry about that or just go to Google, search squiggly one, you'll find me thank you very much


So, hello, everyone. So, today, we're going to talk about the OpenStack cluster zero-time upgrade and featuring in the Kola project. So, my name is Hieu, and my colleague here is... My name is Duong. I am software engineer from Fujifilm, and I'm also a Kola reviewer. Yeah, so you can ping us in our... Here we are, our contacts are on the screen here. We are email on an IRC. So, this talk will give some reviews and thoughts about the zero-time upgrade for OpenStack service. And please note that this is just an idea... This idea showing in this presentation is just a concept, and hope that in the future we can implement our idea in a native OpenStack project. And we have some PLC and demonstration via Kola project. And here on our line, firstly, we come through some concept about the OpenStack upgrading. And the second thing is our approach to achieve the minimal time to zero-time. And the last thing is some zero-time upgrade proposal in the Kola environment. We have some demo, and we show some live demo while upgrading in Kola project. And we have zero-time while comparing with the normal upgrading process. And we have it in our video demo. And so this is a live demo, so hope that is okay. The first thing here is about OpenStack upgrading. So this is one of the most demand features for every system, and nowadays the service license agreement is more strict. So after it's released, we need to decrease the downtime of the system. We cannot achieve the upgrading via the co-upgrade, but this is very hard to control the downtime, and the co-upgrade is very easy, but we cannot control the downtime. So here come the two upgrading models. The first one here is the blue-green deployment and canary release. And the second one here is the rolling upgrade, which are implemented in some OpenStack projects. So in the screen here, we have two clusters. The first one is a cluster running the old versions of our service, which are depicted by green color. And the second cluster here is blue color, that running the new versions. So blue-green deployment just suite on the request from our cluster to the new cluster. So this advantage here is a high cost hardware requirement for switching and preparing the infrastructure to upgrading. So the canary release is an advantage model of the blue-green deployment. So we just need to suite a few percent of user requests from the old cluster to the new cluster here. And if our new versions of service can work well, so we will suite on 100% user requests from the old one to the new one here. So here come the rolling upgrade. Rolling upgrade model in OpenStack can try to eliminate the need to restart the old service on new costs simultaneously. So we have three services, A, B, and C, all running in the X version. And while upgrading from the A service and the B service from X to X plus one, we need to ensure that the A service and the B service in the new version can work well with the C in the old version. So it may have some doubt harm in while upgrading. And we come from the User Story Product Working Group, and this is the eight requirements for performing rolling upgrade in OpenStack project. The first one here is the online schema migration for which supporting the project can migrate the data and we perform upgrading the schema OpenStack project. The second thing here is the maintaining mode that we fancy on the request from the user while we upgrading the service. And the third one here is the line migration and if we try to rolling upgrade the data plane, for example, the Nova Compute service, so we need to ensure that on the VM running in the node, can line migrate to the other node. The fourth one here is the multi-version interop, which I mentioned in the last slide, that on OpenStack service that communicate with our IPC you need to work while we're upgrading from the old version to the new version. The fifth one here is the great full shutdown is that if one upgraded service processing some user request, we need to ensure that the current user request to go into the upgrading process. The sixth one here is the upgrade or gestation that we can automate the upgrade process via some tool like NCBO or HEAT. And the seventh thing here, the upgrade thing that we try to ensure on the new patch upload to OpenStack to code can work well and do not break the upgrading process. The eighth one here is the project targeting which DC propose for provider enough information for operator or end user to see how many projects in OpenStack that support rolling upgrade. And more detail in the upgrade access and start, the DC of OpenStack defy upgrade-related task. The first thing here is support upgrade. The second thing is support-accessible upgrade. And there are some OpenStack projects, almost OpenStack projects that support upgrade, but there are no projects that can support the accessible upgrade because they're very hard to test the data plan of the OpenStack project. The third one here is support-rolling upgrade. There are a few OpenStack services like Nuva or Neutron that now support the rolling upgrade. And the fourth and the fifth here is the zero-dial time upgrade. We can ensure that while we're upgrading, there are no dial time, but we can accept some a little bit of delay while in the user's response. And the fifth one is zero-impact upgrade that eliminates on the delay from the user perspective. And I'll talk targeting the fourth one here that supports the zero-dial time upgrade, but not native in the OpenStack service. So from minimum dial time to zero-dial time upgrade here, we need to enhance two things. The first is the configuration management, why we released a new version of the OpenStack project. We can have a new config. We can have the deprecated config or removed config after the two releases. And we need to pin it in the config file for the RBC communication. And the second thing here, we need to enhance the DB migration or another term here, online schema migration. So while upgrading the database, we need to ensure that all the process of the database upgrade cannot break the work in the old service of OpenStack. Currently, there are two main approaches for online schema migration. The first thing here is the trigger bay that Keystone and Glance are implemented in the last cycle. And we also saw that Facebook uses something like trigger bay in the reference link here for doing the upgrading of Facebook service. The second upgrade here is the trigger list as the Nuva and Neutron are trying to target. And another upgrade here is the binary lock bay that we will talk about later. So for the database online schema migration, so there are two candidate solutions. The first thing we propose is that we need to buffer on the request in the upgrading period. And the second thing, we utilize the checkpoint and snapshot of a binary lock of the database. This is our proposal that in the first step, there are a normal OpenStack cluster. And in the first step, we try to upgrade the OpenStack cluster. We turn on the request buffer. This can be an in-memory request buffer. And this will hold on the user's request in this buffer and tell the user that please wait a few minutes while we're upgrading the OpenStack cluster. And after upgrading our service from the X version to the X plus one version and the db-rayer from X version to X plus one version, we release on the request in the buffer and ensure that the request is resend with the original auto. So there are two kind of requests. We need to buffering the first thing is the RESTful HTTP API request from the user and the mid-wind interproject and the second thing we need to buffer here is the RPC request through the message queue layer. And we need to ensure also that the only request that we put in the buffer need to be resend in the correct order than best with the timestamp. So this can have an advantage that from the user point of view there are no service-perceivable downtime if the migration time is short enough. But it comes out with this advantage that if the migration time is long, mainly by the database migration process, some requests can come out. And the system will last when the requests are queued in the buffer. And for some requests, we see that there are some uprights from the Keystone project that allow to expire token so we can reduce the expired token while resending from the buffer. So for trying to resolve the buffer can be very large database while upgrading and migration data will come up with the next proposal. So every open stack database has a feature called binary lab. So we turn on the binary lab and on the transaction will be held in the binary lab and then we create the checkpoint turn on the binary lab. So there are some depict here that on the new data will come in the upper layer of the red color and on this new data will be recorded by binary lab and we set down on the database related service and read the binary lab we migrate the data to the new version of DB. And after that we turning off the binary lab and come restart on the service in the new version. So there are a little bit of time here and this can be eliminated with the previous approach. So the advantage of this proposal is that the internal system is very smaller comparing with the previous approach and this advantage here from user point of view is very short downtime but the implementation is more complicated than previous approach. For example, not open stack service using the same DB mechanism that can support the binary lab. So our live demo will come up with the first approach. So for conclusion we can combine the two candidate methods to get advantage from the both methods. So the first step here we create the checkpoint and the binary lab and then we migrate the current DB to the new version schema and then we turn on the buffer for holding on the user request then we migrate the new data to the new DB and then we turn off the binary lab and we finish. So we hope that this can have a zero downtime from user point of view and only a bit lag while user sending some request and have a response here. So here comes the demonstration in Kola and my colleagues will help you. Thank you everybody. First I have some words about Kola project. It is in B10 in B10 of open stack and submission is provides a product ready container and deployment tools for operating open stack cluster and I do not see any colleagues here so thank you for bringing Kola to open stack it's a very nice project and very nice team currently we have three deliverable the first one is Kola it provides a Docker image for every open stack service currently we have own service in B10 has immediate Kola. The second one is Kola asable it is the asable playbook and supplement tool for deploy open stack cluster and the last one is Kola Kubernetes it is the same mission as Kola asable but the deployment tool is by Kubernetes and HEM the Kola asable is in but Kola Kubernetes is in active development so we have some company use Kola asable in production but previously we have we need to enhance for zero time upgrade and for the first one is configuration management and Kola asable support configuration management by implement and mechanism configuration overridden it is use future of asable and some of our patent script Kola Kubernetes post boot potential to automate automate configuration management you confirm map and as a result and catcher of Kubernetes and HEM and active development so it not have complete future and for the online schema migration for open stock service support online schema migration natively we must implement mechanism in Kola logic and I have blueprint here you can see the red one so online service upgrade for your schedule for the project would not support OSM natively we can implement above idea high availability and load balancer layer and for the request buffer in demonstration we use intermission in open REST maybe not many people heard open REST or intermission in web framework but it is extension of engine and intermission is lower plugin for open REST for buffer in the request and it is open source for the PLC we have some component here you can see we put intermission be in front of adiproxy from adiproxy adiproxy is part of Kola deployment model and the keystone is only a sample in Kola deployment adiproxy is in front of open stock service and the intermission here is for buffer in the request render upgrade is third plate we also have some component here the first one is header for the request go out intermission and the second one is I change part of some service is in upgrade I we also have one scenario here is continuously send 200 request is create and release to and we upgrade to the master cost bay why the upgrade is send for demonstration we wrote some script and you can get it as a github also we record to video as the upgrade without time is video I hope is kind of source let me publish and we have four pan here the first one is the first column is where we run script and the second column is right we tell the log the output and the error log of the script will send the request I choose this I'm sorry the first side is a bit small you can see before the upgrade is third plate the output is is right out and the upgrade is task because we cannot increase the true cluster for not buffering and the buffering version so we record the not buffering versions and show it in the video and in the next we do try to live demo in the buffering version so in the last here is the error log from open stack cluster we do upgrading the neutron from Newton to the master so currently there are no errors can you skip? maybe I will skip a little bit it's still fine but yeah you can see that I you can see that the neutron server is in upgrade so it takes back for a while and the request is sent to the neutron there is an error here in the bottom right pan many errors come back with the live demo something wrong? sorry the VPN connection is time out I must use VPN to connect to my cluster and the connection is time out please open the video for that so in the meantime I will play the second video and if the connection is bad first I will provide some live demo so pan is now all the same as the previous video I am sorry for the connection it's gone talk a little bit so in the demonstration we only buffer the HTTP request so we do buffer it in our research okay so COLA community also post many interest in rodent upgrade and zero time upgrade but so here is a test with environment that is deployed by COLA and we put a new layer calling OpenRxD with the intermission and before upgrading the COLA the open stack cluster deployed by COLA from the new turn to the master version we turn on the buffering request and then start upgrading the cluster and continually sending the grid and delete network to the new turn API server so in the upper right here is the response from the new turn and similarly with the previous scenario in the lower right here is an error loop from the new turn API server so if there are errors that will show up here mostly from the HTTP code of 400 more than 400 and less than 500 connection back connection back if somewhere it seems that teamwork does not like VPN I don't know why the teamwork with CMD does not like VPN so okay, please come up with the video so we cannot connect to our system via the VPN connection in some network something so please come up with the video you can see that the neutral server the neutral server is finished upgrade the phone is missed more here but here is in the first in the top left pan it is the three yellow line and it puts up the neutral server it's finished upgrade and you can see that in the bottom right pan all errors is speed up but the up put pan is still fine but it lags as he said before due to the buffer the request it hold in the buffer and the request is continuous it's still sender can you skip to the last part for the final reason sure it's very long very very long process progress here so the upgrading of the neutral server from old version to the new version is very long because we need to wait for the neutral server in the new newest version to come up and take around 5 10 minutes and it is it is a case that our neutral server that the body has many data in it and it's at that time and in the production when the data body has many many data the migration progress is much longer much longer than it so if we do not have the buffer layer on the request it fail skip a little bit here the upgrading progress is finished in the first part and the request is continue process you can see the output is come back here but no errors can you skip to the so output is continue so in the first top left panel you can see that the upgrading process is finished and the line in the lower left panel is the request finished sending the request for creating and deleting the network and after finishing the upgrading process the buffer now release on the request that in the buffering and here you cannot see the error from any error from the request of the neutral API server can you continue you can see that the request on the request is sent and the output is near the end of the output we index the request that you can see here in the request that creating and deleting the network number 1, 2, 3 and then in the in the top right panel here you can see the order of the buffer request continuously increasing from 1 to 200 so that is finished so very sorry for the VPN connection but come back to this slide so we have the video demo here and sorry that we cannot create a live demo because time out but you can try it by yourself we provide the script we use in the demonstration even the second VM for the testing is put here and I get the idea from the collaboration project to set up a VM from the request you can in the our demonstration you want to for the host OS and you can use our script to set up this for collaboration deployment and everything else is provided by collaboration so that's our presentation do you have any questions if there are no questions okay so thank you for coming here and very sorry for cannot have a live demo so thank you thank you very much


Hi there! It's DJV and I'm very excited to announce my Briarfest plans in this video. So if you're not a collector and you're unfamiliar with the event, Briarfest is a three-day festival that was held in Lexington, Kentucky. And it was a festival of horses essentially, so it included lots of model horses, briar horses, but also real horses and their owners and famous horses from around the world. Unfortunately, this event obviously has been cancelled for the last two years because of COVID, but this year I have really actually taken the time to develop some sales and items for you guys to purchase at Briarfest. Briarfest weekend is the 16th, 17th, and 18th of July. I'm going to verbally announce everything that is coming down the pipeline, but official announcements will come closer to Briarfest and when these things are happening, I just wanted to kind of put a bug in everybody's ear and say, this is what I'm doing, so watch out for it. And it is starting now, even though it's the end of May, I already have plans here for the end of May. Saturday the 22nd of May, I am going to be selling my E.T. Custom. He's an older custom from a couple years ago now, but it's time for him to go. It'll be a week-long auction that will end on the 29th of May, which is this Saturday. He will be listed on Model Horse Place, and that's an auction site where you can sign up and include your bids and then pay for the model via PayPal. Time payments are accepted. He's going to start at $100 U.S. and he has the reserve, but the reserve is low, so I believe he will meet the reserve for sure. After that, we essentially have six weeks leading up until Briarfest, and I have created six statement customs to sell these six weeks leading up until Briarfest. So to anticipate Briarfest coming, I'm going to list a single stable mate every week up until Briarfest. So essentially starting on June 3rd, every Friday to Sunday, I'm going to have an ongoing auction for one of these six drastic custom stable mates. So they're not just repaints, they're actually drastics. They have sculpting work done to them, and the paint jobs are pretty pretty awesome. Definitely some of my best work I've done. Those models are all going to be listed at an auction, and I'm going to be listing those on Model Horse Place as well. I will be launching that Saturday the 29th, just as like a formal post saying it's happening. Coming up in June as well on the 5th of June, I'm going to be launching my gambler sticker, and that is essentially a sticker design that is similar to what Briar does with the gambler's choice models. You'll buy into the set price, and you can receive one of four colors. You can buy as many as you want, but there's no guarantee that you're going to get the one you want or the chase piece. And then within the chase piece, there are going to be three winners, and those three winners will receive one of my Briarfest medallions, free of charge. I'm opening it up on June 5th, and it will be going until Briarfest and be closed during Briarfest. Really cool designs though, you're definitely going to want to get on board. The chase piece is so cool. I will be releasing more information about that on June 5th. The week leading up until Briarfest, I will be announcing and revealing everything that I talk about now. I have sculpted a medallion exclusive for Briarfest this year. It's really my second medallion in production. I haven't done one since Arrow. You'll be able to buy a certain amount of those at limited quantities as well for a buy it now price. One of them I'm going to actually do a giveaway. I'm not sure how to work that quite yet, and I'm also going to be painting one as an artist proof that will be auctioned off during Briarfest weekend. I also have three limited edition sticker designs for Briarfest, so they're going to be released at limited quantities on each day of Briarfest weekend. So the 16th, 17th, and 18th, there's going to be a design for each one, and they followed the theme of a horse is a different color, so they're very unique and very cool. I will essentially launch each one during that day, and once they're gone, they're gone. I'm not making any more. They're not pre-orders. They are essentially set quantity, limited edition as well for Briarfest weekend. I will be having three micro mini paint jobs, and they will be available at buy it now prices as well. So I'm going to set the prices. I'm going to list them in the morning, and whoever gets to them first gets a DJB piece. But way back in the day, I actually filmed the entire process of creating Yorg start to finish, and he will be released in a tutorial form that you will purchase to view. It's essentially like a course, so it's going to include more information and be a little more in-depth than my YouTube stuff, and it's going to include links and references and things that you can go to to help learn how to customize, and it's going to dive a little bit more into sculpting the eye, sculpting the face, sculpting hair, and painting that really intricate detailed paint job that came with Yorg. I'm also very excited to launch some exclusive merch, so I wanted to do this for a while, but I've been trying to figure out the logistics of how to do so, but I will be releasing shirts that are limited to Breyer Fest, so they will be an exclusive design that is in conjunction with the stuff I'm releasing for Breyer Fest, and those will be available in t-shirts, crew necks, and possibly long sleeves, and I'm also going to have a hoodie, and I'm going to include some studio run stuff as well, that's just my studio logo. I'm also releasing a plethora of other sticker designs so that you can add them to your cart and you can fill up your cart full of the stuff that you've wanted to buy, but didn't want to like spend a bunch on shipping, so the shipping can be combined in that way, so I have lots of cool designs coming, as well as my best customs contest horse is going to be included in the custom line of stickers that I created previously. Then possibly I also would like to do a traditional custom, this is very tentative, I'm not sure if I'll get there, but I would like to release at least one larger sized custom, we'll see how that goes. The 15th of July is essentially when all of this stuff I've talked about minus the gambler sticker and the Thiebelmaid customs will be released on July 15th, and that's the Thursday before Breyer Fest. On the 15th I'm also going to be releasing the DJB swag pack, and that's going to include everything that I just talked about is going to be in one package at one price, so you get a slight discount on if you were to buy all these things individually, you can buy it once, and it's going to include a lot of the awesome stuff that I've talked about. Everything combined, so you don't have to rush to buy the stuff before it is sold out, you can be a part of it in a sense that you get everything at this one large cost. I'm really excited to announce all of this stuff, and I really hope that everything goes to plan. All of these sales are going to be listed on my website, www.djb.com. I'm going to have a separate page set up for all of my Breyer Fest sales, and you'll be able to add everything to the same cart, and essentially I'm going to put all of my sales available, and obviously after Breyer Fest things will be shipped, some stuff will have to be produced after once I know quantities, and some stuff will be ready to go right away, but you can add everything to your cart. Everything will be priced in American dollars, and everything will include shipping within the price, so stuff is going to be a little bit higher price, but you're not going to pay the additional shipping on top of it. International people, we're going to have to have a conversation.  I'm also very excited that I will be using PayPal as a merchant this time. You can pay with your PayPal account, but you can also enter a credit card or a debit card into PayPal to pay without having an account. Thank you so much for watching this all. This is a mouthful, and I'm very excited. Just wanted to verbally announce all that stuff, and that's my plans. I hope to see you all at BriarFest this year.


Okay, we're back. This is Dave Vellante and we're live at the Moscone Center in San Francisco. This is theCUBE. We're at Oracle Open World. This is our third year here and this is the Oracle Backup and Recovery spotlight. We're going to drill into some of the trends that are going on in the industry. We just set up the overall sort of market angle and the technical angle. Some of the things that Oracle practitioners should think about. And to have this next conversation, I'm here with Shane Jackson and Mel Schum of EMC's BRS division. Shane is the vice president of the division and Mel is a database expert. Mel has been on theCUBE before. We had him on last year at Oracle Open World and we can drill into some of the technical aspects. So gentlemen, welcome. Thank you, Dave. Good to be here. So good to see you guys again. You know, we're here at Oracle Open World. It's amazing just to see the transformation of Oracle. I know Shane, you live out in the valley and you've seen Oracle. You knew Sun Microsystems as well. I don't know, Mel, if you're out here as well. But to predict that Oracle would be here as a hardware company, talking about all this cool hardware. Really a software company doing that. I never could have predicted that, but it's quite amazing transformation, isn't it? They've definitely transformed in that way. Yeah. So at the same time, it's become a different animal to compete with. I mean, we're at VMworld last month. It's all about the ecosystem.  But let's talk about backup specifically. It's a critical topic for Oracle DBAs. It's a complicated one. And if you mess up your backup in Oracle, you're in deep trouble because you're running your business on it. So Shane, I wonder if you could start just by talking about some of the trends that you're seeing in your business and how things have evolved over the last couple of years. Yeah, absolutely. I mean, it's an interesting point you make about Oracle and the competitive nature, but they're a very close partner in the sense that our top use case for our backup and recovery solutions is for databases. And it points right back to the criticality that you just talked about, where if you mess up the backup of that, it makes an impact on your business, right? Not just your ability to get a backup done or recovery done from the previous night, but it actually has a downstream effect on the ability for people to do work and for the company to make revenue. And so that's really where we've been focused in EMC's backup and recovery systems division is on things around recoverability, right? And I think that's the old adage of about backup. It's not about backup, it's about the recovery. So obviously, recoverability is important. Doing that efficiently, so you need to bring some efficiencies into the mix in order to advance the cost and reduce the cost that it takes to get this done. When you contrast that against how quickly data is growing, it's like a tractor pull. The further you go down the track, the more the data weighs down on you, the harder it is to get the job done around backup. So efficiency has to be in the mix. And the third part of it is agility. So it's not good enough to just have a backup plan for what you need to do today. What's going to happen next in the step after that and the step after that? So you have to come to the table with those three things and that's where we've really been putting our focus in terms of the EMC's backup and recovery systems division. To do that, we really look on a couple of dimensions, which we all get into as we go through the conversation around database backups in terms of performance. So you have to bring the performance to the table that's needed. You need to have simplicity. If one of the key trends that we're seeing is that not only is it about the backup team wanting to understand and know what's going on with backup data, but the application owner themselves needs to know. The database administrator wants to understand, it's my job on the line. If my database doesn't work, if I can't get that data back, I want to have control and know where that backup is. So for him to be able to do that simply is important. And then the final thing is to be predictable. So you want predictable processes around your backup and recovery. So if you have those three things as a DBA, you start to feel pretty comfortable with your backup solution. So Mel, last month at VMworld we were talking about, we talk about backup and recovery everywhere we go because it's an important topic, but the discourse is really around virtualization and the resource allocation and the physical resources that you have available and techniques to sort of architect around that. What's different in the Oracle world about backup? What makes it unique and challenging? So yeah, that's actually an interesting topic because it's very unlike just plain old files because if you have 99% of the files for a restore of the database, you actually have a zero successful restore. You're in trouble. Yeah. And I've heard this actually in a customer environment where literally the backup administrator says, yes, we are 99% successful because we have 99 files out of 100. The DBA turned to the backup administrator says, you've got 0% success rate because I need all the files to do a restore. And that's the critical criticality of is being able to understand what files are relevant and what files are not relevant. I've seen a lot of customers wanting to tune the performance and not necessarily in terms of the throughput, but reducing the number of people required to do a restore. I don't have to have my DBA, storage administrator, standard administrator, server administrator, backup administrator, all coming together to figure out where is the backup and how do I get it back to where it's supposed to be and all the pieces are there. I've seen a lot of customers say, let's streamline this thing, make it almost self-service where the DBA is the only one woken up at 2 a.m. and Sunday. The DBA knows exactly where it is, kicks off the restore and then it off it goes. Because no matter how fast it is, getting five different people in five different areas to speak the same language to try to do a restore as quickly as possible, it's restoring by committee. And that's where a lot of people realize restoring by committee does not work. No matter how fast your networks are, you can't get the committee to agree to exactly where everything is at that time. And the DBA, because like Shane said, they are vested in making sure that the database backup is correct. They're the ones that actually get to do it. Enabling the DBAs to back up the database properly so that they know how to restore it properly. And those are the things that I've seen coming through as a trend where we're trying to streamline the process, not necessarily through the throughput, because you can only tune that to a certain point, but streamline the literally project and bring it down to one person so there's no critical path or no mishandling of handing off things. Having it all down to just one person, just do the restore as quickly as possible. It reminds me of that old bromide. It's people processing technology and oftentimes people say technology is the easiest part. If you ever doubt that statement, go look it back up in Oracle Worlds. It's really about the people and the process, isn't it? Exactly, exactly. If you can get the process down to just one guy who knows exactly what he's doing or Gal, they can actually get it done a lot faster and more efficiently. Now having said that, technology has evolved and we've seen the days of tape and then VTL and obviously today we're in this world of purpose-built backup appliances. We've looked heavily, we've often cited the IDC report. It's been amazing to see EMC's progress there. For those of you who don't know, EMC actually acquired data domain and has the assets of data domain, a previous acquisition of Avamar and a previous acquisition of Legata which has turned into network or software and the combination of those has led to a really dominant market position. You can't find a lot of markets where a company has as much share, maybe networking, Cisco and networking, but you've got about a two thirds of that marketplace in the purpose-built backup appliance. How were you able to achieve that? How important is Oracle markets to that dominance and can you maintain it? I think the way we achieved that is that EMC at the time of the data domain acquisition made a strategic decision to break out a business unit focused wholly on backup and recovery. So that division has grown over time. We're over three years in now and we've got over 4,000 people in that division that wake up every day thinking about only backup and recovery. So if you look across other industry players, probably hard press to find anybody else that's that mask stacked up against this problem which as you look at the different data from IDC and you guys have talked about it, backup is showing up more and more as a top priority for even the executive IT members of companies. Back when I got into backup, I was in the tape business and you bought your servers, you bought your storage and whatever money left over, you bought some tape drives and some robotics. It's completely changed because they're now seeing that the backup process can stall things like virtualization, it can stall what you're doing and your business objectives around Oracle and databases and whatnot. So it's much more at the forefront on how companies are looking at where they're going to make their investments. So the combination of having the focus with any EMC on backup and recovery and the industry changes such that the old method of just having backup software pointed to a tape drive is far from adequate and has been well proven. How have you changed? Because Shane, you came through the acquisition of data domain and you guys did a great job of really focusing on cutting costs, the de-dupe rates that you were going to achieve, predicting those de-dupe rates and really essentially replacing tape as the primary backup medium. How has your messaging and conversations with customers changed over the last couple of years? Yeah, interesting question. We were actually just joking as we're preparing for the show, one of our sessions where we're talking a lot about data demand and Oracle backup. Some of the slides in that deck were around in 2004 because of some of the key value propositions we bring like data and vulnerability architecture which is the way we cycle through the data on a data domain system to make sure that it's always recoverable. That's nothing's has happened during the course of the retention period. Our stream informed segment layout technology which makes us very fast in the way that we interoperate with the disk which gives us our performance advantages. Those are key advantages that we've had throughout and that still remain unmatched. What has changed over time is the interaction with the users of the ultimate users of the backup. So if you go back to data domain days it was purely about the partner ecosystem. So how do we work with Symantec and the rest of the backup partners? And now the focus has shifted much more to the application owners. So what is the Oracle DBA? How do they do their backup? What does that mean in interfacing with EMC backup and recovery products through something like Oracle R-Man? How does the VMware administrator interact with our products? The storage administrator and right on down the line. So if you look at where we're going with our products it's less about just the backup administrator's use of the technology but the whole application users interaction with it and their ability to see and understand what's going on in the environment. Now your CTO of your division Steven Manley has been on the queue and he at EMC World this year laid out this new vision of sort of essentially taking space efficient snapshots locally and then asynchronously moving the data offsite for disaster recovery. A new way of thinking about backup, we call it the time machine for the enterprise, the Apple time machine, sort of idea. You know being able to dial up or dial down your RPO and different approach. So Shayna I want you to sort of talk about that vision just briefly you know where you're at, you know what your thoughts are there and then Mel I want to ask you how it plays in the Oracle environment. So briefly it maps basically right back into what I just said and the ultimate goal is to have a consolidated layer of protection storage. So what happens when you have the different application owners starting to care about how they do backup? They start creating silos of storage where they're directing those backups and all of a sudden from the top of the organization looking down you don't have visibility into where the backups and my end compliance you know the things that a CIO would worry about. So the goal of what Stephen Manley was talking about is getting to that protection storage where all of those different interfaces right to that single consolidated back end. Once you have that and the capabilities for those application owners and their applications to be aware of that storage, then you can start to do the things like the snapshotting technology that Stephen was referring to in his keynote. But so Mel what's your prognosis for how that's going to play in the Oracle environment and where does it fit? So from an Oracle DBA's point of view, what we do is provide a facility for self-service. You'd be able to do your own backups and own recoveries without any intervention. But there still needs to be an element of a back administrator there to monitor to make sure things don't fill up, things, jobs actually run well. So there's ability for them to oversee all the DBAs, VMware administrators and all the other ones to make sure jobs are done successfully. There's another piece also where DBAs care more about the backups until it's too old that they don't care about it. So it's a point where it's an archive point of view. So the backup ministry will still need to make sure that they manage the archive and maybe save it off to another location or another place. But once the DBAs are pretty much through with a backup, it's let's say it's 30 days, 60 days, 90 days old, they don't really care too much about the backup at that point. The backup administrator still needs to care about that. So we allow the decentralization of the backup restoring for the DBAs but not necessarily to worry about is my data domain filling up, did all my backup jobs run successfully for compliance reasons, to make sure that everything is done correctly. So that job is more facilitated for the backup administrator, but we're facilitating that by making products that changes the dynamics in the customer environment that way. Do you guys still see a lot of tape in Oracle environments and does that surprise you? Occasionally, yeah, and it's funny because there's some countries actually where the law says you have to use tape for compliance and it literally spells out tape and the customers will follow to the letter saying, I will use tape. No matter even if it's virtual tape, they want to use physical tape just because the letter of the law says you use tape and it's surprising to me. And it's fair to say that increasingly that's in an archive or compliance role. Exactly. Now, you've sort of taken some action in that archive market, you've got some solutions there. You've essentially, in my mind, effectively creamed tape as a primary backup medium. Do you think that you'll see the day where disk, you know, in our lifetime where disk is the primary archive medium? I think so. You know, if you look at the rest of our lives outside of this show, does tape exist anywhere? The only place I have tape is in my fire safe where I've got my kids' tapes from 12 years ago and I'm scared to be able to duct tape. That's another one I used some of that last weekend. But no, we're building a lot of work with data domain for example, which originally was optimized for fast streams of data like you would find in a backup, not necessarily the shorter segments that you would find in an archive kind of workload but over time that's shifting so that we can do those workloads as well because if you can get your data where you need it to be, get it replicated off-site for protection, you've taken care of all of the needs of either the archive or the backup. Not much room for tape left in that equation. So now that cloud has moved beyond the hype cycle, you've seen Oracle dive right in and essentially put forth its version of cloud, which the messaging's pretty tight and fairly compelling. I would think that the number of customers that are going to hop on it, we still haven't seen the uptake in cloud for backup but maybe we can expect to see that more if Oracle's going to push it. So Mel, what are you seeing in terms of cloud as a backup target? And I'll ask you guys what you expect going forward. Yeah, I see three plays here. One is more like a remote backup where customers want to keep their production in-house or want to outsource the backup so there's remote backups. There's also where they outsource the servers as well as the backup so that would be more of a local backup. Also replication services. Hey, I've got my backups here but I don't have any facilities to replicate it to another location. So I've seen three different plays in terms of how backups would play into this market. And with EMC, we do have services or products that can facilitate those three types of services whether it's local, remote, or replication backups in that environment. Do you see that, Shane, as something that's going to increase or is it just the recovery issues are still too problematic to make that widespread? Oh no, it's already started. Of the three use cases that Mel just referred to it's that the customers that have the local backup say a data domain or an AMMR system maybe they don't have another facility that they can replicate to so they look to a service provider to provide that disaster recovery capability so that's already well on its way. Excellent. All right gentlemen, well thanks very much for coming on theCUBE and sharing your experiences to what you're hearing in the Oracle customer base specifically and generally in the market. So good luck and enjoy the rest of the event. Thanks for having us. All right, keep it right there. We'll be right back with another segment on the Oracle Backup and Recovery Spotlight here at Oracle OpenWorld Live from the Moscone Center in San Francisco. Keep it right there.


Hi and welcome to the session. My name is Joshy and I am going to help you to solve the following question. Question is, for what value of N are the Nx terms of two APs, 63, 65, 67 and 3, 10, 17 equal? First of all, let us understand that the Nx term of an AP with first term A and the common difference D is given by An is equal to A plus N minus 1 multiplied by D. This is the key idea to solve the given question. Now let us start with the solution. AP given to us is 63, 65, 67. This is the first AP given to us. So our first term of this AP is equal to 63 and common difference D is equal to 2. Now Nx term of this AP is given by An is equal to A plus N minus 1 multiplied by D where A is the first term and D is the common difference as we have already understood this in key idea. Now we will substitute for A, 63 and we will substitute for D, 2. So we get An is equal to 63 plus N minus 1 multiplied by 2. On simplifying we get An is equal to 63 plus 2N minus 2. This implies Nx term is equal to 61 plus 2N for this AP. Now the other given AP is 3, 10, 17. Now clearly the first term of this AP is equal to 3. So we can write first term as A is equal to 3 and the common difference is equal to 7 for this AP. Now we know Nx term is equal to A plus N minus 1 multiplied by D as we have read in key idea. Now we can write An is equal to 3 plus N minus 1 multiplied by 7 substituting for An D. Now this implies An is equal to 3 plus 7N minus 7. This implies Nx term of this AP is equal to 7N minus 4. Now we have to find the value of N for which Nx terms of the two given APs are equal. Therefore we can write 61 plus 2N is equal to 7N minus 4. This is the Nx term for the first AP and this is the Nx term for the second AP. Now simplifying we get 7N minus 2N is equal to 61 plus 4. This implies 5N is equal to 65. Now this further implies N is equal to 65 upon 5. This implies N is equal to 13. So the Nx terms of the two given APs are equal for N is equal to 13. So our required answer is 13. This completes the session. Goodbye and take care.