What is going on guys? Welcome to a new video. So I'm pretty excited about this one to be honest because it's going to help a lot of you guys out. I think I've been getting a lot of questions, especially recently coming into the new year about whether dropshipping is a good way to go print on demand or Amazon FBA. So what I thought I would do then now that I've been dropshipping for over two years, I thought to do a video like this that knowing what I know now, if I had to start from the very beginning, so go all the way back to day one, then would I still do things the same way? Would I still use dropshipping? What sort of things would I do differently then? So today then in this video, we're going to be covering all those sorts of things. And I'm going to be showing you a business model that you've probably seen before, but I'm going to be showing you how to start this business then all the way from the start to the finish. So how much money you actually need to start this business model, where to get your products from and then how to advertise them as well. So that being said guys, that's the topic. Thank you for tuning in. I hope you enjoyed the video and let's get straight into it. What is going on there guys? Welcome to my computer. So let's not waste any time then and jump straight into it. So the first thing I want to show you then or a kind of point I want to make that the easiest way to be successful then with any business is to find somebody who's already doing it well and then pretty much replicate what they're doing. So if you've not seen it before, this is kind of like Shopify's marketplace where people can sell their Shopify stores. Anybody can use it and you can pretty much. So this is like the main page and you can search by like whether they're drop shipping, print on demand, retail stores, what industry they're in and it's a great way then to find stores that are doing really well, go to their site, see what their site looks like, see what their best sellers are, what products they're selling and the stores I want to show you today then because they've been absolutely killing it and they kind of illustrate the point that I want to make in this video and that is that print on demand is such a good business model especially for beginners because it's really cheap to get started, it's really quick to get started, it's probably one of the easiest products you can market and in terms of scalability as well then it's just absolutely huge. So to illustrate my point then I found a couple of stores just to show you guys. The first one I show you is Coal and Coddle and their asking price is up here in the top right so nearly half a million dollars. The average monthly profit is $25,000 and if just to prove it to you if we go down to not expenses but actually sales these are all verified from Shopify themselves so they can't be edited and as you can see this store has done nearly three and a half million in revenue and going back to that point then I wanted to make about scalability you can see this is where the store started so nothing in September, nothing in November, October, January but then first month six and a half grand, second month nearly 50 grand, third month nearly 60 grand and then in the fourth month they did $650,000 so you can see just how quickly and how crazily print on demand stores are scalable. For a number of reasons really one of the things I really like in fact the main reason is comes down to delivery. Whenever somebody mentions dropshipping everybody thinks oh no one's going to wait four weeks for a product but when it comes down to print on demand you completely eliminate that problem because you can find suppliers or printers in America in the UK that can ship to your customers in the space of a few days. Now just one quick note in fact to be wary of when you're looking at stores is always check the traffic against revenue because if the traffic is really small and the revenue is really high then it can be signs of a fraudulent store but as you can see they've had over two million visits again comes directly from Shopify so this is a legit store and I've read through all this so I don't have to go through it with you guys in the video but these guys that was all generated through Facebook ads as you can see so Facebook advertised and it also mentions it up here as well so you can see they're using the exact same macs and strategies that I talk about on this video and all they're doing then is using these simple designs and what I've done is if you going back to this main page if you look through some of these especially some of the higher some of the stores that turn over the higher amounts then they'll be classed as private listings which means like these ones here and they'll be hiding their store URL so nobody can see the products they're selling but if you keep scrolling through you'll be able to find some what that actually give away their URLs so this is their store then basically and as you can see the store itself actually looks very very basic a lot of people over complicate things when it comes to store design but as you can just looking at this is really basic anybody can put a store like this together probably within an hour or two and these are the products then if I just use this tool up here called commerce inspector click best-selling and it's going to take us straight to their best-selling products and as you can see it's all print on demand products so these are things and the designs as well because the designs are just words you can't trademark words or common words like this so in terms of coming up with your own designs then it's a really easy thing to do and since we've got their best sellers as well we can simply just go ahead screenshot these send them to a designer which I'm going to get into later on fire.com and then we've got our own designs that we can go and start selling and we know that these products sell well on Facebook as well and the reason products like this then absolutely kill out on Facebook is because they're social products they're products that people that spark an emotion in your audience and that is 100% the ideal product for Facebook you want products then that people want to engage with and share with their friends and these are the sort of products then that will go viral because they make people laugh and when people laugh at something they want to share it with someone so they can make them laugh as well it's their social products so products like these probably make you smile so copy and paste obviously it's a lot of fiver and stun stuff so I've created a monster and then his son has got the what the t-shirt that wears the monster they're just fun and quirky products that people can relate to and when it comes to marketing these on Facebook as well it lends themselves to a specific market on Facebook you can target parents with children of a certain age so straight away you've got your market you've got your product you've got your store and you once you've got your designs then you're just ready to go everything pretty much is just laid out in front of you which we're going to get into in this video another thing as well of why these works so well on Facebook is if you look at the images there's faces in them and there's people smiling in pretty much every single one of these there's somebody smiling and that's the best way to advertise any product in fact I was talking to someone recently on a call and we were talking about the best way to advertise products and hands down the best way to advertise anything is to show somebody using your product or wearing your product smiling because that's what catches attention just quickly then moving on to the second store so here's another one if we just go down to performance you can see these guys are done way over a million it only goes back to June 2016 where they did $2,000 in their first month then $60,000 this one's a bit sporadic but as you can see even on their lower months like they're still pushing fire figures a month and the traffic tally is up as well so again you notice a legit store and just have a look at their store now they've put a bit more work into their store but as you can see it's pretty basic if we use commerce inspector it should tell us the theme as well symmetry testing by clean so I don't think it's a standard one but this one here what's it called again colon cuddle this is easily replicable and definitely something you could create with a free theme as well but as you can see going back to the products themselves again dead simple always daddy's fastest swimmer and both these stores actually targeted around kind of like parents newborn parents and that kind of niche and if we just check out the best selling products then for this store as well it's going to give us ideas of the kind of products we can sell in their store as you can see they did nearly two million in revenue these are the best sellers so we know straight away these products sell now these aren't as standout ish and aren't what I call passion products or social media products as much as this store here so what I've done then is on this google document where I'm going to go through the profitability and go through the numbers with you guys just so you can see how profitable profitable you can be with print on demand I've based it on this store here and their best selling product but before we get into that then you're probably thinking how do we actually come up with designs if you don't want to create themselves I mean you can create something as simple as that just using any kind of in fact you can use camber.com to create something simple like that but in case you want to go through professional designer put your own twist on it maybe perhaps include some sort of image then what you can do is simply screenshot that head over to Fiverr and all I've done then is search t-shirt designer and it's given me all these different ones and as you can see the kind of average price is around about eight pounds so when I've done my numbers in this document here then that's what I've based it on another thing to quickly show you them before we actually get into the numbers is the prices which I've put into here so I do want to prove it to you when I go through any sort of numbers I don't just like to use fluff I do actually want to prove it to you guys this is why it costs and this is the actual potential so that means that then how profitable or how much money do you actually need to start this business so start up cost wise then you need a Shopify plan now if you're clever about it and you have everything planned out all your designs and everything you start advertising from day one then you then you won't have to pay these costs because most of the apps you need you'll get a free trial on and it's the same Shopify as well when you sign up you will get a free two-week trial but just in case you don't then this is worst case scenario 29 dollars for the basic Shopify plan 50 dollars for apps designs you need I wouldn't just get one design I would go for say 10 just to kind of bulk out your store a bit more and I've based it on 10 dollars a design and if we go back to fiber you can see you could probably get them a bit cheaper than that especially if you said to one particular designer I want 10 designs it might give you a discount but I like to work on worst case scenarios so you're looking at about 100 dollars then for your designs and then what I've done is I've based it on printify just because these guys have printers in the UK and in America and in Canada as well so whether you're selling in those big three countries or not you're going to be able to find a supplier that will ship it locally to your customer within a few days so all in all then you're looking at 208 dollars now that's including the premium plan with printify which I recommend you get now I'm not affiliated any means so I'm not recommending them for for my own benefit you'll see in a minute that when you look at the costs they give two costs they give if you're on the free plan you pay this more expensive one here so you'd pay nine dollars 51 for a kid's body suit but if you're on the premium plan you'll pay 732 and I've done the math here so you save in approximately four dollars per order on the premium plan so you don't need eight orders a month to pretty much make it worth your time or worth your money essentially so what I've done then is I've based all of these prices and the products on what these guys are doing here because if they're doing it then the products are so simple there's absolutely no reason why we shouldn't be able to sell those same products at the same prices so starting from the top then where are we we're looking at the kid's body suit so as you can see they've combined two products into one here you're obviously getting the kid's body suit and you get in the top for the dad as well so we've got two prices we've got the kid's body suit we've got the adult t-shirt and just to show you guys then the kid's body suit is over nine dollars 51 or 732 and the adult t-shirt then is 773 or 595 and just to show you the prices on here we can see the kids the adult t-shirt here if we were to go for the cheapest one obviously you've got 773 or 595 and if we go to the kids one if we scroll down now to me these look exactly the same if you just have a look at like the shoulders on these how they overlap and if we go back to here you can see they kind of overlap there as well so if we can get a better picture so I wouldn't be surprised if these guys are actually using printer fire themselves so we're pretty much sourcing the exact same products um so just go to go back to the price shipping is either six dollars or four dollars I believe it was six dollars to outside of the UK then four dollars inside the UK and both were five to seven days as well because you've got to allow a couple of times of processing and then depending on whether you go for a faster or slower shipping method you're looking at somewhere between five and seven days which just like I mentioned earlier in the video just completely eliminates that up to four weeks so in terms of pointing people off because of delivery it's not a problem you're gonna have to worry about so to do some quick maths then total product cost adding all these up together is either 22 dollars 24 or 18 dollars 27 now the most expensive price on the left is if you use the free plan and the price on the right is if you use the premium plan and as it says there you're saving about four dollars per order ordering two of these products together so if you do go for the premium plan you'll only need eight dollars a month and you'll make that 29 dollars back so we've got our total product cost then what is the sale price so what can we actually sell this product for these guys as you can see are selling it for 40 dollars which isn't cheap but people are obviously paying it if they've done over three million in revenue so a sale price is 40 dollars so depending on whether you go for the more expensive or cheaper one I've just kind of gone straight down the middle to give an approximate number you're looking at approximately 20 dollars profit per order minus your Facebook cost per action or your cost per purchase so as long as you get cost per purchase of less than 20 dollars which is quite manageable should be achievable especially on viral products like this products like this if you put them in front of the right audience then people are going to share this like rapid fire and if you go viral then just the limits are pretty much unlimited and that's pretty much the whole video then start to finish I've covered I think just about everything now we have gone through quite a lot of numbers so if I've confused you a bit then feel free go further back in the video watch it again or leave a comment down below I do get back to every single person and if you're still watching then hopefully you've enjoyed the video as well let me know what you guys think about print and demand do you think it's a good business model or not and that being said then guys thank you for watching and I'll see you all in the next one


and plus TV Africa. The following advisory is issued by the United States to its citizens in Nigeria, speculating threats to security. President Mohamed Bohari has advised the nation, security establishment and the entire citizenry not to panic but observe vigilance. The president said this in a statement issued by his media aide, Garbar Shehu. He said Nigeria is no exception in having terror threats listed in foreign governments travel advice to their citizens. According to Bohari, UK and the United States travel advisory also state that there is a high likelihood of terror attacks in many Western European nations.


Everyone's anti-war until the war propaganda starts. Everyone's anti-war until the war propaganda starts. Nobody thinks of themselves as a warmonger, but then the spin machine gets going, and before you know it, they're spouting the slogans they've been programmed to spout, and waving the flags they've been programmed to wave, and consenting to whatever the imperial war machine wants in that moment. Virtually everyone will tell you they love peace and hate war when asked. War is the very worst thing in the world, and no healthy person relishes the thought of it. But when the rubber meets the road, and it's time to oppose war and push for peace, those who had previously proclaimed themselves anti-war are on the other side, screaming for more weapons to be poured into a proxy war that their government deliberately provoked. This is because the theory of being anti-war is very different from the practice. In theory, people are just opposed to the idea of exploding other people for no good reason. In practice, they are always hit with a very intense barrage of media messaging, giving them what look like very good reasons why those people need exploding. Being truly anti-war isn't easy. It doesn't look like people picture in their imaginations. It looks like getting smashed with a deluge of information designed to manipulate and confuse and working through it while getting screamed at by those who've fallen for the brainwashing. It's not cute. It's not fun. It's not the feel-good flower-power time that people intuit it is when they look at the part of themselves that seeks peace. It is standing up against the most sophisticated propaganda machine that has ever existed while being offered every reason not to. When people think of themselves as anti-war, they're usually imagining themselves as anti-another Iraq war or anti-some theoretical Hitler-like president starting a war because he likes killing people. They're not picturing the reality of what being anti-war actually looks like in practice. Because selling the war to the public is a built-in component of all war strategy, the war will always look necessary from the mainstream perspective, and it won't look like those other wars which we now know in retrospect were mistakes. It's always designed to look appealing. There's never not going to be atrocity propaganda. There's never not going to be reasons fed to you selling this military intervention as special and completely necessary. That will be the case every single time because that's how modern wars are packaged and presented. This is why you'll always see a number of self-described leftists and anti-imperialists cheering for the latest U.S. war project. They are ideologically opposed to the idea of war in theory, but the way it actually shows up in practice is always different from what they pictured. Our entire civilization is shaped by domestic propaganda, but the only time you ever hear that word in mainstream discourse is when it's used to discuss the comparatively almost non-existent influence of Russian propaganda on our society. All the mainstream alarm-ringing about Russian propaganda gives the impression that it comprises close to 100% of the total propaganda that Westerners consume. When in reality it's a tiny fraction of 1% of the total propaganda that Westerners consume. Almost all of it comes from Western sources. Propaganda is the single most overlooked and under-appreciated aspect of our society. It has far more influence over how the public thinks, acts, and votes than any of our official mechanisms for doing so, yet it's barely discussed, it isn't taught in schools, and even the best political ideologies barely touch on it relative to their other areas of focus. All the fretting about Russian propaganda from establishment narrative managers comes so close to giving away their secret that they know it's possible to manipulate the way the public thinks, acts, and votes using media. They just don't admit that they're the ones who are doing this. It's actually the weirdest thing in the world that there's something that has been directly affecting our minds, our entire lives, and which directly affects the way our entire society is organized, but we don't talk about it constantly. It should be at the front and center of our attention. But of course, that's the whole idea. Propaganda only works on those who don't know they're being propagandized. The US centralized empire's ability to hide its propaganda machine is a foundational element of its brilliance. Being truly anti-war is necessarily a commitment to finding out not just what's true about all the other war narratives currently promulgated by the imperial war machine, but all the narratives you've been fed about the world since you were young. It's a commitment to truth that takes on an almost spiritual quality in the way it informs every aspect of your life when truly espoused. It's important to research and learn new things about the world, but what's equally important and which doesn't get emphasized nearly enough is the practice of examining the beliefs you already hold about your society, your government, your nation, and your world, inquiring as to whether they're really true, and who might benefit from your believing them. Don't make the error of assuming you'll be aware and informed enough to spot all the lies right away.  It takes some time. Even the most aware among us were indoctrinated into the mainstream world view to some extent earlier in their lives, and to this day most of the information they get about the world has some of its roots and branches in parts of the propaganda matrix. It takes work to see things clearly enough to form a really truth-based world view. But unless you do this, it's impossible to be truly anti-war, because you can't skillfully oppose something you don't understand. To fight the Imperial war machine is to fight the Imperial propaganda machine.


It was sort of a monotonous day, doing the same thing over and over and over. Yeah, they were fairly heavy. We just put these shells in there, but then it went into a larger, about that high. And strange things, these shells that I was making, my husband was firing on the battlefield.  Did you know what John was doing at that time? Well, sir, yes and no. We wrote letters.


We have a lot of whole space intrusion detection system and we claim that this is the one that can actually do the following things. So we all know that computer attacks actually exploit software flaws. So the most classical example is this buffer overflow attack. So basically attackers try to come in, compromise some of the control sensitive data structure and maybe execute, quote, assuming the identity of the owner of these victim applications. And this is a very dangerous kind of attack because most of the modern worm attacks actually use buffer overflow as a basic primitive. And then there are other kinds of software flaws like attacks that actually try to exploit the input validation, like SQL injection or the directory traversal. And then there are classical problems like race conditions and so on. And then there are other attacks like they don't have nothing to do with software flaws like social engineering, password cracking, denial of service and so on. What we are going to focus on today is really just what we call control hijacking attacks. In this kind of attacks, attackers basically try to hijack the control of the network applications and then run some piece of code, assuming again the identity of the owner of the victim applications. Now the interesting part of this control hijacking attack is that there's actually a well-defined recipe to mount this kind of attack. There's no mystery there. At least at the higher level, of course, individual victim applications have different kinds of vulnerabilities. But at the high level, you can actually analyze the general kind of buffer overflow or control hijacking attacks in particular that there's actually a recipe. And this recipe is actually not unlike the kind of procedure that real hijackers would actually use to hijack an airplane. So what exactly actually happens? Usually what happens is that the attacker would try to inject some sort of malicious code or data into the address space of the victim applications. So this is just like a hijacker try to sneak in some weapon into the airplane. And then the attacker would try to twist the application to transfer its control to this injected piece of code so that you can actually do something. And this is like a hijacker actually try to take over the airplane. And then finally, the attacker would actually try to execute some system code. Anything you want to do, except you want to amount some sort of denial of service entering the infinite loop. Anything more interesting than that involves some sort of system code. Exactly. You want to read somebody's email. You want to read somebody's address book and send, duplicate yourself as an email. You want to read some sensitive file and send it over to some places. You want to download a compiler. All these things eventually involve some sort of system code. So eventually, once you get control, you want to do certain things. So this is just like a hijacker would actually, once you hijack the airplane, someone probably use the airplane to hit something. And that's basically the flow that typical control hijacking attacks would actually take. So a typical example of this sort of three-step recipe, we can use this as an example. So this is a very simple stack overflow attack. In this particular case, the attacker actually try to overflow a particular local data structure like user ID. So this is just a simple integer array, five element array. And the left-hand side is the piece of code, the right-hand side is the corresponding stack layout. So as you can see that the attacker actually try to overflow this particular integer array.  And then you can overflow this frame pointer and then this return address. And this return address is what we call control sensitive data structure in the victim application. There are other examples of control sensitive data structure. Any data structure that would affect the control flow of the program is called control sensitive data structure. Return address is one example of that. Function pointer is another, some sort of import function table is yet another example of control sensitive data structure. So in this case, it's just the attacker simply overflows, overrides the return address. And it overrides the return address with the value of 100. And you can see that 100 is actually the base of this local array, user ID. So assuming that this attacker actually overwrite this memory location 108 with the N80 instruction, which is the instruction that you use to actually issue a system call, then the attacker can actually get the control after the input returns. Because when input function returns, it uses the contents of the return address to jump to. In this case, the content of the return address is 100. So the 100 happens to be the base of this user ID. And the control goes to 100. And then 104. And then 108. 108 happens to contain the N80 instruction. And that's game over. Right? That's the first step. That the attacker actually grab the control and then issue a system call to do some bad thing. So that's that. It actually illustrates that there's actually a three-step recipe in this process. So there's nothing new up to this point. Now recognizing that there's such a three-step recipe, how can we deal with this general class of control hijacking attack? That's where we want to focus on today. So we have been working on this control hijacking attack problem for a while. And we basically take a multi-pronged approach to solve this problem. And the umbrella project is called Palladium. Today what I'm going to only talk about a particular component of this Palladium project. By the way, Palladium has nothing to do with Microsoft's Next Generation Secure Communion Base project. It has complete no relevance with that one. All right? This is complete our own project. So recognizing that there's actually three-step procedure to mount a control hijacking attack. What can we do? Remember the first step is that the attackers try to inject something into the victim application. And usually the way they inject something is through buffer overflow. So the right thing to do should have been you should compile your application using every bound checking compiler. If your compiler has every bound checking mechanism built in, then you should not have that problem. But how come that people don't want to use every bound checking compiler? There are actually commercially available every bound checking compiler. And open source one will be our bound checking compiler, GCC, which is derived from GCC. The reason that people don't want to do array bound checking is because it's very expensive. The typical performance overhead we are talking about is between 100% to 300%. So it's pretty expensive. Because every memory reference now you actually have to check whether it is exceeding the bound of its associated data structure, like something within a data structure or something within an array or something within a dynamic allocated to buffer. You have to check whether every memory reference exceeds the corresponding object bound. And that's very expensive. In the Palladium project, we use a very interesting idea to solve this problem. The way we solve this problem is that we exploit this particular feature, virtual memory hardware features in x86 architecture. Basically, what we do is we use the segment limit check in the x86 architecture's virtual memory hardware. And by twisting it in a certain way, we can actually get that performance overhead under 10%. This is the fastest array bound checking compiler you can have. Of course, this is a very architecture specific, mind you. This is not a penalty, which we cannot automatically apply this technique to other architectures, but since x86 architecture accounts for more than 95% of the machines, so it's probably okay. But this is sort of one of the interesting aspects of Palladium is that we can actually do very fast array bound checking by exploiting certain virtual memory hardware feature in x86 architecture. So that's the first line of defense. If you compile your application with the array bound checking mechanism enabled, you should be able to prevent attackers from injecting anything. And that should be the cleaning solution you should use. If you don't like it because you don't want x86 or you just cannot afford to recompile all your application or you just get binaries from your vendors, you don't really have that option. Then we go to the second line of defense. In the second line of defense is your compiler solution. What we are trying to do is remember in the second step, what they are trying to do is they try to twist the victim application to transfer its control to some maliciously, some injected malicious code. So if we can somehow protect this so-called control sensitive data structure, then we should be home free. And that's exactly the idea of the second line of defense of Palladium. We try to protect the integrity of this control sensitive data structure. What is control sensitive data structure again? We turn address function pointer and this import function table. So the idea is very simple. Every time the application actually modified this control sensitive data structure, we keep a copy of that. And from that point on, we know it should not be modified. And later on when the program actually tries to use this control sensitive data structure to transfer its program's control, we'll double check whether the one that we store away and the one the program actually use, they actually match. If they are different, then we know somebody is trying to tamper with this control sensitive data structure and something is wrong there. And that's the essential second part of the defense. So again, even an application, you don't like array bound checking, compiler, fine. We'll protect this control sensitive data structure for you. All this assuming that we have access to a source code so far, all right? So that's basically the second line of defense. Now if you don't like to do this array bound checking or you don't like this integrity check for some reason, then we have this third line of defense, which is the topic of this talk. You want to do some sort of system call policy or system call model check. So idea is that I can allow you to come in, inject whatever you want. And even if you can twist my application to transfer to the injected code, as long as you cannot issue arbitrary system call, I'm okay.  Of course, you can actually insert the infinite loop, but even that in the modern operating system, it's not a problem. Every process has a quantum, so this is not really a problem. It cannot really mount a very serious denial of service attack. So our basic assumption is that if we can somehow protect each application in such a way that the application cannot issue arbitrary system call that is not supposed to, then it probably should be okay. And that's what we are going to focus on. So remember just that at the, somehow we have a way to derive some sort of model of this, of any arbitrary network application. And at the wrong time, we are going to monitor its wrong time system call behavior against this statically derived model. And if there's a deviation between the two, then we know this application must have been hijacked. And that's why it's wrong time behavior is different from the statically derived behavior, right? And that's the thing that we are going to talk about. Now, when all these fail, let's say this attacker is really good. That just the user doesn't want to deploy all these solutions. Then we have the very last line of, it's not really a defense. It's really sort of taking a different viewpoint of this entire security problem. So we build a system call repairable file service. And the idea there is that we try to borrow ideas from sort of four-tower and computing community. Where they actually recognize that it's very expensive to build highly sort of four-tower and computing systems. So, and then we realize that there's actually two things that users want. One is called reliability. The other is called availability. And at the end of the day, what the users really want is availability. Now, reliability typically means that it's mean time to fail is very long, infinite, right? And availability means that the system somehow is up with the high percentage of the time. So that's the availability. Now, there's actually a subtle difference between the two. Because availability can actually be defined as mean time to failure. Over mean time to failure plus mean time to repair. So it's a mean time to failure at the numerator, mean time to failure plus mean time to repair at the denominator. That's the definition of availability. We want this ratio to be close to one. Meaning 100% of the time it's available, right? Now, the four-tower and computing community recognize that to achieve this availability metric to make it equal to one, there are two ways to do it. You can make mean time to failure to be infinite, right? The highly reliable, never fails. That's one way to do it. Or you can make mean time to repair close to zero. That also can get you a high availability, right? So the last line, the last element of this palladium system is to say that we can take the same idea in the security world as well, right? Or we try to build a system such that it would never be broken. There's no security breach, but we know it's getting more and more expensive. All the low-handing fruits are gone, right? And then, of course, there are always misconfiguration, human mistakes, these and that. So maybe the right thing to look at right now is to see how we can quickly recover from a compromise system so that we can get down with our lives. If we can quickly recover a compromise system like within sub-seconds, why do I care? If you can compromise whatever you want, assuming that, no, of course, there's some price about this, which is that if somebody steal your intellectual property, right, there's nothing you can get back.  And that's the time that you cannot afford to have, or somebody screw up your e-commerce site, and therefore your business cannot continue and so on. So we are talking about that kind of scenario. That this repairable file service can actually help you. So the question now becomes that if we want to build something into a computer system in such a way that it can repair itself quickly, even after a successful intrusion, what does it take to do something like that? And that's essentially what this repairable file service is doing. And we have been able to do this kind of thing for NFS server and SQL server just fine. So basically what it can do is the following. If imagine that somebody screw up your database 24 hours later, you find it out. That is your option. Your option is let's roll back the database to 24 hours ago. For people in Wall Street, this is probably not an acceptable option, because they don't want all the good transaction that happened during the 24-hour period to be gone. So they need somebody to come in and carefully identify the damage that actually caused by the intrusion, and then selectively roll back those damaged data. And that's what this system can do you, can help you. We can actually do something like that for NFS server or for a database management server, all right? So all of these things are part of Palladium. But today, as I say, I want to focus only on system called model checking, all right? So we call this system program semantics-aware intrusion detection. Now, just to give you an idea, most of today's horse-based intrusion detection system are using similar ideas. They are monitoring some sort of system called patterns of the applications. Even though the commercial system called behavior blocking system, they do the same thing. They basically have to have some sort of policy for some important application. And they can somehow, you know, monitor the system called patterns of this application at a run time, and see if they actually deviate from the original model that they are supposed to follow, all right? So the big deal about the paid system is that we are able to derive this system called model in a way that's accurate and automated, all right? So most of the existing horse-based intrusion detection system follow the same model. The only difference is that the way they derive this model tend to be manual or going through some sort of statistical learning phase, all right? So you have to understand that there's nothing new about the idea of monitoring the system called model. This is what everybody is doing. The new thing here is really about how do you derive such a model in the first place? I give you a PowerPoint. What are the sequence of system called that PowerPoints are supposed to make? That's the question that we want to know, all right? So as I say that the current approach to this system called monitoring approach is really about how do we derive this system called policy or model in a way that's accurate and hopefully automatic. Now, existing approaches are something like they can use many specifications. Somebody go in and then either reverse engineering or look at the patterns, run the programs for a long time and see what happens and so on. So obviously this is an error-prone process, labor-intensive and not very scalable. Or you can use machine learning techniques that you can run the programs 100 times and then try to derive the so-called normal behavior. And then if anything deviates from that normal behavior at the wrong time, then you can declare this possible intrusion. And all these things would lead to false positive because you can never cover all execution paths of the program. There's no guarantee, right? After all, you are running them. There's no guarantee you can cover all of them. And that's why a lot of this whole space intrusion detection system have false positive. I mean, sometimes they are even worse than that. They don't even perform such a process for each and every application. They just have a single policy for all the reasonable network application. And what we want is that we want to do it in such a way that it's accurate and automatic and hopefully they can be tailored to each and every individual network application. And our position to this problem is very simple. We say that everything is there in the program. Assuming you already have a source code. Of course, you can compile a program and you can derive the system code pattern at compile time. Information is there. After all, the program is actually making a system code, right? And so you can actually derive this information. And not only we are going to derive the order in which these system codes are made, that's what everybody is doing, like open, read, write and so on. That's the order of system code. We also want to derive the sites at which these system codes are allowed to be made. So for example, a program actually makes two system codes open. But that program makes the system code at two different places. Then we want to make sure at a wrong time, actually they are two open codes. System codes are made, and they are made at exactly those addresses, okay? So we are going to check not only the order of the system codes, but also the places at which these system codes are made, right? So this is going to tighten up the flexibility of these attackers. Remember how the attacker is going to attack? Once he gets the control, then he tries to issue a system code. And most likely this system code is either in a stat, or he actually makes some code to the libc in order to make a system code. In either case, we should be able to detect them, right? Because we are going to check the sites as well. So when they make a system code, they follow the order that I derive at a compile time, and not only they then make a system code at the places that I think this system code should be made, okay? Only then that this kind of system code that attackers make can be successful, right? So as I say, emphasize again that the process of deriving per application system code policy or model in paid is automatic and is actually very accurate. There are some small window of vulnerability still. That's why it's not zero force negative. But it has a very close to zero force negative. I'll explain what's the window of vulnerability of paid. So in terms of this architecture, it's very simple. You take an application going through the compiler, and you would derive this system code graph. So it's basically a graph. It says that if you go come here, open, and follow, it should be a read or write. And it can be read or write because there's a branch there. We don't really know at the compile time which ways it's going to take. But we know that after open, it should be either read or write, all right? So that's why it's a system code. It's not a sequence. And then at the wrong time, we observe the actual system calls made by the application and compare the two. If there's a deviation, then there's an intrusion. And when we declare there's an intrusion, there's indeed an intrusion. That's why it's zero force positive. So in terms of attracting the system code policy or model, it's actually very mechanical. You can take a program, build a system code graph from its function code graph and function control flow graph and blah, blah, blah. And in the end, you can actually do it, okay? So I'm going to skip this mechanical part and talk about something that's more sophisticated, where the problems really are. I mean, this part is sort of pretty easy to do. The problem with this approach, if you think about it, is there's actually a fundamental flaw of the assumption that at the compile time, you can derive the system code model or policy from a network application. Can you think of any reason why that assumption, there's actually a flaw in that assumption? The problem is that at compile time, sometimes you cannot even derive a complete control program. So imagine that you have a program that has a function pointer. And the value of this function pointer is only available at runtime, right? So I cannot even construct a control program. So what are we talking about? You can statically derive a system code model, right? Wouldn't that be like a pretty unrealistic? And that's what we call by dynamic branch targets. Dynamic branch targets are branch instructions whose target addresses are not known at compile time, right? So we don't really know where it goes, right? So examples of this could be something like, you know, signal handler. For example, you have a program that includes a signal handler. In your program, there's actually no call site that calls this signal handler, right? By definition, no part of the program will call signal handler. Who will call signal handler? The colon will call signal handler, right? Your application registers the signal handler to the operating system. And then when something happens, the operating system will call back the signal handler and do something, right? So if your program contains a signal handler, you don't even get to see. Now who jumps to it, right? So there's no way you are going to analyze the signal handler system code model. So how do we solve this problem? That's basically what we are talking about here. So it turns out that there's actually a loophole we can explore so that we can solve this problem. And the basic recognition is that although at compile time, we cannot know the target addresses of all the branch instructions. We know that we don't know, right? We know that sometimes this is a function pointer, so I don't know it's a value, but we know we don't know. And at the places that we don't know, the branch instructions target, we can actually insert a special system called call notify. So this requires some sort of operating system support. So essentially what we have is we are given a program and at those places whose target addresses are not known, we are going to add an additional system called call notify. And the arguments of the notify will be the actual value of the target addresses of these conditional branch instructions. And this value will become available at a run time. So I can actually inform the run time checker about the values of these dynamic branch instructions. And that's how we solve this particular problem, right? So that's one problem associated with this approach. There are other problems as well. Real programs are actually more complicated than we thought. It's not just a bunch of control for event, air, square loop, and so on. There are things like set jump or long jump. And then there are things like signal handler. And there are things like dynamic link library. Like if you have a program, and they're actually at a run time call DL open of some module. And this module name is not known at compile time. At compile time, you don't even know this piece of code is part of the program.  Fortunately, all these problems can be solved by something similar to notify, right? At the run time, we all know that these are all pretty core key control constructs. And then we can all insert this notify system calls appropriately. So that at the run time, the run time checker will know. So for example, the way to deal with the DL open, the program at the run time call DL open to load a module. And then at the run time, we are going to analyze the module to construct the corresponding system call grant and continue, right? So some of the stuff they will do at the compile time, now we have to do at the run time because we have no choice. At the compile time, I just don't know that much. So I have to defer some of the things that we need to do at the run time. And that's basically what we are doing. So that's the other problem we have to solve in order to make this work. Now, even if you solve all these problems, they are actually sophisticated attackers, right? Imagine what we have. We have, I have a compiler, and then I can actually analyze any network application to derive the corresponding system call grant. At the run time, I'm going to check that network application system call pattern against this grant. Any deviation from the system call grant would be flat as an intrusion. Seems pretty tight, right? Not really. There are people who can do so-called mimicry attack. The notion of mimicry attack is saying that the attacker can come in, exploiting the good old buffer overflow vulnerability. And then from the point now, he is going to, he or she, is going to emulate the legitimate system call sequence according to the same system call grant. So he's trying to fool the underlying run time checker saying I'm a good guy. I'm actually issuing a system call exactly according to the system call grant. Now, if this particular application contains some system call that the attacker needs in order to really mount the attack, the attacker can actually follow some certain legitimate system call sequence until that particular system call comes along, and then issue a system call to the damage. So for example, you have an application, and that application contains some system call like exact, which is the system call allows you to fork another process. And at the buffer overflow point and the exact system call, there's a sequence of system calls in between them. So the attacker would actually follow exactly the same sequence or system call as specified in a system call graph until he hits the point, hit that particular exact system call and do, and issue the system call. So that's the way to mimicry attack. The idea of mimicry attack is that the attacker actually can use the same tool that we are using to derive the system call graph and embed the knowledge into the attack code as well. Now, we are assuming pretty sophisticated attacker now, but we have to assume they are as good as we are. So they actually can use our tool, derive the legitimate system call graph, and then try to derive a mounted attack at the point that the particular system call that they actually need. So that's the idea of mimicry attack.  So for example, for exact, you can say now I want to focus process, a shared process, for example. So at that point, you have to change the argument of the system call so that you can do what you want. So these are the two things that you need to do. You basically have to issue each intermediate system call without being detected, and you have to grab the control back so that you can continue doing that and at the last moment issue that damaging system call. So how do we solve this problem? Basically, what we need to do is that we have to check the system call argument whenever possible, right? Remember, at the last step, that guy is trying to say that this is the exact system call that I need, and I'm going to fit that share slash bin slash share, that particular argument into the system call so that I can get a shared share process. And the other thing is I have to prevent the attacker from grabbing the control back. How does the guy grabbing the control back? The guy actually have to fake all these system call and then put into the return address back to his injected call, right? So if every time a system call is made, I check the return address on the stack, make sure none of the return addresses are actually in the stack. We can prevent the attacker from grabbing the control back. So these are the two things that we need to do. Make sure the system call arguments are all legit, and make sure that the control never goes to the stack, for example. So these are the counter measures we can use to prevent the mimicry attackers. So I'm going to skip some of these and then I'll give you an example, talk about what paid actually provides. So paid actually checks the following things. Again, it checks the ordering of the system call. At the wrong time, the system call has to follow a certain order as we derive at the compile time. So that order has to be correct. Paid also checks site, that each system call has to be in the right place. And paid also checks stack return address. The return address on a stack cannot be in a non-text area. They have to be in a text area. This is to prevent the mimicry attacker from grabbing the control back. And then finally, paid also includes additional mechanism, which inserts a random notify system call at the low time. I'll defer this point when I show you some example. So let's say you only have ordering check. And that's essentially what everybody has nowadays, the whole space intrusion system. They only check the order of the system calls. So, and this picture basically shows the control flow graph of a program. So in this case, it makes five system calls, set UID, read, open, step, and write. So if the attacker actually somehow grabs the control through buffer overflow vulnerability, all he has to do is just issue the system call in exactly the same order. And then eventually he can compromise the system, right? So because it's a mimicry attack, right? It's a mimicry, the exact order that the program is supposed to make. And when he hits the one that he needs, then he can mount some sort of damage. He can cause some damage to the underlying system. Now let's say we actually check both ordering and site. So in this case, the attacker cannot just simply issue the system call in arbitrary places. He actually had to issue the system call exactly at this place. So he actually had to issue the system call at this location as specified in the original program. So that's what he needs to do. So that's what happens. You do this jump, go to that right system call and come back, go to that place and then come and eventually compromise system, right? And the way that he can get the control back is by modifying the return address, all right? So we can prevent this if we do stack check as well. We do ordering, we do site, we do stack check. So in this case, the attacker can do the same thing and try to go here. When this is done, the control has to go back to the original flow because he cannot fake the return address because if he understands we are checking, then he cannot fake. Yes? Yes? Yes. I understand that. Yes. I attended your talk. Yes, that particular attack would actually fly. You can actually fake the return address without being detected. But there's a way to deal with it. I'll talk to you later. Not that particular attack. It's a completely different way to solve this particular problem. Then if we do actually stack check, there's actually one loophole. Let's say this guy only needs exec. So he actually doesn't actually need to follow the exact system call. So exec is the only one he needs and he doesn't really need to grab the control back. Then in this case, the even ordering site and stack check cannot help you, right? The guy wants to grab the control can actually go ahead and issue the exec call. So we cannot really help you. So that's why we have the last mechanism called notify. The way notify works is that at a low time, when a process is started, we actually would randomly modify the binary in such a way we can insert the notify in random places. So this is not something that you get from binary. This is something that we insert at low time, right? So in this case, if the attacker is doing the same thing, then this particular attack will get detected because he needs this particular notify, all right? Remember, all the notify, and notify is part of the system call policy, if you will. At the wrong, when the program started, we randomly insert notify and this will be part of the system call model and we check that they should follow the same model. And because the attacker doesn't know how we actually insert this notify at a low time, so there's no way for them to actually follow this notify exactly, right? So that's the way to deal with it. So we also do system call argument check. Basically what we do is that we can actually derive, analyze different kinds of system call argument and classify them into three categories, static constant, dynamic constant, and dynamic variables. And static constants are something like hard coded into the program, dynamic constant are something you read from the configuration file, from command line input, or from environment variables. Since that you won't be able to know at a compile time, but once you get initialized, they never change. So these are the dynamic constants. Our system can deal with the static constant and dynamic constant. We also can incorporate the static constant and dynamic constant type of system call argument into the system call policy. So now not only we are checking site, not only we are checking order, site, and return address, and randomly insert notify, we also check the system call argument has to be correct. Okay, for those that we can check. Unfortunately, there are a lot of them fall into the notes, the category of dynamic variable system call argument. This is like something like, you know, you have Apache that get a URL, and you can get an URL with the root directory of Apache, and then you get the full path name, and you use for open, for example. Those kind of dynamic variable we cannot do, either statically or at a long time. So we cannot really check, so we just let them through. And this is the only loophole that attackers can use. So when they attack, they have to use some system call, and the system call argument better be dynamic variable. Otherwise it will get caught. So in the end, the window of our ability is the following two types. That at the time of, at the point of buffer overflow, vulnerability, the attackers, the system call the attacker needs in order to mount any damage, to cause any damage to the underlying system is immediately following the buffer overflow vulnerability. So in that case, there's no way we can check it, but the next system call is exactly what he needs. So that's one way. The other way that attackers can sneak through is that they don't really need to make any additional system call. The attack is in the form of changing the system call argument. So if they can overflow some data structure which eventually would affect the system call argument, then they can also sneak through this because they don't need to make additional system call, we cannot really do anything. So these are the windows of vulnerability, and these are where, this is the reason why paid force negative is not exactly zero. So we have prototype implementation, and I just wanted to show you the throughput.  It turns out the performance overhead is really acceptable in most cases. So in this case, we just basically tried four different configurations. The generic paid, and paid with the return address check, paid with the random insertion of notify, and paid with both the return address check, and random insertion of notify. So it seems that everything seems to just fine. That the performance of the throughput overhead is under 11% for all cases. So it seems it should be okay. So I hope that I give you some idea of what people can do with the horse face, the intrusion detection system today. That use compiler technology, you can actually do a lot. Of course the downside is that you don't always have access to the source code. That's the only problem. But if you are willing to go this route, the compiler can help you a lot. Previously compiler is about compiling program. And then in the 90s, people use compiler to improve the performance of program. Now we probably go into the era in which the compiler can help you to strengthen the security of the application. We are not only interested in translating the high level program into binary code, or to speeding up the program. We also want to improve the security of these programs as well. So the big item that we want to do now is to implement a version of pay that can work with the Windows binary directory. So as I said, this removes one of the biggest criticism of pay that you have to have access to source code in order to use pay. And we are hoping that we can do something with the Windows binaries without having access to the source code.  And if you are interested to try our pay, then send me a mail or contact me towards. Thanks.