Hi folks, my name is Rikram Gadi and I originally had submitted a talk called Shining Alight on a black box. However, things changed and then after Ian and I changed our slides to B. So hopelessly broken 2.0, circumventing security controls and network accessible services. So like I said, my name is Rikram Gadi. I'm the one on the right here. I am a senior security analyst at ISE and I like to hack things like web apps, mobile apps, binaries and IoT devices, which is why I do a lot of work with the IoT Village. I like to read a lot and I'm always confused. Then we also have Ian Sinerman. Hi. Well, that would be me. I'm a security analyst at ISE as well. I may have been a low key colony as a child. I also like to hack things, web apps, IoT garbage, some hardware, tech obscura, that sort of stuff. I always like to try and learn new things. I always like to teach them as well, whether that works, maybe not. But I'm also always confused like Rik. I really like that one. I guess it's an easy one to like. It's very realistic. So yeah. So the things, here's the agenda. This talk is about our research project that we concluded in 2018. During our research project we hacked a bunch of embedded devices, 13 where we had 13 targets. We got a remotely exploitable shell in 12 of them. And these are the three best stories that I could fit in half an hour or that we could fit in half an hour. And the idea behind it was that we were trying to find remotely exploitable bugs in embedded devices. So which is kind of what you do when you play the SOHO policy broken CTF. And throughout the whole presentation, we're going to cover three devices, the Buffalo Terras station, the Drobo 5N2 and the Nekir R9000. These are all devices that we bought, I think, early last year. So I would say March-ish. And then we hacked in between then and we ended everything in about October, November. But as we'll find out throughout the presentation, just because we concluded testing does not mean that our job was over. With the Buffalo Terras station, we're going to be looking at how sometimes developers may be confused with how some functionality may work. We're going to be looking at a couple interesting HTTP headers. And then we're going to be talking about an interesting situation where responsible disclosure where we responsibly disclose these issues to this manufacturer. And then they didn't respond to us in some sub-having where they tweeted some information and then deleted it. And it's all very humorous yet concerning. Then we have the Drobo 5N2. We're going to be talking about how we reverse engineered the protocol, which is what the stock was originally about. And then after that, we're going to be talking about how we found the keys to get into the Drobo under the device's doormat. And then last, we have the R9000, which we'll be talking about an interesting authentication mechanism and how we were able to fake a call from inside of the house. And then after a tale of bug bounties and bug bounty companies that we ended up in. And then after that, we're going to have a conclusion where we talk about responsible disclosure, the stuff that we found, how we found it, and comparing our study from last year with our original study from 2013. So without further ado, I'll kick it off with the first one, the Buffalo Terras station. This is one of the devices that's actually in the CTF right now. And after you figure out how easy it is, you'll score some easy points. The Terras station with this very easy name is a Soho Enterprise business-grade NAS. And it runs between $2,000 to $4,000. It's made in Japan. And it has an administrative web application. And I'll pass it over now to Ian to explain everything else. Okay. So this web app has, it has this wonderful JSON API. So one thing that I really dislike about JSON, at least in the context of, I guess, everything, is application JSON. So application JSON really sucks when you're trying to do CSRF, assuming they're actually checking the content type, because you generally need to pre-flight your requests if you want to set this content type. But further, we see that there is an authentication cookie. So they're probably using cookies for some of this. But there's also an authentication value within the post body. Back to CSERF, that's probably not going to be something that we can do if that authentication token is there because we would have to know their authentication token in order to send a malicious post body. However, we decided to kind of change that. So first thing we did is, you know, find the source code for this, or at least the code for the web app. In this case, we found that they were all pre-compiled Python binaries, which kind of sucks. Like, it's Python, you should be able to read it nice and easy, but this is not super readable. However, you just use on CompileSix and then it's just ready to go in a matter of like one or two minutes. So that was nice. So now we have very nice readable data, and it's in Python, nice and easy to parse, even if you don't know what you're doing. And then we see some rather concerning stuff here. Like, skip off. Yes, please, I'd very much like to do that. How do I do this? What do you guys think skip off does? So somebody thinks it's a security mechanism. We'll talk later. But it's a, yeah, let's figure out where this is going now. So the next thing I did after seeing this was just see where else to skip off reference, like within this file. So I just do a search and then we find this chunk of code. I highlight the important parts. And it looks like if we just set our HTTP host, like our host header to local host, we skip authentication. You know, it's like, I can kind of see why someone would implement this. So let's talk about that. So let's say that we have an API that needs to talk to itself.  Or we could just say, hey, when I talk to myself, I know it's me, so we're good to go. So I'm pretty sure that's what they were trying to do. So, you know, if the host header is always a local host and a local request, and it's never a local host and a client request, then the host header being local host means it's a local request. You know, good to go, job done. Except there's a problem with this. And I think many of you have already realized this problem. And it's that the host header is client controlled. So that's not good. So the host header is usually local host and a local request. And it's rarely local host and a client request. So the host header being local host just means it's a request with a weird host header. So one of the reasons that I think this becomes an issue with a lot of people is that the host header is application layer while routing decisions are done at the network layer. So although in a lot of our large web applications, we can expect some routing decisions to be made based on the host header, this is a tiny little, tiny little NAS on your LAN. Like, you're not going through a load balancer to talk to your NAS.  So since there's no load balancer and since we're talking to it directly, what can we do? Well, let's find out. So we have a base request here. We have a junk seed and it responds with, hey, this is an invalid ID or invalid session ID. Okay, that makes sense. So what if we set our host header to local host? And we still have a junk seed and we still get an error but it's a slightly different error. It's still invalid but it's invalid params. And it's saying that, you know, the reboot function doesn't take any arguments but we did give it one. As far as I can tell, the only argument that we may have given it was the seed parameter. So what if we just delete it? Well, if we delete it, we get result null. And then the device makes some sad beeps and reboots because suddenly we're an admin. That's probably not good. So I just got a shell. And now I can get a root shell without authentication. Also probably not good. Yes, well, I guess if for those of you keeping track, the authentication is the host header kind of. So the fact that you could just send, say, your IP address is 127.001. And then I have to say this is all you need to know from here on out. We were able to access all the functionality in the NAS. Also the ability to make the device beep. And that was really interesting as well. So we brought this device to another CTF. I think no one's figured it out here so far. There's actually a request to make the device play music. And that's one of the most annoying things that we found out. So remotely we're able to play music in other people's houses. And on top of the fact that we're able to get a shell. I'm not sure which one's more concerning. Yeah. So I don't know. It seems like after all the shells that we got on these devices, getting a shell kind of got boring. So then it became, hey, we can play music. This is fun. This shell is boring. So yeah, how about that Tweet and Delete? So we decided to disclose. As normal, we disclosed all of the issues that we found to the manufacturer. Gave them at least a month or two to fix them before we're doing public disclosure. In this case, you know, we sent an email to their security contact on 06-22 and heard nothing. So we sent another on 0702 and heard nothing. So then we sent the volumes to the security contact on 07, like on the next day and we heard nothing. So we sent the CVEs on 08-22 and we heard nothing. So we announced our public release because it had been many months and we tried our best. And then two days later, we did our public release with a demo live stream showing off the exploits and how to do this. And then something happened the next day that none of us were anticipating. An official Buffalo Twitter account retweeted the link to our live stream. What did that link contain? That link contained a very nice URL to our live stream on YouTube about how to hack all Buffalo devices. What happened to that tweet in? Well, at some point, they must have realized that something was terribly wrong because they deleted it. However, we do have a screenshot, so that's nice. So we're not crazy. This actually did happen. Hopefully your folks in the back can see it and enjoy your life and so you definitely can see it in the back and hopefully you're enjoying it as much as we did. So what ended up happening with the device in the end? Did we get patches? Well, we'll find out. So clearly they realized that something was wrong. So at least someone at that company is aware that there's a lot of vulnerabilities that should be fixed. So clearly, as far as patchability goes, there are patches. There are no patches. It's been like a year I think? Yeah, and for a talk that I did at CypherCon, I did some more research and found that all Terrasations are vulnerable to the same exploit, including the ones with the brand new completely redone UI. How much were those devices again? The devices, I think some of them were up into 20k, something like that, like professional grade network attached storage for businesses. 20k for your own, I guess, C2C server in the end. Pretty much. But yeah, I guess in summary, the host setters client controlled. Unless you have something that's parsing it and making sure that it's not client controlled, maybe don't rely on it for authentication. And like, if you have a security address, please pay attention to it. We're trying to help you.  Like clearly whoever had deleted that tweet knew that something was wrong, but they didn't own up to it or if they did, someone didn't listen to them and all of these devices are still vulnerable, including the one in the CTF. Like it's running the newest firmware and you can go over and get a shell in it if you like. Oh, you want to talk about Maryland Democratic Party real quick? You're way more enthusiastic about this issue than I am, so I'm going to let you take care of this one. Yeah. So after all of this, we found out that the Maryland Democratic Party had a Buffalo NAS on the internet with no password. And while we were doing all this research, another research company found it and contacted them and then like did a release about it.  But the Maryland Democratic Party did take care of it. They put a password on it. So it was still on the internet, but they put a password on it. And then we released this. So I guess I'm pretty sure every nation state and their grandmother can Google. So sorry, Maryland Democratic Party. We tried. Just to be clear on that one, we didn't hack them at all. That never happened. Let's make sure I don't want to hear about that later on from anybody. But it's kind of funny because we give a lot of these presentations where we tell people about like, hey, like you there are vulnerabilities that you're seeing are it's in the system. It's like you can have the like up-to-date firmware. You can have a good password. It's like if there are authentication bypasses, it's like false sense of security that you're leading yourself into is like I mean wrong. It's important to have good passwords and important to keep your stuff up to date. But if there's no update and people can just change the host header to local host and get in, you're just lying to yourself. Talking about lying to yourself is our next device, the Jovo 5N2. The Jovo 5N2 is a SOHO enterprise-grade NAS and it is between $400 or $500, way cheaper than a Buffalo, but just as vulnerable. This one's made in a great, I'd say a lot more vulnerable. This one's probably way more vulnerable. I'll tell you guys how many unauthenticated shells we got on this thing at the end of this. But this one's made in America. The one, the reason why we wanted to look, to research into this device was because it doesn't, you can manage it through a web app by default. Almost all these devices, there's like you hook it up, there's a web app, you connect to it. The Jovo only, the only way that you can connect to it by default is by installing this thing called a Jovo dashboard and people on Reddit were losing their minds over it because they thought it was really cool because it has all these pretty lights and the kids really like LEDs. And the other reason why is because it's like pretty robust and it's also like pretty fair price point I guess. I wanted to get it because it has this custom protocol that it uses to connect to the device with this like only macOS and Windows binary that you need to install. So we installed it and this is what the Jovo dashboard looks like. Just, I think this was the macOS version, you install it and then it gives you like other like information about the device like the serial number, it tells you the like how many drives you have installed, when was the last time you like set up RAID and all that and the life expectancy of all those drives. Not sure how it does that. And you can also install other apps and remotely access the device through other means as well. The first thing that we did is that I was really worried that the only way that we'd be able to assess this device is by doing a lot of hard core reverse engineering because like oh they probably have certificate pinning, they probably encrypt everything with TLS. Ha! It was just plain text. Everything and I know it's a little bit hard to see that but that's just we opened up Wireshark and started clicking on a bunch of stuff and we found out that everything was in plain text. I was like well cool but it's so it's like this customer proprietary API was just XML and what you had to do is that you sent the like that like drynet, TM stuff at the beginning, those dots are just hex characters, I put dots in so it's a little bit more easy on the eyes and then some XML data. Well we still need to reverse engineer the protocol here, we need to figure out like how it all works, what does the 61 here mean, what does that DRA number and how does this all work. So the first step that I said is like well cool, maybe I can just send this message with echo and then pipe it into netcat, connect to the device on port 5001. We saw that whenever we were interfacing with the device it was over port 5001 and that it was always listening on that port as soon as the device turned on. So maybe we can just send this and figure out if it just gives us a message back maybe there's no authentication. We sent it, we didn't get anything back it just froze. We needed to figure out why at that point so we need to do some more protocol reverse engineering and see where that goes. So I also found out while we were looking at it that if you kill the instance of your Jorbo dashboard it'll restart and when it restarts it'll have something listening on port 5000. It's like cool well I can probably just connect to the device on port 5000. If you connect to the device on port 5000 it spits out all this XML and that's really interesting notice there's no trickery there no authentication I'm not sending anything connected to the device on port 5000 and that's it. So I was like alright maybe it is that it needs to be connected to the device on port 5000 and also send a message. Well let's try that out if we send that and we echo this information pipe it into netcat maybe there's maybe there's no authentication. It's like well that's not working either maybe there's something else. So at this point we're going through the process of reverse engineering if you're gonna how is it that the whole like handshake part is happening between these things. So we kill the Jorbo dashboard and I think the other thing that was very important about this is that every time you kill it it just automatically restarts so we needed to set a script to automatically kill it every time until we were ready start water sugar then start back there from from nothing and we found out there is authentication when the Jorbo dashboard starts so the application that connects to your device it sends this message and this message is only it only happens once at the beginning kind of sounds like what happens when you log into an application right you log in what you send your username and password once it sets a session token it gives it back to you and then you have all that information and you can just keep on doing the do. So we needed to reverse engineer the front part here so you can see that the drawing ATM part is still the same there's a bunch of dots and a number there that number looks pretty long and it looks I would say it looks complex enough that I don't think I'd be able to brute force it so we started looking into what it is what it is that this number meant the first part the join a TM part was just those hex characters then we found out that after that it would say if it's coming from the server or if it's being sent to the server with the other bytes and then the rest of it was a size of the packet and now that we know all that information there's something else here that we still need to figure out what's that so the part that's like I guess kind of highlighted in red but definitely bolded that looks like something that's still complex enough that we can't just randomly guess who it belongs to but we found out that when we connect to the device on port 5000 it gives us back that number that that here folks is the serial number so it looks like the thing that you need to authenticate to the device is its serial number it's like oh this is complex enough serial numbers are pretty long but you can just do the following connect to the target on port 5000 extract the serial number from the xml that's returned to you send the login request on port 5001 send whatever command you want to port 5001 and then install whatever you want we found out that you can install pretty much anything you can install my sequel you can install apache you can install open ssh you can install other malware that you find out and you find anywhere but it pretty much allows you to do anything and then after we found out that drobo also provides this thing called drobo access it's a web application that they provide so that you can connect to the device through something that's not the drobo dashboard and we were so wondering I said well we don't really have a shell yet how are we going to do this the first application that we installed gave us cv 2018 14 6 9 9 and I think that's a little bit hard to see for everyone in the back so let's look at this a little bit more closely here's the device's IP address 192 168 1.26 it's on port 8080 that it listens on drobo access you send an enable user request and you set your username to your command injection payload that goes straight into a shell and that's the easiest shell I've ever gotten throughout my whole career and that's pretty much it there's no authentication or anything you send this individual request to any job access I guess job or job or with job or access and you automatically get a shell so let's talk about now the disclosure timeline we send everything's them on 0706 we're in an email so like hey we want to send you these vulnerabilities over how do you want to receive them do you want to see encrypt them or not do you want us to PGP sign it ha they didn't care we send them back again to security contact ha they didn't care we send them to the we send the CVs over anyways hopefully stirring something up for them to respond back to us we got nothing and then after I did a public release and a live demo of me exploiting this vulnerability I'm also going to be doing this in on other conferences I'm going to be a b-sides Puerto Rico in October I'm going to be doing the same thing again and the reason why is because they don't fix anything so send the DM to the gerbo CTO Ian what happened there how do we DM the gerbo CTO so for that handy-dandy protocol that they gave us I decided to write a little Python utility that makes it very easy to run your own commands and I accidentally got command injection just while writing a script so we kind of figured we should probably tell them about that because it's depressingly trivial so I I sent him a DM and or I sent the the CTO of the company that acquired robo a DM we'll get to that so then after that we recent all the vulnerabilities that we found to drobo and in it to CTO email or sent all the vulnerabilities that we found the job of the CTO's email we didn't hear back from him I'm pretty sure he doesn't like us besides the point Ian mentioned something interesting while we were sending all this stuff over something was happening in the background job was getting acquired while job was getting acquired we found a bunch of we found nine unauthenticated shells folks nine that's embarrassing to me not for me I found them but they're like this company store centric they were acquiring two companies job oh and next in throughout the whole process now I'm here in red which I hopefully I'm hoping all of you can see in august 21st 2018 they released this on the nexon website let's look at that timeline again we submitted everything on 0706 so that would be July yeah July he's shaking his head July and then after on august 22nd 22nd we send them all the CVs throughout that whole process they could have addressed these issues or just got them back to us they get I'll be honest they could have been just busy with their acquisition and not really in the mood to deal with nine unauthenticated shells sounds like their problem on mine but let's go to the summer the summary of this issue having a proprietary protocol is not making safe just because you're like you're prescribing to the idea behind like if it's mine and nobody else knows about it nobody can find any exploits that's not true there are many good reverse engineers out there they will figure it out it's a bad idea to authenticate with the thing that you're providing users they probably shouldn't be authenticating users with the serial name or the serial number I probably wouldn't be authenticating people with their name and pay attention to your support tickets we sent a couple support tickets in hope that they would address these issues never got addressed and then last up it's like if you end up screwing up like Ian said it's probably just to own up to it it's a if somebody submitted these things maybe it's time to address them there was also something in other some other thing that happened that was interesting throughout this whole process when I was sending them these emails I got or guess we got we got blacklisted our P.I. just got blacklisted now that makes no sense why would you blacklist somebody who sending you an email and I'm hacking a device that I have in my house those things on add up those are very separate things but that was whatever I could have also I give them the benefit of the doubt I actually give all these companies despite all the headaches the benefit of the doubt may have just been that we downloaded the firmware too many times may have just been that like we're a security company and it looked like fishy traffic it's all I think I I understand if those things happen I don't understand not addressing the issues that were reported so now I'm passing it over to Ian for the Nekir R9000 which is the last of last advice we're going to be looking at today and this one's really a doozy have fun Ian no idea so the R9000 holds a special place in my heart for good reasons and bad reasons we'll get to that so it's a flagship router by Nekir at the time that we did our research I think it was like the most expensive one they offered something like $350 to $500 it's aimed at like power users that sort of thing and as a rich feature set with all sorts of fun applications you can run on your router because you need to run applications on your router and it's administrate administered via a web app a mobile app and tell that if you cheat of course I cheat but it also has a bug bounty for vulnerability disclosure and only a bug bounty for vulnerability disclosure we'll get to get to how that kind of broke things in a minute so the web app you know it was kind of boring it's what we've seen a lot it's just basic authorization or like yeah basic authentication no clear by passes it's a form post but it has C serve protection it's very crappy C serve protection so if you want to break that probably can I highly recommend trying so I started poking at other things like the mobile API so it's a soap API which yeah you that it's not fun to work with those but it's it's different and as jwe based authentication which is it's okay but static analysis showed that it was a total minefield of command injection and command injection is one of my favorite things to do so that that instantly got me interested but sadly the API is terribly broken and unreliable and half of the end points just did not work at all so it kind of ended up being an uphill battle to do anything with this API but I still got off bypassing friends so we'll figure out how Eric have you ever like seen people using the exported for her much I've seen a lot of people use the exported for her I've never seen somebody use it properly so the exported for her it's a de facto standard it's so it's something that a lot of people have agreed on that it does it does x thing but it's not properly standardized but it's usually used by load balancers to convey a client's actual IP address to some sort of upstream service usually so it's also not as simple as a lot of people think it is so the exported for her is actually a list of IP addresses normally we only see it as a single IP address but it's designed so that when a load balancer or whatever that's working with this header receives a request it should prepend the IP address that it received that header from to the beginning of the list and also it doesn't have to be an IP address you can put whatever you like in this header and your load balancers probably just gonna stick an IP address on the front of it so a lot of people don't seem to realize this and it causes problems like what happens if they're just expecting an IP address and dumping that into a database and I put a little semicolon boy in there breaks things so how does this relate to our router well our soapy API interprets the exported for her why I honestly have no idea there is no reason that you should need the exported for her on your land again you're not talking to your router on your land for a load balancer that would be a hell of a router but static analysis also showed that the R9000 is probably the only neck your router or device that interprets exported for her I downloaded all the firmware that I could find unpacked it search through it and the R9000 was the only one with an instance of the exported for her that's also weird but what you know what can we do with it well here's a problem so htp requests are handled by CGI server and this is you htp deep that CGI server sends those requests down to a like a downstream process in this case net CGI is what handles all of our soap API requests so you htp d we'll take something in take your request turn all the headers into environment variables and then toss that down to a different process so net CGI uses the remote address environment variable to determine if a request is local and much like the buffalo it will whitelist itself so it can talk to itself without having to deal with authentication and normally the remote address environment variable is what you would want to use for this because it will be the actual IP address that that request came from in normal circumstances and even like if you try to change it like it's chances are you're not going to be able to mess with it however you htp d just replaces the remote address environment variable with the contents of the x4 to 4 header for some reason like I'm a complete re screw scrub I graph scrub and everything but even looking at the assembly I could tell that that's exactly what that did because it was like 10 lines of assembly and that was it so yes that's not good because if we can say that we're whatever IP address we want and it uses an IP address to determine if you should bypass on authentication why can't we bypass authentication well we can we just set we just set x4 to 4 colon 192 168.1.1 and suddenly we're an admin on the soap API and we can do whatever we like so thus cv e 2019 12 51 0 was born so I wasn't satisfied because you know off bypass isn't fun if you don't get a shell right so I got a shell cv e 2019 1 5 1 2 5 1 1 it's kind of big so I don't think we're going to focus on this shell because it's got a lot of fun challenges like it can only be 17 characters it has to be all capitalized all capitals it has to have a colon it has to have a single quote and then it's in my colon and you have comment out everything but if you want to talk about that talk to us later because we don't have time yeah before we get out before we get away from this one the interesting part was I even found the range header which is definitely an unexpected header so we're able to use the range header to say like alright well let's put the whole thing that we need in the header and then we'll reference that header in the xml body of that soap request and I guess we were just lucky that all those things happen to drive together yep when you're poking at CGI and you're trying to get weird command ejection payloads through the environment variables are very much your friend but I wasn't quite done yet because netgear has a very fun clause in their bug bounty if you can get remote unauthorized access to administer a netgear device via the internet not the LAN it will give you 15 grand I can buy a lot of ice cream with 15 grand so yeah I want that so I started looking into that so the soap API requires extra headers like for the soap requests and all that good stuff so XHR can set these but it's cross-origin so it'll have to pre-relate the requests and chances are the routers was going to slap that right out of the air so CSERF isn't going to happen so the device isn't exposed to any um it doesn't expose itself over the WAN at all so I was kind of out of luck at this point so I just kind of decided well guess I'll die I guess I'm not getting the 15k until two weeks later and I was taking a shower and my brain started just shouting dns rebinding and say two minutes later I figured out why the thing with dns rebinding is that it functions a lot like CSERF except it's seen as being the same origin so you can send whatever requests you like without having to deal with these pre-flighting um annoyances so yeah no more pre-flighting however it differs from CSERF and that we cannot send authentication in our case well dex-worded 4 is a de facto standard so can we just set that header and make ourself an admin well yes so that's what I did so it's not restricted so let's just build a payload so this is the workflow that I went with we have um the victim is anyone on the land they can be authenticated unauthenticated does not matter mobile devices does not matter they just wait for the dns ttl to wear out and then once it does I start issuing post requests via xhr with our auth bypass header to do the following we start to config change we enable qos we enable advance qs then we finish the config change and we pop a shell so we have to fire off five requests to enable a bunch of services and do configs and stuff but it actually only takes like 20 seconds to do all of that and then get a shell so just threw that into I think singularity and then it was off to the races uh so we started uh disclosure uh so we got 15k bounty didn't we rick yeah right although I appreciate the applause something we didn't get the bounty why was that Ian so you know how the our disclosure timelines have been pretty small up until now and we tab through the all this is half of our disclosure timeline we just put the important bits in here so let's go through some of the uh more important ones on 10.03 or 18 10.03 we submitted all our all of our vulnerabilities through bug crowd because that was the only disclosure avenue that we had uh so we got an award for cross-site scripting via the Xorted 4 header a completely different issue that was rather low severity so that was nice uh but we didn't hear anything else for two months uh until next year stated that they can't reproduce the command injection issue and they had in the meantime released new firmware uh and asked us to test again and record the uh proof concept so they could figure out what they were doing um so we did that you know we verified that yes I can still get root remotely um and I gave them a nice video so they marked the command injection exploit as triaged which was nice uh that was a little over two months after the initial release uh and then about a month after that they released the firmware um <IP_ADDRESS> uh they didn't tell us about that they just released it and then about a month after that or half a month or so I got a hunch that you know I think they fixed everything without telling us or giving us rewards so I checked and they had so we confronted them and they marked everything as unresolved and gave us degraded rewards like you know that command injection north bypass that lets you do admin and everything totally not critical totally um so whatever that's fine we just wanted to disclose the issues we're not actually going for the money although it would be nice so we asked for cvs because net gear is a or it was a um cv numbering authority so they should be giving us cvs for their products uh and they just didn't respond and then something like a month later we asked for cvs again and they said we're not doing cvs anymore okay then why are you with cna so we contact mitre to get cvs and they say we'll give you cvs once we know that net gear is not a cna two months later almost like what half a year over eight eight months since we started the disclosure timeline we got our cvs from mitre and surprise or unsurprisingly net gear was no longer on the list of cna's so that was fun anything to add rick well i got plenty to add so one of the things that i guess was really problematic about all this was that when we reported all these vulnerabilities through bug crowd to net gear all that time went by and they were just not fixing the issues they weren't admiring that we had sent them the issues over i can i blame both net gear and bug crowd for the situation because we had responsibly disclosed all these vulnerabilities through them and this was the first time ever i think both of us have ever seen bug crowd put a blocker not on the researcher but on the company for not addressing the issues that we had sent over net gear had also put us in a position that we thought that all right cool if we could have easily send them these issues separately and they could have been addressed and the dns for binding was just kind of a nice feature that we knew or i guess a nice way to chain all the things together to get unauthenticated command injection on this device would i guess 20 seconds of user interaction the thing about it is that we would i feel i can't help but feel that i ended up being lied to as a researcher especially from the fact that we meet we met all the requirements of their program and we didn't get what they were promised that they were going to give us that's beside the points i guess kind of water under the bridge at this point in the summary so in general like i highly recommend if you're doing anything with web applications use the x forwarded foreheader it is a very fun header to mess with you can get command injection sql injection a lot of sql injection you're tainting logs all sorts of good stuff like that and cmdi like yeah it'll it'll find a way if even if it's you know four seventeen characters and mangled to all hell you're still going to get command injection you just have to try hard enough so again environment variables are your friend dns rebinding is remarkably powerful this was the first time that i used it and it kind of blew my mind because suddenly all these attacks that require you know authentication tokens or um require bypassing um c-surf protection become extremely easy to do as long as you don't have to worry about authentication and like yeah if you have a bug bounty please communicate with us don't just leave us sitting there for two months five times um and if you stop providing service communicate you can like say hey we're not a cv uh cna anymore um and also like communicate in general it's nice um and for bug bounties we found out a few times now that bug bounty bug bounty programs like the companies don't have much of an incentive to treat researchers fairly they can just say no and you can't really do much there's no incentive for them to not not really do that aside from just people getting angry um and bug bounties probably shouldn't replace your security contacts we would not have gone through the bug bounty if we didn't have to but that was their only security contact that that was the only way that we had so that's just how it ended uh i guess anything to add rick no that's kind of it i know we're definitely over time so we're just going to run through these conclusions and answer some questions at the end for the quick conclusions these were the things that were different from when we conducted a research project in 2013 in 2013 most of the shells that we ended up getting were through c-surf we found out now i think it's more that our security research in general has gotten to a spot where it's more it's easier to get a hand of different ways to bypass checks especially authentication checks so in this case we didn't need to use c-surf for any of these we just use a lot of authentication bypasses one of the things that was nice now that we didn't see in 2013 is that in 2013 a lot of the devices had executable stacks we found uh i think two buffer workflows in in one of the asus routers that we hacked those did not have an executable stack so we had to do rob and a bunch of other like really fancy stuff to eventually get a shell that was not the case in 2013 where just pretty much it was the bottom of the barrel with regards security on software packages really out of date in 2013 they're really not that much anymore one of the bugs that we found a lot in that study was that smb was horribly out of date so you could do some link traversal that's really not the case anymore for a lot of these it's pretty it's much more up to date and i guess nicer from both the securities perspective because you get to try to find new interesting security vulnerabilities instead of these old ones and before we didn't see any publicly documented security contacts a lot of the times we were just emailing people that we found the LinkedIn now we we did see some manufacturers for example asus terramaster, Synology, QNAP a lot of these companies actually tried their best to ensure that the vulnerabilities that we were disclosing were getting addressed and publicly documented uh like disclosure outlets the two that i mentioned that i think were the ones that made me the happiest were QNAP and Synology yeah QNAP and Synology were very good about all the issues that were reported to them as soon as we reported them they responded within the a day or two and they addressed the issues and they had us checked to make sure that everything was good let's find that we'll stay the same devices are still remotely exploitable given the 125 cvs that we found i think that's pretty easy to understand um there's still plenty of c-surf not like i said in the previous slide before we were using that for the exploit chain for a lot of the stuff now we don't need to use it as much because we found a lot about a lot of authentication bypasses OS command injection is still a problem that's probably one of the vulnerabilities that we focused on this time around and security obscurity is still alive and well we looked at a lot of manufacturers that the way that they would do stuff it's like they would try to do their own type of encryption or their own type of like set or file host things so that it would become kind of problematic but it wasn't in the end and here's some of the stuff that stayed the same for or like it's like what changed but stayed the same in manufacturers some manufacturers actually really care i've been talking about Synology and QNAP a lot not because i know anybody there but it's because i was really happy with the disclosure process xiaomi too yeah oh yeah xiaomi was another one that was very good i i think that's how you say it right i don't know the xiaomi did a very good job of addressing the issues that we disclosed there they have an interesting bug money program they don't they they paid us in toys never had that happen before and um even as a child and a lot of the companies have bug money programs needless to say i'm not very happy with companies like necker who were partnering with bug card and they ended up in the situation where we feel cheated but a lot of other companies they'd actually pay out their bug bounties and i'm happy for that and some companies are really interested in working with researchers to get things addressed a lot of the stuff that we reported they were very much happy of understanding they wanted to know how did you guys find they what did you do do you think that we have more instances can you check also it's free work so why not but it's a really nice situation where they want care about the security and they're trying their best to improve it and that's kind of it folks these are me and ian's twitter me and ian's twitter and well we also love talking shop we're going to be at the village for the rest of the day until sunday we'll be here we'll leave eventually but the this was a very good experience and this was the results of our three of the best results from our research project the two other people that weren't able to present with us today that's josh mire and shah marani those guys found a lot of other vulnerabilities and it was great to work with them thanks for your time and i'll open the floor up to questions if any of you have anything to say or ask


The behavior of panel All right. Well, right now we're gonna do something new and we're just gonna take a short video It's a famous person and we're gonna take a look at it and let you know what we think this person is being Honest or deceptive Mark? Okay, so we've got George Clooney talking recently about the idea that he uses a flow be one of those Vacuum cutters from I think the 1970s or certainly 1980s to cut his beautiful hair So let's have a look at that and then let's tell you what we see. Let's watch the video You've been cutting your own hair and I've been got my own hair for 25 years So it has nothing to do with quarantine. Yeah, look, I have my hair's like really like straw, you know And so it's easy to cut you can't really make too many mistakes. So years ago. I Bought a thing called the flow be which when we did not I was a kid. Yeah The infomercial the flow be this ingenious device lets you give yourself and family perfect haircuts every time Yeah, it comes with a vacuum cleaner and clippers. Yeah, I still have it. Stop it. You don't use it My haircuts take literally two minutes. I go Is this flow be? Yeah, that is awesome. Yeah, listen man. It works Now, you know, I wouldn't do it to my wife All right, Greg you want to go first? Sure. I this is what I call lying for sport You're doing it for your own entertainment for the entertainment the person across from you Do I believe he cuts his hair every week with flow beat? No Do I think he maybe did it one time visit? Whatever. Yeah, maybe he's done it a couple of times But I see that engagement that paying attention looking to see if we've made a connection and doing it for entertainment I always call it lying for sport because it's not harming anyone It is entertainment for the person and it personalizes you more than you would be otherwise It's it's him entertaining someone chase where you go We have some eye accessing during the entire Sentence when he's saying I've been doing it for 25 years not when he's trying to recall, you know I've been cut my hair for 25 years or so That's when you would see the eye accessing it wouldn't look like this. I've been cut my hair for 20 the past 25 years That's him thinking Should I do this? Should I do it and that's what we're seeing right there next we have When he gestures, yeah, I've still got it He gestures to his house and the hand falls back really quick think if you're talking to somebody you said yes I've still got it in the house Your hand our hands all stay up and this is cross culturally. I've seen this in the Middle East I've seen it in Europe our hands stay up when we're pointing somewhere and it's almost as if like yeah It's over there, but don't think about it being in there and I'm not gonna go get it and show anybody So the hand falls pretty quick and then at the very end his words are softened lacking endings So when he says it's the flow be he didn't say that it's just a jumble of sound and then he says flow be That's what it is So if I can just mix these words up It's a lot easier to lie because I didn't really say that it was the flow be that cut my hair for the past 25 Years, I just said a flow be Just skip over the the rest of the sentence Scott what do you got? All right, I think I agree. I I think he's I think he's got a flow be I think he uses it every now and then So I think we're seeing a mixture of Truth a lot is because he's a cool guy everybody likes this guy. You know, he's great actor He's one of my favorites, but but I think we're seeing a 50-50 there. I agree with you Greg I think he's used it, but he doesn't use it all the time. I'll bet when the co vid hit Nobody was in the house using that dang thing all the time So that may be true on that part And I hate to say this because I'm always talking about how bad my hair looks all the time It looks like I cut it, but I don't have flow be But his hair looks pretty cool to be flow bead. I think So I don't know if I just got my involves a cutter and a vacuum cleaner. There you go So I don't know if I got that sheen because I like the guy or what but it's still But I think it's 50-50. I think he also has pros to it. Of course when he's doing a movie or something They're going to do it So I think maybe it's it's I think he does have it the only thing it bothered me when he says it comes with a vacuum cleaner A little thing like that because it didn't come with a vacuum cleaner. You attach it to your vacuum cleaner That was the thing So that's the only part that bothered me about that. That's what makes me think it's a 50-50 thing So I think it sounded cool when he got into it and I agree with chase. He got into it going Am I going am I going I'm gonna go to the wall with this thing. I'm going I'm going And he just he went on in man. He said I'm doing to kick the door and it went on in So I I think that's the part. I think it's sort of the 50-50 thing I think he's telling the truth but at the same time being just a touch deceptive Because I know it's George Clooney, but man your your hair can't look that cool with a flow be I don't think you know, I think they still be selling it if they did if it did I sent it to my barber And she said that's not a flow be And you guys have seen I think I've facetimed you guys while I was getting a haircut here in my office And She said no, it's it's perfectly cut around the ears. It's perfectly cut to an exact You know measurement when he turns his head you can see there's a good line there Hard to do by yourself according to her, but I don't know.  What do you got? Yeah, so there's a lot of data there that suggests he doesn't cut his own Hair so what's really going on here? I would say what we've got here is chaff redirect and resume statement. Okay so Here's what I think is really going on here when people start talking about his hair There is a suspicion That it might not even be His own hair. So what are you going to do when hair is brought up? Chaff and redirect let's talk about flow biz Let's talk about some weird contraption from the 70s 80s Because now you've got a picture in your head of George Clooney doing his own hair With this bizarre contraption. You don't have an idea in your head of but is it actually his hair? Notice where he shows you his hair. He goes round the sides He doesn't go to the thick head of hair on the top of his head at all I suggest this is chaff redirect and then the resume statement, which is Uh, you know, I got this really uh, strawberry hair It's easy to cut it. It's like I've got the greatest hair in the world And then the resume statement right in the at the end of I wouldn't do it on my wife Well, no, obviously you would not force your wife to have a haircut with a flow bee that she didn't want But now you've mentioned it what a brilliant person you are for women's rights for suggesting how you wouldn't do it To your wife. So again, it's just a redirect of it's lovely George Clooney Who doesn't force his wife to have a haircut. She doesn't want. What a lovely guy classic case for me of chaff And redirect and resume statement. There's something there. I would suggest he's hiding about his hair In general possibly maybe I would say because he probably has some pretty severe lawyers All right.  What do you got thumbs down? All right mark. What do you got it's thumbs down there's something else going on there All right, I'm gonna go in the middle. I guess before I think he's he's a little bit of both a little bit of both All right. Well, if you like our videos, be sure and subscribe Just click that little red button down there near next to mark and hit the little bell That way you'll know when we have new one come out. We good Yeah, one more thing I don't know a lot about youtube Mark is obsessed with these metrics and algorithms and and how people do stuff Mark has shared something in our whatsapp group a couple days ago. If you're watching this right now There's a 3.7 chance that you're subscribed to the channel. That's so sad We try to put out some really cool stuff for you guys So please consider subscribing if you're not already subscribed Click the button down there. It helps you we give you a lot of good information and it also helps us It helps our channel grow and thank you very much All right, excellent. See you next time. Bye now


Welcome back everyone to theCUBE's live coverage in San Francisco for VMware Explorer. I'm John Furrier with my host Dave Vellante. Two sets, three days of wall-to-wall coverage. This is day two. Got a great guest, Scott Baker, CMO at IBM, VP of Infrastructure at IBM. Great to see you. Thanks for coming on. Hey, good to see you guys as well. It's always a pleasure. Good time last night at your event. Great time last night. It was really well attended. IBM always says it's the best food, so that was good. And great props, magicians, and it was really a lot of fun comedians. Good job. I'm really glad you came on. One of the things we were chatting before we came on camera was how much change. We've been covering IBM storage day back on the edge days and they had the event. Storage is the center of all the conversation. Cyber security, but it's not just pure cyber. It's still important there. And just data in the role of multi-cloud and hybrid cloud data and security are the two hottest areas that I won't say unresolved but are resolving themselves and people are talking about. It's the most highly discussed topics. And it sits all on storage. Yeah, it sure does. And in fact, what I would even go so far as to say is people are beginning to realize the importance that storage plays as the data custodian for the organization. Certainly you have humans that are involved in setting strategies but ultimately whatever those policies are that get applied have to be applied to a device that must act as a responsible custodian for the data it holds. So what's your role at IBM in the infrastructure team? Storage is only one of the areas where you're here at VMware Explorer. What's going on here with IBM? Take us through what you're doing there at IBM and then here at VMware, what's the conversations? Sure thing, I have the distinct pleasure to run both product marketing and strategy for a storage line. It's my primary focus but I also have responsibility for the mainframe software so the Z system line as well as our power server line and our technical support organization or at least the services side of our technical support organization. And one of the things that's going on here in the lab a lot of noise is going on. Is that a bird flying around? Yeah, it's what I'm doing. Yeah, we got fire trucks. What's changed? Because right now with VMware you're seeing what they're doing. I got the platform under the hood, developer focus. It's still an ops game. What's the relationship with VMware? What are you guys talking about here? What are some of the conversations you're having here in San Francisco? Right, well you know IBM has been a partner with VMware for at least the last 20 years and VMware does I think a really good job about trying to create a working space for everyone to be an equal partner with them. That can be challenging too if you want to throw out your unique value to a customer. So one of the things that we've really been working on is how do we partner much stronger? When we look at the customers that we support today what they're looking for isn't just a solid product they're looking for a solid ecosystem partnership. So we really lean in on that 20 years of partnership experience that we have with IBM so one of the things that we announced was actually being one of the first VMware partners to bring both a technical innovation delivery mechanism as well as technical services alongside VMware technologies. I would say that was one of the first things that we really leaned in on as we looked out at what customers are expecting from us. So I want to zoom out a little bit and talk about sort of the industry. I mean I've been following IBM since the early 80s right? I mean it's trained in the mainframe kind of market and so we've seen a lot of things you see come back to the mainframe but we won't go there. But prior to Arvin coming on it seemed like, okay storage infrastructure yeah it's good business and we'll let it throw off some margin that's fine but it's all about services and software, okay great. With Arvin and obviously Red Hat the whole focus shift to hybrid. We were talking I think yesterday about where did we first hear hybrid? Obviously we heard that a lot from VMware. I heard it actually first early on anyway from IBM talking hybrid some of the storage guys at the time. Okay so now all of a sudden there's the realization that to make hybrid work you need software and hardware working together, right? So it's now a much more fundamental part of the conversation so when you look out Scott at the trends you're seeing in the market when you talk to customers what are you seeing and how is that informing your strategy and how are you bringing together all the pieces? You know that's a really awesome question because it always depends on who within the organization you're speaking to. You know when you're inside the data center when you're talking to the architects and the administrators they understand the value and the necessity for a hybrid cloud architecture. Something that's consistent on the edge, on-prem, in the cloud. Something that allows them to expand the level of control that they have without having to specialize on equipment and having to redo things as you move from one medium to the next. As you go up stack in that conversation what I find really interesting is how leaders are beginning to realize that private cloud or on-prem, multi-cloud, super-cloud, whatever you call it, whatever's in the middle, those are just deployment mechanisms. What they're coming to understand is it's the applications and the data that's hybrid. And so what they're looking for IBM to deliver and something that we've really invested in on the infrastructure side is how do we create bi-directional application mobility? Making it easy for organizations whether they're using containers, virtual machines, just bare metal, how do they move that data back and forth as they need to and not just back and forth from on-prem to the cloud but effectively how do they go from cloud to cloud? Yeah, one of the things I noticed is your pin this. I love AI with the, you know, the eye of IBM and get those little signage there. AI, I remember the quote from IBM is you can't have AI without IA, information architecture. Right. Rob Thomas. Rob Thomas has the sound bites. But that brings up the point about machine learning and some of these things that are coming down. Like how is your area of devolving the smarts and the brains around leveraging the AI in the systems itself? We're hearing more and more software is being coded into the hardware. You see silicon advances. All this is kind of not changing but kind of bringing back the urgency of hardware matters. That's right. At the same time, it's still software too. That's right. Right, and so let's connect a couple of dots here, right? We talked a little bit about the importance of cyber resiliency and let's talk about a little bit on how we use AI and that matter. So if you look at the direct flash modules that are in the market today or the SSDs that are in the market today, just standard capacity drives. If you look at the flash core modules that IBM produces, we actually treat that as a computational storage offering where you store the data but it's got intelligence built into the processor to offload some of the responsibilities of the controller head. You know, the ability to do compression, single instancing, deduplication, you name it. But what if you can apply AI at the controller level so that signals that are being derived by the flash core module itself that look anomalous can be handed up to an intelligence to say, hey, I'm all of a sudden getting encrypted rights from a host that I've never gotten encrypted rights for. Maybe this could be a problem. And then imagine if you connect that inferencing engine to the rest of the IBM portfolio, hey, Q-Radar, hey, IBM, Guardian, what's going on on the network? Can we see some correlation here? So what you're gonna see IBM infrastructure continue to do is invest heavily into entropy and the ability to measure IO characteristics with respect to anomalous behavior and be able to report against that. And the trick here, because the array technically doesn't know if it's under attack or if the host just decided to turn on encryption, right? The trick here is using the IBM product relationships and ecosystem relationships to do correlation of data to determine what's actually happening to reduce your false positives. And then have that pattern of data too, it's all access to data too, big time. That's right. And that innovation comes out of IBM R&D, does it come out of the sort of product group? Is it IBM research that then trickles its way in? Is it the sort of the storage innovation? Where does that come from? Where does that bubble up? Well, you know, I got to tell you, it doesn't take very long in this industry before your counterpart, your competitor has a similar feature, right? So we're always looking for what's the next leg? What's the next advancement that we can make? We knew going into this process that we had plenty of computational power that was untapped on the FPGA, the process of running on the Flash Core module, right? So we thought, okay, well, what should we do next? And we thought, hey, why not just set this thing up to start watching IO patterns, do calculations, do trending and report that back? And what's great about what you brought up to, John, is that it doesn't stay on the box. We pushed that upstack through the AIOps architecture. So if you're using Turbonomic and you want to look application stacked down to know if you've got threat potential or your attack surface is open, you can make some changes there. If you want to look at it across your infrastructure landscape with like a storage insight, you could do that. But our goal here is to begin to make the machine smarter and aware of impacts on the data, not just on the data they hold onto, but usage to move it into the appropriate tier, different write activity or read activities or delete activities that could indicate malicious efforts that are underway, and then begin to start making more autonomous, how about managed autonomous responses?  I don't know that we'll ever get there just yet, but the important thing here is what we're looking at is how do we continually safeguard and protect that data and how do we drive features in the box that remove more and more of the day-to-day responsibility from the administrative staff who are technically hired really to service and solve for bigger problems in the enterprise, not to be a specialist and have to manage one box at a time. You know, Dave mentioned Arvin coming on, new CEO of IBM and the Red Hat acquisition and that change. I'd like to get your personal perspective or industry perspective. So take your IBM hat off for a second and put the Scott experience in the industry hat on. The transformation at the customer level right now is more robust to use that word. I don't want to say chaotic, but it is chaotic. They say chaos in the cloud here at VM where big part of their messaging. But it's changing the business model, how things are consumed, you're seeing new business models emerge. So IBM has this lot of storage, old systems. You're transforming, the company's transforming. Customers are also transforming. So that's going to change how people market products. For example, we know that developers in DevOps love self-service. Why? Because they don't want to install them. Let me go faster. And they want to get rid of it, doesn't work. Storage is infrastructure and still software. So how do you see in your mind's eye with all your experience, the vision of how to market products that are super important, that are infrastructure products that have to be put into play for like really new architectures that are going to transform businesses. It's not as easy as saying, oh we're going to go to market and sell something the old way. This shifting happening is, I don't know if it doesn't answer yet, but I want to get your perspective on that. Customers want to hear the storage message, but it might not be speeds and fees. Maybe it is, maybe it's not, maybe it's solutions, maybe it's security. There's multiple touch points now that you're dealing with at IBM for the customer without becoming just a storage thing or just hardware or hardware, it doesn't matter. No, you're absolutely right. And I think what complicates that too is if you look at the buying centers around a purchase decision, that's expanded as well. And so as you engage with a customer, you have to be sensitive to the message that you're telling so that it touches the needs or the desires of the people that are all sitting around the table. Generally what we like to do when we step in and we engage isn't so much to talk about the product. At some point, maybe later in the engagements, the importance of speeds, feeds, interconnectivity, et cetera, those do come up. Those are a part of the final decision, but early on it's really about outcomes. What outcomes are you delivering? This idea of being able to deliver, if you use the term zero trust or cyber resilient storage capability as a part of a broader security architecture that you're putting into place to help that organization, that certainly comes up. We also hear conversations with customers or requests from customers about how do the parts of IBM themselves work together? And I think a lot of that again continues to speak to what kind of outcome are you going to give to me? Here's a challenge that I have. How are you helping me overcome it? And that's a combination of IBM hardware, software, and the services side where we really have an opportunity to stand out. But the thing that I would tell you that's probably most important is the engagement that we have up and down the stack and the market perspective always starts with what's the outcome that you're going to deliver for me? And then that drags with it the story that would be specific to the gear. Okay, so let's say I'm a customer and I want to put forward a, you know, I'm buying it to zero trust, zero trust architecture, but it's going to be a somewhat of a long term sort of plan. But I have a tactical need. I'm really nervous about ransomware and I don't feel as though I'm prepared. And I want an outcome that protects me. What are you seeing? Are you seeing any patterns? I know it's going to vary, but are you seeing any patterns in terms of best practice to protect me? Man, the first thing that we wanted to do at IBM is divorce ourselves from the company as we thought through this. And what I mean by that is we wanted to do what's right on day zero for the customer. So we set back using the experience that we've been able to amass going through, you know, various recovery operations and helping customers get through a ransomware attack. And we realized, hey, what we should offer is a free cyber resilience assessment. So we like to you from the storage side, we'd like to look at what we offer to the customer as following the NIST framework. But most vendors will really lean in hard on the response and the recovery side of that, as you should. But that means that there's four other steps that need to be addressed. And that free cyber resilience assessment, it's a consultative engagement that we offer. What we're really looking at doing is helping you assess how vulnerable you are, how big is that attack surface. And coming out of that, we're going to give you a vendor agnostic report that says, you know, here's your situation, here's your sort of grade or your level of risk and vulnerability. And then here's a prioritized roadmap of where we would recommend that you go off and start solving to close up, you know, whatever the gaps or the risks are. Now, you could say, hey, thanks IBM, I appreciate that. I'm good with my storage vendor today. I'm going to go off and use it. Now, we may not get, you know, some kind of commission check. We might not sell the box. But what I do know is that you're going to walk away knowing the risks that you're in. And we're going to give you the recommendations to get started on closing those up. And that helps me sleep at nine. That's a nice freebie. Yeah. Yeah, it really is. Because you guys got deep expertise in that area. So take advantage of that. It's got great to have you on. Thanks for spending time out of your busy day. Final question, put a plug in for your group. What are you communicating to customers? Share with the audience here. You're here at VMware Explorer, the new rebranded, multi-cloud, hybrid cloud study state. There are three levels of transformation. Virtualization, hybrid cloud, DevOps now, multi-cloud. So they're in chapter three of their journey. That's right. Really innovative company, like IBM. So put the plug in, what's going on in your world. Take a minute to explain what you want. Right on. So here we are at VMware Explorer. Really excited to be here. We're showcasing two aspects of the IBM portfolio. All of the releases and announcements that we're making around the IBM cloud. In fact, you should come check out the product demonstration for the IBM cloud satellite. And I don't think they've coined it this, but I like to call it the VMware edition because it has all of the VMware services and tools built into it to make it easier to move your workloads around. We certainly have the infrastructure side on the storage talking about how we can help organizations not only accelerate their deployments in, let's say, Tanzu or containers, but even how we help them transform the application stack that's running on top of their virtualized environment in the most consistent and secure way possible. Multiple years of relationships with VMware, IBM, VMware together. Congratulations. That's right. Thanks for coming on. Good to see you. A lot more live coverage here at Moscote West. This is theCUBE. I'm John Furrier with Dave Vellante. Thanks for watching. Two more days of wall-to-wall coverage continuing here. Stay tuned.


Yeah, hi. It's a pleasure to be here. So she already introduced me My most recent projects in the moment are body forms and who commas for body press But he forms is a form builder and who commas for body press brings who commas into Body press both is available in the wordpress repository in this talk I want to cover the different strengths of user-generated content and how you can benefits on if from it I believe that many people don't understand what user-generated content really is and Because I'm working with this. I decided to keep have that talk So what is user-generated content user-generated content is actually every every thing what your users create it can be block post a command or any upload a review actually at the moment when the user riches your site and start giving your data and that is user-generated content and Nearly 50% 47% of customer will read about three to five pieces of user-generated content before they think about buying your product or service so User-generated content can be a really big factor of your success and of your growth strategy Oh wait, that was too fast if you look at user-generated content. It's actually starts Now I lost the point How we've a wordpress is all about democracy Publishing data and my question this talk is why is all the user-generated content often stored outside of wordpress? So for example if you have a newsletter and to use a service for this you store this data outside of wordpress if you collect Mails or create lists often these informations are stored outside of wordpress and then this Data does not belong to you and to your installation User-generated content in wordpress is stored in posts and pages if you have posts that can be post meta Commence user and user meta and if you use body path that can be expo file fields What I found out is that often we have many different user-generated Content sorted all over the sites for example you have a hook umershop and then you have a my account page And you maybe have a learning courses shop, then they have another place for their courses or to set up the profile And one great idea is to bring all the user-generated content into body press So your users have a centralized place where they find all the relevant data they give to you and This can be also like for example product reviews from Google places and when you create a nice profile where they find all these parts of the user-generated content you can Make them review your product or review your site Then you get the stars on Google places for example, and that will benefits your business But to have that you need to make it as easy as possible for them to find that and To call them to that these action That can be lots of different things like I said before you can create account pages if you have a learning site it can be your courses your lessons or the subscriptions they have the Even invoices reviews orders or if you have products with need support you can bring this into the profile And then they find all this relevant data and don't get lost on your site because if they get lost on your site that is frustration and if the user gets frustrated he leaves your site and he not come back and When we talk about body press that is really interesting because body press is a social network component of WordPress and WordPress is all about blogging, but you can't block in body press actually so it is super great if you Make it possible for your users to write to Create guest posts because this guest posts Can give you a huge feedback from your customer It can be a how-to documentation a showcase or a story, but it can be also a hub for Feedback where you maybe decide no I don't want to publish this but the feedback I get from there is really interesting because I can improve my existing products or the service or the experience the user got on my site and That's why I think Guests posts are super important and can be a huge motivator for your audience Wordpress is all about blogging why yeah, that's what I just said and We have created a small plug-in which enables you to use Body press and make them outer profiles because often I hear no I don't want to use body press that is like a social network like a Facebook clone But actually that's not true in the moment when a user reaches your site You start to get an interaction you have a social communication with your user and if you use body press you can bring this communication To one place to the profile and store all the information you need in the expo field data So you have them for later usage Nobody wants to fill out form in the internet It's really hard to make people give you user generated content So the best is you create nice funnels that the user like to give you the data If you have a registration form, which is really long nobody want to enter it So make it small only the email address and the name and then With click on the activation link you can ask for the password or even after enter the password you can ask for further information So you have a funnel which keep the user motivated to give you information And when you have a learning site or a shop or something where you need more information Or they need to finish the lesson or courses gamify this process You can put budgets in the profile and make the body press profile the home of all the user generated content That is actually I think a really important part So yeah when we talk about user generated content We also talk about a GDPR Because all the user generated content actually is GDPR But if you take it serious and use for example body press just a profile component to have a centralized place They can find all the information they give to you and even like External resources like the Google places can be found in the profile and will make it super easy for them to manage their data You you should always make really clear where you Save data so if you have a contact form It's different than us if they create a blog post for you or a review Which maybe is located on another side Yeah, that was a small talk Thank you Thank you. That was short and sweet. Thank you very interesting Have any questions from the audience? I Can't really see Anything there. So if you have a question from that part of the word, please shout very loudly Body form body form. There's a free version of what plus org do we have another question? Yes, can you get the microphone? So it's important when we take Questions to have the microphone there. So the people that are Transcribing everything can hear it. So please give the microphones and don't let us shout My question is this body forms it only works with body first or you can use it as a standalone plug-in No, you can use it as a standard alone plug-in It's actually a form builder to create user-generated content So you can create forms for any post type and then use that forms to collect the data and you have use So users see the lists of Their posts and can manage edit or Delete them according to how you set that up in the rules and capability section. Thank you Here oh there was oh, okay Please thank you Hi, hi, I asked you about security Yeah What kind of role have users when it's login to my WordPress site? So normally you have like registration forms if you create registration forms You can set up the different rules the user have in the back and you can decide which rules are allowed to view Create or edit content. So every user can have different capabilities on what he's able to do and which lists He's able to see this is a stand alone Roles that WordPress provide WordPress comes with rules and capabilities and in the forms you can select the different Rules and which capabilities you want to give so they are able to create edit or delete Thank you, and if you have member types body press also comes with member types. So you can give for example Different users different member types, but they all have the rule as vendor and are able to create products Okay, okay. Thank you and you can also for example in the earlier days We use forums to give support or collect data, but then you have not much Decision about what is public But if you use gaspout that can be really similar and you decide okay that question that is okay It's not harming my business I will public it and then people can comment on it and you have a feeling like a forum But you have full control of the user generated content Thank you. Thank you for the question more questions We have five whole minute for the questions because fan was very short so go Enjoy this my question is about Yeah, my question is about user generated content. It can be really good when managed properly and the best thing about user generated content is that you'll love your Users your visitors to contribute content, but this can escalate quickly like for example You don't want to monitor or approve everything on all the other hand when you don't do that People can start spamming your site. Is there a way to filter this automatically like Without having like moderation so that before it goes live you can moderate it and review Yeah, there is a plug and also in the WordPress or repository it called body forms moderation So you are able to create a workflow and even send notifications to different users of your site the admin or the moderator or the submitter and Even in the review process you can create notifications and say please change this or that. Thank you We have time for another question It's here in the front. Can we get a mic here? Thank you I will want to know what do you think about the classic forum website which are using baby press What do you think it will be in future? It will grow it or not? Also for me when I start work with WordPress and start sales teams and plugins I have a forum and then it was really hard work for me So most of the companies they switch to help this and this is like isolated place And I feel like blog posts or guest posts can be something in between So you give your users the possibility to write something or ask the question and then you can decide if this is Important and relevant for others and make sense to public on your side so it is in between of completely have a wall and Decide only to use a head desk or a Forum so it's something in between I feel Sorry, what about the future the future? The you mean our forums. I think they're going down less and less Yeah, it's not so important these days because also the communication in a forum most of the time people need to register there And this starts to become slowly Yeah, the social networks doing this what for before was The forum is now most of the time a Facebook group or something like this But this is an interesting point because also if you think about user-generated content and you write your blog posts on Facebook Or somewhere then they don't belong to you I think we should think about WordPress as our main hub and home and first write the post in WordPress and then Post it wherever you want even the image of the media so it belongs to you and it is your Content and not the content of a service you are using Thank you. Thank you, Sven. Thank you for being with us


He had so much tremendous faith that the traffic would stop for him. We don't see that kind of faith every day. We're just striding out into traffic. We're learning of those examples like having too much faith in human nature. So I think walking out into traffic and expecting the traffic to stop for you. Maybe too much faith in God, too much faith in human nature. And then other people who are quite depressed, convinced that nothing can ever get better. Maybe they could benefit from a little more faith. I've now spotted two possibly three homeless here in the Central Business District. And they look quite drug-addled. There's probably five drug addicts. You can see a bit like a public loosens and a public menace. But only five, no homeless encampments. There's just one guy under a bridge. He's in a sleeping bag. There's a sleeping bag moving around. Very little graffiti. So the closer to the water, the more expensive the real estate. The better quality of people. And then you go out to Western Sydney farther away from the water. And you get more working parts for Logan Australians. But everyone's been very nice. How do you make it to Sydney Opera House? And I was told practice, practice, practice. But Sydney's only come out of quarantine about five weeks ago. Pretty much every store requires that you both mask up, go in the store. And you check in the New South Wales Safe app. This is an outbreak. And these seem like reasonable measures to me. I can't get all offended. I think tomorrow is a big trans day of pride here in Sydney. I want to deep on the police and do away with trans discrimination. Holding this on shutters for a bit. Along with the anti-vax demonstration. So I've walked about 11 miles so far. Oh, why did the bird cross the road? Because he has faith. Can't see that every day. What kind of bird is that? Right in the central business district. But yeah, I'm just in the mindset. I just want to learn from everyone. Some people are impressed by their energy. They strive or run down the street. The energy in their drive. Fitness. Sense of mission. Other people are impressed by how elegantly they dress. Other people seem really happy. So I've got one friend I've just talked to. One made a mind from childhood. He's been working at the same government agency for 30 years. So that's not 40. 40 lives around. 40 years have been able to sustain a relationship for longer than a year. Got my mate. He's married with kids. Multiple kids. And he's a stayer. 30 years in the job, mate. Let's catch the light. Boy, you don't want to get confused about the direction of traffic. Busy central business district. So yeah, we got King's Cross coming up on the right. So some people say drugs are bad. What do you do? It used to be anything you wanted. You could get it in the cross. You showed me the underworld that you killed me with pain. Hmm. Poignant message there. So I remember when I was a kid, I went to this dunny. I came out by Lake Macquarie.  Like, meet me at this time and I'll do these things to you. Like, on the one hand, I was admit a little bit titillated.  They're very generous, open-hearted men are. And then kind of freaked out and disturbed at the same time. So that may be an excess of fashion and affection. Ah, Centennial Park coming up. Very nice. So I'm also paying attention to people on this trip who are much more proper than I am. Alright, because I keep having to quiet down. I'm going to be shocked. I'm saying a lot of inappropriate things. Which is fine, you may say, but then it's negatively affecting people around me. So there are people who have more prestigious positions in society than I do. People have more to lose. People have worked hard to, How am I going to get out of this mess? Can I just run across the street here? That's the only one. Why are you on a public mess? It's running there like an indigenous Australian. Where am I going? Okay, I'm on a straight and narrow. Pretty good shape for a man my age. Kind of embarrassing as I got caught by the coppers. J-Walking. So yeah, there are people in my life who are much more proper, professional, upstanding, have more to lose. I'm glad to develop a certain reputation. And so, I can't be making my possibly offensive comments at full volume. And I can negatively affect others. Another thing that I'm meditating on this trip is to be aware of how my selfishness, such as my desire for a cheap laugh, may negatively impact others. So, whether or not I'm having a good laugh, what if it negatively affects other people? So, I don't know. I don't know. Maybe someone can tell me. Man, a lot of beautiful women. But whatever it is I'm seeking in those beautiful women, let me find it in God's instead. That's my motto. They were seeking in excitement. We laughed live on YouTube. And every time I turn a corner, it feels like I'm turning into a new park. I figure out how to use public transport. I could be a big spender. I could have an Uber. Or I could just walk 15 miles today. I've got experience in the city. It feels good to have my mainly vitality back. I owe it all to ancestral supplements, beef organs. It'd be awful if I got really sick. I completely relapsed into my chronic fatigue syndrome. I've had the mother of war relapses.  But that's living in reality. Recognizing that thing that I'm incredibly, incredibly excited about right now. It might just have a placebo effect on me. There may be nothing inherent in it. So, I feel like I'm in the best shape of my adult life thanks to these ancestral supplements, beef organ capsules. But hey, what do I know? It's a scientific validation, I think, for these. I can share with you my experience strength and hope. You seem to help me. The other lifetime is a serial enthusiast. And now at the right old age of 55, I have more of a recognition. Hey, I'm always super excited about something. It doesn't mean that it's real. It doesn't mean that I'm staying. And I also recognize that being a stayer is hanging in there, having zits splashed as the Yiddish say. Just sitting there, doing the work. What doesn't come as naturally to me is careening off into some new enthusiasm. So, I also think about some of my past enthusiasm to present enthusiasm. And about which ones can I maintain? Instead of just bouncing from serial enthusiasm to serial enthusiasm. So, you know, the 40 academic of the day to another 40 academic of the day. Maybe there are some that I can... I should hang with longer. Not just be so promiscuous in my interests. I'm always falling in love with some humbly new idea that tantalizes me and excites me and promises me a magic clue to how the world works. It's rather immature of me at age 55 to keep pursuing these intense eyes of like, oh, I've got a great new idea. So, maybe I can harness the energy and enthusiasm and power of that with a keen recognition of my infallibility and excitement-seeking tendencies to be a dilettante as opposed to those who hang in there with one topic and explore it in depth. To be recognized by nature and try to get the best out of it. That's also my end-end. What enthusiasm has to present when I need to maintain? Maybe I don't even have to verbalize that. Maybe I just need to commit to my actions. That is how Judaism is going to talk about in Judaism. Christians don't talk about that Christianity. Christians don't talk about Christ. Jews don't talk about Judaism or Jewish identity. Christians don't tend to wax their alcohol about my Christian identity. I've been out and about in Sydney for two days now. Mine is the only selfie stick that I've seen. They're vegetarians and vegans. I was intellectually convinced that vegetarianism is not a healthy way of life. Particularly now for children. It's actually kids up for social failure. Vegetarians are socially very unpopular. People don't like having to cook their food or post-vegetarians with meal. So you're putting your kid and yourself behind the eight ball to create social disadvantage. And also, it seems pretty clear that a lot of essential nutrients that people lack. So that's my theory on the essential supplements, beef organs. They provided vitamin D12 in a way that my body could assimilate. And that's why I got renewed vitality. Sydney football stadium. It's serious about their rugby here. Rugby league is the number one sport in Sydney. Australian rules football is the number one sport in Victoria including Melbourne. And what about Brisbane? Maybe rugby league? I'm not sure. What's the number one sport in Brisbane? Or Adelaide? Probably cricket is Australia's number one sport. Followed very closely by rugby league and Australian rules. Now it looks like a pretty magnificent stadium they're building up here. It's going to be a rule follower on this trip. Follow the rules except for when I do a little jaywalking. Only on weekends. Only when it's safe. Only in moderation. Other people don't know how to jaywalk. Jaywalk moderately. Some people they... I gave one friend, it's like a little taste of jaywalking.  Follow the rules. But then he took the jaywalking way too far. He just thought it was a midst for the jaywalk. He was like, oh, I'm not going to allow these secular authorities to tell me what I can do. And Dutton say the Aboriginal Australians are closer to the Asiatic than to Africans. Oh, how is Judas Maccabeus' appearance on Edward Dutton? I just could not compete with that stream. Oh, man, I love this stadium here. I mean, there's like three stadiums in one. I mean, this is huge. Where's the Sydney Cricket Grounds? I'd love to visit the Sydney Cricket Grounds. I followed Sydney Cricket Grounds. Oh, man, just right out there wearing the baggy cream cap to represent Australia. Oh, like if I could perform my one man play eroticized rage at the Sydney Opera House, I think it would be Australia's most anticipated cultural event since Craig McDermott was finally called up to the national cricket team. Craig McDermott was a Queensland spin bowler. Finland is the New Zealander Scandinavia. What does that mean? Man, do you see the size of this? These rugby stadiums? Is this one stadium? It's enormous. I think you could probably fit 200,000. They're building three stadiums or is this one big? No idea. This looks huge, mate. To be a lumberjack. Striding through Craig's training out back. Oh, Sydney Cricket Grounds. Oh, this is the Sydney Cricket Grounds. I'm walking by the Sydney Cricket Grounds. Here in Australia.  Played a couple of games at the Sydney Cricket Grounds. Boy, I'd like to hit one for six at the Sydney Cricket Grounds. I'd like to give them my googly. Look, don't go to that park where they throw alternative lifestyles off the cliff. I'm trying not to, mate. Another another resolution I've made for this trip is no cartaging, particularly no cartaging near cliffs. So, this is the Sydney Cricket Grounds. Right here. And we're live at the SCG Richie Benow here. And let's go down to who did the pitch report? Ian, was it Ian Chappell? Let's go down to Ian Chappell for the pitch report. Thank you, Portie. So, the wicket looks like it's going to take some spin today. So, if you look closely here at the wicket, you can see it's ready to take some spin. And so, you can look forward to a fast day of run scoring, wickets falling. A day filled with just high quality, entertaining cricket. Thank you, Ian. Richie Benow, Ian Chappell. That was just some classy Channel 9 cricket commentators. Oh, Tony Gregg did the pitch report. Oh, the South African Englishman. Oh, I love the pitch report. Finding out if the wicket was going to take some spin. Oh, how the shielders look amazing, mate. I'm trying not to crack on any of them too hard. Like, I mean, the ones that I've been looking at are probably not age-appropriate. I mean, they're adults. Right, they're 18, but let's just say they're not over 40. The shielders here look amazing. Don't wear as much make-up as in the states. So, they're more natural. And they're a little more shy and retiring. So, I think Air Supply said that the shielders in Australia are as rough as bags. Which I want to disavow. They just, they don't wear as much make-up. They don't wear make-up to the beach and stuff like that. So, they're also not as forward in Australia. So, a woman very unlikely to ask a man to dance or ask a man out in Australia. So, Australia's more traditional. So, in the country, it's generally not on that you extend your hand to a woman to shake hands.  Now, in city Australia, I think it's much more frequent. I mean, these city people, they're so promiscuous, man. They're just, like, sticking their hands out and shaking hands with the shielders. Like, it's no big deal. That's not what I'm supposed to do. You're not supposed to shake hands with women. Anyway, I still feel a little guilty. Oh, there's the Sydney Cricket Ground, mate. Oh, look at those beautiful lights. Sydney Cricket Ground. They play T20 there, One Day Cricket, Test Match Cricket. We got the Ashes series starting in about three weeks. So, I still feel a little guilty about my friend who I introduced to J-Walking. And he just couldn't J-Walk moderately. Told him, like, just do it now and again. Like, when there's absolutely no traffic coming. Don't make, like, a big public spectacle of it. There are more Chinese in Sydney or Latinos in the world. I haven't seen many Chinese in Sydney. Like, I'm not out and about here. Palm trees, gated hives, could be Beverly Hills, yeah. My friend, he just couldn't J-Walk responsibly.  He had to vlog about it and tweet about it and stream about it and vlog about it. He started getting nicked. Alright, Professor Andrew Fraser. Yep, yep, so, yeah, I remember the 12th Man satire. That's some quality Cricket satire, mate. That was tops. So, yep, I'm all on. I'm all ready to go meet Professor Andrew Fraser. So, let me know, let me know, Jim Bowden, what's the latest time you could pick me up on Sunday and so we could still be on time for Professor Fraser so that I can arrange earlier in the day spend some time with my sister and then I'll meet up with you and we'll go see Andrew Fraser and we'll revisit the last question 10 years after the initial publication. The book that shook the intellectual world of the West. The last question by Professor Andrew Fraser. This is very nice. Very classy. I'm a very respectable man, guys. So, I want to share my respectable side here in Sydney. No more rap scallion. I think Brendan O'Connell is hiding somewhere in Australia. Yeah, we're just a few hours away from Sheldon's. Good old Google Maps makes the journey through the big smoke a lot easier. Now, we just have to convince Jim Bowden to get a cell phone, right? We have to make two trips to the airport because we missed each other. He doesn't have a cell phone. Just because you have a cell phone doesn't mean you have to leave it on all the time or allow notifications all the time. There's such a thing as silent mode, focus mode. You don't have to allow the cell phone to use you. You can learn to use a cell phone. We can love people and use our cell phones instead of loving our iPhones and using people. One of my favorite sayings from 12 Step. Oxford Street. Very respectable. I remember I was on a job interview a few years ago and the employer said why is everyone from Australia like got a poor letter name like Smith or John. Now, why do all Australians have these very unfillable names? I said we're in Anglo-Saxon society. Catch a ferry from Opera House to my place and we'll drive to Bessex. It's a two hour drive. We'll be shoving soon.