cool how they got hacked episode six six already six already it's because he's tired he's been popping boxes for the last week prepare for some exams yeah the OSCP for all you guys who who are familiar is not an easy exam not an easy exam lots of work lots of studying lots of late nights falling asleep at the keyboard waking up to a lot of unintentional keystrokes lots of code execution there's piles of empty red bulls around them but it's worth it it's worth it it's pretty intense that's that's the important part is in the end it's worth it I've been learning a lot yeah so Tom Lawrence Xavier D Johnson more re-snash all right so now you know who we are in case you are just starting at this episode if you shouldn't go go roll back five episodes go give us a couple spins yeah we have a couple things we're gonna talk about today so we have the Wi-Fi jamming the WP3 and some mobile app hack but the big thing we're gonna talk about the end today we didn't we heard you about the honey pots and we're gonna actually set that up as not this video but as a demo of a honeypot yes he's just been busy and hasn't had time to do it and but we're gonna set one up that's gonna be like a separate video but we were listening we read all the comments like we said each time we got you we're gonna do we're gonna cover like the setting up for the honeypot putting out a honeypot out there what you collect with a honeypot and then we'll talk about that but that's gonna be like a separate we'll just dedicate a honeypot video that so this is just your how they get hacked we're gonna talk about a couple news topics but dive into the matrix we're going into the meat are we following the white rabbit we're following the white rabbit because the matrix got hacked and so we'll glitch in the matrix glitch in the matrix and we'll cover that in depth after we start with these couple of our news topics because you know back when I was in high school if you wanted to get out of an exam you would well allegedly maybe someone sort of maybe pull the fire alarm a couple ways you can allegedly get out of a test back in the day you could pull a fire alarm yeah you could call you could call in a certain situation you should never call in a situation but you know these days kids are you know more technologically event so and their Wi-Fi jamming so yeah a couple kids in Jersey the courting to North Jersey North Jersey dot com Dennis Miller said school officials and I reached out to the police department notify them the students were part of a scheme where they would disrupt the school's Wi-Fi upon demand Wi-Fi the course this is where it goes bad first they figure out they can disrupt the Wi-Fi then it becomes a scheme because they're offering it as a service would you like your Wi-Fi disrupted during exam time got that exam you forgot to study for we'll press the button for you 2995 whatever they were charging I have no idea so I've actually there's a video if you look at my channel called Wi-Fi D offing I they they just peer to be doing it a little bit different but they weren't overly it didn't get as technical maybe as I want because it sounds like they were doing jamming yeah versus D offing which are very jamming as an FCC problem which is going to get these guys in more trouble D offing is intact but it's a different law you're breaking yep because you're manipulating an electronic device as opposed to broadcasting a signal to disrupt other signals they should just use a D author that's my debrief to these guys advice D off next time look up be often ESP on Google and you'll find that the chip is like five bucks to be able to pull this off or you can go to Tom channel I have the GitHub and I walk you through how to do it that's one of the reasons I have the Wi-Fi device that he's seen in my thing as I have a video on this there you go not that I'm authorized you should do it but it's you should understand how these attacks work on your network because if there was a smart network admin watching this this is how one there was obviously some type of admins they caught them they caught them the way all young boys get caught trying to impress a girl oh boy oh yeah yeah she told on them there you go yeah we can we can girl I'm so cool I can take the school down I can shut down she's like oh can you can you do it during my test so I won't have to take it sure baby and he did it and now they're in trouble oh boy yeah so some FCC yeah but FCC won't let me be salute to the young hackers I always like when you know they start early it just shows you know a techno less prowess ingenuity ingenuity oh boy yeah yeah I don't know if I can condone this guys if you just do any amount of googling you'll see that this is how we get botnets yeah this is this is why we can't have nice things so do you guys remember Mariah remember the Mariah button it yes do you guys know the motivation behind the Mariah button it yeah that was one of the games the Minecraft server no no no no no the Mariah button that was the one in New Jersey actually at Rutgers and if I'm not mistaken this kid got caught and everything went down and he was he was basically collecting all of these routers and all of these IP cameras to do DDoS attacks on the college when they were booking oh okay so he could get the classes so that so that people couldn't register for class is that was like just don't do stuff at school like go yeah I'm not condoning that I'm just condoning their I'm trying to think of a word their ingenuity ingenuity it's interesting we just gotta mold these young kids and they get them to do something in the right direction the right direction and things like that so that's definitely there at the co-hackers yeah I mean I think that Wi-Fi jamming is a I think it's low-hanging fruit I think the problem is is that these kids got their hands on the equipment to do jamming versus do I think that yeah this would be a completely different topic from our perspective if this was a deal off versus a jam jamming could could be potentially dangerous not only because of you know the lack of communication on a particular band but because of the overspill and the bands next to yeah it is an FCC problem do this because for a while there there was a few people and they realized was legal I can't really exact article what people would be more aggravated in New York about people who are on their cell phones in a subway yeah so someone this came up with hey I can just press a button and create interference but the problem you're created is what if someone had an emergency and wanted a call 911 or something like that well now you've now blocked all cell phones I mean yeah I got that person being loud they oh yeah yeah you know and it's annoying sitting next to a subway with someone's having a conversation real loud like that but you've also stopped an emergency and that's where this comes into an FCC problem because you're actually blocking potential emergency access now be interesting is if these kids come back and go you know what we thought about that and we accounted for it and we're using this amount of power and we only could get this amount of wattage and we can only get this amount of feet yeah that'd be interesting oh no we were localizing our de-authentic I mean excuse me we're de-authentic we were localizing our jamming attacks to this class focus beam to shoot it only out the Wi-Fi device that covers the classroom see that see be that be those hackers kids be so good be so good that the jury just goes were they really trying to cause damage yeah hopefully that doesn't ruin your lives honestly because I mean they're young they've made some mistakes yeah it'll be okay related to Wi-Fi Dragon's Blood oh boy analyzing WPA 3 not 2 3 the new what standard dragonfly handshake and I'll leave a link I'm not gonna go over every little detail but what essentially has happened so the Wi-Fi Alliance is a group so you have the IEEE group that assembled standards but the Wi-Fi Alliance is a little different they are a pay-to-play and they develop it behind closed doors because us other outside hacking people they're what now yeah they're a private organization that develops Wi-Fi and develops a standard behind closed doors because they don't want a smart people on the outside interfering with the smart people on the inside and when they're done they do publish this which led to someone going wow you implemented it wrong but by the time you find out they implement it wrong they've also gave it to the vendors they sent it out as a ratified standard of alright go make these Wi-Fi chips to sort WP 3 and these methodologies and they have a flaw that was discovered in a handshake now these security researchers aren't your average matter of fact I don't know why these aren't the people and even kind of they make a kind of snarky comment on in here that I could like for if this wasn't designed through security through obscurity these are the same people that found in the crack attack that happened last year that caused a lot of updates to WP2 protocol which of course didn't happen because most old stuff never gets updated yes if you're running commercial or if you're paying me to supply your Wi-Fi I updated and I maintain my clients equipment but we know most people go there was an attack last year I haven't updated my Wi-Fi in five years yeah probably you're right so it probably exists in there so same people who did this research they applied some really interesting algorithms to WP3 and the referred to as the dragonfly handshake they have a very very technical debrief and that's why I said I could make an entire episode maybe I will do a deep dive walking through their security research but it's a 16 page detailed write-up of how they're able to leak information but not exactly crack it so there's two to pronged attack what they have here first D off thing WP3 was designed to avoid situations like the crack attack because WP3 is last year was ratified WP2 was ratified I think like 10 years ago maybe longer longer yeah so it's been around for a long time and you know security protocols are not better but what they found was they just implemented a couple things out of order in their security handshake and that's where these guys found that edge to get in now they also this is my favorite part when hackers are smart asses they found out that they could do a denial of service on a commercial WP3 device with a Raspberry Pi and they commented it doesn't even get above 27% CPU usage to shut down commercial Wi-Fi the attack that it was literally supposed to mitigate is possible now through that edge attack they're able to acquire encrypted credentials and then they would have to use they talk about the compute time needed of a depending on how much entropy was used in the password so it's not like it's just drop in password it's not it's a non-arbitrary attack by the way it also is fairly complicated but it's documented it now has CVE's insert IDs assigned to it and the trickier part is if this would have been engineered with the thoughts that these people are putting into from the beginning one it wouldn't happen to they're trying to do a work around on the engineering of a ratified standard versus if they would have done the standard differently now this is it developing things behind closed doors in a security market you know you know we're gonna poke at it security people are gonna poke at it geniuses like these these two are gonna find a hole in it this is why there is no security through obscurity all standards if you have to have obscurity in the way you're developing a security standard it's probably not secure you're hiding something you're hiding something yep you're afraid you're you don't want someone to check your math problem to make sure it equates properly here I like that this is why your teacher always says show your work I like that this is to show your work you can't just say it's secure you need to prove it and public code audits do that but when you develop it and then say hey this is the gold standard we came up with you took it away from public eye so I'm really not happy with the way the Wi-Fi Alliance does this and you know hopefully this is a lesson maybe they'll learn maybe they'll change their ways maybe they'll look for okay you're right they'll be far we'll have a different flaw in it that these same people I have faith in well in another 10 years we'll have WP for and these guys will drop another yep or it'll be me or maybe have they may they may retire what someone will pick the torch up and find this and find the security hole in the way that would probably be those kids who are just jamming Wi-Fi at high school yeah they're jamming Wi-Fi high school now by time to be for comes out to be cracking WPA for and going you guys could have been pulling this better if you would have asked us like hey and they can see that look we were jamming Wi-Fi back when it was high school 20 years into our careers we're like really good at this now exactly stick out of kids stick out of kids yeah nothing see there is no security throw security this just doesn't work the next one is that this is a report and it's kind of not a paywall but it's a one of those you got to sign up probably from give them a bogus email address so you can get the full detailed report already the highlights of the report the vulnerability epidemic and financial services and mobile apps and you know everyone wants it I need my phone to do my banking and all that actually I don't I don't do any banking on my phone that's there's a reason I don't do banking on my phone because I don't trust the apps I don't feel like to reverse engineering them I have this weird feeling without reading the rest of this report what do you think lowest bidder newest guy they could find out of high school probably develop the app what do you think what are the odds I think it's probably like Xamarin or something some bad framework or what Cordova Apache Cordova or something as opposed to go to every single phone yeah yeah Xamarin's not bad if you do it properly but then they make Xamarin I come on Miguel is an awesome dude so anyways I like Miguel you come up a gnome at least I'll leave it alone well that's a whole different it's a whole different topic but anyways this is the they did not name specific apps they didn't have to they see they took all the major banking apps so we can and odd you can figure out who the major banking apps American Express yeah yeah and a lack of binary protection they found a 97% of them yeah so I actually kind of wish you would have done an inverted list but I just told the wall this one past and that's how it's interesting maybe this is this is this may be industry problem this may be industry problem maybe because and this is speculation here on my I used to I used to dabble and you know apps you have to pass your package along to Apple I don't know if people realize that like you have to basically say here's my package go through to make sure it doesn't do malicious things and so if you're packing it right with a cryptor quote unquote so that it is off of Skate it then that auditor doesn't really get to see no no no all right no because the way they text the way they test a sandboxes a signal does it in a secure way yeah so does so does what's the other one key base both of them pass the security it's a you can use those anyway I agree no benefit of doubt for you guys nothing I mean we can't skip over the fact that most people are doing mobile banking on open Wi-Fi networks yeah yeah there's definitely other security concerns about mobile banking so are you a couple that are unintended data leakage 90% of the apps tested shared services with other applications leaving data from the financial institutions app accessible to other applications now this is a checkbox when you're doing is a developer do you want to share with others no I want an isolated app what does not have abilities to share matter of fact even like signal when you're going through the app screen it you can have it turn off so it does not even display if he sends me a message on signal it does not show up as a notification because you can say don't share any information forcing me to open the app and then you can go a step further and put a password on top of the app so they're not doing that weak encryption now this is where the encryption gets a little bit more detailed 80% of the apps tested implemented weak encryption algorithms or incorrect implementation of strong ciphers so the strong cipher was available they didn't use it they didn't it's like oh yeah I have this awesome encrypted system and I said that to be the password one as the password so when you don't properly implement strong encryption so yeah oh cool aes 256 cbc all the way but we forgot to add a longer key to it so or we use the same key all the way across all the devices yeah we're using admin so yeah great it's encrypted admin though it's encrypted admin encrypted admin so like you know they didn't I just said you don't have to know the details but the strong ciphers were there they're available to us aes 256 is common now it's not hard to implement well if you come up with your own way of implementing it I guess it is don't please don't yeah please don't roll your own crypto don't roll your own crypto trust the people who have vetted other crypto out there just use it work around current frameworks unless you're a super genius in your nope it's not easy it's not easy I'm not saying no one can but I'm super genius you know why you just go to the vetted yeah the vetted solution there's a reason as the people get smarter they go oh I guess I don't need to invent my own security stack this aes s stuff pretty works good matter of fact we now have we can do Diffie helman full key exchange we can do elliptic curve encryption we have some of the quantum proof stuff it's out there it's documented how to use it don't think you're smarter than the guys that did that I mean maybe you are but you better really be willing to test that that's not tested that's not security through obscurity at all no those dudes are like secure security through math how yeah how will the how those key exchanges are implemented is well documented it's not a secret at all 70% of the apps use an insecure random number trader a security measure that relies on random values restrict sensitive resources making the values guessed and hackable R&D yes not not getting good R&D you need good random numbers random whatever they were doing they weren't doing it right so yeah that's this is like 91 called and we're like having the same poor R&D poor encryption like what no obfuscation on binaries what like what is this what is this this is like the most highly attacked you know sector of our world right now it's finance how dare you not put the extra security on it yeah you already have all the money you have it all even before I spend it you get it yeah it's just but is this a security issue or just yes this is a security or is it a rush from the developers that hurry up and get it out without properly security is the very most and utmost primary concern we know that but do the banks I think so because I could just put sideload this video game that's candy crush with a K that can now see every single time you get a bank deposit it may be able to do something weird with that notification because you're sharing data yeah and this is part of the problem they stored it in some of the because we when you're when you're a app developer apps develop a little differently so each one in this goes across Android and on Apple there's a series of randomization so there's not a common place they store data that's part of the obfuscation for every app it's randomly generated that's perfect then you have to go to the common areas on a phone so I can share data between them like your downloads folder things like that they only it's a banking app why would I ever need information to come from any of those other or share things or those are restrictions they just didn't check the box yeah like why would I ever execute from the temp directory right there's never yeah or share any data into or into the temp directory right so there's just some in these are just some security things and these are those edges you need to get into the system so it's it's a mess it's a mess but we're gonna the least we're gonna cover the next mess because this is fun this is this is the debrief here so welcome to matrix this is matrix org an open network for secure decentralized communication so I'm gonna read a little bit about what matrix is if you haven't heard of it but matrix is basically a decentralized message message that matrix is an open-source fabric for communication that anyone can participate in a good intro to matrix is by joining the decentralized chat rooms like matrix hq now if you've ever used a lot more people have heard of we chat in riot mm-hmm those are pretty popular chat apps are built on matrix so it's an open-source sent decentralized but ability to federate and what it means and it's a little bit complicated picture like you think of a company like Facebook or anyone and they have a chat system or WhatsApp but you can't host your own WhatsApp server you you use the WhatsApp client and use the WhatsApp thing on the back end that they own well matrix is going hey you can run it against our servers which are open but you can also stand up your own server in your own hosting and from there you can centralize it so you can connect the chat rooms in this other central server so it's a system that allows you some integration but it kind of decentralized this is a cool concept there's a couple companies like Massadon coming up with a Twitter replacement that are decentralized instead of one company being in fully control it's kind of a cool movement if you want to get into it but let's talk about the security one and if you want to get into it someone wanted to get real into it and they did and they did spoiler alert they definitely did and so this is where things go a little off the rails for them is now the attack was they how they got a foothold in there let me read the actual exposure so it's this is an interesting one right this is one of my favorite kinds of attacks is something that I'll talk to people over at Amazon about is something that you know when people when I like to talk to people who are just getting into into security or are like you know in that mid-range insecurity I always like to talk about these this particular kind of attack because it's something that as an entry level or as a mid-level security person it bends your mind because you go okay how do I protect against this because you're this is what you're up against you so here is the incident report which is great matrix one open source developers open source company so here's what you need to know more leave links all this in the show notes here an attacker gained access to servers hosting matrix or the intruder had access to the production database potentially giving them access to the unencrypted message data password hashes access token has a precaution if you you're in it matrix or you should change your password now the matrix or home server has been rebuilt and running securely bridges and other ancillary services this blog follow as soon as possible and modular dot I am home servers have not been affected now this is one of things they want to make clear as separation if you stood up a server yourself your self-hosting matrix you are not affected by this directly and the reason why it's not a flaw in the matrix protocol this is completely a flaw in the developing team that was running this this is the DevOps problem this is when we're gonna break down everything DevOps said wrong and thank you thank you because we didn't have to do much work on this the hacker because he had control and took control of the GitHub and the packages he had he poem them top to bottom oh yeah then he went and posted on their own GitHub here's what you all could have done better and I love that I love what he did and we're gonna read through it because it's fine and by the way I must throw this out here what he did is literally what I do yeah I go and make issues and go this is not this you shouldn't do this like fix this then it's so refreshing to see someone who is just an anonymous looks to be gray hat doesn't look to be a hundred percent black hat because he didn't try and do anything he actually told him what or she we don't know who they are they're doing some interesting work on the weekends I'll tell you that whoever they are yeah so that's the whole matrix debrief of you know short answer would happen but let's talk about the back end and how this person did it we're gonna we're gonna do the blow-by-blow because there's we're gonna do in post mortem and this I just love that they took the time to write up everything that went wrong so hackers love write-ups they love write-ups and this is this is that little dance on your grave a ponja I'm on the end field I'm tossing football I'm doing to dance I'm like you know double fingers up here just I'm on the way out I got everything I can everything I can running mini cats yeah so he noticed their blog post that I read and it's got a few more things in there I'm not gonna bore you with it because he didn't think it was extensive enough so he starts with I notice your blog post they were talking about doing a post mortem and steps you need to take as someone who is intimately familiar with your entire infrastructure I thought I could help you out oh by the way this is all been taken down but we'll leave links to where I have acquired all this we had to have a discussion so we could find us because once he hacked their github and posted as them on github they decided to redo their github and took all the stuff down but don't worry we got copies of it all we'll leave links for all you down there so if you read through this let's face it I'm not a sophisticated attacker there was no crazy mail where root kits it was SSH Asian forwarding authorized key to because he just he was able to keep the keys and we'll get that in a second here and through a well okay Jenkins old zero day this you know this could have been detected by better monitoring of log files learning of anomalous behavior compromised and oh compromised began well over a month ago considering deploying an elastic stack and collecting logs certainly you're for your production environment so first debrief here no logs he was he gained access a couple months ago with the he said zero old day so yes it was a flaw in the Jenkins server that they did this is not a piece of the DevOps framework they had in the back end that was not patched so there's your edge found it popped it and zeroed yeah zero zero old day I love that the shirt comes in clothing.com yeah so here's another thing the internal dash config repository contains sense of data because you got in their github from this so we acquired access gets in their github the internal config can repository contain sense of data and the whole repository was often cloned onto hosts and then left there for long periods of time even if most of the configs were not used on that host host should only have the configs necessary for them to function and nothing else kudos on using passbolt this could have gotten real messy otherwise so you know they at least had a couple he give him kudos when they use a couple different things are you from a passport I'm not yeah me either so not really I didn't take time to look that up to see what that was but then it gets worse this is this is where the bigger mistake was made on each host I tried to avoid writing directory to authorize keys because after a through a peek at your matrix dash ansible private I realized the access could have removed by any time by employee that add a new key or did something else redeploy users but SSHD config allowed me to keep keys authorized key to and not have to worry about any ansible lock me out which authorized keys to I'm pretty sure that's like discontinued right well no no what they did was and this is interesting so when you have authorized keys so you have an SSH key pairing so we use public key authentication that's good that's strong what ansible does when I rebuild my servers ansible is gonna look at the keys ansible is gonna go get a server and go oh here's the key file let me pop it in there what he was able to do was go I'm gonna order if I can add a second key and he leaves a second key so even if they redeploy the server and redeploy the ansible keys it's allowing a second set of keys to be on there it should only be implicitly allowing a single set of keys so what he did was he just copied it in there added to the config to look in these both these key files ones mine ones these other DevOps guys who aren't paying attention to me because they don't have an elastic stack they're not they're not looking so he was able to do this and what the concept is when ansible deploys it should be erasing the old keys not allowing any other keys and doing that so this is that little comment on on how they did that so it's just these are this is such a minor thing to do from a DevOps standpoint if you're gonna go through trouble you know how to build an ansible script just tell it you can only use one key file there's it's not this is not like a huge like reengineer your whole tool stack here it's just don't allow another key file but because they did he just said oh I'll just put my keys and key to and allow it there you go and when they overwrite the because what they're doing to revoke access and this is actually a problem that would occur when you revoke access let's say each one of us has our own set of keys and Xavier doesn't want to work on the project no more we redeploy the keys without Xavier's key but what if Xavier popped a key file to on there we shouldn't be allowing a key file to it should only be a single key file on her server that's that's kind of a breakdown for that I was able to log in the servers via internet address this is where things get bad this should no good reason to have your management ports exposed to the entire internet never that is almost like think what he should have said in the very first line of this why would you have your management ports on SSH exposed consider restricting access to production either a VPN or a Bastion house so you this is one of those things like you don't want to open up SSH unless absolutely you have to especially when you do things like allow a separate key file you allow second key file you leave SSH open I mean this is one of those debriefs on there hmm why was it open why aren't you all VPN again VPN is not that hard you know even pivoting through a jump box with proxy chains I did a video on how to use proxy chains to get into something there's ways you can do this you can do it over VPN you can do it with the proxy chain there's ways you can help add layers of access we've recently started using I did that video on there and you'd like zero tier yep I like zero tier and I like shuttle to yeah shuttle there's zero tears bad bad ass I gotta throw out that I mean he's even talked to one of the engineers there yeah they're they know their product really well it's tight it's a persistent secure access it's actually one of those weird times when yes there's some convenience but there's actually some security put in and it's a little bit different the VPN I'm not gonna go in and out and I'll throw this out there right red team this one that you guys know red team always wins that UDP hole punching yeah going out man yeah that's a powerful stuff if you're inside a corporate environment the bells don't go off whether that was interesting that will just say Xavier tested a few places and it worked it was didn't go off and he had access hey so that's another side of zero tier that we just were impressed with yes either way if they were using something zero tier because zero tears not opening any ports at all there are no ports open so he's able to access your chair at home and zero tier at other places he was at other places and which is cool but it's also no ports are open on either server you can have a hundred percent locked firewall with with the exception of zero tier will have problems if there's certain amounts of egress filtering it will have problems but that's not that what egress filtering is not where the who does egress filtering yeah but egress filtering wasn't a problem this is ingress filtering the fact that they actually had ingresses into their DevOps network that's where the problem is that's the debris found this it's really bad to don't do that this is going next or once I I like this once I was in the network a copy of your wiki really helped me out and I found what someone was forwarding ports over to flywheel with Jenkins access this allowed me to add my own key to the host and once again adding you and make myself at home thanks Jenkins thanks Jenkins there appeared to be no legitimate reason for this port forward especially since Jenkins itself was being used to establish communication between them I'm not too familiar with the two different products are talking about right here Jenkins yes but not the other ones but either way once again they had an internal documentation server because you assume you don't have to lock down your internal documentation server and yes someone's gonna point out hey Tom don't you have a wiki yes I do how is it locked down very very extremely like even VPN internally to get over to the network and two factor authentication with only SSH and filtered firewalls and ACL rules so yeah even if you were in my network I always assumed someone is in my network so you take the time to lock down your documentation and how your network works because you need to have all that so yeah and when you want to test it give me a call yeah yeah and you do we he's doesn't he pokes his stuff you know I want to know if I don't just think I'm smart and secure things I think is I'll just send an email to one of your guys and be like free pizza yeah oh shit free pizza now principle of least privilege yeah this is just learn this beat this in your head escalation could have been avoided if developers only had access the absolutely required did not have access to all the servers I would like to take a moment to thank whichever developer forward their agent to flywheel without you none of this have been possible that's some real smart assed up there but I enjoyed it but this is this is a we had a conversation with a company maybe one of the DC 3 and 3 events that kind of said hypothetically and we're like looking at I'm gonna look we know your work but hypothetically what if you had a dev team with the root access pretty much every server on there and your company grew really fast and now they're trying to figure out how to pull it back but they want to keep the devs happy we're like pull it back but don't make the devs happy get a dev ops team make everybody a dev ops engineer only hire full-estat guys yeah be smart be smart so this happens at companies and it becomes a very awkward thing and we've talked about this like you have to pull it back if you don't want to end up being on the show if you don't want to be episode number seven pull it back not everyone should have root access on there this is bad so the final one is the SSA forwarding complete compromise could have been avoided developers were prohibited from using forward agent yes or not using dash a inter SSH commands this flaw the flaws with the user agent forwarding is documented this is one of the things where you can forward through servers your agent keys so it's referred to as SSH agent forwarding I have it turned off on mine you only turn on like an as needed basis if there's a reason to use it but once what this does is allow that SSH key to be passed from one agent to another so once he had access to one you're able just to go laterally through all the servers I do like and the archived one that the first post to someone eating popcorn because you know these are the comments on this because this was posted on our github before they got control of their github and taken down because they had keys they had the signing search for the matrix they had the signing search do you know how much carnage could have gone down with the signing search to the package this person like they polled them top to bottom wrote it up told them what they could have done better and left it alone so this could have been much worse they could have sat there they could have developed threats inside of it they could have poked and put things in there which because of this is the nice thing about being open source development if someone were to start inserting code in there you would someone would have noticed someone to say what is this doing but how but then once that happens you start having to figure out because he had access to several DevOps people you'd have to figure out who he was impersonating doing as impersonation like hey yeah why'd you write this weird code over here that contacts the server in China I mean if someone would have found it but now it's already been deployed and compiled at that point so now you have to issue a different it thing this doesn't sound like you ever got to deployment it never got there because this person just wanted to prove they could and do a debrief and do a write-up I mean this is some great write-up this is in great insights this is the ultimate egg on your face that you got poem but you got poem by the right person so that much is true the debrief is good on there's some security lessons earn I bet I bet all this has been changed and I'm willing to bet we're gonna see an update from the folks at Matrix is hey man that guy's write-up it actually is pretty good we suddenly have p-lop I would like that I think that from my perspective when I think about this you think about the origin of how this guy actually got his foothold immediately yeah and that's kind of what I was what I was getting at the beginning from from what we know from from the data that's out there the compromise was not necessarily at the matrix level it was at the hosting provider yeah well so yeah it's kind of yeah is at the very base level because it's all a DevOps problem right you know they got in through the the architecture of the DevOps Jenkins system that managed all this and just that got them in right to the code base because that's where you're that's you don't just want at that back end but it's that one little hole and this is seeing what's happened with some of these other companies so it's really yeah everything is not application security no everything is not looking at the application secure the matrix protocol solid exactly operational security slash operational excellence and you know network security is really really important monitoring alerting lateral movement detection using deception aka honeypots right we like to we'd like to say honeypots but I like to call it deception just because I'm thinking about honeypots v2 right so being able to have maybe something that you know for factory developers aren't supposed to touch like another Jenkins box that have another set of signing keys and the moment that that attacker would have went to go touch that that would have been a booby trap and alarm would have went off and now I know that someone's moving laterally through my environment he was in their environment for over a month or a month we talked about that and this is the same thing this is where would you implement a honeypot in this you would have had it actually had that wiki had the outline of how their network was set up you would have had that in there oh yeah all every night everything's moved over to production to server over here winking an odd verbally you've met some agreement hey no production to server if anyone touches it you're fired because you're the guy with this is our trip this is our trip wire into the systems that we know someone got in so you documented as if it's part of your infrastructure so someone reading your documentation like this guy that's these are all different ways you can use that to do this but I think there's a lot of lessons aren't here it's a great debrief we leave links all this so you can read through it yourself and grab the popcorn and sit back I mean matrix like I said a cool project it's not really the fault of any here's the developers and dev ops or maybe some of the same people I don't know exactly who's in charge of each section of this because it's an open source project but it's still really interesting right up and it's something you can apply to your infrastructure because you're trying to work on keeping your security team clean but hey your dev ops team has to be keeping all this locked down as well and everything up to date yeah it's really up to them when you really think about it at the end of the day it really does come down to dev ops to keep the infrastructure and operational excellence intact they are the last quality gate I am a security engineer right for a for a fund company that you guys could probably guess where I work and you know I'm a security engineer on the dev ops team you know I mean we are the we are the last quality gate I want to keep them safe he tries he's like I make them aware right I put up guardrails and that's a part of it right yeah he called them bumpers but what I call them are guardrails and you make sure that your your users can't do more than this and they can't do more than that and you know I have users that go directly at the guardrails so but they learn and they start to flow with traffic and that's kind of the way that you know we talked about p-lock and principle at least you know privilege and so you know that that kind of is a part of the guardrails this user can't make other users this user can't edit roles this user can't edit groups you give it a mean this user can't do everything to every resource or as what we like to call star dot star in the identity access management world not 777 man this solves all the problems you don't you never need that no well you can get it done with four seven sevens all right yeah and more videos coming on that there you go and more videos coming on zero tier because uh this guy's poked at it too it's pretty nice and it's super easy and it looks like I get a hundred up to a hundred devices on unlimited networks yeah which is yeah interesting for what I do for a living it's going to be it's going to be places you know we're also talking about internally I mean I didn't include you guys in this but we said because you can create a public zero tier wherever you can join we tell about creating our own little net of stuff to play with mm where other people can join in the fun if you do that just make sure that all of our subscribers and you have to subscribe click the subscribe button all of our subscribers should be able to get some access and some shape or fashion that's all yeah I think it might be kind of fun because we could actually set up that and play a game of it there you go yeah I was thinking about some fun ways to do it because then people could just join the network on there and it doesn't pose me as much of a risk when I do it because the way zero tier works it does not have a gateway to give you outbound access you only get internal access because it's a private network because if I were to let you VPN then you could do something like go to some website that would get me in trouble using my IP address that's why I don't do that but doing it with zero tier could be fun because I can set up a little private repository and like a treasure hunting game there you go capture the flag yeah that'd be fun yeah I think that's one be a fine way to do it anyways that's enough today we'll put some honeypots on there and see some honeybots see what people can find see if they can trip the wire if you can't trip the wire right now he's been busy working on cracking servers and gaining root uh-huh the oscp um I'm in the pwk lap I'm not ashamed this is my third time right first time I went for 90 days second time I went for 60 this time I'm going for 30 this time I'm going at it with a completely different mindset my frame so um if I fail I fail but uh I learned so much from this go around legally but it doesn't even have to be a legit it's actual legally so um I'm just enjoying myself and I'm staying up way too late and drinking way too much caffeine so hopefully I survive the next 15 days yes yes all right go reduce that access close them firewall holes uh think about our ways to do it and see in the next oh and um upgrade windows xp service pack one because oh yeah they have some nasty vulnerabilities you might want to check out yeah quit these old machines come on and turn them off you know that's actually the challenge we have is trying to figure out which stories to cover because there's like it's too much there's too much all the time and so much of its stupid stuff listen to the dark net diaries we've mentioned it like no joke I love it the the one they just released on the banking stuff and a lot of it's some face palming like oh yeah they had an older version uh they found an old not patched windows box and then they didn't expect them to be inside the network and yeah great that though the whole atm hacking one the couple recent posts by dark net diaries listen to that it's it's inspirational i'm intense i want to get to that level of production so that too that guy is good there you go jack jack wrysider jack wrysider he's oh yeah inspiration inspiration man and hack five and all those other people give him a shout out oh yeah kitchen oh yeah for sure yeah moobix and uh in his blog and uh everything yeah we don't we we know someone because someone made a comment to me like oh you're copying dark no we're not copying it we're sharing like we're all there's plenty of security to cover we love all those people give them a shout out listen to them too hell i'll say they've they've been doing a great job on it so we're out man later later


This is a dissection demonstration of the vascular structures in the abdomen after removing all the viscera. So, as you can see, we have removed the liver and we have removed everything and cleaned up. So, this is the entire posterior abdominal wall with the entire vascular structures in between. So, let's try to make sense of what we can see in front of us. Straight away, let's turn over to the most important vessels. This is the abdominal aorta. And we can see the abdominal aorta is entering the abdomen through this region here. This is the aortic hiatus. The hiatus is at the level of T12. From the T12 level, it divides at the level of L4 into the two iliacs, the right and the left common iliac. And further down, it will divide into internal and external iliac. So, this is the length of the abdominal aorta in the abdomen. The abdominal aorta is on the left side and on the right of the abdominal aorta is the inferior vena cava. The inferior vena cava enters the abdomen through this hiatus that you can see here. This is in the central tendon of the diaphragm on the right side. This is at the level of T8. This portion which is missing is actually the portion which was inside the liver. Since we have removed the liver, therefore, we cannot see this part here. And this is the other portion where we had to cut off to remove it from the liver. And it extends all the way from T8 and it divides a little lower than the abdominal aorta at the level of L5 into again, right in the left common iliac vein. So, therefore, the inferior vena cava is larger in the abdomen than the aorta. However, we can see only a small portion of it because once it enters the liver, we cannot see it. And thereafter, it goes through the diaphragm and it immediately enters into the right atrium. So, therefore, it does not also have any intrathoracic component. So, that's about these two great vessels. Now, let's take a look at the branches that we can see here. Right after as it emerges, almost at the point where it is emerging the abdominal aorta, it gives off these two branches. We can see them here. One branch going on the left side and one branch coming on the right side. These are the inferior phrenic arteries. And the inferior phrenic arteries not only supply the inferior surface of the diaphragm, but the inferior phrenic arteries also give branches to the supraignal gland. And we can see it is giving branch to the right supraignal gland. And here it is also giving branch to the left supraignal gland. So, the inferior phrenic arteries. Then we have this artery here. This is the celiac trunk. And we can see the celiac trunk has got three branches. The largest is this, this phrenic. The second largest is the common hepatic artery. And then the smallest is the left gastric artery. This phrenic artery gives many branches before going to the spleen. The common hepatic artery gives off this branch, which you can see this is the gastrodiogonal artery. And then after it makes a curve up and becomes the hepatic artery proper, which goes to the liver in the extra hepatic portal triad. And the left gastric artery, it runs in the lesser curvature. And it also gives a branch. We can see this is an esophageal branch, which supplies this portion, which is the abdominal segment of the esophagus. So, this is the celiac trunk. This is at the level of D12. Then we have this one. This is the superior miscentric artery, which is at the level of L1, unpaired miscellaneous branch. Celiac trunk is a branch of the foregut. Superior miscentric is a branch of the midgut. And we can see that it gives numerous branches. The first branch that it gives off, which has been removed, is the inferior pancretico-diogonal, which runs in the pancretico-diogonal junction. The second branch is this one. This is the middle colic artery. Then it gives rise to the right colic stem, which divides into an heliocolic and right colic artery, which will further supply the right side of the colon. And these other numerous branches, which are just a few of them, these are the gingeral and helial arteries. So these are the branches from the superior miscentric artery. Then we have the next unpaired miscellaneous branch, that is this one here. This is the inferior miscentric artery. This is the artery of the hindcut. And we can see this arises at the level of L3, and it gives branches to the descending colon. This is the left colic artery. And it gives numerous other branches, which we can see here. These are all the sigmoid arteries. Typically, there will be sigmoid 1, sigmoid 2, sigmoid 3. And after that, the rest of the artery will continue into the pelvis as the superior rectal artery. So these are the three unpaired visceral branches. Apart from that, we can see numerous branches coming out along the lumbar abdominal wall, both on this side as well as on that side. These are the various lumbar arteries. Another important artery that arises from the abdominal artery is this one on the left side and this artery on the right side. This is the testicular artery or the gonadal artery. In the case of female, it will be the ovarian artery. And this is running with the testicular vein. We can see and it is running and entering through the internal ring of the inguinal canal on this side, as well as the internal ring of the inguinal canal on this side. So these are the gonadal vessels. And finally, as we have already mentioned, abdominal artery divides into the two common iliacs. Since we have already cut the kidney, we can see the cut portion of the renal arteries here. This is one cut portion of the renal artery and the other cut portion of the renal artery coming out from the abdominal artery is this one. So this is the right renal artery and this is the left renal artery. This is the left renal artery. We can also see the abdominal artery giving branches to the left supra-renal man and it is giving branch to the right supra-renal man. Right supra-renal man, left supra-renal man receive branches from the inferior fending artery, abdominal artery and from the renal arteries. So these are the paired visceral branches of the abdominal artery. Now let us take a look at the divisions of the segmental arteries of the kidney. Each kidney receives five segmental arteries. So we can see that as the renal artery gives the renal high lump, it divides into five branches. Superior, inferior, anterior superior, anterior inferior and posterior. So we can see that these are the various one, two, three, four, five. These are the five segmental branches of the renal artery on the right side. Let us try to trace the similar segmental branches of the renal artery on the left side. There should be five. We can see one, two, three, four, five. So here also we can see five segmental arteries on the left side. And the segmental arteries are named thus. They are named as superior, inferior, anterior superior, anterior inferior and posterior. So these are the segmental arteries which divide the kidney into five surgical segments and therefore it enables us to do what is known as segmental nephrectomy. Arteries run behind the veins. Thank you very much for watching. Dr. Sanjay Sanyal.


So our next speaker is Mr. Doug French, as a former banker and then a man who got his master's in economics under Murray Rothbard, he knows where if he speaks about deposit insurance and related issues. Doug is a senior editor of the of Agora's laissez-faire book club, former president of the Mises Institute, great donor to the Mises Institute and it's great to have him here Doug, tell us all about deposit insurance. Thank you Lou, it's wonderful to be back in New York, we were here two or three years ago and it's great to be in this wonderful city, especially wonderful to be down the street from you know Barney's and Anne Taylor and the NKY and Todd's, some members of my family are going to be very happy about that and possibly do what Ben Bernanke wants us all to do with this smell of QE3 in the morning. I did want to make a mention about this book, you may have seen it propped up here re-assessing the presidency, if you do sign up as a member of the Mises Institute and support our great cause, you get a copy of that for free, there's a few authors here today, Joe Salerno has a piece in there, Tom Woods, so you may want to think about joining the Mises Institute today and get a great book and possibly a great keepsake to have them autograph it, so please think about that, this other book over here is a little something I wrote and you may not think I'm much of an author but I had great help, Murray Rothbard helped me with that book, it was my master's thesis and Hans Hoppe was on my thesis committee, so you can't get any better help than that, so whatever you think about me, think about, I tried to get, it had been wonderful to get Murray to co-author but it just didn't work out, so what I want to talk today about was TAG, which is maybe something you've heard about or haven't heard about, but the story of TAG actually starts in 1934 with I'm sure a president that you are all very much a revere, FDR, and after taking office and declaring a bank holiday, FDR told the nation in his first fireside chat he said after all there is an element in the readjustment of our financial system more important than currency, more important than gold and that is the confidence of the people. Well, what FDR was telling Americans was to be confident in government force, to be confident in what Murray Rothbard called an inherent hoax, the smoke and mirrors term for unbacked name of the federal government. Eight states had actually tried bank deposit insurance prior to the Great Depression and actually all eight funds failed, but that didn't stop the government from continually agitating for nationwide deposit insurance. There was actually 150 proposals for nationwide deposit insurance made into Congress, but the idea actually wasn't popular. 1932, Herbert Hoover called guaranteeing bank deposits a lot of rot, adding that it would make the government responsible for the management of all the banks in the country. Big banks hated deposit insurance. It believed that it would only keep smaller weaker competitors in business and actually FDR agreed with them. He told a press conference, the general underlying thought behind the use of the word guarantee with respect to bank deposits is that you guarantee bad banks as well as good banks and the minute the government starts to do that, the government runs into probable loss. FDR went on to say that the government's objective would have to be not putting a premium in the future of unsound banking. Now the banking panic that peaked in the first few weeks of March 1933, Roosevelt in his first official act, he closed the banks on March 6th, said that the banks would be closed for four days, and then what did his administration have to do? Well, they had to quickly draft legislation to actually legalize the holiday and resolve the crisis. In other words, FDR actually closed the banks without having the legal authority to do that. He didn't have the power to do it. The emergency banking act wasn't completed until a few days later. At that time, presidential advisor Raymond Morley said, we know how much of banking depended upon make believe. Believe or stated more conservatively the vital part of that public confidence had in assuring solvency. Now Murray Rothbard said it a little bit differently. He said the very idea of deposit insurance is a swindle. How does one ensure an institution, fractional reserve banking, that is inherently insolvent and which will fall apart whenever the public finally realizes and understands that it is in fact a swindle? Well, we didn't have nationwide deposit insurance until January 1st, 1934. And it started at what seems to be today a fairly nominal amount, it was $2,500. But when you adjust that in inflation, it was about $41,000 in today's money. And now in 1935, that amount was doubled to $5,050. It was doubled again to $10,000. It went up in 1966 to $15,000, $20,000, $69,000, $40,000 and $74,000. And then in the middle of the SNL crisis in 1980, it was raised to $100,000. And that's the way it's been until of course the recent market meltdown in 2008. And the deposit insurance limit was raised to $250,000. But that's not all. Also in 2008, the FDIC instituted a program called TAG, Transaction Account Guarantee Program. And what TAG does is provide unlimited coverage for non-interest bearing transaction accounts. These are typically checking and payroll accounts for corporations and municipalities and possibly large personal accounts. Now according to Wall Street Journal last month, taxpayers are standing behind $1.3 trillion in TAG deposits. And interestingly enough, the vast majority of these TAG deposits are held by the top five banks. While the Fed has been stomping down interest rates to zero. And as of yesterday, it appears they are going to do that until the end of time. Banks are paying but a few basis points to interest bearing accounts. So you're not giving up much to actually just take zero interest and get unlimited FDIC insurance. And Jim Grant wrote in his latest Grants Interest Rate Observer, he wrote, 0% interest rates in blanket FDIC insurance of bank deposits reconfigured what used to be a market in short-dated IOUs of the private sector. Today's money market is increasingly a market of short-dated IOUs of the public sector. He went on to write, when a given claim yields nothing, the prudent investor will roll Treasury bills or functionally the equivalent same thing, lay up deposits at too big to fail banks. Now it's clearly where corporate cash is going. The American Banker reports that the percentage of corporate cash held in bank accounts stood at 51% in May. That's marking the highest level since they started doing the survey seven years ago. This year's percentage compares to 43% a year earlier and 23% in 2006. 77% of the company's surveyed said they didn't care about yield. They cared only about safety and only 2% were interested in yield. FDIC reports that actually non-interest-bearing deposits for the top five banks have swelled over 100% since TAG was put into place in 2008. And by the way, if you're wondering about the FDIC Deposit Insurance Fund, it currently stands at $22.7 billion. That sounds like a lot of money, but it is backstopping $7.1 trillion in deposit. That is 30 basis points. Basis points being 100% of a percent. The Problem Bank List website actually put this rather colorfully. They wrote, this is the equivalent of trying to protect yourself with an umbrella in the middle of a CAT3 hurricane. The collapse of one of the two big to fail banks would immediately require the FDIC to seek financial assistance from the United States Treasury. And of course, during the last financial crisis, the FDIC was nobody else was able to secure a loan, but the FDIC was able to secure a line of credit from the Treasury for $500 billion just in case the need should arise. One might guess that the need will arise. The TAG is scheduled actually to expire at the end of this year. Like so many other government intrusions, it was put in place actually in 2008 with the idea it was temporary. You remember it, but it was worried. They weren't going to be able to get their cash out of their ATMs. I mean, what would we do? So they put this in place. Let's do this until the financial storm passes. And then it would sunset at the end of two years, actually in 2010. But actually in 2010, the Dodd-Frank Bill extended TAG for another two years until the end of this year. So this is again an issue. Back then, FDIC Chair Sheila Baer said it is necessary to extend the TAG program because the lingering effects of the financial crisis that emerged in 2008 in large, systemically important banks have now spread to institutions of all sizes, particularly in regions suffering from ongoing economic weakness. Allowing the TAG program to expire in this environment could cause a number of community banks under stress to experience deposit withdrawals from their large transaction accounts and would risk needless liquidity failures. This reflects the continuing legacy of too big to fail and the different liquidity pressures our community banks experience as a result. Keep that in your mind. Community banks. Now, here we are two years later. The bankers still do not want to give this up. Frank Keating, he just wrote a letter to the editor to the Wall Street Journal, and he claimed that taking away TAG would increase uncertainty in an economy whose path is anything but certain. He says the goal of the program was to maintain liquidity for financial institutions. He said depositors remain nervous for a number of reasons. The fiscal cliff, problems in Europe, the economy is slowed, and who knows what all. And this program should stay in place. But of course, he doesn't want to make it permanent. He just wants a temporary extension of another two years. He writes a TAG in a bailout because the banks have paid deposit premiums on these deposits. Of course, we might remind Mr. Keating that there are only 30 basis points worth of these premiums that stand behind their coverage. Besides, he says, hey, it's been successful. It has supported lending at no cost to the taxpayer, but in fact, really, there's been no lending at all during this post-crisis era. Scott Shea, he's the chairman of Signature Bank here in New York City, and he says the deposits of too big to fail banks are already essentially covered, so it would be unfair to take TAG away from other lenders. Jeff Gerrard, chairman of the Independent Bankers, says TAG deposits anchor broader banking relationships and support local lending. Local lending, really. 40% of the bank deposits in the entire country are held by four banks, and they're not local. 78% of the deposits are held by the largest 1% of banks. Let's say the largest 70 banks that are out there. And by the way, if banks aren't lending, what are they doing? Well, derivatives, that's the latest growth industry in the banking business, and when it comes to derivatives exposure, the top 1% of banks have 99.999% of the derivatives exposure. That total derivatives exposure according to the last FDIC quarterly report was $225 trillion. So what are these big banks doing? If they're not lending money, there's no one to lend to. Well, during testimony before Congress, JP Morgan, CEO, Jamie Diamond specifically stated that the bank's deposits had swelled by more than $400 billion in recent years, putting pressure on the bank to seek higher returns. Bank analyst Chris Whalen, who by the way spoke for the Mises Institute here two or three years ago, he makes the point in a recent investment letter of his that the growth of JP Morgan's non-interest-bearing deposits supported by TAG almost perfectly tracks the period when the Treasury of the bank increased its rogue speculative activities, something you may have read about, specifically the size and risk profile of the London trading operation of Bruno Xkill and the JP Morgan CIO office seems to have increased at the same time that the supply of excess funds due to TAG, JP Morgan was peaking essentially from 2010 till today. Whalen figures that TAG accounts for $200 billion of JP Morgan's deposit base or about 10% of total assets. So that additional cash provided a big incentive for Morgan to Morgan management to add increased risk because remember after all JP Morgan Chase needs to make a can keep assets and equity returns at the at a growing rate and if you have increased assets through increased deposits then you need to take more risk to keep keep up that return. Diamond told Congress that his bank was unable to deploy these increased deposits via lending. There just wasn't enough loan demand. So the liquidity instead was invested in corporate bonds via the Chief Investment Office. Whalen says insiders actually at JP Morgan have told him that his suspicions that there was a connection between the increase in TAG deposits and the speculative trading activities of the office in London is actually true. They've actually confirmed that conversation with him. Now according to the New York Times this spring JP Morgan had 30% of its portfolio invested in securities that are backed by the federal government either agencies or or or treasuries. Now this was a shift from the end of 2010 when actually that their portfolio was 42% of governments and agencies. Now by comparison Bank of America had 87% of its bond portfolio in government securities. So clearly JP Morgan was taking more risk in the government or in the corporate bond area. The time speculates that JP Morgan may have wanted to be a little more ambitious and earn more returns with its hedging program and of course the hedging program is made through the heavy use of derivatives price of these derivatives being linked to the value of corporate bonds and this is a quote from the New York Times. While the bank made both bullish and bearish bets with these instruments it appears that the trading strategy started losing a lot of money when the market turned against corporate bonds toward the end of March. Now JP Morgan's troubles or JP Morgan's problem with what to do with the excess TAG funds was actually mentioned by Thomas Lemke. He's a general counsel and executive vice president for leg mason and he was speaking on in on behalf of the investment company institute who is by the way against the extension of TAG. He wrote we understand that some are calling for congress to extend this unlimited insurance program beyond its statutory expiration date. ICI strongly opposes any such extension. We view the program as having the potential to dislocate markets and increase systemic risk in times of market stress by creating an unlimited taxpayer support backstop for these transaction accounts. Historically the risks posed by deposit insurance programs have been mitigated by capping that amount of the depositors account that is insured. Now in banking everything starts with funding. Funding creates the need for earning assets. After all this is fractionalized banking. You don't collect deposits and then let them sit there and guard them so that you know people when they come back for their money it'll be there. Banks do something with this money and hope not everybody comes back at once for their dough. So the Fed's zero interest rate policy actually has banks in margin rate under margin rate pressure. A flood of funding encouraged by this FDIC's emergency TAG insurance causes bank management to make even more risk for more yield.  But TAG has plenty of adherents and supporters on Capitol Hill. Senate Banking Committee chairman is Tim Rogers and he actually is a Democrat from the great state of South Dakota. He wrote a letter supporting extension of TAG. That's hardly surprising since Citicorp's banking operations are actually operated in that state or at least chartered in that state. Johnson's easily one of the most friendly members in Senate when it comes to pandering to the big too big to fail banks and it should be noted that the two big to fail banks benefit disproportionately from TAG. For every one dollar of TAG funding that goes into small banks four dollars will go to large banks. Indeed when small banks may have had a funding advantage actually before the crisis today large banks have the upper hand in terms of funding in part because of the FDIC's TAG program. Indeed the proportion of TAG eligible deposits held by the largest bank as I said earlier is almost double. At the end of first quarter of this year more than 75 percent of the 1.3 trillion in TAG deposits were held with banks of over a hundred billion in deposits. Less than four percent of the amount was held by small community banks with assets of less than one billion. So far from supporting economic growth as supporters of TAG suggest and far from supporting these poor community banks that's mentioned by Sheila Bear and others the FDIC insurance for TAG eligible deposits actually spurs the growth in too big to fail banks and it actually spurs unsafe and unsound banking practices by these same banks. In the case of JP Morgan the result was of the nearly 10 percent increase in their total assets and this flight to quality if you will encourage by TAG was a significant increase in the risk-taking at that bank. The need to degenerate returns on the flood of funding pouring into JP Morgan actually resulted in a breakdown of their internal systems and controls leading to a significant financial which I believe was five billion dollars or such and reputational loss of one of the biggest banks in the country. Now a similar increase in this non-interest bearing deposits has occurred at Wells Fargo Bank and what Wells has done with this increase in funding is an increase to almost 40 percent market share in the new mortgage origination sector and that's an incredible market share that has been encouraged by the fact that they have a vast funding advantage with the FDIC TAG program over their smaller competitors. Now as Wayland writes the half-point rate differential between Wells Fargo and the other mortgage lenders implies that this giant bank is actually taking a loss on its new residential production over time but what Wells can do as they originate these mortgages is quickly sell them off and make a quick gain on sale and that's really what they're after. Now the American Bankers Association or the Independent Community Bankers Association may cry for an extension of TAG to stimulate economic growth or jobs but TAG is simply another active government intervention in the United States economy that under the guys of protecting small banks and the banking public but actually the winners are the large banks small banks and the publics are net net losers. Now in a wonderful book Money, Bank Credit, Economic Cycles Jesus Huerta de Soto's wonderful book he wrote the various systems and agencies designed to ensure created deposits in many western countries tend to produce an effect which is the exact opposite of that intended when they are established. These deposit guarantee funds encourage less prudent and responsible policies in private banking. Since they give citizens the false assurance that their deposits are guaranteed and thus that they need not take the effort to study and question the trust they place in each institution. These funds also convince bankers that ultimately their behavior cannot harm their direct customers very seriously. In not quite 80 years U.S. deposit insurance coverage has gone from an inflation-injusted 41,000 now to unlimited so it's no wonder that the financial system while magnitudes larger has grown many times more unstable. William Seidman he was the chairman of the FDIC during the SNL crisis.   A return to sound banking would mean doing away with the swindle of deposit insurance entirely otherwise that financial nuclear explosion could happen anytime. Thank you.


Hey, what's going on guys RudeLinLinL here coming back at you with some more Python tutorials Let's fire up idle and see what we can do here. I'm gonna create a new script file.pythons Type in a shebang line if you're on linux create a new class There's a Create a constructor. I can test if this is the current script Had a random parentheses in there. We're gonna fix that Let's create a root object. There's an instance of our base class Now let's create a string variable here up inside the base class Let's create a self.string and we can set this to Tab tab some spaces in here. This is a new string Okay, so now let's take a look at the function that we're gonna be examining today This is something called lstrip and what lstrip does is it removes all the white space characters? Inside of your string That are at the front that are at the far the far this left position of your string So what we can do here is is try and test that out. Let's print out self.string.lstrip I'm gonna run this it says this is a new string, but if we had printed it out regularly self.string It displays the tab keys and a couple spaces. This is a new string So what self string.lstrip does is by default will Remove it the white space characters, but you could of course change this to be anything else as well Maybe we could change it to like any characters like q, r, z, and q, r, z, and s, q, r, s, and z in our case if you want to go in order And that isn't going to remove anything But if we had just some random q, r, z, w and that sort of thing It'll remove none of those because at the beginning you see there's this q here And that's not in our list of characters to remove so what if we move this q over to let's say the end of that string We only get this q here And it's removed the r and the z and the s and the w because those are in the character list That we're trying to get rid of but the q is going to go away What if we added a backslash t in there to see if it will remove the tabs and it will but it still has those spaces to work with So let's try and recreate this all on our own What we're going to do here is to find a new function. We're going to call this left strip and We're going to need self and the string and then characters We can change this to be None first of all And we can test if Characters is equal to none We're going to want to change this to an ASCII thing here. So let's go ahead and import our string module And we'll change it to anything that is white space Characters can equal String and we should change the string that we're passing in remember to string to look through Characters equal string and then we can change this to white space right here Great. So now when we loop through a string to look through we can do for Character in string to look through we can test if the character is in characters And if it is We can we can remove them and the way we would remove them is once again creating a new string variable for so we can do new string Create this here and then if it's in the new string characters Let's see Hmm. Let's try and see how we can do this because if we continue to loop through this and if we set new string Plus equals nothing That'll that'll remove all those characters all those white space characters And then if we did else and we added the character It'll remove things that aren't at the front of the string though So we have to try and accommodate for this and I'm thinking we could do this by counting because if we did this String plus equals character if we had ran that when we're done we return this new string if we print out That's a self dot left strip You can do self dot string here. We can run this and New string reference before assignment. Oh We should set that to be nothing first of all I'm gonna get rid of this this one right here See what this does it'll get through all the white space characters But even if there are white space characters Inside it it'll still remove them because we have these spaces here and we're removing them because we're only because what's only It's going through the entire string and we don't want that we only want that that first one So what we can do here is I'm assuming create a new counting loop. Let's try and comment this out and Let's see if we can try and invent a new logic structure here Let's do the let's get the length of the string can be the length of What we're looking for string to look through and we don't need a code block there That's just absurd. So we can now we can loop through that one. So for I in range of string length What we can do here is test if the character is In characters is in that thing that we're trying to get rid of or that risk the list that we're trying to get rid of We can we don't have to add anything to that string Plus equals nothing, but if not, then we know that okay something is wrong here. So let's do else, let's see We can break out of this loop though And we're gonna want to keep I though because I is gonna let us know where to begin from the next loop But we're gonna want to loop another time. So for K in range I in The string length and then we can add all those things that we would have missed So new string can add character or I'm sorry string to look through With the index of K. So let's give this a go Global name character is not defined. I see I'm sorry if string to look through Because remember we're using I to index now. We aren't using we aren't using character as a placeholder So string to look through an I and if that's in the characters, we can add something to it So now what this has done as it's removed all the white space It's in the front of the string here and this works perfectly because we haven't supplied a string Characters list to look through though But we're going to get the white space string that ASCII has applied for us So if we do import string in the interactive shell We do string dot white space All the things that are in here are going to be removed by default with our new function left strip But all these other things even if it's in there after it. It's going to be Removed so let's try adding a so adding a I think a parameter here left strip and then anything that's in our new qwrz s and Then a tab key and let's leave the spaces though Let's create a couple more here and then let's do SR WQZ and then a couple more Z's maybe an S in there and then we can run this and It has all these but inside of our string that we've passed to it It still only has the spaces because what we've done is we've looped through at once And when we've tried to get things that are inside that character list if it finds them It will remove them by adding nothing to the string character But we're still continuing that loop or at least that position with I and then if we find something that isn't part of the characters We will break out of this loop and continue to go from another loop Starting at that same position where we left off as and then we'll add all the characters that we found So this is going to let us let's see add to it in a different way So that it'll only remove the things that are in the front of the string or at that leftmost position And that's how you set things up. So let's try it with the let's try with the real string Let's concatenate on here a new line Couple new lines so we can see what the original is and then what the built-in function will do and that sort of thing. So let's do We set up QW RZS. If we run this They both display that same thing So there you go guys look at what we've created here This is going to allow us to remove white space or any other characters that we supply inside our strings And we've built this and took a look at the function in our own way And now we've gotten to something a little bit more advanced so you can be proud of yourself But thank you guys for watching. Thank you for sticking with me. I know this one is a little bit more of an adventure But hey, I'll see you guys in the next tutorial. Bye


Hey, I'm Shannon and I live in Hollywood, California steps away from the Hollywood Walk of Fame This video to me is a sensual session because I want to invite you guys into a very intimate place for me Which is my home and show you how I have curated a space that really reflects where I am in life And how I feel about myself as a woman and it's deeply personal I'm scared shitless for some reason, but I want to invite you guys into my studio Apartment so welcome to my home. My favorite part of course is the exposed brick and the real hardwood floors I think from that your interior design job is basically halfway done for you This is also my bedroom as I said the studio apartment is a little small There's a painting from Venezuela, which I just love on my heart and if we go over to the east wing of the bedroom You can see there is my wall unit has a lot of very deeply personal and cool things to me My almost famous bear rolling down the street smoking indos sipping on dinner juice. There's my journal and Picture of me and my mommy of course very important the phrase supernova or the word supernova Deeply personal and important to me my sex books along with my book late and then other cool books Just personal development books. This is something I absolutely love about my place I have a projector and all day long I play sounds of the rainforest and videos from the rainforest Tranquility every in the east wing now We have the vanity area which has my favorite saying right now impatience is a virtue I read that every single day and reflect on it and this is my getting ready table this I'm super proud of actually refurbished and respray that myself and this mirror. I also restored myself This is my workbench area the roof the roof is also my workout. It's my gym. It is my meditation zone I'm up here all the time. It's my favorite part of my whole apartment. I'm not supposed to be up here really But I'm up here all the time low-key. Okay back to the apartment. Welcome to my walk-in closet There's my wig for all you guys who complain when my hair is straight. I just don't really do my curly hair I didn't straighten my hair. I'll just put a straight hat on so move on and these are my clothes and my babies my little shoes Well, not little I'm size 10. All right The tour continues over to the other side of the east wing and this is a super cool product I want to show you guys which is a scale from vanity planet, which is a hardwood floor base It has an electronic digital display on it. I love it It's battery operated on my description box and you can find a discount promo code to get this exact same scale in your home All right bathroom This is where all that shit go down my favorite part of the bathroom is a window a bright beautiful window I think that's luxury to me and I have a view of a palm tree Which I just really like when I'm just doing my business in there just looking out and reflecting on that My two favorite things also exist in the bathroom, which is my favorite plant I don't know why plants grow really dope in here. You can have your own theories on that and This company called come clean soap made a custom soap for me. Yes, that is a sex dice soap So I love it if you guys love it to go in my description box You can find a link to that site and you can buy your own soap or buy that soap that I showed all right over into the West Wing This is my kitchen slash office area. This is my dry eraser board wall I'm very proud of that you can go to Home Depot and make any wall into a dry eraser board Which I super recommend for any creatives my workspace also of course has pictures of my family because it's my office And that's what people be doing in a office.  I've also got my Degrees and diplomas up on the wall. There is my associate in sex education from the Institute for Advanced Study of Human Sexuality I'm working on my clinical sexologist, but that is not there yet and it should be there soon There is my diploma in print journalism. Oh, she's so smart Oh another cool thing I had all of my best friends write their favorite work inspired quote here So I can look over and feel inspired by the words of shameless Maya and Margarita and my homie Ranji and my other best friends in Los Angeles the kitchen is a very important place for any developing adult I think especially for women. I'm gonna be sexist and say that it's where I've kind of learned and cultivated my Right to nurture especially myself. I've been throwing down in this kitchen. There's some blackened lemon salmon risotto Which is my bomb signature dish I make a sick risotto if I do a pasta I do an olive oil and vegetable pasta and Artichoke which makes the world go around of course macaroni and cheese because I love me some carbs and cheese So that is my office slash kitchen I spend probably most of my time when I'm at home in this area and secondly I spend the rest of my time probably in my living room slash Bedroom see how we multifunction here the other room is vanity slash bathroom It's it's just like a really economically savvy space Speaking of economically savvy this coffee table was so cheap and I love it It swivels and I have my best friends on display and their dope work on there So I'm just a proud mama all around my apartment is hella old Which means there is ridiculous amounts of storage and I cannot fill it up But it's really great for that and that's it guys that's the end of the tour Welcome to my humble abode Just just a little girl from the six trying to make it out here in the big pond say what up at night time though At night time though it gets turned up I put the projector on and you know I feel myself I get a little sexy and one of my best friends from Toronto music playing in the background This is 1985 and his group division now 1985 produced hotline bling He also produced just hold on we're going home truffle butter and now he has his own project So go into the info box and get the link to his SoundCloud and now that's officially the end of the tour People told me that wheat is not addictive and it very much was addictive for me