My training squad over here, so they're just going to help me along. Is the audio okay? Louder! Louder! Okay. Louder. Always louder. Okay. In case you didn't know, I'm here to present on this polymorphic shellcode engine that I developed for UNIX systems and stuff like that. It's... I'm K2. There you go. K2 for president! Thanks, Joey. Now, the target here that... The whole point of this system is to allow you to bypass network intrusion detection systems without being detected, basically. Now, most of these systems here, at least for today, they're based on signature analysis, quite similar to a virus scanning technology from years ago. So they rely on hard-coded databases that they query for suspicious patterns. So if they see an IDS vendor will perform an attack, log that attack on the wire and see if they can come up with a mechanism so that they will be able to identify it at any time. Some of the drawbacks of this system is that they require quite frequent updates. As you can imagine, I mean, splice are written every five minutes, right? So, you know, you've got to update these things, keep them current. And that's kind of an ongoing battle. Whenever something comes across bug track, someone's got to go and identify whether or not this vulnerability is actually real and then generate some kind of signature for it. These systems analyze data on the wire in a serial fashion. So, I mean, from beginning to end and try to match it against known systems. Some other probable ways that they could go about it is protocol analysis. Now, you've got your intrusion detection system, and it's going to go, okay, hey, this is my web server. It should only be performing a certain amount of functions, right? So when I see my web server, like connecting back to the client, you know, that might be something suspicious, right, depending on like their particular configuration and whatever, right? So that would be a bad thing. Also, some things on the horizon appear to be statistical analysis intrusion detection systems. Now, these systems are primarily engineered with the assumption that network data over a long period of time is so similar. And what that means is that, you know, a finite sample of like a week-long worth of like traffic patterns can be extrapolated to like, you know, an entire year, and it should be fairly similar. So if these systems get going and you're able to identify good traffic throughout the entire thing or process in the long run, they should be able to identify any statistical anomalies based on that baseline. Now, these things are under development, and I really don't know any IDS vendor that really has something of that kind of quality or what have you. Some of the invasion techniques that are currently employed by people are primarily on the network layer. Now, this would entail stuff like IP fragmentation to confuse the intrusion detection system as to what the traffic is going to end up looking like when it arrives at the destination host. As many hosts reassemble fragments in, you know, various manners, and they might overlap in certain ways. So, you know, some of the ways to defeat these systems in the past has been just to like overlap your packets or send them out of order, do what have you. A lot of these IDSs, some of them don't even look at fragmented packets. So that was always like a really good way to get around them. Excuse me. Probably be something like spoof data, right? Like if I don't want the IDS sensor to know where I'm coming from, you know, that sure does aid. Sure, they might see what I'm doing and pick up the data, but it doesn't really matter if they can't tell where I was coming from. I suppose, right? I mean, that helps out in certain ways. And also, you could spoof the origin from some ignored host, like a DNS server or something like that that might have some special properties within the engine of the IDS, right? So it goes, oh, if there's some traffic from this host, let's just ignore it because it's so chatty. Some other things that we've got here that have been explored quite heavily is on the application layer. And this primarily is in the realm of data obfuscation. And what we're talking about here is, you know, with something like Unicode, there might be like a half billion ways to print the letter A to the screen, right? So if your split depends on the fact that you've got to have an A there and the IDS is just kind of geared towards an ASCII character set, which is kind of like a subset of Unicode anyhow, it might miss some kind of like more advanced encoding mechanisms that you might use. So again, this is another problem of the IDS, right? I mean, they've got to account for, you know, God knows what the end system of the attack is going to do with this data, right? Does it support Unicode? Is this Unicode? Or is it just going to interpret it in a different manner? So I mean, these are really hard things for the IDS to kind of understand. You can use things like alternate character sets or what have you kind of along the same lines as that. And another technique that you could possibly use is data encoding on the application layer. And that's pretty much what this particular utility is all about. We're going to encode the data in a way that every execution of it coming across the screen is going to be unique. So in essence, your splits are always going to be zero-day regardless of signatures, right? Because the signatures are designed to analyze a specific code and, you know, they're only good once they can get it into the database. But if you're able to have new codes every time being generated on the wire, then, I mean, it seems reasonable that they won't be able to detect it. Essentially what this utility is going to do is work with a buffer overflow exploits and it can possibly be adapted to format strings, any kind of shellcode or binary executing stuff that you're going to send across the wire. It should probably be able to help you out with. I assume that most people have a fairly good understanding of buffer overflows and, like, you know, there are, like, weekly talks on this. So, you know, you can just... I hope that you guys have at least read a paper or something. Now, you've got this beast that we all call shellcode, which is essentially the arbitrary commands that we're going to be sending to the target system. So, the shellcode is encoded prior to the launch. Each encoding, therefore, is unique. And, you know, we're able to bypass signatures. The decoder, what we have to do is once we encode the shellcode, obviously it isn't going to function when it lands on the target system, right? So we have to prepend that with a decoder. Now, this decoder itself will process the data after it appears on the target host. So, unfortunately, a lot of splits are written so that when you jump from into the knob section, you know, hopefully they wrote it good enough so that, like, they're jumping fairly close to the beginning of these knobs and not just, like, right, you know, right at the end and they just kind of coded it and it worked and they said, okay, killer, there we go.  So your shellcode is effectively, like, you know, increased in size. So, I mean, even if the network intrusion detection system were on the host that was being exploited, it would not be able to detect anything because this is all happening on the application layer. And, again, signature analysis, you know, it should be able to, should be unable to match the shellcode or the decoder or the return addresses that are normally placed at the tail end of your buffer overflow. This is because I incorporated a number of primitives to modulate the return addresses based on your tolerances and stuff like that. The decoder itself, also, is in a polymorphic form. Now, polymorphic is essentially the ability to exist in multiple forms and be functionally identical. So, you know, we'll go into that a bit later on. Oh, by the way, I mean, anybody feel free to pop up and ask some questions. You know, I love interactive crowds. It's extremely polymorphic, you know. Well, currently, I only support one decoder because the encoder is in C and it's in the API and it encodes it and sends it out. And I've just been concentrating on making it cross-platform rather than adding, like, you know, tons and tons of bells and whistles to the decoder right now. So, I'm trying to get it across the platform. Well, you'll see. It had...  Actually, I just added... The question was whether or not I have genetic algorithms based to detect, you know, to breed new decoders which are able to survive in the wild. Right? Not currently, you know, this is on the horizon, right? Well, this is just the public version, Joey. Come on. Okay. I think we had an electric... You can configure that to your particular tolerances, right?   So, it's fairly... Pretty much up to you. Yes? Oh, really? You made me skip my slide, man. Real men. I don't use knobs. Now, the attack payload of a buffer overflow, just a brief overview, typically consists of these three sections which we've got to, you know, take a look at. We've got this knot sled, which is the initial portion.  Now, these three individual sections or what the IDS is will, you know, be focusing on, you know, one of these three. That was the Canadian beat. Also, format strings again, and we can adapt this for their use later on. Knot substitutions. Currently, the Knot instructions at the beginning of the shell code are substituted. Now, we've got an extensible list of possible replacements that can comply to whatever restrictions that your particular code needs to adhere to. For instance, if you say, I need two upper compliant code, two lower compliant in space, or I've got various banned characters that appear in the generated shell code, this API will automatically generate that for you. So, if you've got, if you don't really have any skills to like write that code yourself and you just want to cut and paste, you know, you can try and see if it can identify a sequence that will generate the code for you. But the more restrictions you place on the encoded shell code, the, you know, obviously, the less permutations you can actually form, right?  Just because of certain restrictions in the exploit. This note is primarily for Intel, the Intel architecture. Traditionally, guys coding Intel stuff don't really have to worry about the alignment, which is like where you're going to jump into the knobs. So, if you're jumping in there and traditionally it's only a one byte knob instruction, if we enable like multi byte, you know, instructions to be in that section of the shell code, you know, there's the possibility that you're going to jump into the middle of an instruction and not going to be able to execute in the way that you normally would. So, but I mean, I would encourage the use of multi byte knobs because, I mean, this greatly increases the, you know, the amount of codes that will appear within that section. I think I've got about 28 right now. So that's 28 out of a possible 255. So like a little better than 10% of, you know, character space will be available in that knobs section. You know, I've heard from statistics, you know, degree guys that, you know, this really isn't quite what you need to have to be statistically resilient to analysis. So if you enable these multi byte, you know, features that will allow you to have virtually limitless amount of characters appearing within that ops led. Okay, now, Joy. Is there any ideas which is like not plain basic stupid? No, they're all pretty dumb. They don't really have the current ability to analyze the instructions right now and see exactly what they're doing or the data per se that I have seen. Oh, the question was if I have seen any ideas out there which can actually intelligently analyze the data sections of these attacks and actually kind of understand what they're doing, kind of, you know, maybe similar to some virus scanner stuff which can actually analyze the data within like, you know, applications or what have you and identify a polymorphic attack or identify some kind of virus signature. Now, the basic assumption that we've got to make is that there's always more than one way to do it, especially in computer science, right? I mean, you know, how many ways can you like get that X equivalence there, right?   So, I mean, if I needed to calculate Pi or I needed to calculate X there, I could alternatively select, you know, one of these mechanisms, you know, the decoder itself. It isn't just one decoder. It's like a decoder with like a tree kind of system that can alternately select which way it's going, you know, on a random basis. And you can extend that if you feel that you've found another way to like add one to a register, you can just kind of like add that instruction in there and, you know, it can do that. There are also alternate instruction paths so that, you know, if we need to calculate N, we can use, you know, various values that we have also to calculate that. There's a read me with the distribution. If you read the read me, it goes into like a little bit more technical details of exactly what's going on. And of course, you can always just kind of read the source. That'll tell you exactly what's going on. I clicked already, but this thing's kind of lagged out. Non-operational code padding. This is the euphemism that I use to identify this expansion here. You see L plus A plus M equals E.  So, you know, we've got lots of these non-operational padding instructions that'll appear in there. These are the things that you will tune to your likeness.  It's your tolerance. The more pads that you incorporate, the more space you've got to take up on the knob sled, right? So, you basically got to tune that feature ahead of time. This is kind of what you were talking about earlier. Also, this padding is randomly generated based on your specifications in the API, right? Like, if you say no, again, the same thing, the two upper, two lower is based kind of stuff or carriage return, whatever.  Things like that, you'll be able to automatically generate. Man, it's hot here. Oh, yeah, I've got some new functions in this release. I actually initially released this polymorphic API at the CANSEC conference over in Vancouver. I guess it's like Dursec also, www.dursec.com. You can, right now, the decoder also can appear in like a out of order, you know, function. So let's say there's five operations that you need to have to decode the payload. What you do ahead of time is kind of like set up the structure and define what positions each instruction can enter into. In this case, as you can see, one, two, three, four, five, you know, one, three, two, five, four. So, you know, if you need to, so long as you're not altering the algorithm itself, right, a lot of instructions can appear in virtually any position. I also added a weighted knob slide. So if you have got like a hard on for like, you know, printable ASCII characters in your shellcode, you can like wait those knobs to like a certain level. Hey, hey, quiet, quiet up front here. Yeah, I got a real hard on for printable ASCII shellcode. No, so you can say, I don't know, like if you had, if you were attacking something over like a CGI listening on a web server, right, and you know, HTTP traffic typically has a lot of these angle brackets and stuff like that and whatever else quotes and this double quotes and whatever else, right? HTTP, you know, those characters. You can kind of weight those to whatever values you want. Also, this weighting will increase the variance in the API itself, right? So if you just kind of go in there and randomly weight everything yourself, that'll pretty much mean that yours is a custom copy, right? And the codes that it generates are going to be like more tuned to your preferences rather than the default, default one. So I mean, if anyone, if any IDS vendor actually does create some kind of method to detect this, you should be able to effectively weight everything out and presumably, you know, to your liking, it'll still be functional. But again, here, you know, we, there's occasionally the requirement for certain shellcode restrictions in your attack, right? So you're going to be going along and you find out that your split requires to upper to lower his space or like any special cars banned out of this, right? So you just kind of define that in the, in this structure, you say, like, you flip some bits and you say, you know, hey, I want this code to be to upper resilient or to lower resilient and it'll go ahead and do that for you. If it doesn't, you know, then it'll tell you. Currently, right now, I've got a 32-bit key that I use to encode everything and that's just kind of like applied, you know, against everything one at a time. I don't chain it or anything like that and like, you know, any kind of crazy stuff. I feel that that's enough. It allows you to create a lot of permutations of the shellcode and, I mean, it's really difficult to detect. Again, I've got return address modulation, right? So, I mean, if you feel that, I don't know, I mean, if the IDS vendor has a signature that'll detect against that, you know, you can enable that and that might help out. What I was thinking about, I was, you know, I was thinking about implementing a sliding key. So, you know, as you kind of encode each section, the key changes and the variance gets increasingly, you know, you get a lot more variance in your encoded shellcode. You know, possibly can the sliding key be used to generate normalized shellcode to the protocol which you're attacking? You know, possibly, right? I mean, I'm sure there's a way if you could develop an algorithm that can do that, you know, your decoder might be a little bit bloated or big, you know, I don't really know. I haven't put too much effort into that right now, but there's definitely the possibility in the future, right? No matter what, there's always a way around, you know, any kind of detection mechanism that anybody has. I believe, question back here? Yeah, exactly, right? So, the default weight of the members of the, like, decoder or the knob substitutions, right, is just one.  Yeah? Well, you know, that's a possibility, right?  The current implementation of this API, of this engine, actually, I created an API for exploit developers, which is extremely easy to integrate into any split.   You need to be able to figure out exactly, like, where the boundaries are in the shellcode itself, right?  So, you know, it's really easy to integrate in source form, at least, into any exploitation scripts that you got, right? And I've also got a filter application for existing exploits.  You can just pipe the output into this filter and then you're going to have to, you know, select a few options. You're going to have to tell the filter, like, okay, the knob used in this blade is, like, X90.  So, it knows when to stop encoding the shellcode. So, with those two things, it kind of knows, okay, this is how many knobs I've got. This is how much shellcode I've got to the boundary of, like, the return addresses and whatever. We currently support IA32 Spark and HPPA. I tried to, I actually limited all of these to, like, the most basic instructions that's possible. So, like, you know, Spark V8 and HPPA risk 1.1.  I'm sort of planning to do some MIPS PowerPC and Alpha work. I don't know. It's kind of up in the air right now.  Right? Pretty basic. And that's all you got to do. Countermeasures, that was the last slide. I don't know. There could potentially be some countermeasures for this stuff. I heard some Sourcefire guys or Snort guys talking about some specific demons that they could monitor on the wire, like, to detect all these patterns and what have you. But, I mean, I'll believe it when I see it. Sorry, guys. Yeah, K2.ca. www.KTWO.ca. Apparently, this is an older version of my slide presentation. I knew you used to have that in there. Sorry. This guy over here.  What's my name? What's my name? Self-mutating encryption generators and stuff have been, like, there for a long time. But, for example, like, if you're doing, like, an enterprise-wide scan, an anti-wire scan taking 30 minutes is not a problem, but an IDS is, like, more or less real-time. So, there is a practical inherent limitation in modus operandi when it comes to IDSs and anti-wire software. So, what I'm trying to say is that the techniques you present here would have, actually, a practical limit when it comes to detection in terms of anti-wire or IDS software. So, what do you think about that? Um... Man, I've got some serious power problems over here. Well, I'm sorry. Um, I just need... You can, right? And, I mean, another benefit of... of, uh, Sploits in the Wild using this kind of technology is that you're going to increase the, um, you know, processing power to identify what's going on here, right?  Holy Jesus, man.  Like, if you need to brute force an offset of, like, a respawning daemon or whatever, right? And you've got only a small window to attack in. Um... I seed the random number generator with, uh, the current time in seconds. And then I add to that the, um... add that, um, the current... your tick register, or the lower 32 bits of your tick register or your CPU.  Like, the interval between... at which you're going to re-enter the function and you're going to grab the, uh, the tick register is always going to be slightly different on a multi-tasking operating system, right? So, I mean, at one time, it might have taken, like, 500,000 cycles. At another time, it took, like, you know, 500,000 and one cycles, and that's just enough to, like, generate something different. Joey? Yeah, I mean, I think, like, my company antivirus and anti-doctrination and antivirus has actually addressed these issues in terms of antivirus in the past, but in the future. Don't you see, like, there's a fundamental challenge you have answered here?   Yeah, definitely. I mean, the amount of processing power that's required to identify... Joey was alluding to the fact that this is a paradigm shift in exploit development, right?   Sit there, memory resident. But as soon as polymorphism came along, it's kind of, like, enabled the viruses to have this endless cat and mouse game, you know, going around in circles forever, and, you know, that's still going on today.  Like, ideas can just barely handle gigabit right now, so, I mean, I really can't see them and doing virtually any processing on the data. I know. Hey, box, we'll detect it right now.  It's in this structure, it's the last member, it's the last integer in the decoder structure, in the junk structure. Just as a hint. I've got a demonstration here that I intend to show. It might have some surprising results. I've got real secure, a little secure, analyze this. You're really secure from now on. Here, we've got the real secure console. Speakers come up here and beat me if you really want to talk, because I don't know how I'm doing for time. 20 minutes? Okay, I'm just going to grandstand for 20 minutes, if I can. Okay, I'll just be a second. I'm going to set this up here. Essentially, what I'm going to go over here is a couple of things from this Linux box to this Linux box.  Stupid. Stupid. Okay, let's see here. Okay. What I'm doing here is I'm going to imitate the IMAP protocol and, you know, some kind of integer login space. Login data. Quotes. There's some quotes around that login data. And then you say pass. This is what, you know, a typical IMAPs plate would look like. And I'm sure we've all seen those before.  And we'll see what over here, what real secure does about it. Oh, whoops. This here's the new version. Real secure. Did its job and secured us. Thank you, real secure. It is a, this product does actually work, you know. Suspicious TCP packet from the address here. Essentially what I'm going to do is go through here, here's it. Let me give you a little background on why I'm, you know, going up against real secure here. Initially after the CANSEC conference or DRSEC, like www.drsec.com I, I, everyone started chatting about this a little bit, right?  ISS released this big advisory saying, hey, we're not vulnerable. This doesn't work.  Could you please send me, this is my quote up here. I had asked for some technical details, TCP logs, et cetera, of an attack that was detected, but none could be provided. I have put it through some testing and I have found that it's most definitely vulnerable to these techniques. Okay. These are kind of taken out of context and responded back to this ISS.net mailing list here by, let's see here, Tim Farley at ISS. Thank you, Tim. He took me out of context here. Later on here he's going, oh, this guy, me, admits he doesn't know what real secure is supposed to detect in the first place, hence the request for the TCP logs. No, Tim. I have logged so that I can verify what the hell is going on and verify that you guys actually did some work, but none could be provided and that's what I meant that, he concludes that because it didn't detect something he threw in front of it, it must be vulnerable. No, no, no. Well, yeah, man. He goes on here to, this product does detect a lot of stuff. I don't want to give him too bad of a name here, but it does detect buffer overflows just like he's saying. It has a generic buffer overflow signature which attempts to identify hex 90 in your data. But as we saw just now over here, it actually has a specific IMAP signature. It's not the generic Intel signature. I can show you that in a minute. Real secure is not designed to attack to detect attacks by recognizing the shell code. Okay, Tim. Well, anyhow, he goes on, I conclude that you use something that we don't have an XPU for, I don't know what XPU means, but apparently it's something. Okay, two days later, by the way, this is all going on in a mailing list that I'm not a member of and I didn't find this out until months later, so I didn't have a chance to respond to any of this. But luckily, I was doing a Google search of my name and Newtate, so I was like, yeah, yeah, let's see how popular I am. And I was like, yeah, yeah, yeah. No, but someone CC'd me this. I disagree, you've left out these key steps, right? This is from Tim again. Tim Farley, ISS Atlanta, T Farley at ISS Atlanta. Tim Farley, ISS Atlanta, T Farley at ISS.net. Apparently, his phone numbers have changed, so no, actually, I've actually heard also that Tim is no longer with ISS after, and this is just like two months old, so apparently, I don't know, there might have been a little abrasion there because he's really abrasive towards me. So he left, he concludes that I left out some key steps that I don't understand the scientific method, apparently, right? So attempt an unmodified attack right here with the IMAP overflow. Verify the IDS response to it. Okay. Suspicious, yeah, I'm out. Okay. Attempt the modified version of it. Okay, okay, okay. Thanks, man. He just worked himself right into this. Okay. What I'm doing here, I'm doing the same thing I did before. You can't see that? I'll get a second version up there for you guys. There you go. As you can see, M7, like my favorite song, anybody know what M7? Magnificent 7. Apparently, what you do with it, this is the filter application, so it's going to take that same EXP that was run up there for, short for exploit. M7, I'll give you the help for that. You've got these four options here. ISM or H, short for Intel, Spark, MIPS or HP. MIPS doesn't even exist in this code. I'll just put it there for fun. I had the intention of coding that at the time when I wrote this. Now, and then what you do, you select your architecture here. As you can see there, I did dash I. This is the Intel overflow. And then you do dash O, the offset. So you tell the filter when the offset values are going to, so it knows when to stop encoding, because you don't want to encode those. Dash and Knop, you've got to tell it what particular Knop you used. I know everyone uses 90, which is the official Knop, but there is the possibility that someone used something like the capital A, like cheese does all the time. And then you do dash X exploit, or you could run the exploit pipe if you wanted to, because it accepts standard input. If you don't do that, I just did that for fun. And then in some other things here, dash U, dash L, upper lower code, dash B, give it a string that's your string of band characters, dash C, that'll output a C style array that you can just kind of embed in some other code, or you can take and analyze somewhere else.  So you can 9 times out of 10 truncate this thing by 1 or 100 bytes, and it'll still function. Dash P is to pad the encode decode length. What this is, say I generated a decoder, but the jump offset was a band character, you might have to tell this filter application to add some more bytes in there in the decoder so that you're not landing in a band character, like a two upper two lower space character. Dash U is an attempt to modulate the offset back into the knob slide. This can be dangerous, because your exploit might not work, because, you know, you could jump out of range. So, we're going to go through here and run this new exploit. So, oh, this guy is not a marketing person, neither is Chris Rowland for that matter. Chris Rowland actually made the initial response that ISS isn't vulnerable, and he is an engineer, apparently, and he has written many of the signatures in real secure, so apparently he's really in the no guy. Oh, it's a two-way street. Well, by the way, I actually did send this code to ISS ahead of time before the public release, and they had a chance to analyze it and everything, right? So, I kind of see that as a two-way street, and they didn't provide me with their logs, which I would have seen as a two-way street, so I see some friction there. You know?  I mean, I didn't even know this was going on, and it was named, so here you go. So, let's do this. I map overflow and see what real secure has to say about it. Sensor error. I didn't know this was going to happen. I'm sorry. No, I'm kidding. Apparently, we just generated an exception fault. An exception encountered in function X1004E 360 in packet hash table, packet proto TCP, packet TCP UDP hash, 000143. So, apparently, I don't know. Let me think about this. Oh, okay. This appears to be, I don't know, man. I think, for some reason, real secure is attempting to diagnose the essence of the protocol here and figure out what all this means to it. No, I feel great that, like, my packets mean a lot more to it than the I map did, and it's thinking a lot harder about what to do, and it kind of, it just couldn't handle that, and it caused an exception. So, okay, let's see. I know I was thinking about that, dude. Oh, I flashed myself. So, we'll do it again. Another sensor error. So, this is a reproducible error. It looks like, well, well, I mean, I think this might be exploitable. You know, it just seems to me, yeah, my laptop thinks so, too. There you go. I think that he's thinking a lot.  Let's get the new one. Okay. Similar kind of thing, hash table, blah, blah, blah, blah, exception, encounter, calling this function that it can't resolve the name of that, so I'm assuming that it's overwriting some kind of function pointer, something like that. So, you know, if we could take, if we could make some intelligent use of that, instead of just kind of random, this is designed to be random, and I mean, if we made some intelligent use of what that randomness was coming over here, you know, we could direct the instruction flow of real secure. Possibly. I'll set up another demo here. Just take a second. I flashed my under. Let's do it on another port. Explain this in a moment here. I'm going to send it to port 110. Okay. Tim, Tim, send an unmodified version. Hold on a second. I just put that up there for the guys in the back. Come on. Give me a break. So here's the unmodified split. Hold on a second. Real secure. I'm sorry. Let's try that again. Let me start real secure, you think? I tried it before and it didn't have to be restarted. I think the deal that this is crashing in is like, you know, it's shit's resolved when it's processing and it's able to handle it. Let me just try one more time. Let me get rid of this quote here. By the way, if you're making a pop three split, apparently put a quote there, No, I don't know.  Okay, okay. Let's try that. Stop. Sorry for this lag, everybody, but you know, it says NT I'm dealing with here. Bless you. I thought this was NT four for a second. There we go. Okay. Okay, we restarted that. Okay.  Okay. Let's see. Connecting active. So, I mean, you can all see what this does. User exploit code going to port 110 of the vulnerable system that we saw events happening before. So, bless you. Oh, it quits on. Oh, I know what it might be. Here. I think we might need a space in there. Actually, catch this before. Let me try a different port. We'll try the FTP port. Apparently, real secure is having a hard time. And we'll just let it have that hard time on a four meter wide screen. As you can see, I would have demoed, if it would have detected something, I would have known how it would have not detected something following that. But, yeah, I'm having some problems. I could do it. I could like, here, what I can do, I'll do the IMAP one again just so you can see all of you guys here can see that the scanner is actually functional. Okay, so, you know, I don't know why those other ones weren't being seen whatsoever, but who knows. Let me do them a favor. Let me check my policy and make sure that I've got all the policies going on here. I'll just do this in front of everybody so there's no question in anybody's mind what they're doing. This is version six, by the way. So it just came out the other day. Seriously, I was trying to run my demo and then they released a new version on me and I was like, oh no. Okay. It's like, why the sensor? No, it's not letting me click apply the sensor. Does anyone know how to use real secure? Okay, this thing could just be foobar. I mean, we could have just crashed enough stuff so that it just can't handle what's going on anymore. I don't know, right? I mean, I'm trying to apply this stuff. Any other questions as to how this is going to function or anything like that? Okay. Oh, yep. Good question. In terms of the decoder section itself, he asked how much randomness do I expect to have out of the decoder? Well, here, if you see right here, when I ran this code just now, it deduced that this here is the original payload and all of those blocks there are hex 90. Over here, we've got the fabled NSH, so anyone can see that. It figured out, okay, I've got this much to encode, blah, blah, blah, blah. Almost nearly 3 billion, so nearly 3 billion possible outcomes. So that's 3 billion parts of, you know, 3 billion shellcode permutations at least. Here's the encoded shellcode. Oh, man. This monitor isn't working in front of me, so I've got to go off the big one here. But here's the key we used, A2, blah, blah, blah, blah. And here's the encoded shellcode here, 54 bytes long. The order of everything went 0, 1, 2, 3, 4, 5, 6. Oh, 6, 8, 9, 10, 11, 12. I guess I can't see where 7 went either. As you can see, yeah, it's off to the side. As you can see, it's out of order. If I were to do this again, it could be in a different order. And the hard-coded value that I used is, I hard-coded a 42, a D, and this and that. You see that the D there is a character that you might have had to use that P option to pad all this out with. Here is the decoder engine itself, 73 bytes long. And here is the actual polymorphic shellcode. So this down here has this up here prepended to the front of the stuff. So let's run another one really quick. And we'll see that the last one was 73, this one is 66. So I mean, that's a fair difference. And the order here is 0, 1. Yeah, the other one went, if I look up here, it went 0, 1, 2, 3. Yeah, I don't know. I mean, real secure didn't cash it or something. But 0, 1, 3, 2. So now you see that 3 and the 2 are out of order. 4, 5, 7, 8. And the 7, 8 are in order. And the 6 is out of order, all this stuff. So you can see it's kind of out of order. The hard-codes are all different. The length of this stuff is all different. You can go in here. Yeah, question? I'm using a simple x-word with the key. What was that again? Yeah. Why is that? There's an even number of... It's image you are seeing where you generate a lot of multiple encryption generated and a lot of garbage instructions. Okay, I see where you're coming from. But you can... Every 4x block. Every 4x block, yeah. Yeah, it's the same key, actually. Yeah, I'm thinking about using a sliding key. I mean, that's kind of the reason for that. I mean, this is just to evade current and network encryption deductions. So I mean, in the future, if anyone does detect it by a mechanism like that, I mean, we can go ahead and add a couple extra instructions. The problem is, is I really didn't want to take up too much of the knob sled. Right? And I mean, any... Every additional instruction I use potentially is like in another few bytes of space, right? And I mean, this space is at a little bit more of a premium than it is even in the virus-coder world, right? I mean, because like, you know, one byte could mean the difference of getting root and not getting root. So I mean, I just don't want to make it too overly complex to start to begin with, right? So I guess they could do that. Give it a shot. See how it goes. See, right here, we say the maximum amount of non-operational instructions. By default, I use a 4. For Intel, Cisco, CPUs, I found that 3 to 10 works really good. But for risks, you should probably try and keep it to 2 to 4 because in the risk systems, it's always a 32-bit value. So I mean, that's 4 bytes at a time. Down here. Here is the... This function itself is... This here are the knob replacements. So basically, this is a regular knob. This is a multi-byte knob that you can replace it with. This is a single-byte one. These values here are all defined in the other header file. You can look them up and figure out what it means. But this last value here is the weight. So this one is like a 2. And what? This might be an old version. Anyhow, this is the weight here. Oh. Or this is the weight. I don't know. Whatever. Look at the other header file and it defines what everything is. And you can figure out what all those integers mean.  Any other questions? You want to compare them and see if they're identical? You would prefer that they're different? Yeah, but there are some sections of this code that are static. So, I mean, they are... Okay, 1,004, E, 6, 0. 1,004. 1,004, E, 3, 6, 0. Yeah, it looks like it's the same. Okay, well, yeah, I mean, that could be right, right? But I mean, there's a lot of static data also. And I mean, it could be reading the offset section, which is the same every time. Or it could be... I don't know what it's doing, right? I mean, I haven't fully debugged it, but apparently we're smashing something. Right? And if we're smashing something, then that usually isn't the best thing to have go on. Especially in the IES, yeah. As you said, duly noted. Any other questions? Question? Yes? Question was, you know, hey, are we going to have lots of stuff that will generate a split and exploit the target system and the IDS simultaneously? You know, hey, that's definitely a way we might want to move. Re-code any binary app? I don't know, man. I don't think too hard. I mean, everything's pretty modular and tight, you know? Anyone fairly familiar with C should be able to, like, you know, do whatever they want with the code. I like to think that it isn't too sloppily written. You know, there's a couple of global variables that, like, my teacher, my profs at some school will get pissed at me about, but I kind of need those. I like globals. Anybody else? Yeah, I'm just wrapped up. I'm just doing Q&A. Okay, yep. Pardon me? K2.ca slash security.html. Anybody else? $5, all right.  Okay, thank you.


What's going on, everyone? Sam here with late sports card, Drippin' 21, 22, Panina Revolution, basketball, Chinese New Year, 8 box, case break, number 7, random team style. There's a look again at your random results. As always, you can find these on the website under the results tab, as well as the link in chat. All right, guys, let's get mosaic filled up. That's the next break to go. Just the Pacers, Thunder, and Wizards left currently. That is it. That is all. Revolution, Chinese New Year. New Year parallels, as well as our greens, number 288, and 8, as well, around 12 Chinese New Year parallels. I think so, yeah. You'll see. Probably like four or five of them, probably, whenever a couple boxes. That is Austin Reeves, New Year parallel. So New Year's is pretty much the correct size. Basically, you get like one pack. Quentin Grimes, Julius Randall. Nice. Austin Reeves, that is one of eight. There you go, Lakers. I want a Louis C. Congrats, man. Getting MVP chance right now. Congrats on that, so I guess they're not green. The 88 is green. Those are just regular ice. That's nasty. That's really sick. Miles McBride, Shreve Cooper, former five-star recruit. I know a really good time to get that. I would mag it, actually, I think. Really nice there. Congrats, Mellow Anthony. Congrats on that one, Louis. There you go, buddy. Again, guys, we've got just the Pacers, Thunder, Wizards left in the next Mosaic break. Stavion Mitchell, J-Val. Joe Taken the Thunder, thank you, Joe. We're down to just the Pacers and the Wizards. That is it. Both on sale. All teams are on sale. We do have two more Mosaic PYTs after. Trey Murphy. We do have two more Mosaic PYTs after this. And those are both on sale as well. Another 10 bucks Tuesday basketball. That's almost sold out. So thank you, guys, there. Miles Turner. You know it, Louis. Hollow gold. That's what it is. Thank you, thank you, thank you. Michael Porter Jr. The guy who is allergic to passing, Michael Porter Jr. Just Scotty Barnes, Moses Moody, Tyrese Maxie, Brandon Boston Jr., and Kelden Johnson. I don't think so, John. I don't think there's autos in these. There is in regular, obviously, and there is in T-Mall, but there's not in Chinese New Year. Oh, does it? I was going to say, I don't think I've ever seen an auto come out of this. James Book Knight. Probably similar to like Illusion's T-Mall, where it's like super, super rare, but you don't get them a whole lot. D'Angelo Russell. There's Green to 88. OG Anonibi. 60 of 88 for the Raptors. OG Anonibi. There's Og. Yeah, you're not exactly. You're not really chasing autos in this. Isaiah Todd. Montrez Harrell. Montrizal Harrell. Reggie Jackson. Corey Kispert. Bones Island. Siddique Bay. The new Hawke. Evan Mobley. New Year's Parallel is Jalen Green. James Harden. Hollow Golds are the case, like the Super Short Prince, Bobby Portis, as well as like the, anything numbered, really, is kind of what you're shooting for. The numbered stuff. Box Trace. Another 10 Box Tuesday spot. Another 10 Box Tuesday spot. That might be close to sold out, actually. Yep, 10 Box Tuesday. Sold out. Sandro Mamakalishavilli. Yeah, they gotta eat in the out of 88. Yanis. Chinese New Year. And guys, got those three mosaics. We gotta fill up. Plus our three box, our six box mixer. Prism Choice, Don Russ, and Prism Hobby. Prism Draft. I should say Jaden Springer. Cam Thomas. Red. Pascal Siakam. Dang it. Oh my god. Thank you. Thank you for telling us what break we're watching, Donnie. Donnie, Donnie's just there to remind you. Just the Pacers and Wizards left, guys. Then about 15 to go in the two afters, well. Io Desuneman. You really need a, a delete message, message button on Tristorte. Tray, I'm, we really do. Kind of with you. Especially when I'm right, right. Who knows what's going to go wrong there. There's John Morant on the green to 88 for the Grizzlies. 10 out of 99, or 10 out of 88, yes. Santy Aldama. Then a Shrew. You know what's really unique about these heat uniforms? The, the City Edition, they're basically made up of like letters from past jerseys that they've worn over the years. Interesting. Killian Hayes and everybody's, everybody's jersey is different. It's like the, the, not like the lettering on everybody's front of the jersey is all different. Like it's all unique. Really? Yeah. Same with the numbers on the back. They're different colors and stuff. So like if you see a hero on top, he's got the pink one and like a red four versus Kevin Love's got like a red four and a yellow two. Yeah. See, see how they're all, they're both different. Isn't that really cool? Yeah, that's cool. Yeah. And then all the lettering on the front, spelling out Miami. I don't know. It's probably not. It's probably just randomly assigned. But I saw it like, I saw a thing and it was like that, um, Cam, er, uh, Dearon Sharp that there's like 50,000 combinations or something crazy like that with how many like different letters there are and different word marks you can use, which is cool. Just soon move Kyrie Irving. Yeah, I thought that was super unique. Oh, nice one coming up here. There's a good case. How about a Cade Cunningham? Seven out of 88. Let's go Dean. Congrats, buddy.  Holy cow, man. Let's go. Let's go Dean. There you go, man. Very nice. Very nice. Very nice. Shengyun? What? No. All right. Never mind. Yeah, I guess we're just K.8. That's a good story. Yeah. I mean, even with the Reeves. You got it, Dean. No problem. I agree. Nike becoming the Jersey manufacturer. There's Jalen Johnson because the amount of like, you know, like throwbacks and all different kinds of things that you can get is just insane, dude. It's awesome. So awesome. Fred Van Blee, Chris Paul, Luca Garza, Drew Holliday, Wendell Carter Jr. Halfway through guys. Oh, I agree. Yeah, NBA does a great job with the city additions, all that kind of stuff. It's awesome. Again, guys, just the Pacers in the wizards left. Pacers are 44 and the wizards are 30. That is it left on that one. Yeah, I can imagine on that one too. Dean. There's Bones Highland. There's the Cops. There's a LeBron New Year parallel. Bronze Wagner. And Evan Mobley, reporter junior, KPJ. Shae Gildress Alexander. Jeremiah Robinson Earl, Rookie for the Thunder. Yeah, me too. Me too. I'm pumped, dude. Josh Gidee. Cole Anthony. Yeah, I'm so amped to see that the city, city connect jerseys come back out again this year. Charles Bassie. Who else is getting them? The Braves got one already. The Orioles, the Mariners. Who else? I forget now. Not the Reds. Yeah, they do. I know Mariners, Orioles, Braves. Who are the other three? Or two. Rangers, Reds. Oh, it is the Reds. Rangers, Reds, Pirates. There is really good, really good potential there. I was kind of pissed that the Yankees weren't on this year. They'll probably be the last year. So follow there, Matthew. There's going to be Butler. Chris Duarte. Scotty Barnes. And a Steph Curry. Zach Levine. Red, Donald Benton. Helden Johnson. Shengyun. Julius Randall. Again, just the Pacers in the Wizards left in the next one, guys. Both teams are on sale, plus all teams on sale in the next two Mosaic QIPs as well. Luca Garza. Pacers in Wizards, everybody. That is it. That is all. Check it on out if you are interested in a Mosaic PYT. Just the Pacers left. Wizards are gone. Thank you, Donnie. Yep, thank you, Blaine. Judd taking the couple of teams in 53. Thank you, there, Judd. Georgia's Call of Tezikas. Just the Pacers available, everybody. 45 bucks. What's Barnes' number? Scotty. Four. Malcolm Brogdon. There's Jalen Suggs. New Year. CJ McCollum. 3J. Cam Thomas. D-Book. Josh Gitty, New Year for the Thunder. Nice one, there. Jordan Pult. Seth Curry. The Nets. Greg Brown. Dezmond Vane. Bojan Bogdanovich. Four seats for the lower bull for nothing. Yeah, that's top, Dean. That's top. Missing out in Little Caesars Arena. Hey, there's Kai Jones. Both NYT and Spilly. Oakland, St. Louis, Detroit, Cleveland. What happened with the Redlands game? I think Dean said he was supposed to be there, but I think he just can't go. There is Garland. Cade, New Year. And guys, just the Pacers. That is it on the next break. There's Ant-Man. Franz Wagen. Luca Donsich. Toronto could have really good ones. I feel like Toronto's got good potential. School in the Ney-Yard. Geez, man. Derek Rose. Four of eight. That's Jersey number for the Nicks. Nice one there.  Fair. I feel that for sure. Josh Christopher. Nicolay Yolkic. Last pack of the break. Good luck, everybody. Reeves and Joelle Embiid. That'll do it for the break, guys. Nothing to really recap. No autos or anything. Thanks again for the fill. Next up, Mosaic. Let's get the wizards.


Yeah, hello everyone. Welcome to the second session of the day. Today I will explain to you relationships in the Android app. So yeah, let's start with it. When we talk about relationships in the Android app, it's important to mention that we only support relationships between TI's, okay, and relationships between events and TI's. We do not support the other way around. Events have to be on the left side of the relationships. Also, we don't support enrollment either, but there are no constraints when it comes to programs or unit or track entity type. For example, you could have a relationship between two persons in different programs or, for example, a relationship between a person and an area that are different track entity types, so no problem about that. Where can you see the relationships? Basically, if you go to the day dashboard, you can see here the bottom bar in the third bottom that has a circle. If you click on it, you will see a list like this one. In this list, you see that Victor Garcia has two relationships, one with Pablo and another one with Andres. If you click, for example, on this item on Pablo, you could see some enrollment details and you could even navigate to Pablo's day dashboard. I will show it to you later. Another thing that you can do is to delete the TI. Okay, so let me just show you. I have here my application. I'm going to go to COVID-19 case registration, so I'm going to click, for example, on Hymen. This is my day dashboard. I'm going to click on relationship, which is the third button. And now you can see that I have a relationship with Helen. If I click on Helen, I can just navigate by clicking here. I can navigate to Helen day dashboard. So that's one thing you can do. Another thing we could do is to delete the relationship if I click here. Okay, so how can you create the relationship type? So let me go to the server and explain to you step by step how can you create a relationship type. It's important to mention that for the next exercise, you don't need to create a relationship type. We're giving it to you. So it's already there for you. But let me explain in more details.  The first thing that you have to do is to put a name to the relationship. In my case, I have chosen has been in contact with. I have clicked here B-directional. B-directional means that you can navigate from the left side to the right side, and then from the right side to the left side. You can navigate both ways, the relationship. This text that you see here, it just is the same text that you see here. This person has been in contact with. In this specific case, Jaime is the initiating entity and Helen is the receiving entity. So this is the text that is showing up here. Another thing you have to do is to define the constraints. Both left side and right side. In the case of left side, you have three options. You can choose between track entity instance, enrollment program, and events. In this case, for the left side, we can only choose between track entity instance and events, okay? We do not support enrollment. For the right side, you can only choose track entity instance, okay? Because we don't support these two for the right side. Then you choose a track entity type. We want to create a relationship between two persons. These two persons belong to the same program, okay? I choose here my program and that's it for the relationship. Also very important, when you create a relationship type, remember everything in DHS2 has share settings. You have to go to share settings and give the specific permissions. But again, you don't need to create this relationship type. It is there for you in the exercise, okay? Just to let you know how you can create a relationship type. So let me just go back to the slides. Yes. One second. So, well, sorry, I forgot to mention something. I forgot to show you how to create a relationship. So let me just go to Heime here to the relationship screen. And now if you want to create a relationship in the Android app, okay, you click on this button on the plus and now it's going to show me all the relationships, all the relationship types available. In this case, we have here has been in contact with, which is the relationship that I just show you on the server. So I can click here, okay? And then I have to choose a program because you can have a relationship between different programs. So in my case, I choose ST00, which is my user. And then I can choose a TI. Once I click on one of these, there will be a new relationship created. So yeah, that's how you create a relationship just by going to your day dashboard and then just going to the relationship screen and clicking here and then choosing a program, okay? So there are different ways you can visualize a relationship. The list is one way, but you can also visualize them with a map, okay? In the same screen, in the list screen, I will show you later, there is this button, a map. If you click here, you can see that for example, Victor has two relationships, these two relationships, and the two arrows indicates that it's a bidirectional relationship. So this is one way of seeing it. You have another way of seeing it. It's by going to the search screen and then clicking just right here in the bottom bar in the right bottom. This is the same that Andres showed you before, but I will show it to you again. Then you can click on the map layers and you can say, hey, I want to see this relationship has been in contact with. So you will be able to see the relationships in the map. So just let me show you. For example, here, just let me go back to everything again. So I can go to Helen, for example. Helen has two relationships, okay? And here there is a map, okay? I can click on this map and then I can see the two relationships. Helen is just right here and has a relationship with Jaime and another with Alberto. As you can see, there are two arrows because it's a bidirectional relationship. Another way of seeing your relationships is let me go back again. I'm here in the search screen. You can just go to the bottom bar and just click on this button. You can just click on map layers and then you can say, hey, I want to see has been in contact with, okay? So you click here. So let me zoom in. You can see that here is Helen. It has a relationship with Jaime and then it has also a relationship with Alberto. Sorry about the image being black. It's the color is not working well in the emulator. So that's why you don't see the image well. But if you do it in your device, you can see everything perfectly. It's because the library being used doesn't work well with the emulator. So let me go back to the slides. Another thing you can do as I mentioned before is that you can create a relationship between different track entity types. For example, I can have a track entity type called ARIA where it will be a polygon, okay? Instead of a GPS coordinate, it will be a polygon and then you could have a person. And I could name that relationship belongs to the area and then in the map, you could see something like this. This could be, for example, a COVID area of cases and then you see this TI, which is Pablo that belongs to this area, okay? So again, you don't have constraints when it comes to track entity type or units or program just to, I want to show to you this example. So one important thing, the word of the day is offline, okay? So I'm gonna write down later on the slide. In case someone missed it, it's offline, okay? So now you have to let me show the exercise, okay? You have to create, you have to create two relationships, okay? With three cases, okay? So in the previous exercise, with Andres you created multiple TI's, okay? So what you can do now is to create two relationships and one of the relationships has to be the index case, okay? And then you have to visualize your relationships in the map and sync with the server. So what you will need to do is to send a screenshot of the map showing the relationships that you have created. So let me just go back again. So this could be an example, valid. You have three TI's and one of that is the index case, which is Helen, the one in the middle, and two relationships. So this could be valid for the exercise, okay? So yeah, that was it.


It's so nice to see your bright and shining faces on this really frigidly cold day today. I hope you enjoyed your meal. As always, we thank the Bull for a delightful service. And also Prevea for being our sponsor this month. So thank you very much. My name is Lynn Podian and I'm the chair of the Business Advocacy Group. If any of you have an interest in joining our Business Advocacy Group, we meet next Friday. We meet next Friday at 7.30 in the morning. We're always looking to have new people join us. And what we do is we plan these first Friday forums. We look at the national concerns, the state concerns, and the county concerns about how things will be affecting your business. So if you'd like to join us, feel free to do that. John Rogers is a touchstone for you and you can reach out to him and find out more information. On your table, you'll find this lovely piece of paper here that will give you some information on the upcoming events for the chamber. We have our first Friday forum, which is of course today's immigration reform. Next month in March, we're actually gonna be doing a double header on transportation and we'll have state elected officials. In April, we'll be touching on early childhood learning. Both are going to be really good lineups. Just give yourselves a second to look over the rest of the concerns that we have, business owner success strategy roundtables coming up next week. And we've got our focal point on Wednesday, February 19th with networking to win. Chamber gala, just so anybody who doesn't know does know now is sold out. If you were like myself and forgot to put it on your schedule to get your tickets, well, you gotta be on a waiting list. I'm thinking it's about 200 strong right now? No, maybe not. But I'm hoping that we could all get a place around the table for the gala this year. But unfortunately, we are gonna be on a waiting list at this point. So if you would all give a warm welcome to our speaker today is Kurt Bauer. He's the president and CEO of the Wisconsin Manufacturers Commerce. I'm gonna give you a little heads up on his history. He'll love this. I'll go back through his life story for you. In 1993, he began his trade association career as a staff writer and media assistant for the Wisconsin Bankers Association. In 96, he was promoted to head WBA's government relations program. And in 2002, he was selected to be the president CEO of the Phoenix-based Arizona Bankers Association. In 2004, he returned to WBA to become a president and CEO. And in 2011, he became just the fifth head of Wisconsin Manufacturers and Commerce, the state chamber of commerce and largest business trade group. Founded in 1911, WMC represents 3,500 employers of all sizes and from every sector of the economy. Kurt Bauer. It's a delight to be here. Lynn read the bio and says that I was in Arizona on days like this. I wish I never left, but my wife particularly wishes we'd never left. But actually, I'll take a beautiful sunny day like this as opposed to 20 degrees in overcast. So it's actually quite beautiful out there. And it was a lovely drive from Madison over here. So I appreciate being included. I was asked to talk a little bit about immigration reform. And I'm gonna take a little bit of license. And I told John, I'd probably talk about, and actually, I think John, you asked me to talk a little bit about our future Wisconsin project. And in the process, I thought I'd expand the topic just a little bit and talk about two of the biggest economic issues that we see at WMC. I've been at WMC for three years now. And it's a steep learning curve. It's a big association. We have 3,500 members, all sectors of the economy. And part of the job here is to go around and meet with local chambers of commerce, business leaders and learn about the issues that impact them, not only now, but in the future. And it became very clear to me that Wisconsin really has two major challenges in the future. The first is workforce, which relates to immigration reform and energy. And that's one that I think is the most underreported economic story in the state. And I'll get to that in a moment, because a lot of people are surprised to hear that because in the United States right now we have an energy boom. So what could be the problem there? I'll get to that. So I wanna talk about first workforce and immigration reform. And I divide this topic really into two categories. The practical and the political. The practical is the need. The political is a little bit of the fear. The chamber community, the business community is often accused of being a center right and aligned with Republicans. On this one, we sometimes get a little cross-wise with Republicans, particularly the Tea Party, because we see the need and we recognize the fear, but we think that the need outstrips the fear. Let's talk a little bit about that need. We have done a lot of work with the UW-Madison Applied Population Lab. And they did a report analyzing population trends in Wisconsin from 2010 to 2040. Right now we have just under six million of Wisconsinites, 5.7 to be precise. We are anticipating by 2040 to have about a million more, 808,914 to be exact. That's a 14% growth. So you look at that and you say, well that's pretty healthy growth. It's not quite what you see in the Sun Belt, but for the upper Midwest that's not so bad. But 91%, 91% will be above 65 years of age. That's outside of the working age population. Only 0.4, 0.4, not 4%, 0.4% will be working age population which is calculated at 18 to 64. Then we looked at a Georgetown study that analyzed data from around the country and that translates into, so in 2010 we have 2.8 roughly, I rounded these numbers just for ease, 2.8 million Wisconsin jobs total in the state. By 2020 we'll have 3.1 million jobs, at least we hope so. But, there's another bot here, 317,000 new jobs at the end of 10 years, but just 15,000 new workers at the end of 30 years. Bottom line is that this is a crisis. We often talk about it being a shortage now and a crisis later. It frankly is probably a crisis right now for Wisconsin. And John was kind enough to send over some information from the Sheboygan County Economic Development Corporation.  Nobody in Wisconsin is immune, not even Milwaukee, our most populous county. In fact, maybe the more populous counties are going to be the hardest hit. And this is not just a problem unique to Wisconsin. This is the upper Midwest. This is actually most of the country. And right now Europe is going through it. They're probably about 10 years ahead of us. They're a bit of the Canary in the coal mine. They've had historically low birth rates for quite some time and you see that they're very aggressively seeking immigration. I've got a friend of mine who is a dual American Italian citizenship. He worked in the Philippines for the last 10 years. He married a Filipino. And while he was not able to come back to the United States because he couldn't get a visa for his wife, he was able to move to the EU. He was able to move to Italy. So what the plan is is that she will immigrate to Italy, she'll become an Italian citizen and then they'll come to the United States. But that shows you that the Italians in much of Europe is very receptive to immigration from around the country or around the world because they need the workers. So this is a crisis now or a shortage now crisis later. What does it mean? Frankly, it threatens economic contraction. It also erodes the tax base. So think of those numbers again. A massive expansion of the over 65 year old population and think about the healthcare needs and the social service needs that are probably gonna go along with that. At the same time, we're gonna have a shrinking of the tax base to pay for all of that. I kinda likened it a little bit to North Dakota and the problems that they were having prior to the energy boom that they're experiencing right now. Their economy was contracting. Small towns were really disappearing. Downtowns were being shuttered. And I was thinking about that while I was driving through Sheboygan Falls coming over here, one of the prettiest downtowns in all of Wisconsin. You think about businesses going out because it's just not the demand for the services. You also think about it from a business perspective and all of you are from different businesses. We tend to think a little bit, maybe too biased in terms of manufacturing. It's in our name. We were founded as the Manufacturers Association merged with the State Chamber in 1976 and about 51% of our members are still manufacturers. 20% of the Wisconsin economy is manufacturers. It really is the bedrock of Wisconsin's economy that all other sectors of the economy benefit from. So what does it mean to a manufacturer? Well, what do you do? You can automate, but there's only so much you can automate and businesses are automating. Todd Teske just recently left as chair of our board of directors as the head of Briggs and Stratton and he was telling me that they've been forced to automate dramatically over the last few years and they've got plans to do more of it. But you're still always going to have a human element in not only manufacturing but in most other types of work as well. You can move part or all of your operations to where the workers are. Of course, all that in the 80s and 90s we lost jobs to globalization. What I often think is ironic is that now we have this opportunity for reshoring because the costs of doing business overseas have increased. Labor has gone up in China. There's less currency manipulation. Still some, but they're less. And of course the transportation costs now with the energy boom in the United States has made us very competitive. So we are primed right now to really have a renaissance in manufacturing but we can't find the workers now and it's only gonna get worse. So businesses will have to decide. Can they automate? Will they move part or all of their operations to where the workers are? And the third option is really to contract. They cannot bid for projects. We already see that happening right now. And another part, maybe they decide that they can't run two or three shifts. Maybe they can only run one. And we're seeing that now too. I was just down in Beloit not too long ago and a small manufacturing operation was looking to start a second shift and they needed 12 workers and they found seven and they just couldn't find the other ones. And as a result, they weren't able to start that other shift which means they weren't able to bid for other projects which affects the profitability of the entire company and of course those seven people they did found, they still weren't able to hire them because they couldn't find the remainder of the shift. So obviously you can see how this impacts and it's all by and large pretty darn negative. So what do we do about it? It's a big question. Well, we can try and increase birth rates and that's a little difficult. I often think of Wisconsin, maybe we need more blizzards. When the lights go out and no one can go anywhere. You always say if nine months later you get the blizzard babies. We can fight to keep what we've got and of course we're a state that's known for a brain drain. Young people graduate from our universities and private colleges which are among the best in the country and our tech colleges or some tech colleges are outstanding. So they get their degrees, taxpayers subsidize oftentimes and then they end up going someplace else. We can try and fight to keep them here. We can encourage delayed retirements, 65, that's still relatively young. I think about my grandfather at 64 when he died. He was an old man. My dad is 85 and he seems very vibrant. He doesn't wanna work but you get the point is that I do think that the world has changed and the vast majority of us will probably work beyond 65 because our life expectancy is going to be longer. As it is, you see people who retire at 65 or 64, 65 and then they end up starting a second career doing something consulting or whatever it is. I think that will probably have to be an imperative going forward. We can have migration, people moving into Wisconsin from other places, that's part of our history. I'm from Beloit, Racine, Milwaukee, all moved African-Americans from the deep South to work in factories in those locations as part of the Great Migration and of course then immigration which is also part of our history and again part of my history as well. My grandparents came from Germany to work in factories in Milwaukee before they ended up working at Fairbanks Mores in Beloit. So all of those are options and they all have to be on the table for us but there's a common denominator for all of them. If we want to have people move to Wisconsin, if we want to have people stay in Wisconsin, if we wanna encourage people to get married and start a family here in Wisconsin and feel secure enough in their position that they can have not just one child but maybe multiple children, we've gotta have a strong Wisconsin economy. We've got to make sure that we have great quality of life. We've gotta have good schools, we've gotta have good recreation options, urban centers, arts and entertainment and if we don't do all of that we're gonna find ourselves in a real dire straits. So let's talk a little bit now about the fear of immigration and that's frankly just as American as the melting pot is. If you look back at American history, whoever has come here really wasn't all that excited about other people coming over here and if you know the movie with Lena Caprio, The Gangs of New York, that really dramatized that. You saw the Anglo Protestants didn't want the Irish Catholics coming over and that's what the big fight was in New York. Well that's again, part of our history here in the United States and the people who are here are always suspicious about what will happen to American society with a new group coming in. That's certainly I think the argument that we're hearing from the Tea Party. We've had some interesting experimentations with policies that you've probably heard about the self deportation. I think Alabama has that, I think it originated in Kansas and it's basically a matter of that the laws are so restrictive if you are an undocumented immigrant you get pulled over for speeding you could find yourself targeted for deportation and with your family still anchored in that community. I think it's a pretty scary and maybe a bit too aggressive a policy. Yeah it's interesting too with the Republicans. This is really a no win situation for them politically. They're damned if they do and they're damned if they don't. They're damned if they do because the Tea Party element doesn't want it they're damned if they don't because if you look at the demographics of this country it is shifting. Whites will not be the majority in this country very much longer and if the Republicans want to be anything other than a party of white men they're going to have to reach out. So I kind of look at it this way. I think it's the right political option long term and I certainly think practically it's the right option for the United States economically. So you look at the GOP as having a war with itself a little bit. You've got right now Speaker Boehner has indicated that he was in favor of immigration reform. There's a caveat to that because now it looks like the world has changed a little bit and I'll talk about that in a moment. You've got our own Paul Ryan, the congressman from the first congressional district chair of the budget committee and the vice presidential nominee and the last presidential election. You've got Bill O'Reilly from Fox News very influential in the conservative movement. The Wall Street Journal editorial board very much in favor of immigration reform and of course the US chamber which is allied with us. We don't have a formal governance relationship just like the Sheboygan chamber. They work with us but there's no formal relationship. We're not obliged to take their policies any more than the Sheboygan chamber is obliged to take our positions but they see it the same way we do. They look at the demographic data. Against you have the Rush Limbaugh's of the world, the Tea Party, Karl Rove, National Review, a very influential conservative magazine and here in Wisconsin you have somebody like Vicki McKenna who is a very influential talk radio host. She does a show in Milwaukee in the morning, Madison in the afternoon that is also broadcasting La Crosse and Eau Claire. So she gets around the state actually more than somebody like a Charlie Sykes who is at the largest radio station, WTMJ. And she'll often, we get along very well with Vicki and I like her personally, she actually went to Bloch College again in my hometown but she'll deride our position as we just want cheap labor and maybe that's true with some but I guess from my perspective I just say, well we may not want cheap labor, we just need labor in order to have the economy continue to grow. So you look at some of the issues that is holding back reform. One I would say that the Democrats on the one hand want immigration reform and maybe they don't want immigration reform because it's been a very effective wedge issue for them. They were able to use that in the last election and you saw Ron me got a pathetic percentage of the Latino vote as a result of his positions. During the primary he talked about subscribing to that self deportation policy which really alienates the Latino population. So you've got border security, the conservative right wants the border security, you've got immigration law enforcement, bottom line is that you've got the president saying I've got a pen and a phone and this is the current spat. Boehner and Ryan had been saying that they wanted to push something through. Now Boehner is saying that we don't trust the president to actually do, to honor a deal because he's not currently listening to Congress, he's going off on his own and an example of that would be the executive action he took on the Dreamers which are the children of illegal immigrants who were born here and therefore they're US citizens and the executive action he took there. Worker verification and a visa entry system, amnesty, legal status for undocumented immigrants, is it fair or unfair to do that? Is it the right thing to do?  Do you want to put them at the end of the line? What are the economic implications of doing so? What are the political backlash of doing so? I guess from our perspective at WMC, all of that stuff is very complicated. What we look at this and say, we've got a problem, we've got to solve it and there are multiple avenues to solve it and one of them has to be immigration reform and some of the things I think can be worked out. We want, you don't even have to call it immigration reform per se, you can call it a guest worker program. Right now, we have multiple instances where we are educating foreigners, the best and brightest of the world at our great universities here in Wisconsin and around the country and when their student visa expires, we don't grant them a working visa despite the fact that they're highly educated in some of the most in-demand areas, the STEM areas, the science, technology, engineering and mathematics and what we're doing is we're sending them off back to their home country or wherever into the waiting arms of America's competitors. It doesn't make any sense at all but on the lower end, we also need, we need lesser skilled workers and you may have heard this but many of the crops in the Yakima Valley in Washington State where apples and peaches and nectarines are growing right near cherries, much of the crop was not harvested this year because they couldn't get the workers that they normally get because, well, a variety of reasons. One of them is that Mexico's economy is actually doing quite well so when we look at immigration in the future, it probably will be Latino but it may not be Mexican. It may come from other parts of Latin America or South America. So we think that this is something that needs to be solved and we think the sooner the better and frankly, I think that the politics will work itself out. I think that the Republicans are wrong that Latinos are somehow genetically bred to be Democrats. I think that's ridiculous. I think that politically it works out that if they want a future they're going to have to embrace the Latino community and I think if we're gonna want a strong economy with a vibrant workforce, we're going to have to embrace immigration reform. So just briefly on energy then. So you've probably heard a lot about the energy boom that is taking place in the United States and it's fantastic. It really has made us very competitive and we're hoping that the president approves a Keystone XL pipeline now that the final regulatory hurdle has finally been passed and they've indicated that there are no environmental concerns with this. We hope they approve it. I have my doubts on whether or not he will at least before the midterm elections in November. But here in Wisconsin, 70%, roughly 70% of our energy comes from coal and if you've been following this issue, the EPA basically placed a moratorium on building new coal fire plants in the United States and this summer we fully anticipate that they will place new restrictions on carbon emissions that will probably take offline older coal fire plants here in Wisconsin and throughout the upper Midwest. That's gonna raise energy costs and we don't have any alternatives. Now you may be thinking, well, hey, we've got the Marcellus and the Botkin shale deposits, both of which produce oil and natural gas. But the problem is that we don't have the pipeline infrastructure to get that from there to here. We'll have to build it. Rape payers pay for that, that infrastructure. So that'll be expensive and it'll take some time. Plus you'll have to convert existing coal fire plants to natural gas. That'll be expensive. Rape payers will have to pay for it. That'll drive up costs. And of course, if everyone is forced around the country to switch from coal to gas, the price will go up along with demand. That's just classical economics 101. So the bottom line is that this is a real threat to Wisconsin's economy. We need cheap, reliable energy. That is the foundation. Along with workforce, energy is the foundation of an advanced economy. And right now, both of them are threatened in the state of Wisconsin and it's something that we are all very concerned about at WMC. So that leads us to the future Wisconsin project that we just put together and we're just in the beginning phases of it. It is a plan to put together a 20 year vision, the economic strategic plan if you will, for the state of Wisconsin. We don't really have anything like that right now. We tend to be guilty of thinking short term. Businesses tend to think quarterly to quarterly if they're stock. Businesses just sometimes month to month, maybe year to year. Maybe they have a five year strategic plan, but we just typically don't tend to think longer term. So this is an exercise for us to do that, to take a look at the demographic data and some of the other challenges that we have and see whether or not we like where we're going to be in 20 years. And if we don't, what can we do together to change it? And we're going to be partnering with this initiative with the Tech Colleges, the UW System and the Wisconsin Economic Development Corporation, which I think is the perfect partnership. So you've got the private sector represented by WMC, academia and government working together to try and address these problems, identify the problems, put together a plan to solve these problems and then execute that plan together. And we're going to focus on six areas that we call competitive quality indicators. Talent retention, which is that workforce component. Business competitiveness, which is basically how competitive are we as compared to other states and frankly globally because we're operating in a global economy. Global engagement because the demographic trends that I talked about for us are just the opposite for Asia, the wealth and population is going to grow in Asia. China and India in particular. And we in the United States and Wisconsin need to think globally. We need to think about the opportunities that presents for us. We need to export, we need to take advantage of those relationships. Government efficiency, we frankly want a very lean efficient government that does what we need it to do and does it as cost effectively as possible. Quality of life, we do have a very high quality of life in Wisconsin, we want to maintain that. And of course we want to encourage an entrepreneurial spirit. We have two great research universities, three if you include the Medical College of Wisconsin and a lot of great innovations and patents come out of there but we haven't done a very good job of commercializing those ideas and creating new jobs as a result of that. So that's just one idea of how we can maybe foster that entrepreneurism that helps create jobs and new ideas and makes Wisconsin a vibrant and fun place to live. So I will stop there and if you have questions I'd be happy to answer them. The discussion about minimum wage and whether that should go up or not with the immigration discussion. It seems to me that there is a synergy there. Well, I look at this, we typically have the same position that most businesses have on minimum wage. We really don't think it's a good idea to raise it. We think that it's discriminatory to young people in particular. There was a Forbes article last week that came out that said that 0.8% of people over 21, excuse me, over 23 receive the minimum wage which tells you that it really is a entry level or supplemental wage for the vast majority of Americans out there. So I think that there's a disinformation a little bit, I was just with the president last week. I had a chance to meet him at Waukesha engine and he pushed this issue and I don't always agree with the president's policies and I applauded politely when he did most of his talk but on that one I disagreed. I just don't think that the data backs that up. I think that that's really a campaign issue but you also look at it from this perspective. It is rather interesting right now. We call it the workforce paradox. We know we have historically high unemployment in the United States and in Wisconsin. We're lower in Wisconsin than we are at the national level. About 6.3%. Senators, 6.3% unemployment in Wisconsin? Something like that. I didn't mean to put you on the spot. I think it's 6.3%. It's about a full percentage point better than the national average but we still have jobs that are going unfilled particularly in southeastern Wisconsin and the industrial corridor. About 13,000 we estimate. So frankly from my perspective, I think we do, it would be a lot smarter to work with our tech college partners to have people bypass those minimum wage jobs and have them get right into those high-paying factory jobs that pay 30% above the median. That are family sustaining careers, not just jobs. So I look at it a little bit differently. And I honestly, I don't think it matters all that much with immigration reform. I really don't. Yes, sir? I'm going to call the number here in this country. Do you know how many legal immigrants there are in the state of Wisconsin? I do not. I'm sure somebody has estimated that number but I apologize. I didn't come prepared with that. I'm sure there are some people that just show up. Oh, right, the staggered. It's your number. I don't have that but the average factory worker, and I apologize that I'm being so manufacturing specific, but the average factory worker is in their late 50s right now and will be retiring in the next 10 years or so. And that means we've got to have a pipeline of workers to replace those workers. And of course, we also know the need is very high in healthcare and tech as well. Other sectors, I'm sure, but right now it's most acute in manufacturing healthcare and tech. Yeah, tech. Yes, ma'am? I have not seen a study that shows that we're making a lot of progress, but it's baby steps. One thing that I thought was very interesting is I mentioned I was with the president last week at Waukesha Engine and I could have given his speech. I was standing next to the head of the Waukesha Business Alliance, the Waukesha Chamber. And I think everybody in the chamber community has recognized that there's been this shortage of workers, particularly for manufacturing. And sometimes I fuss with the president that he has emphasized a four-year degree over and over again and he didn't talk about that. He actually talked about the need to get on a career path that makes sense. And he said that a four-year degree is maybe not the right thing for every student, which is something that we have been saying. We talk about return on investment. And I remember I had a chance to go to China with former UW-Madison Chancellor Ward and in a dinner at Shanghai, I asked him what responsibility does the university system have to tell an incoming freshman who's chose political science. I can pick on political science because I have a degree in political science, but what's the return on investment going to be?  And what's going to be the return? What's the demand going to be like for jobs after that? And what I often tell people is that I've yet to hear a factory owner, a plant manager, or really anybody say, you know what I really need? More political science majors. Well, we need to tell people this. And frankly, teachers, parents, counselors, they need to be informed so that they can inform young people. And young people listen to these role models. What the jobs are going to be like in the future? That's part of this Future Wisconsin project. I think we do a manufacturing month in October. I think we need to turn that into a career month because it's not just manufacturing, it's all sectors. And I think what we need to do is hire people to put together an accurate, as accurate as you can, forecast on what the career, or what the job market's gonna be like four years hence so that young people in high school, frankly, they need to make these decisions. Maybe a little bit earlier in junior high so they can start determining what is going to be the right career for them. We shouldn't set people up to fail and tell them that they really need to get a four-year degree. And they're really not passionate about it, but they do it because of peer pressure. Their parents want them to do it. And they go, and they dutifully get the degree. And then they find there aren't a lot of job prospects, at least not here. So they're forced to go someplace else, which we don't want. Or they go back to the tech college system. And I think we had the governor at our business day program yesterday, and I can't remember the statistic, but he said it's a very high percentage of people who are at tech colleges who have four-year degrees and have not been able to find the kind of careers that they were hoping or told, promised that they were gonna be able to find. So the tech colleges are a shining star in our education system and that we need to steer more young people in that direction. Look, if you get a two-year degree or a two-year certification at a tech college, that's not to say that you can never go and get your bachelors of science or a bachelor of arts. We have plenty of examples of people who got a two-year degree, started earning and decided that, okay, now I'm ready to go and do something else.  As far as people who kind of choose not to work, who are capable, but how does the effect of being able to receive like government assistance, food stamps and whatnot, balance against that person's decision? I happen to see a lot of people who will tell me, wow, I get a job and I'm ready to go and qualify for these things. Is that, do I just see a large percentage of people work? Or what are you, how many are there? I hear that anecdotally from our members. We just surveyed on that. We do twice a year, we do an economic survey of our membership and we asked specifically that question and only about 4% of our members said that that was really a problem, which surprised me. It was lower than I thought it would be because I do hear it more often anecdotally out there, but I think it is a concern. And you saw the CBO estimates that 2 million people would be better off or will leave the workforce because of the Affordable Care Act because frankly they're penalized for working. I do think that we've got a problem in this country in Wisconsin, we're losing the culture of work. Wisconsin has always been known for a very strong German-Norwegian work ethic and we're losing that a little bit. I hear it's stronger with the millennials, so maybe there's hope there, but I do hear that the work ethic is not what it used to be. The soft skills aren't what they used to be. People are surprised that they have to show up for work every day, that they can't just take a day off when they want to or leave when they have a doctor's appointment. It seems to me that there's a lot of people right now that don't understand what employers' expectations of them are. And maybe, I don't know, you start peeling back this workforce issue and you start dealing with a lot of different issues and it must be something in our culture that we have to address. Well, I mean I think I see, most people will go through the natures towards the most common denominator often. So when someone does have food and shelter provided by taxpayers, it's a reasonable choice to say, well, why not just stay home then and take that. And the problem that I see is that when I explore this with people while they're on a witness stand, they're telling me that they have friends that they live within this building and they're all getting food stamps. They're all, you know, and so where is the, I feel that there's a gap with who's supposed to be screaming these people and allowing them to have these benefits when I look at it go. How do you qualify? I don't get this. I think it's a great point. You know, Paul Ryan often says, if you pay people not to work, don't be surprised if they don't. And we had a speaker yesterday again, we had our big business day in Madison event about a thousand people from around the state and we bring in a bunch of speakers and one of the speakers talking about the minimum wage but I think it relates to this as well. He said, look, if I'm, 21 years old, I'm making $7 and it's $7.25 an hour which is right now the minimum wage in Wisconsin and I get an increase to $15 an hour which is what SEIU wants for the fast food workers, you know, more realistically probably $10 an hour. I haven't improved my skills. I just get this, you know, I get this mandate. I was saying earlier, it's basically an employment tax. I didn't improve my skills. I'm now making $10 an hour and, you know, I sit around and I don't go to school to bed of myself. I don't go to the technical college. I don't go to the UW system. What message are we saying? And what does that say about our future competitiveness as a country? We need people who are going to be aggressive, who improve their skills because we're competing against a very aggressive world. Again, I've been to China. I see, I mean, it's unbelievable what's happening there. What's happening in China and the growth is like nothing that's ever happened in the industrialized world. And those young people are very hungry, they're very aggressive, they're getting educated. One thing that they haven't been able to do like we have is innovate, but they're working on that because they know that that's a deficiency and they can't steal everything or by now they probably have stole everything. So, I mean, now they're gonna have to innovate themselves. And we've got to compete against them.  We're 300 million, 340 million, I don't know. 300 million-ish. They're 1.3 billion. They've got a numerical advantage to say the least, although they've got their own problems. Yes, ma'am. I agree with you that, because I've been there and I've created them and every sports bar in New England, New York, Utah, Texas, Shanghai, China, you find a bachelor's game, you find a pre-made packer game, and I'm telling you, in another university, Minnesota, whatever, are you going to one of these bars and there's maybe one or two. You go in, when the packers are playing, there are a lot of these constant people. They have left and it's sad. They are wonderfully educated, fun, hardworking people and they want jobs back here. They come back here and then they leave again. What do we have in Wisconsin that's going to keep them here? That is a good question and it goes back to, I think, an economy and a quality of life that is very competitive. We need it, the governor was kind enough to remember that three years ago, he quoted me yesterday, three years ago at an event like this, I said that whoever solves this problem first in the Upper Midwest wins and it's gotta be Wisconsin because we have similar quality of life and similar advantages and disadvantages. So whoever solves this first wins. So we need a vibrant economy that draws people in, migrants, immigrants, keeps people here and encourages families to, or people to feel comfortable, secure enough in their position that they're willing to start a family. Right now, young people are delaying those decisions because they don't feel secure enough. Somebody's probably not gonna ask the love of their life to marry them if they're working two part-time jobs, despite the fact that they've got a degree and they may have a very strong work ethic and they may be trying everything in their power. We've gotta create that opportunity. We need upward mobility. We need opportunity for them and if we can do that, we'll have a fighting chance. I think it's gonna be very challenging for us no matter what but I'm with you. I, as I said, I went to China with former UW Chancellor, David Maward and I'm also on the Wisconsin Alumni Association Board and we had a reception in Shanghai and it was packed with young people and I'm sure many of those people maybe wanted to go back to China but many of them were not Chinese and they went over there. We'd like to keep them here but we've gotta create the opportunities. Part of that too is urban centers. Milwaukee is a diamond in the rough but it's not achieving its full potential and if it's not achieving its full potential neither is Wisconsin. I'm worried about Madison falling into that rut. I mean, one of the reasons why will often compare us to Illinois because it's a great comparison. Illinois is a basket case. I mean, they're almost a lost cause. Minnesota, on the other hand, it has a strong economy that their unemployment rate is actually lower than ours and one of the things that people ask is why is Minnesota doing better than us? I think it's because they've got the Twin Cities. The Twin Cities are a destination. When I graduated from college, a lot of my friends, they went to Chicago, if they stayed in the Midwest, they went to Chicago or the Twin Cities. We need to make Milwaukee that and I think we're capable of it. Milwaukee's a great place and there's a lot of opportunities in Milwaukee but it goes back to this future Wisconsin initiative. We've gotta put together some sort of a plan. It's not just gonna happen. You have this thing. So, they really would like that they love this area. It's just, you know, the tech innovation, the support for, you know, innovation, for technology, startups and that big stuff just doesn't seem to exist in this country. How we do it on time? It's 107? Okay. In order to grow that sector of the economy, tech, biotech, science, you need three things. You need highly skilled people. You need money, frankly. And frankly, you need some sort of catalyst or innovation, right, to start something out. Well, we've got two of the three really. We've got those major research universities I mentioned earlier. UW-Madison, UW-Milwaukee and to some extent the Medical College of Wisconsin, a smaller scale but still they've got a research component and they come up with some pretty interesting things. And of course they attract young researchers. The problem is of course those young researchers get offered jobs someplace else or if they do end up commercializing and innovation here in Wisconsin, oftentimes the money will come from someplace else and they're drawn to where that money was. So we're low on the money side. We've got two of the three, we need more money. And frankly then we need other things that are gonna keep young people here, the anchored here. And that I think goes back to the quality of life from a young person's perspective. And quality of life means different things to different people. I've got a member up in Ashland that he's a huge manufacturer and I asked him about how he's able to track workers and he said, well I track people who wanna hunt and fish and Ashland's a great place to do that. Well that's great. So he's got his niche. But people who tend to be in the research side like art and entertainment options. And this is one of the reasons why the Milwaukee Chamber is so desperate to keep the bucks. Because they think that that'll hurt them on that retention of young people that it'll hurt the city. So it's a simple formula, but it gets a little bit more complicated. You've gotta try and keep those young people because the incomes are here, you've gotta make it a fun place to live. The other thing is that a lot of the innovations that come out of the UWs are hard to commercialize because the practical application won't be known for several years. It just isn't that easy. It takes a long time to get that done and to suddenly start making money. Or not. Well thank you very much. I enjoyed spending a little time with you and I hope everyone has a great weekend.