If you're new to the channel, I'm Gulf Pony under new car track SUV reviews on YouTube. And today we are in the brand new 2023 Volkswagen Golf GTI courtesy of Faulkner Volkswagen in Mechanicsburg PA. For more information on their inventory, please feel free to check out the link in the description box below. And so today we are in this one because there is one major change for the 2023 model year. And now the Golf GTI specifically has been sold in the US for 40 years. And that may or may not have something to do with the major change, I'll be covering that of course. And this one will be competing with the Civic Si, Launcher N and GR Corolla, just to name a few. So ultimately in this video, we will be testing out and going over everything about this one from acceleration to braking, steering feel, ride quality, sound system, exhaust club, all that fun stuff. So having said all that, what do you guys say? Let's just go ahead and jump right into it. And as always, let's start with pricing. And so there are a few different trim levels for the 2023 Golf GTI. First one being the S starting at $30,530. New trim level for 2023. Here it is, you guys, 40th anniversary edition starting at $33,055. Yes, that's the major change. But anyways, SE trim level, which actually is the one we were in today, starting at $35,330. And lastly, the Autobahn going for $39,070. But regardless of trim level that you go with, power plant on the Golf GTI is going to be the same. Powering the beast is a two liter turbo charge inline four cylinder, putting out 241 horsepower at 6,500 RPM, 273 pound feet of torque coming in at 4,000 RPM. Power is going to be sent to the front wheels through your choice of either a six speed manual or a seven speed dual clutch with paddle shifters, which is the one that we have today. Zero to 60 time is going to come in at approximately 5.1 seconds. Top speed, 155 miles per hour, that's impressive. With MPG numbers coming in at 23 in the city, 32 on the highway for the manual, and then 24 city, 34 on the highway for the dual clutch, taking regular unleaded fuel. I didn't expect to see that when I was doing all my research for this one, so that's pretty cool. But so then before we do any kind of fun acceleration or paddle shifter test here in the Golf GTI, I wanted to mention to you guys the drive modes. There's a little button labeled mode just underneath the infotainment screen. When you press that it's going to give you options like eco comfort, sport and custom, adjusting things like the shift points, the throttle response, the gauge colors, also the steering sensitivity, the engine sound. I noticed that immediately and the climate control settings actually as well. So quite a bit. So well done Volkswagen for all those adjustments. But anyways, now that we've got all of that out of the way, what do you guys say? Let's go ahead and find a straightaway. Let's put the paddle shifters here to the test first and let's see how quickly these paddle shifters are going to react for us here. Oh, it popped, it freaking popped. All right, here we go. We are in full manual shift mode. I just let this shifter back one more time. But three, two, one, yeah baby. Ah, this thing is fine. All right, if I'm being honest, I was in sport driving mode. There was a slight delay to the paddle shifters. I wasn't expecting that because it's a dual clutch, but seriously quick. So what I'm going to do now is give back full control to the Golf GTI, I can't even talk today. And we're going to let the Golf GTI do a quick little acceleration here and let's see how quickly we can get this one year up to speed. All right, in three, two, one. Yeah. Decent grip. Holy cow. This thing is quick. It pins you in the back of the freaking seat, man. This thing is fun. Dude, Boston Autoblog. I know what you're talking about, man. This thing is a fun car. Like it pins you into the back of your seat. That was an incredible acceleration in sport driving mode. The other thing is, I'm just going to mention it to you guys. Now, when you press ambient lighting, you could choose between like five different color themes for the gauges, like yellow, red, orange, aqua, blue. Yeah, this color is called aqua, but that is an incredible acceleration. But anyways, I'm getting off topic. To go along with that acceleration as always, braking is equally important. So upfront, you will find 13.4 inch ventilated front discs. In the back, 12.2 inch ventilated rear discs. As far as that 60 zero stopping distance goes, it's going to commit at 120 feet and since there's nobody behind us, let's sit there. Oh my gosh, this car keeps impressing. It literally won't stop impressing you right now. I feel like a little freaking kid just driving this car for the first time. This is insane. Very, very firm braking feel. So instantly brings you to a stop. The 120 foot number really feels like the one teens, quite honestly. It feels like a sports sedan, quite honestly. So instantly brings you to a stop, not a soft braking feel whatsoever.  Therefore, we actually do have that today. So essentially what that is, is it monitors each shock absorber individually, not only adjusting to the road imperfections, giving you a smoother ride, but also tightening up the suspension during heavy cornering, really giving you the best of both worlds. At test on ride quality, I'm actually just going to take it out of that sport driving mode and put it in comfort for a little bit here. So it just hit like a little pothole back there and it wasn't that bad actually in that comfort driving mode. Now we'll say as a little disclaimer, cars like this, you are going to feel a little bit more of the road. So expect that, but it's not as bad as I thought it was going to be. Certainly not as bad as my heavily modified 2019 for Mustang GT. So I'll just put it that way. Ride quality is doable. That's a good word for it. It is doable in the Gulf GTI, especially for how much fun this car is. As far as steering feel goes, now I'm in comfort driving mode. It's still decent feel to the steering. Let me actually go ahead and put it back in sport real quick. Does give you a much weightier feel to it. So a much heavier steering feel in that sport driving mode. I actually liked it. That feels really good. So instantly pointing you in the direction that you want to go. So I am a big fan of the steering. Not quite as good as the Integra that I recently drove, but still it's dang good in the Gulf GTI. Touching on cabin noise, you get a lot of that engine noise when you hit the gas, which I personally love, especially in sport driving mode, because it does make a difference when you put it in that sport driving mode when it comes to that engine sound. So I like that. So other than that wind noise or road noise, it's pretty much that bag quite honestly, which kind of surprised me because usually with compact cars like the Gulf GTI, you do get a bit more of that, but when it comes to cabin noise, it's actually really good. You just get that engine sound, which if you're buying this car, it's a good thing. But anyways, then touching on visibility, I can see pretty darn good out the back. I will say those second row headrests are kind of beastly. So on those back two quarters there, that's gonna impede visibility slightly, but having said that, this is a smaller car, so you really shouldn't have any issues with rear visibility. Another thing though, you actually get rain-sensing windshield wipers that come standard for all trim levels of the Gulf GTI. So what that is, is when the Gulf GTI detects any kind of mist or rainfall, it's gonna automatically turn on those windshield wipers for you. So kind of like automatic headlights, it's just one less thing you gotta worry about there. And if you were to go with that Autobahn trim level, it's actually gonna, in addition to that, give you a head-up display for even better forward visibility. So it's gonna display your speed, speed limit and safety features up on your windshield. So get better focus more of your attention on actually enjoying the drive, because this thing is a dang enjoyable drive. But anyways, that about rounds off the performance segment of this review you guys. Let's now go ahead and take a look at the exterior of our brand new 2023 Volkswagen Golf GTI. All right, so here she is you guys, the new 2023 Volkswagen Golf GTI finished in Atlantic Blue Metallic. In case you were curious of our exterior color name. So I like that name Atlantic, like Atlantic Ocean. So that's what I'm thinking at least. But anyways, let's go ahead and start where this one is actually made, taking a look at the VIN. First character is the letter W, indicating that this one is built and assembled in Germany as it should be, of course. But let's go ahead and start up front. You got that red accent piece running through the front grille with the red GTI lettering. Definitely very distinguishable for the GTI trim. So a big fan of that.  I love that look. So then of course you can see that big intercooler front and center down towards the bottom there. Definitely a big fan of that as well. To the sides, LED headlights with LED daytime running lights do come standard. You get the automatic feature with that as well. Meaning when it starts to get dark at night, headlights will turn on automatically for you there. And if you were to go with the Autobahn trim level only you will get automatic high beams. So if you have your high beams on at night and it senses a vehicle coming in the opposite direction it's gonna automatically dim them back to low beams and when that vehicle is gone it's gonna automatically then bounce it back up to high beams. So definitely a very convenient feature there as well. But that pretty much rounds out the front end of this one. Very good looking, very low hood line as well contributing to this more aggressive look. So let's now go ahead and make our way to the side of the GTI. All right, so now since we are around to the side of this one gloss black windows surrounds do come standard. And actually one thing I wanted to show you on these gloss black windows surrounds real quick is you actually have some Volkswagen lettering. Kind of etched into the doors there. So I think that is pretty cool. Nice little added touch there that they didn't have to do. Of course also you have that GTI badging found on the front fenders that looks good as always. Take a look at the side mirrors. They are body colored power adjustable side mirrors with LED integrated turd signals. They will be heated and actually they come with puddle lights as well for a little added illumination at night. I thought that was pretty cool. And taking a look down at the wheel configurations 18 inch five spoke alloys coming with the S and S E trim levels and then 19 inch black alloys with summer tires coming with the 40th anniversary edition and the auto bond trim. So little difference there. And the one more added thing I really wanted to mention to you guys is with that 40th anniversary edition, you're actually going to get some added 40th anniversary edition graphics kind of found towards the side skirts towards the bottom of the doors I should say. So it's a very cool look actually. I really liked that. But anyways it pretty much rounds out the side profile. So now go ahead and make our way to the back. All right so now since you are around to the back of this one gloss black shark fin antenna all the way to the top there. Just below that rear spoiler with an integrated brake light just below that rear window wiper. You do have some GTI badging found on the hatch itself right underneath of that Volkswagen emblem. So that definitely looks good. LED tail lights do come standard for all trim levels across the board as well for added illumination at night. And then just below it all, I love these exhaust outlets. I think they look so dang good. But dual exhaust outlets with some massive chrome tips. So having said that I do believe you guys know what we have to do next. As always here is that exhaust clip. All right so now since you are around to the back of the golf here when it comes to opening that rear hatch there's a button of course on the key fob to unlock it. But the way to actually open it up is press in on the upper portion of that Volkswagen logo and then lift up. That is one of the coolest ways to open up a trunk or a hatch of a vehicle. And if you're not familiar with Volkswagen you're not gonna know that. So I absolutely love that. But anyways once opened up cargo capacity comes in at 19.9 cubic feet. If that was not enough space of course the rear seats do fall down. There's a 6040 split bumping that up to 34.5 cubic feet. There is some LED cargo lighting back there. They didn't have to do that. Most manufacturers will still give you halogens back there. So I like that. Grocery bag hooks to my surprise. You typically only find those in SUVs. So very refreshing to see them in this thing. Also you're gonna find some tie-down anchors. Another one of those things you a lot of times won't find in this kind of car. And if you were to lift up underneath of that cargo floor you will find a spare tire but there's actually a little bit of in-floor storage in there too to maybe put an ice scraper or a tire inflator kit or something like that. So a lot going on in the cargo here.  But then making our way up to the rear leg room that comes in at 35 inches even for reference. I mean even six feet tall. This is me sitting behind my own driving position. Of course rear center armrest with cup holders does come standard rear ventilation actually also coming standard. So I like that. There is a little bit of storage just underneath of that rear ventilation. Then there's a couple USB-A charging ports actually as well. And then to my surprise if you actually were to go with the Audubon trim you can actually get heated rear seats coming standard back there without Audubon trim as well to spoil the rear passengers a little bit. So I thought that was pretty cool. Then making our way up to the front seats manually adjustable cloth seating coming with the S the 40th anniversary edition and the S-E so you might be wondering why do we not have that cloth seating? Well, there is an optional leather package for the S-E trim level. I think it goes for $1,225 from correct. But that does give you the leather seating that we have today. And I love this leather seating by the way. You got the GTI badging found in the upper portion and they're all one piece too. So there's not a separate headrest which I think looks so dang good in this car. Anyways, 12 way power adjustable driver's seat for the Audubon trim level and that Audubon really gives you everything else like a power adjustable passenger seat, heated and ventilated front seats, leather seating and that's basically all that we have today here on the S-E because we got that package. So do want to mention that we do have heated and ventilated seats. I got the heated seats on because it's in the 30s today 31 degrees that is freezing but the seats were plenty comfortable. There's lumbar support as well. So certainly didn't have any issues finding my perfect driving position but let's now go ahead and take a look at the steering wheel. It's tilt and telescoping. It is leather wrapped and it is actually heated for all trim levels across the board. To my surprise as well. I'm not sure why I didn't turn that on. There you go. Just turned it on. That is freaking nice. I need that heated steering wheel on a 31 degree day here. And that 10 and two grips are definitely bolstered on the thicker side of things. And I like the GTI lettering found at the bottom and it is a flat bottom steering wheel. I feel like I can go on and on with this thing. Then make your way to the startup. I really like this key. It's a heavy duty key. You got your Volkswagen logo on the one side. Lock on lock and the button to pop the rear hatch on the other side. But it is all keyless entry with a push button start. So all I'm going to do here is simply put my foot on the brake and press that silver engine start button located just in front of the park button. So by the way, let me touch on the shifter real quick to put it in a drive. You simply put your foot on the brake and pull the shifter towards yourself to put it in reverse again, foot on the brake, push it towards the start button and then to put it in park. That's what the P button is for. So a little bit different shifter than most of the manufacturers out there. But now let's go ahead and take a look at the gauge cluster. This is one of my favorite parts about the Golf GTI. First thing you notice when you first get in this thing. So it's a 10 and a quarter inch digital gauge cluster. So that's great. But then if you were to go with the infotainment screen, you go to ambient light, you can actually completely adjust the colors not only of the gauges, but the ambient lighting as well. So I'm going to do that. I'm going to show you guys there's red, there's blue, which is called desire. There's aqua, which is called eternity. There is infinity, which is an orange and vitality, which is a neon yellow. I think that's probably my favorite. And then you can adjust the brightness as well. So love, love the gauge cluster in this thing. One of the best looking gauge clusters I've seen in quite a while, just because you can completely change the colors of this thing. And in typical Volkswagen fashion, there is a view button actually on the right side of the steering wheel where you can choose to display a heck of a lot more as well. So this is essentially like Audi's gauge cluster more or less. You can completely make the gauges all a navigation setup if you want to. If you keep hitting that view button, there's safety information, there's your traditional gauges, there's a full digital gauge cluster. These are the best gauges at this price point available right now today. I'm just going to put that out there in the past 700 plus cars that I've driven. These gauges are phenomenal at this price point. They are the best without a doubt. Love it, Volkswagen, you crushed it. Well done. So to make our way to overall interior quality, there is a power panoramic sunroof coming with the SE and the Autobahn trim levels. Automatic climate control also comes standard, meaning you just set a temperature that's going to automatically hit that for you. Do want to mention though, TriZone climate control is going to be available. Stainless steel pedals are going to come standard on all trim levels across the board. So I like that. Wireless phone charger also coming standard on all trim levels across the board. That's going to be that rubberized thing just in front of the engine start button. So your phone doesn't slide around up there. And be a lighting also coming standard. I just gave you guys those colors. That is amazing as well. Now I will say, wouldn't have minded if they made it a bit brighter. I still think Mercedes-Benz is the benchmark when it comes to ambient lighting. BMW is good too, but Mercedes-Benz does it so bright. If they could make that a bit brighter. I know it's the daytime and all that, but still wouldn't have minded if that was a bit brighter for any future cars, Volkswagen, if you're watching this. But anyways, just to the right of the shifter, you do have a little bit of rubberized storage there. You got a cup holder behind everything there. 12-volt power outlet. And within the center armrest, there's a tiny little bit of storage, not a ton, but it'll get the job done there though. But there is a lot of a hard touch plastics on the actual doors. So wouldn't have minded if they gave that a design rather than just finishing it in the matte black. So I think that would look a lot better. Maybe a honeycomb design that you used on the front grille. Bring it on to the actual door here maybe, just like you did just above there. It actually looks like that has that design. We also have a frameless rear view mirror with a compass up there and homelink controls up to three different garage doors as well. So overall though, interior quality is plenty fine. For me, I certainly wouldn't have any issues. So especially these seats, I am definitely a big fan. But now, let's go ahead and take a look at the infotainment screen. And so there is a little square on the left side. If you're pressed that, that's essentially gonna be your home screen in case anybody was curious. But eight-inch color touchscreen display does come standard. Bluetooth and audio streaming of course, Android Auto, Apple CarPlay. You got your ambient lighting colors up there. You got some vehicle information if you wanted to check that out. There's your heated and ventilated seat buttons up there as well. If you slide it to the right, you got some vehicle information, your navigation information as well, which can take up that entire screen if you wanted to. And of course your radio information as well. So when it comes to the sound systems, there's a couple of them. You got a seven-speaker sound system that comes standard and then there is an optional nine-speaker Harman Kardon sound system. And actually, we got that option today. This thing is fully loaded. So having said that, what do you guys say? Let's go ahead and turn on the radio, see what we got playing today. And let's test out the clarity of this one. Dude, that was incredible. That was an incredible sound system for the Golf GTI. So well done, Harman Kardon. You crushed it with this car. So plenty of bass. The clarity was really what impressed me. It was crystal clear. And honestly, this isn't that big of a vehicle. So really to have nine speakers and a vehicle of the size, it's really overkill. So incredible sound system without a doubt. You're not going to be disappointed with the Harman Kardon. So last thing I want to mention to you guys on the infotainment screen is of course, when you to put the Golf GTI in reverse, you will find a rear view camera coming standard across the board, which is always is going to lead us into safety. And so first, let me start by saying IIHS top safety pick, which is a very good start right there. Front side, side current airbags do come standard.  That's pretty cool. And lane change assist as well. So overall, when it comes to my final thoughts here of the Golf GTI, for one, the driving dynamics overall are great. And that includes that impressive acceleration, includes the very firm braking feel, heavy steering feel, like all of that is what you look for in a car like this. Multicolor ambient lighting is great as well, especially the gauge cluster. The gauge cluster is absolutely amazing. So they 100% knocked it out of the park there. I do like the new trim level for 2023 as well. I like that addition. I like the graphics on the side of it. We don't have it today, unfortunately, but I do like that they included that for 2023. Stars are for improvement goes. I guess I got two things here. Again, with the door, they need to ditch a lot of this matte black plastic and just at least replace it with a plastic with a design to it that would look so much better. And then also with the ambient lighting, the gauge cluster is great. Don't change that at all. But with the ambient lighting, that needs to be brighter, especially for this type of vehicle. I think people would really appreciate a brighter ambient lighting in the Golf GTI, kind of like Mercedes or BMW does. So that would be the benchmark I would be shooting for in this thing. So other than that, this is a wonderful car. I had a blast reviewing it. Let me know what you guys think of the Golf GTI in the comments section below. And that is about it for this week. You guys, thank you so much for watching. Feel free to follow me on social media at the bottom of the screen. If you wanted to see what car is coming next on the channel before it gets to YouTube, be sure to hit the subscribe and the bell notification button if you're into new car reviews, that's what we do here on this channel after all. Do appreciate you guys watching more than you know, and I will see you guys all in the next video. Stay, go cue the bloopers. These things are kind of really cool. Like really cool, really cool, so cool. Stay, okay. So much fun, so much fun.


Bringing together the aging research, the longevity research and the orthopedics just makes so much sense to me because people get injured and then later on they develop osteoarthritis. Why is that? Right? And now not only basic science understanding the pathways and the mechanisms and this is over here in the lab. But how do we take this information and use it clinically? This is the key. This is what's been missing in regenerative medicine. We understand so much in the laboratory but we haven't been able to apply it in the clinic and this research that's being done here in VAIL is bridging that gap. And to me that's that's exciting and that's how we need to move forward. Here at this conference we have an equal number of clinicians and scientists and there's a lot of dialogue going on, there's a lot of interaction, there's a lot of collaboration and that's where we're going to see this industry move forward. Very effective. What I'm hoping to see is more validation of what's actually happening out there. So we can weed out the stuff that's not happening, stuff that's total hype and also and also really encourage patients and physicians to make sure that whatever biologics they use are safe. If you just give somebody stem cells and their hormones are in balance, their diet is off, they have a lot of senescent cells, it's not going to work. But I love the approach here where we are looking at all aspects. It's a holistic approach to regenerative medicine. To me that makes so much sense and I'm grateful to see it happen.


Thank you very much everyone for being here. Thank you, Professor Flugo, for inviting me to this fascinating conference. Thank you, Professor Shahadeh. So I will talk about this subject, trying to compare previous or past attitudes toward animals to present ones in the Muslim world. And just read my paper. I hope you forgive me for doing this.  In his second visit in 1933, however, Lane noted that, quote, the generality of the Egyptians very much changed for the worse with respect to their humanity to brutes, end of quote. The view that Muslims' concern for non-human animals has declined in the last two centuries or has been declining in the last two centuries or so is echoed in several other works. Comparing the past to the present, Richard Faults, for example, observes, quote, in better times historically, non-human animals in Muslim societies benefited from protections and services that filled European visitors with astonishment, end of quote. Other scholars complain of Muslims diminished sensitivity to the entire natural world, to the entire natural world. So what I would like to do in this presentation is, first of all, to identify these changes, see what happened exactly. I would like also to propose an explanation, look into the question of why these changes have taken place. And finally, I will consider whether this, the present course is reversible. So I start with the first part, the signs of this decline. Non-human animals, I'll start with the past and then moving to the present. Non-human animals in the contemporary Muslim world are subject to the same mistreatment that is witnessed in other parts of the world. Factory farming and zoos are now part of the landscape in many Islamic cities. The use of insecticides has become common practice in agriculture, industry, medical institutions and households. Habitat depletion has led to the extinction and or dislocation of many species. Live animal transportation affects the lives of innumerable farm animals. Biomedical research may not be a major issue in the Muslim world, but experimenting on non-human animals is not unknown. More isolated incidents, such as the mass killing of pigs in Egypt during the so-called swine influence outbreak, may also be added to this list. Out of these items, the last is the only one that caused, to my knowledge, that caused public indignation and was largely condemned. Comparison between the past and the present reveals a vast disparity. Although violence toward non-human animals was not unknown to pre-modern Muslims, with the exception of killing certain species for food, institutionalized violence toward most non-human animals was at least contested, if not totally forbidden and often punishable. Thus, even though some jurists, for example, allowed the castration of livestock, others opposed this position vehemently and attempted to refute it, both on scriptural and rational grounds. Unjustified killing of animals, the size of a sparrow or larger, and the mutilation of any animal, were prohibited across the board. Although some schools of law tended to have a lax understanding of the word unjustified in this context, others, particularly the Shafi'i school of law, rarely failed to prioritize the interests of non-human animals, except, of course, in instances where there are clear scriptural instructions to the opposite effect. This is basically just like killing animals for food to satisfy hunger. Shafi'i jurists, for example, disallowed the use of the hides and furs of beasts of prey, the tusks of elephants, and the body parts of any animal that may not be killed for food. In fact, the Shafi'i school of law is quite interesting in its approach to non-human animals, because among the things, for example, that they prohibited, like they say you cannot drink milk until the small animal is satisfied from the mother's milk, because that milk is created for the animals themselves, not for us. So it's only like the surplus that human beings may consume. They also say if you want to milk an animal, you have to clip your fingernails so that you don't hurt that animal. They go, in fact, very far in the... And it's not just like how you use these animals, but also the protections that you need to extend to these animals. For example, in case of extreme weather conditions, what kind of protection you need to extend to these animals. Although the other four schools of law did not measure up to the Shafi'i's, none of them failed to accord at least some protections to other species, and all of them shared the position that non-human animals have chorema, or inviolability, a concept that implied that non-human animals have intrinsic value and were not to be used simply as means to humans' ends. Furthermore, many of the rules pertaining to non-human animals were administered by government institutions. For example, one of the responsibilities of the Muhtasib, a government official charged with the supervision of public order, was to make sure that animals of burden were not overloaded or mistreated. Beyond the legal sphere, comparison to non-human animals appears to have been a vibrant aspect of social life in the previous Muslim society, like in medieval times and pre-modern times. Whereas the normative level of the tradition is mostly reflected in Islamic sources, the concrete treatment of non-human animals was captured mainly by the eyes of non-Muslims, particularly Western visitors to the Middle East. The attitudes of Muslims or Turks or Egyptians to non-human animals is in fact a recurring theme in the 18th to the early 20th centuries in European travel literature. George Fowler, for example, notes that, the Turks are notorious for their mercy to animals. Kenneth L. Roberts expresses his aversion to Turkish restaurants which are filled with flies, because of the Turks' well-known aversion to killing beasts or insects. S. Hill observes that, the compassionate disposition of the Muslims extends itself beyond the human species and is exhibited in tender treatment toward the brute creation. Dogs, cats, birds and any animals that are not venomous or otherwise dangerous to men are very rarely, if ever, beaten or wantonly destroyed.  End of quote. Joseph Nightingale writes that, quote, from feelings of compassion, hunting is held in abhorrence by the Turks and birds are seldom deprived of their liberty. End of quote. Nightingale also notes that, although Muslims usually keep dogs at a distance, this is because of ritual considerations, these animals are still, quote, fed by the liberal inhabitants and donations are often made for their support. So this is, I hope, gives an idea about the differences between the past and the present. So I don't think actually that this is just like an essentialized image of the present as Dr. Tomelin was saying in the past. I think this was an actual dimension in society. It is not something that we just see, you know, like defended by Muslim scholars, but it seems like it was part of the social life, the everyday life of Muslims. And it continues in certain aspects. It continues to be there also in like the contemporary Muslim society. Now I reach the second part of this presentation where I try to account for this change. Fazloun Khalid, similar to Professor Lu Fang, attributes the current universal ecological crisis to the rise of modernity. He posits that the secular scientific world view, one of the foundational ideas of modernity, produced a shift in humankind's perception of itself in relation to the natural order. Because of this shift Khalid explains, humans who for Aeans resided in nature's bosom suddenly became its predators. Modernity achieved its way over substantial parts of the world through various means. After transforming its birthplace Europe into a group of nation states, the latter succeeded in persuading or coercing the rest of the human community to organize their lives in like manner. Colonization was one of the important vehicles of this transformation. The colonizing powers created and left behind colonial educational systems and modernizing elites that continued to perpetuate the ethos and propensities cultivated by modernity, including irreverence toward tradition, readiness to innovate, and recasting of the old as antiquated, obsolete and something that needed to be replaced. This is a summary which in fact does not do justice to the entire argument of Professor Fazlun Khalid, but I try just to choose some of the points that he makes which are relevant to my discussion. Consonant with Khalid's analysis, they manage sensitivities toward non-human animals in the Islamic world, strongly correlate with Muslims' contact with modern thought and culture. In fact, to go back to Lane's observation, which I cited in the very beginning of this presentation, Lane, when after Lane describes Egyptians decreasing consideration for non-human animals, he adds, quote, I am inclined to think that the conduct of Europeans has greatly conduced to produce this effect, for I do not remember to have seen acts of cruelty, for I do not remember to have seen acts of cruelty to dumb animals, except in places where Franks either reside or are frequent visitors, end of quote. In addition to this possible influence at the concrete level, contact with aspects of modern thought produced far-reaching changes, including changes in the Islamic world view. And now I would like to elaborate on this point, what kind of changes occurred in the Islamic world view, which in my opinion have not been very beneficial to the welfare of non-human animals. The shift in self-perception, which Khalid identifies at the level of humanity, is quite discernible in the Islamic context. A cursory reading of pre-modern Islamic literatures shows, for example, that Muslims used to place humankind within the animal world, but this is no longer the case. This shift is noticeable, for example, or first of all, in lexical treatments of the Arabic words for animal, the two words, hayawain and debb. Whereas pre-modern Arabic dictionaries never fail to highlight the fact that these two words designated human, spiritual, and non-human earthly animals, that spiritual, I mean angels and jinn, also were considered to be part of the animal world, modern dictionaries rarely include humans and spiritual creatures in their definitions. Furthermore, and like Arabic modern works on animals, medieval animal books such as Al-Jahad's Kitab Al-Hayawain and Ad-Dameeri's Hayat Al-Hayawain Al-Kubra have substantial sections discussing human beings who are treated as one, among other animal species. Works of jurisprudence reflect the same position. For example, when the medieval Hanafi scholar Badr al-Din al-A'ini discusses animals that are entitled to certain types of medical treatment, he categorizes them into two groups, depending on whether or not they may be killed for food. Animals that may not be killed for food include human beings, mules, and donkeys. Even Muslims' understanding of the Quran has been affected by this change. For example, in his commentary on the Quranic verse, quote, there is no animal in the earth safe that God provides for it, end of quote, the early exeggit al-Bahak interprets the word animal in this verse as, quote, a reference to all animals, including human beings. Whereas the modern exeggit al-Tahr ibn Ashur says about the same verse, the word animal designates any creature that moves on earth with the exception of the human being, end of quote. Humans, therefore, are no longer situated within the animal world, which indicates that non-human animals are now relegated to a lower status. The kinship between humans and other animals was not only emphasized in medieval Islamic literatures. Occasionally, it was also presented as a foundation for moral consideration. Medieval biographical works report, for example, that when the scholar, Ruknadine ibn al-Qawbah, saw someone beating or hurting a dog, he reprimanded that person saying, why do you do this? Don't you have animal hood in common with this dog? A mahua shariqu kafil hayawaniya? This statement indicates that ibn al-Qawbah, first, saw nothing offensive in establishing kinship between humans and dogs, and second, that from his perspective, this kinship entitles the dog to good treatment. Furthermore, since this anecdote is cited to illustrate ibn al-Qawbah's piety and good character, it suggests that his biographers share this position. It suggests also that their larger audience probably subscribe to the same position since these biographers do not anticipate objection from them. This, of course, is not to suggest that medieval Islamic society perceived no difference of status between human beings and other animals. According to medieval texts, humans were indeed assigned a higher status, but the perceived difference appears to have been, generally, one of degree rather than of essence. Besides, for the most part, Muslim scholars did not necessarily see a correlation between superiority of status and entitlement to use other animals for humans' interests. Thus, even the permissibility to kill animals for food is more often given a theocentric rather than anthropocentric justification.  Many scholars, particularly from the Mu'tazili School of Thought, in fact, saw that this was not even a rational position, like the fact that non-human animals may be killed for food. It's not something that we derive from rationality. It doesn't make sense. It makes sense only because God allowed it, and since God has allowed it, He is going to recompense non-human animals profusely for their loss of lives or for any pain that He allowed to be inflicted on them on this life. The shift in self-perception is also discernible in the newly developed notion of vice-gerency or stewardship, which has become the foundation of the modern Islamic ecological worldview. This notion implies that humans or Muslims are now perceived as God's deputies on Earth with an obligation to manage or care for the natural world. This implies that they are no longer part of nature, rather they are on the top of it with a divine assignment that places them above other earthly creatures, particularly non-human animals. Advocates of this notion, it is true, almost never fail to emphasize the accountability dimension which accompanies this supposed divine appointment. This emphasis notwithstanding the simultaneous appearance of this notion and the unprecedented decline in Muslims' attitudes to the natural environment, including non-human animals, do not seem to be a mere coincidence. This shift in self-perception has tangible consequences. In the same way that kinship between humans and other animals seem to serve as a basis for moral consideration, in medieval times, absence thereof has facilitated the dismissal of non-human animals' interests in the present day. To illustrate this point, I will compare the positions of two Shafi'i scholars from different periods. As noted earlier, members of the Shafi'i School of Law generally disallow the killing of non-human animals unless a scriptural instruction made such an act permissible. Since Islamic dietary laws do not allow the consumption of the flesh of donkeys or of animals of prey, the medieval Shafi'i scholar Mohi-e-Din ibn Sharif and Nuhawi says, Our school does not allow the killing of an animal, the flesh of which is not consumable. An old donkey or a mule with a broken leg may not be killed, even if one intends to make use of their hides or to use their flesh as a bait to catch eagles and hawks. In diametrical opposition to this view, the modern Shafi'i scholar Atiyah Saqr does not oppose the killing of an old donkey or an animal whose flesh is inedible. The only condition he imposes on this is that good use be made of the killed animal, for example, by benefiting from its hide or feeding its flesh to zoo animals. Thus, wild beasts of prey may not be killed wantonly, but it is legitimate to kill them for their furs, hides, bones, or any other body parts. So this actually is like the total opposite of the medieval Shafi'i position. Atiyah Saqr, the modern jurist, also defends the legitimacy of keeping zoos on the alleged reason that they enable us to study the habits and natures of wild animals. These views are perhaps the more noteworthy because Saqr expresses them after citing views belonging to earlier authorities from his school. This is thus a deliberate departure from the earlier Shafi'i position. So now I hope this gives an idea of how these changes have gradually taken place, and I would like to consider whether the present course is reversible in the last part of this presentation. In spite of this bleak image, hope is fully justified. Richard Faltz maintains that, quote, in recent years, a few individual Muslims have given attention to animal issues as never before, end of quote. Although I disagree with parts of this statement, Faltz's observation is not without validity. In my opinion, whether in terms of depth or breadth, the level of attention that pre-modern Muslims paid to animal issues has hardly been equaled or even approached by modern Muslims. Nonetheless, Western-style animal activism, to which Faltz refers here, is an important emerging phenomenon among Muslims, especially those living in the West, and seems to have won many over to the animal cause. As a result, many Muslims are now careful to consume only ethically produced animal products, and some have even embraced vegetarianism and or veganism. This development shows that, in fact, aspects of modernity may be useful to the animal cause. This type of activism, however, has a very limited scope and is unlikely to produce significant changes in the entire Muslim world, at least not in the near future. In my opinion, more significant results may be obtained, first, through reform in education, and second, by engaging religious scholars in deeper discussions about non-human animals. So now I will elaborate on these two points. One of the immediate causes for Muslims diminished sensitivities toward non-human animals is lack of information. Like other citizens of the world, most Muslims seem to be unaware of the life conditions and types of mistreatment inflicted on many non-human animals, especially in farm factories and research institutions. Besides, given that most or all Muslim countries have adopted Western-style educational systems, the last few generations of Muslim students have hardly had any exposure to scriptural teachings about non-human animals, let alone medieval scholarly discussions thereof. More exposure to such themes and discussions is almost certain to revive Muslim sensitivities to other species. About the second point, engaging religious scholars. Religious scholars can also play a key role in this respect. Islam, as several observers have noted, shapes all aspects of a believer's life, including his or her relationship to non-human creatures. Given that humanity nowadays is faced with an entire set of animal issues that are unique to our time, many lay Muslims seek the opinions of religious experts to understand Islam's take on such matters. The opinions of religious scholars are also sought on animal questions which are not unique to our time, such as the permissibility of wearing fur or killing old animals. As we have seen, for example, the opinion by the modern jurist, Saqr, was in fact an issued legal opinion, a fatwa. Someone approached him on the permit, whether he can, like they have an old monkey and what they could do about it, like whether they could kill it or not, and he issued this opinion as a reaction to a question that was addressed to him. Should, for example, religious scholars pronounce certain animal products as an Islamic, many Muslims would probably turn away from them. Religious scholars can have a deep impact not only by issuing legal opinions, but also by inspiring other Muslims and nurturing in them feelings of compassion toward non-human creatures by exploring the abundant material that is available for them, something which religious figures from previous centuries seem to have done. Considering the wealth of available insights, this goal does not seem to be far-fetched. The main reason why this has not happened yet, in my opinion, is that animal issues seem to hardly preoccupy Muslim scholars enough for this question to obtain due attention. Finding ways to engage them in such process, however, should not be a major hurdle, I hope. Thank you very much.


Masawa Air Base opened their doors to the Japanese public for AirFest, an air show with aircraft from the U.S. Navy, U.S. Air Force and the Japanese Air Self-Defense Force. I think events like these are extremely important to the Japanese-American alliance and the way the relationship to work on several levels. I mean, the fact that, you know, the JASDAF side and the American side are working together to put on the show, let alone just shows a great camaraderie that exists there. But then also, the fact that we can actually give back a little bit as Americans on this base, you know, the Japanese are allowing us to be here and the fact that we can actually give back to them, put on a show, show them that we're here for good, we're here for them to strengthen that bond, I think is really awesome and I think it's really important because they allow us to live here, they allow us to work here and, you know, we get a taste of their culture all the time and a taste of their food and a taste of their experience and it's nice to give back a taste of ours. Petty Officer Brian Mai, Masawa Air Base, Japan.


Okay, everyone. Welcome to Mailware Freak Show 2. So here's the agenda for you. We're not going to really walk through, you know, each bullet by bullet, but just one thing to note is that this is a continuation from a talk that we did last year at DEF CON 17. And we wanted to dig a lot deeper and expand it to some various different classes of Mailware, but also show you some new things that are going on in the world of Mailware development. So we're going to spend a lot of our time during this presentation during the sample analysis. So just keep in mind, so there's going to be a lot of demos. We have four demos for you this year. It's a little bit about us. I'm Nick Prococo. I'm the Senior Vice President Head of Spider Labs at Trustwave. I have around 15 years experience in information security. I built and lead the Spider Labs team at Trustwave. Some of my areas of interest are targeted Mailware, attack prevention, mobile devices, but really from a business and social impact standpoint. And this is Gibran. Hi, I'm Gibran Elias. I have been in this industry for about eight years. I recently got my master's from Northwestern University. And when I'm not doing work, I'm actually doing work, which is anti-forensics, artifact analysis, and real-time defense. So turn it over to Nick. Sure. So to go over introduction here, so basically, we had a very busy year. As a team, we visited over 200 environments, 200 incidents, and that span about 24 different countries. We had hundreds of samples to pick from. And we worked together to pick what we thought was the most interesting pieces of Mailware that we solved the last 12 months and present those to you for you here today. So we have some new targets. And so if anybody attended the talk last year, we talked about the target environment, showed you how the environments work from a technical standpoint. We're going to fast-forward a little bit past that and really describe just the environment at a high level and spend a lot of the time focusing on the Mailware itself. And with the new targets, we have our First Bar in Miami, an online adult toy store, international void provider, and a U.S. defense contractor. So one thing to note that we realized during the preparations of this talk is that Mailware developers were very busy over the last 12 months updating and making enhancements and making changes to the Mailware that they had been developing. Really, it's many improvements they made to avoid mistakes, and we're going to go into those in detail in this presentation. But we were really chatting and thought maybe they saw our Freak Show last year. We pointed out some flaws and they seem to have improved them over the last year. So what is a Mailware Freak Show? Basically the bottom line question sort of answered there, but basically we have access to breach environments. Now these are actual environments that were confirmed breaches. Very important information, very valuable information, very valuable data was taken out of these environments using Mailware. And so really historically the smash and grab was used where the attacker would break into a website or break into a physical location and steal data. They just take the data and run off with it. Today they don't do that very often anymore. What we found is that they spend an average of 156 days within these environments. So this means that they hack into a e-commerce site and they'll be on that e-commerce server in their database for an average of 156 days before someone catches them. So that's something really, really important to keep in mind. Also when they're in that system they have a lot of time to explore. And so they run into business systems, systems that are not the run-of-the-mill system. They're custom developed and they have a lot of time to develop their Mailware and craft them to target those specific environments. And that sort of leads it to the next bullet there is that custom and targeted Mailware is now the norm. It's not the exception. I think when we were doing cases, so you've been investigating cases like five years ago, smash and grab was the norm. And then we started seeing things ramp up. And nowadays when we go out into the field it's basically every single case has Mailware involved with it in some form or fashion. So basically the reason we're doing this freak show is basically to gather information, perform analysis on each piece of Mailware and then the real benefit is to learn about the sophistication of the authors and learn about the sophistication of the current threats. And so the bottom line goal there is to rethink the way we alert, detect and defend in these environments. So what I'm going to walk through before we get into the demo is I think it's important to walk through what we feel is sort of the anatomy of a successful Mailware attack. Now what we did is we took a look at the Mailware that we saw that was successful in the last 24 months and sort of came up with sort of a blueprint. Like if you were to sit down and decide I'm going to write a piece of Mailware and I want it to be successful not just make a lot of noise and crash things and a lot of bells and whistles goes off but you want to have something that's a targeted, custom piece of Mailware that's going to be highly successful in getting data out of an environment. We put together sort of the steps here that we thought were what the Mailware authors were actually using. So we're going to go through each of these steps here. So step one, the authors have to identify a target and so you're not just going to sit down and write a piece of Mailware with no target in mind. And so there's a lot of information out there.  But in the real world or in anything, the end goal is for someone to get money, right? You're not just going to write a piece of Mailware and unleash it. You may, but a lot of the cyber criminals in the organized crime groups want the cash. They want to get cash in the end. So the two big focuses that we see is credit card data that's one piece of data they're looking for and then also ATM and debit card data. Now in the credit card world, in the credit card data world the data exists in clear text in many locations and environments. It's not supposed to be in clear in all environments post that after it's been used, but we often find it is and we'll talk a little bit more about why that is. But basically the cash itself, you sort of see this chain that's on the screen there, that's sort of what I sort of call the Mailware food chain. And basically the cash is at the end, right? So when you have track data which is the data that's stored in the back of your credit card, when you have that data in your possession, you can go and clone a card. You then can go and commit some sort of fraud, right?  You now have a plasma TV in your hands that you bought with a stolen credit card. But then you have to, you could either use that for your own use, but in most cases they want to get cash. So then they have to go and sell those goods to somebody else to collect the cash. And the ATM and debit card world, the data looks very, very similar. There's pins that are associated with ATM cards, but the data itself is basically identical. But the cash is much closer to the criminals.  They don't have to find a buyer for that. And so we hear about large organized crime groups who go and they'll hit a large number of ATM machines all at the same time.  No one could, they don't have to worry about going on the street and finding a buyer. They have that cash and they can move on to their next operation. So that's where you identify the target. So it may be a bank, an ATM network, or an organization that takes credit card information, maybe your target. Now developing the malware, so really we break these things down into sort of the big three. These three functions are basically going to help you obtain the data in the most efficient way. So a keystroke logger, a network sniffer, and a memory dumper. And so we're going to go through those. I'm not going to talk to detail what those are, because when Jabron does some of the demos, we're going to touch on the network sniffer and the memory dumper.  It records keystrokes, but they're using this, but the attackers are using this in a little bit different way. And so I'll just touch on that real briefly, is that when the data itself is being inputted into a system, the data itself is being inputted via a keyboard type device, a swipe device. If anybody ate here at one of the coffee shops or someplace and you saw them swipe your card, that data is actually being inputted into a system just like you would if you typed it in. It's just being right off the mag stripe and inputting the system. Nothing really special is going on. And so then we also sort of have their sort of disk parse with a question. We often don't see that. Now there is data sometimes stored in the system, but it just be easier to take the file and leave. The persistent types of attacks are going to use things that are going to try to access data when it's being used in an active state. If you think of a system that is obtaining data encrypted, it's releasing data encrypted, it's storing data encrypted, what's the better way of obtaining that data than through things when it's either on the network in the clear, if it's in the memory in the clear or being entered into the system in the clear. Some other design considerations, naming convention. Blah, blah, blah at EXC is not the best name to use if you're trying to be stealthy in an environment. If you choose something like SVCHOS.EXE, that's much better. Most IT administrators that are looking at their task manager are not going to notice that as something out of the ordinary. Also, slow and steady wins the race. The attackers and the attacks using malware that we see are very successful. They don't jump in there and make a lot of noise and start doing a lot of damage. They're going to stick around for a while. The malware is going to run and just collect data and siphon that out of the environment. And then of course, persistency. When they reboot a box, you don't want to have to reinstall your malware. You want to be within that system and maintain persistence through many, many reboots. And then data storage as well. You've got to make sure that the data you're collecting is not going to fill the hard drive of the system. So here's step three. Basically infiltrating your victim. So we have a couple of different ways. You have basically the physical way and we see these attacks. You walk up to a computer, you stick a USB key in and it basically puts the malware on the system. That's a physical way. The easy way that we often see is sort of remote desktop and default passwords. We see those all the time. Now the malware itself that's being installed has complex properties. The attack factor is very, very simple. It's something that should not be there, but we see that hundreds of times in many environments. And then you have the Uberway. You have basically the O-Day. We do see that from time to time, but in most cases the attackers are going to use vulnerabilities that are rather old. Things that have been around for a very long time and basically there's available there for the attackers to take advantage of. Now finding the data. The software we found holds the secrets. If you're on a system, you're looking to find out where that data is stored within the environment. The task manager is a really good tool. You can see the processes that are very, very busy. That usually is placed where there's data being processed and that's where you can then hook your memory dumpers into. And then the folders, the processes folders, temp files. We still see those containing a lot of data. Configuration files that contain debug parameters. You turn the debug parameter on on a system and sure enough it starts logging all the activity that it's doing to the hard drive. It's typically there for some of the troubleshoot it, but it makes attackers life pretty, pretty easy. And then of course the wire. In most environments that we run into, even financial institutions, the data on a local network is often not encrypted. Now it's encrypted when it goes across the internet to other locations, but when it's on a local environment many organizations don't feel that it's important that they encrypt that data as it's being transmitted between systems. So that's a big place where you can find data. Then getting the loot out, basically once you try to get the data out of the environment, many, most of these environments have little to no egress filtering. So you don't have to worry about just trying to, you know, it's just limited to say, you know, port 80 or 443. But that doesn't mean use 31337 as the port you use to send that data out. Don't reinvent the wheel. Use what's commonly available, common internet protocols. And it, because really the IT security professionals that are going to look at those firewall logs are going to look for freaks. They're going to look for things that look out of the ordinary. If you're sending your data out of port 80, they're probably not going to notice it very quickly. The last step here, basically covering your tracks in obfuscation, we find this is rather, sometimes optional, right, from a successful malware attack. Like I said earlier, we found the average of these attacks lasted about 156 days. That's a long time for someone to be in the environment before someone noticed it. So being, you know, trying to be covert and trying to cover your tracks, not always extremely important, but it can help. Now, some notes though. Don't be clumsy. This is successful, you know, something to take away as far from the successful malware writer has to put within their malware. Basically, you know, crashing systems, that's sort of bad. You know, filling up disk space is really bad. And, you know, we've, you know, filling up disk space, you know, you might get away with, because a lot of the clients that we see sometimes actually aid the clients. We've seen an instance where, you know, the attackers were kind of filling up the disk space. And guess what the IT guys were doing? They're installing another terabyte hard drive. And then another one, and then another one. And, you know, that's not it. So when they, you know, spend enough money, like $300 on hard drives, they're like, yeah, let's delete the 2003 accounting data, 2004. And finally, they picked up the call, the phone, and said, hey, trust me, we need your help. So it's kind of a note there. Yeah, and then just then command prompts popping up. We've seen some malware that's poorly written, it does those types of things.  You have things popping up. We actually received a call from somebody who said, you know, I think there's something going on in our system. And it was because the mouse was moving around by itself. So you're making things obvious to the 10 end user. Even someone who's not technical is not a good sign. But then you want to mess with the investigators and the cops, right? So you don't want to make things easy. Mac times, you're going to modify those to match the install dates of a lot of the utilities or the files that are in Win32. We're going to show you this. A lot of these new attributes here came into play in the last 12 months when they started doing these things. Office getting output, we're going to show you that in some of the new malware samples. Packing, basically, you know, packing the bag of tricks using packers. You don't have to pack the custom malware you wrote because EV is never going to detect it. But if you're bringing along some other utilities, you have to actually pack those in order to really, you know, be covert in some fashion. Basically, automating but randomizing events. And we're going to show you some things that are going on in some of the latest pieces of malware. But most of the malware writers today are basically lazy, right? So they're going to install this malware and they don't want to keep coming back. And so they want to watch a website or watch an FTP directory and just collect the data as it flows in after they've installed this malware in many, many environments. So, you know, randomizing those events can help avoid detection as well. And then rootkits. So that's one of the latest pieces we've even seen in this type of malware is they're getting away from executables and diving down into using rootkits. So now we're going to jump into some demos. And so, like I mentioned, we're going to spend a lot of time, you know, a big portion of the presentation in the demo aspect of it. So let's talk about this environment real quickly. This is the memory rootkit malware. We gave this guy the codename captain brain drain.  You know, sort of they get the win for for a file name. You know, choice. It is a target's Windows platforms. Now the key features, I'm not going to talk about that because Gibran is going to demo all of those for you in a couple minutes. But then I'm going to talk a little bit about the environment. This was a Miami sports bar. It was an elite location and a lot of celebrities that frequent that location. The IT operations was outsourced to a third party. This is not uncommon. Most organizations below normal enterprises outsource everything. And so they have really no ability to manage these systems themselves. So they're going to outsource it to another company. When we talked to the owner, we actually, we talked to them and asked them about security, about what they do with their systems. He basically said he was getting notices from his bank about online security and compliance and he basically gave him a headache.  He basically admitted that to us. And then the other sort of byproduct here is that the point of sale system was also the sports bar's DVR. It was also the DVR server. So if you ever wonder what goes on in a Miami sports bar after hours, you really don't want to know.  The five second rule does not apply. So now we're going to jump into some demos. Alright. So everyone hearing me okay? In the back. Alright. So are you all ready for the demos? We've got about four demos and I want you to say, yeah, if you are ready for the demos, are you ready for the demos? Am I ready for the demos? No. I've got to move this couple. Alright. So without further ado, let's go into the demos. Okay. So the first sample I have is, it's called the memory root kit. So as Nick mentioned, you know, a lot of malware, you know, now that databases are getting encrypted, we can't really do just smash and grab. So what attackers need to do now is basically maintain persistency in the system and they basically dump the memory where the data resides unencrypted. So you guys are very lucky you guys are going to see an actual malware that is going to install itself as a root kit and steal data from the memory. So without further ado, let's go on to it. Let's see, is the resolution okay? Yep, it's fine. Okay. So I'm going to go to the folder that has the memory root kit malware. I call it memkit and let's actually see what samples it has. So it's got a loader.exe which is basically a file that loads the root kit into the kernel. Then you've got Ram32.sis and actually you know what, this demo is going to be really interactive. We really planned prizes for you guys but we lost all our money in Blackjack last night so the most we could do is give you a Twitter mention if you answer a question. So Ram32.sis wants to take a guess what this file could be. This is the actual root kit that gets installed and searcher.dll that has the track data expressions and you know what not to enable to search the data on the hard disk. So let's actually see what the loader.exe is all about. So I'm just going to do run a strings command on loader.exe and I'm going to show you what it has. So as you can see the usage of this attackers you know they program really neatly too. So they have like a whole usage area in the program. I is to install the system driver. I must be in the current directory so they're helping us out as well. R is to start and resume the capturing. So if you have the malware on the system if you want to start or you know there's an option right there. S is to stop the capturing and U obviously is to install and they also tell you hey it doesn't install until you reboot so pretty helpful there. Okay so what we're going to do is just load this root kit into our kernel. So as you can see loader.exe I just give it an I switch and it installs Ram32 driver. Now we want to run this and we want to start this right. So loader.exe so far so good. Alright so now we're going to go to this windows folder where malware actually dumps the files. So I'm going to sort my files by date modified you know because the file should be created right now. As you can see we don't see any files so what I'm going to have to do and actually I'm going to let you guys answer this. What do I need to do here? Show it in files. Alright you guys are on this. Okay and I'm going to sort this by date modified again. Oh no. It's not the demo. There's one more thing that the malware has. Anyone wants to take a guess of what that could be? There you go. You're getting a Twitter mention. Alright so we go to view again and we uncheck this box. High protected system operating system files. We do that. It gives us a warning but what the hell. Just go with it. Okay so now we see a weird looking file. Can everyone see it? 7152 whatever the random digits are. And it's 0KB right now. So why is it 0KB right now? Because we haven't sent any data to the memory for the malware to attack. So I'm going to open this file in text pad. Favorite text editor. Alright are you part of the team? Okay so right now there's no data there because in the memory we haven't processed any track data.  And I'm just going to open some checks. So these are basically the temporary files like when you swipe your credit card at a bar at a restaurant at a hotel. These temporary files get created but just for very tiny you know maybe a millisecond and then it goes to the database. Or it just goes to the memory and then to the application to the database. So these are some files that I'm just going to load up in my memory just to kind of see what's out there. And basically in my old transactions I'm going to say since we don't have a real point of sale program I'm going to say all payments processed. Alright cool. Alright so I saved this and now we go back to this file and text pad. It's alerting us that hey some application has updated this file. Now we didn't write anything through the file right so it's got to be the malware that did the job. So we're going to reload it and here you go. So we see credit card numbers, the names and this is basically the pattern of track data track 1 data and track 2 data. Now this malware has an additional feature now a lot of the companies like are investing in DLP software and credit card data scanners who can tell me what's wrong with the track data format here. So there's one really tiny thing that this malware does and it's a really neat feature. So if you see here in the first line after these numbers right before the tangent of star tangent we see a percentage sign in track 1 data format in the real data in the real file that I opened we see a credit character. Now this is actually a big indicator for track 1 data and a lot of DLP software they code this into them to be able to detect track 1 data. So what the malware is doing is replacing all the credit keys and replacing it with a percentage sign so if anyone's searching for track data they won't get it. And you guys might be wondering why people don't just search for card order data and that's because a lot of times when you search for card order data you get a lot of false positive, a lot of noise. So a lot of people just search for track 1 and track 2 data. So that's one thing that they do and then also if you look at the track 2 data so in here there's an equals to sign right. So guess what the malware does to the equals to sign. Damn right they turn into money. So that's basically how neat their output is. As you notice my actual transaction file had a lot of other stuff but when the malware runs and it searches memory for the data it basically parses out just the track data and it puts it in this neat format. And the last feature of this malware that I want to demonstrate is that since Nick mentioned they don't want to come in every time and rotate the files themselves. So it has an automated feature so what it does at about 10 a.m. every day is that it changes the file. So let me change the system time to 9.59 and I'm going to make it a.m. So right now we see the date modified 7.31 6.24. So right when the clock hits 10 o'clock this basically becomes 0KB and the new time is 10 a.m. So any guess is what happened to the data in this file. So this is our file and now it's got no data. So what happened was this malware actually rotated the file and it created a new file with today's date. So it says S 2010 7.31 and this is the file that has all the data. So if I just do word wrap you'll see the exact same data that you did in that file. So that's basically it for the memory dumper malware and we're going to move on to the next malware now. Okay. All right. Let's jump back into the presentation real quick. So this next piece of malware is basically Windows credential stealer. So we gave it the code name don't call me Gina and you'll see when we're going through this why the file name is sort of a good choice as well. But again the target platform is Windows. Now the victim here just a little set this up a little bit. This was an online adult toy store. They had about 100 person company. They had some stores as well some physical locations. But they decided to outsource all their hosting basically and development to a low cost provider. And it was sort of a well known provider. They found the information about that company and sort of the back of a tech magazine. It looked really great. And just like everybody else when they're shopping for hosting providers. And basically they found that there was a remote desktop enabled. It basically was a terminal server. And so just to set it up a little bit the attackers were able to get into the remote desktop or system or the terminal server that was used by the hosting provider to get access to all the systems they were hosting. And so I'll set that up for you. And then one other piece is that at the end result the attackers were able to then modify the adult online toy stores website so that it would query the database when you called a certain page and it would dump all the latest transactions into a web page for them to then go and download. Now the attack itself from the functionality. Jabron is going to demo that. But I just wanted to set it up and show you the first part of how they got in and sort of the end result. But the real meat of the malware is actually in the middle of what they were able to do. Alright so we are ready for demo number two. Are you ready for demo number two? Alright. So by the fourth demo we should be here to track one. Alright so this is actually one of my favorite malware. And actually this relates to all of this because you know a lot of us you know if we don't use Windows XP computers we touch this at some point in time because they're so insecure. But anyhow so I'm going to show you the pieces of the malware. And I don't know why when I do it first time it doesn't do it anyway. So call it Gina and let's actually see what's in this package. So we've got FSGina.dll. Now who can tell me what MSGina.dll anyone have heard of MSGina.dll? Yeah so it's basically you know it helps with the authentication process right. So when you see that screen with your name on it and says hey come enter your password so I can steal it you know that's MSGina or you know a slight variation of it. So FSGina is basically a variation of MSGina. It tries to get loaded with MSGina so that it could capture the passwords upon legit logins. Now FSGina.reg is actually an automated script. If I just run this the malware is going to load in the registry but I'm actually going to be nice enough and I'm going to show you guys exactly which key it changes in the registry.  So I'm going to copy these two files FSGina and timestomp in Windows system 32 directory. So what we're going to see is that these two files basically you know they show up at the top right.  So likewise you know attackers know that and what they try to do is basically try to hide their malware around the time when the operating system was installed. So this timestomp utility actually does that for them. So I have this command here that is going to change it but I'm going to tell you a reason why I chose this time Saturday 4-13-2008. It's not because it's my birthday but it actually has a meaning. So I'm going to go to system 32 folder and actually check the time of MSGina.dll. Now if I'm a good malware author and you know I'm actually on the system I want my FSGina like the fake SGina to have the same time as MSGina. So it's basically 4-13-2008 10-42 p.m. so what do the malware writers do? They do the same time. So if you notice right here FSGina right now has date modified of 6-16 and date created of 7-31. When I run this command here it's going to change the time and look what it changed it to. 4-13- 10-42. So yeah now if you're the hacker you would want to delete timestomp.exe so when someone does this date modified date created sort of by that you don't see any malware right? And FSGina basically shows up with you know all the other files. It's lost in the system 34. So now to infect FSGina and to win logon process we actually need to change a registry key. And the registry key that you need to change is you go to hklocal machine, software, Microsoft and a lot of people would think it's Windows but it's actually Windows NT. So you go to Windows NT, current version and find win logon folder and basically all you need to do is add a string value and you call it Gina DLL and when you add Gina DLL you also have to give a path so I do a lot of typos so I'm actually going to make sure that I just copy and paste. Alright so what we're doing is we're saying okay add another registry entry so when win logon .exe loads with the operating system it's going to load MSGina but it's also going to load FSGina and FSGina is going to be the malware that is actually going to take the data. So how that is here I'm going to reboot the computer and we are going to log on to the system to see if it actually works. So while it's rebooting I guess it's going to take a couple seconds to reboot. We're going to raise the question about sort of third parties. We see a lot of environments, special organizations who don't have the ability to manage their own systems putting a lot of trust in third parties and we see a lot of those third parties letting people sort of astray. I mean they say that they're supporting the systems correctly, they say they're securing the systems but they're actually not and so when we see these environments really the organization was compromised because a third party left their perimeter really really really relaxed and so it should be coming up soon but basically that's the main takeaway from this piece of the demonstration is that once that file is on the system it not only left that one organization exposed but all the clients that were accessed through that terminal server also were exposed as well. And remote desktop I know came out everyone jumped on it and still now we see a lot of the environments that say okay yeah it's remote desktop but it's secure, it has encrypted session but just to get to remote desktop if you're running remote desktop on port 389 your chances are of getting phoned are really really high because what the attackers do these days they're looking for remote entry points they're looking for low hanging fruit so if they get remote desktop VNC PC anywhere yeah believe it or not a lot of people still use it and so they basically write cracking programs for remote desktop and once they get into one it's their way then.  So we log in with the correct credentials and when we go to Windows system 32 folder what I'm going to show you is that there's going to be a file and the file is going to be just plain text file and we'll see how clearly we can see the username and password so we go windows system 32 alright so you see like on 731 it created a new file users that so let's double click it and see what it has there you go so all it has is my machine name then it has TW that was the username and the password so basically you know you saw me writing Defcon and you know all those other fake ones it only captured the one that it needed to and that was the legit one so with that we're going to go to the next demo and it's called CTA actually Nick's going to talk about it. Okay so in the interest of time I'm just going to go over this very very quickly but basically this environment was a international void provider so they had a lot of customers they had two different methods of sort of taking data into their environment one was via kiosks where people were buying these prepaid cards and another website and so basically in their hosting center they had a server that was processing all of this data now one thing to note about this data center when we went to do our investigation we actually walked up and out came about 20 cats out of the data center because it was really it was at a barn in the middle of nowhere is where this hosting provider was and so we were sort of confused while these cats were sort of living there and living around these servers but then actually just last week I was watching on television with my son and out came a commercial cat versus dogs 3D and I had this revelation and I was like well that's what was going on the cats were running the ISP so we'll jump in to the payment switch demo of the Planet Sky transit authority. Alright so are we ready for demo number 3 Alright you're kicking at this Alright so hey we got a background change so notice how we have this cool background for every little piece of malware so okay so we will go this time it's perfect so I'm going to go to the directory that has pieces of malware I know we are running short time actually malware freak shows never okay so you see Hydra.Sys now if you learn from the fast Hydra.Sys is a rootkit system 32 DLL that has the configuration settings Win32 is one of the special programs that you'll see Win32 is actually the controller so what I'm going to do is I'm going to actually show you the settings of this malware and this is again pretty system 32 here so as you can see the settings are such that the log would be in Windows directory system 40.log here's a command line for a malware Win32.exe with these options now with looking at just these commands can you guys see what it is? Alright it's basically NGRAP so they've changed the name for NGRAP and they're running it's basically a Sniffer malware right so it's going to sniff the internal network for confidential data now this password I don't know yet but host name we had to change a little just for this demo but Haxers.spider.com it has a user name and password you know if we go so and actually run the malware so nothing happened the malware runs pretty silently what I want to show you here is that if you check the task manager you're actually not going to see it and last year I know someone asked me the question you know if you don't see it in Task Manager would you see it in sysinternals process explorer the answer is no this piece of malware you won't even see it because what all this malware is doing is loading the root and actually starting it right so I'm actually going to show you the file that it is supposed to store data in and here you go system40.blog file right now again there's no data because we haven't done any network transactions of cartel data so I am going to go to my fake point of sale application and communicate on port 5500 so I'm going to go to this payments folder it's going to ask me what's your name and password here I'm a legit user so I'm going to just browse to certain checks temporary checks and basically see what's out here so dark tangent he's got his card stolen again spur guy Colin Shepard he's got his card stolen and this guy doesn't need cards because he has a lot of cash and yeah so you know again these attackers are freaking killing it right so we go to this file and as you see our file is updated so when we see the output we see that this is basically ngrep output so if you use ngrep power you see basically the interface name the poor man's regular expression for track data and you know the IPs that it was communicating to so now that file is there what the attackers do to actually get the data now in the previous malware what you guys saw that attackers still had to come into the system to actually take out the data now this is one better and we'll see how so I'm going to change the system time because you know the malware writers that's one of the shortcomings of this malware actually they basically transferred the data at around the same time every day alright so 59 and I'm going to give you 10 seconds to pray for the demo to work so so this is our fdp root directory this is where the malware should dump data and this is actually you know we're running a local fdp server on the local machine so it's one o'clock let's see one two three four five six oh the demo is not there oh it's am okay good call alright so we're going to change it to okay perfect so this time I'm actually going to do a good job so hit apply and let's see now we got three more seconds to pray one oh oh keep praying keep praying alright we got it now there's this one last feature that I want to show you now if I try to extract these files this is what the attackers get right so I tried to extract it here oh there's a password now remember we had this one config file a long time ago slings.exe and I'm going to just there we go so we had this weird looking password it looks like someone from UK but we're pick a dilly and we try this and boom it works basically the same file that system 40 file that we had over there so that's about it for this different malware now the last piece of malware is the most awesome so you better stick around for that Nick's going to tell you about the background but that is going to be super it's called Dwight's dooper so alright okay so we have a couple of minutes I think we have like six minutes so we're going to go through this so basically to really set this up this is a client side pdf attack now the difference between this environment and the previous three environments the security posture in the previous three environments was basically horrible this environment is a US defense contractor they have a very high level of security they had nothing allowed inbound the only thing that was allowed outbound was port 80 and 443 and everybody had email access and so just really set this up the employees of this organization received an email they had an attachment and everything else sort of went from there now we didn't really use US defense contractors details and things like that in this demonstration so we chose a different company so let's go to the demo now alright last one are we ready for demo number four so okay so basically yeah so we couldn't choose a defense contractor so this is the company that we chose and again so this is basically Jim Halpert's desktop so who likes Dwight you guys are going to love it then alright so this is basically Jim's mailbox and basically you know he's got emails from his company mates right so first emails from Michael Scott you know he finally got the lost ending you know then we got a weird one here from Kelly Kapoor and that's 194kb and that says continuing from lunch conversation alright so let's see what it's about oh that's that's a pages full of rants again alright and this last one and you know a lot of people a lot of us get these announcements right HR announcements and we you know without thinking twice about it we just you know click on and this looks pretty real you know it looks it has a disclaimer it says that it's going to be released at 9 o'clock so you know before running this PDF file I'm actually going to show you the temp folder that it actually has so if you go to this temp folder what you're going to see what what actually happens behind the scenes when we run this PDF file so here we go it's an announcement Jim Halpert opens up his PDF the PDF closes for a second and it opens up again and now the file name is changed and as you can see Dwight Shrewd has finally been awarded the official position of assistant manager but Jim Jim has been pawned right so as you can see there's a folder called gold mine and you know there's a raw file you know raw file they're usually sent out so let's see what's in the gold mine folder bank account details bank statements client lists and commissions oh if Dwight's looking at it Dwight Crank logs it and with that it's got Firefox passwords IE passwords and just about everything else and guess where it comes from it's basically what the attack is doing it's basically taking all the files from the my documents folder it's roaring the folder into gold mine and sending it out and this is basically you know the FTP server again this is where it sends out and again you know there is a password on the FTP server and so Dwight gets his data and he basically has all of Jim's information so guess who's going to win the sales prize here Dwight Shrewd and that's about it for our demo this was our fourth demo and thankfully all of them worked yeah so just to sum it up so you know what we learned here is that customization of mailware is the key right so we're seeing customized mailware targeting environments like you saw in the US dimension contractor example that's very very customized targeting that environment specifically crafted to basically own those employees at that company and instead he wins the race and basically you know you saw the anti-forensic features they don't have to but they do it anyway just for the brownie points automation is another big thing and you know what they're not slowing down and you know the funny thing Nick mentioned at the beginning of this talk last year we gave the mailware freak show and the shortcomings that we gave last year they basically went ahead and corrected the mailware so you know if you come next year we might have DEF CON mailware freak show 3 and thank you guys for being our audience. Thank you.


Hey guys, welcome back to another week of What's For Dinner. My name is Andrea with Food and Mentory Adventures in Food. Our channel is all about the food. We do taste test, recipes, grocery hauls, and What's For Dinner. And we are kicking off another week of What's For Dinner with, you guessed it, our pantry and freezer challenge meals. Still working on our freezer, still working on our pantry, trying to use what we have. So for dinner tonight, we are having Mexican stuffed pasta. And I have actually showed this on another What's For Dinner video, and I'll make sure to link it in the description box. So when I made the Mexican stuffed pasta, I don't know, I guess it's been a couple of months ago, I had extra filling for the pasta, and I put it in the freezer. And so I'm using the filling for the pasta that was in the freezer tonight. So that is coming from our freezer. We still had half a box of the jumbo shells, and so we are getting rid of this box. This was in our pantry, so we're using that up. I had salsa, tomato sauce, the french fried onions, and Monterey Jack cheese. That's all stuff that I had in our freezer or pantry, so we're using that up. And then we are having some garlic bread with it, and that came from our freezer. So I'm going to be moving around a little bit today. So this came from our freezer. I've showed this before on other What's For Dinner videos, and it is from Tom Thumb, and we really like this a lot. It's so good. I like it much better than Pepperidge Farm, and I think this is going to be my permanent garlic toast right here instead of Pepperidge Farm, unless it's of course, it's on sale. So we're having that.  I had some butter lettuce in the freezer from Trader Joe's. And we are using up, actually Howard's going to be using up this simply dressed Caesar salad. This, as you can see, there's just a smidge in the bottle. So we're going to be getting rid of that from our refrigerator. And then this also came from our refrigerator. So I'll be having this on top of my salad. So this is our meal. Everything is from our freezer or from our pantry. So this is What's For Dinner tonight, and we'll see you guys next time. Hey, guys, so for dinner tonight, we are having black beans. So we had some canned black beans that Howard made, and we are serving that over some jasmine rice. And this is some stir-fried broccoli that I picked up from Trader Joe's. Actually, the broccoli was the organic raw broccoli, and I just stir-fried it. And then Howard, this is Howard's plate, and he is having some avocado on the side. So this is what we are having for dinner tonight, and we'll see you guys next time. Hey, guys, so for dinner tonight, Howard is having some leftover ribs from his birthday dinner. He had two left, so he's having those. And then I did not get a chance to make the shaved brussel sprout, while my in-laws were here. So I made those before they went bad.  So let me show you. Here are the brussel sprouts. I got them from Trader Joe's, and I showed them on a recent haul. And then here is the Annie's deluxe mac and cheese. This is something that I had in the pantry that we needed to use. So that's why I made those tonight. And this is my plate. I'm having some leftover broccoli. And then I'm also, of course, having the mac and cheese. And then from the freezer, I'm having these Tyson spicy chicken nuggets. Six of them came in a little box. Let me show you the little box here. So I could have made them in the microwave, but I did bake them. I prefer the crispier nugget. And so there's only one of these boxes in the freezer, so it worked out perfectly. So that Howard could finish off his ribs, and then I could finish off something else from the freezer, which were the nuggets. And like I said, we're having the Annie's mac and cheese from the pantry. So getting rid of two items today for our freezer and pantry challenge. So this is what we are having for dinner tonight, and we'll see you guys next time. Hey guys, so for dinner tonight, we are having taco cassa, which is a taco place, like a fast food taco place. To me, it's way better than Taco Bell. I prefer it over Taco Bell. So let me show you what we are having. This is Howard's and it's wrapped up, I know. But he is having a bean burrito, a spicy bean burrito. And he is having a combo burrito, which has the refried beans and the ground beef is also spicy. I am having nachos, and I talked about this before on another what's for dinner video. They used to make the nachos with the cheese and meat and everything on it. But for some odd reason, they don't do that now. They package everything separately, which I hate. But I am just having plain old nachos, which have cheese. They come with jalapenos, but I don't get the jalapenos. And then also ground beef. And then I also wanted one of their sweet teas. They have the best sweet tea anywhere. And I didn't really have, well, I did not really have. I did not have sweet tea the whole time that I was pregnant or any caffeine. So I've been craving sweet tea now, so I got a large sweet tea. And so this is what we are having for dinner tonight. And we'll see you guys next time. Hey guys, so for dinner tonight, we are having some chili. And I have been craving chili for a while. But as I mentioned before, during another video, during the last trimester of my pregnancy, I could not eat anything tomato based. It just gave me the worst heartburn. So we are having a cold day here. It's in the 30s, and so I wanted to make some chili. So let me show you what I used. So I really like these two alarm chili kids. My mom used to buy these when I was little. This is the regular one, but they also have a mild version. And the reason I like these kids is because they come with the seasoning packets that you see here, so if there's something you don't like, you don't have to add it. So for me personally, I never add the masa, which is used to thicken the chili. I don't add that. And you can adjust the amount of chili powder or salt or whatever it is that you don't like. You can adjust it and leave it out. So I made this. And then from my free, so this came from our pantry. Again, we're in the middle of a pantry and freezer challenge. So this is from the pantry. From my freezer, I used up this Angus beef chili. Now I got this from Trader Joe's a while ago. Again, when I was pregnant, I couldn't eat it. And so I stuck it in the freezer. So I just added this to the chili that I made today. So I got rid of this from the freezer. From the pantry, I used up the stewed tomatoes and the chili beans. And I added that to the chili. I do have a tip for you. So if you have a little bit of extra stuff in the fridge, like a little bit of extra salsa or a little bit of extra tomato sauce. Usually what I do is just add that to my chili. It adds a good flavor. So just a little tip I want to throw in. So I'm having, I used up that. And then I always add cheese and fritos to my chili. And I personally like the fritos lightly salted because I don't like all that sodium. So that's what I have in, excuse me, on top of my chili. And then that cheese that you see in there is something that we had in the fridge left over from when Howard's parents were here. So that is some cheddar cheese slices and some Swiss. And I've never had Swiss cheese in my chili, but that's what we had in the fridge. And that's what I'm using. So Howard is planning to add some rice and sour cream to his chili. He is watching the baby right now because I'm starving. So I'm eating ahead of him. So I don't have his plate to show, but he is planning on adding some rice to his chili. Now I did not grow up eating rice in my chili. So I don't know if you did or not, comment below if you did. So he's going to add some rice and some sour cream. He is not going to have fritos. He doesn't like fritos with his chili. Anyway, this is what we are having for dinner tonight and we'll see you guys next time.