Hey everybody, welcome back to your Wigging Geekdom, Geo here, and today I have the very difficult process of trying to summarize and condense Naoki Uruzawa's Pluto. Oh boy. Welcome back to the channel, and yeah, Uruzawa's Pluto. Where the heck do I even begin with this amazing title? I've read this before, but this is actually my first time doing a video on Pluto.  Now what the heck is Pluto about? Before I do that, I mostly do spoiler free reviews, right? So I don't want to ruin the experience for you guys if you've never read Pluto, but hopefully I can entice you to pick this title up, because I do think if you're interested in reading and collecting manga as well as graphic novels, whatever it may be, collected editions, I think this is something that should be in your library. So what is Pluto all about? I'm going to start off differently because I usually give you a summary of the story, but here I'm just going to geek out about the amazing artwork and how beautiful it is. You know, Uruzawa is a master at character designs, and you know, this is not the exception. Uruzawa has this famous style that you see a drawing of his and you immediately know who that is and what you're getting yourself into. Intricate character designs, very realistic human expressions, and he really did master the craft of conveying emotion and expressions through his drawings. You see that in older people, in younger people, no matter the age or gender, Uruzawa nails it 100% of the time, and the art is just a visual treat. One of the best drawn, serialized stories in my honest opinion, and I cannot gush over it enough, even from these covers alone, which, you know, they're just magnificent. You see how diverse and beautiful these character designs are, you know. All these books are vis signature sized, so it's good to get them in slightly oversized pages, which is always great, especially on collected editions. So where the heck do I even begin with Pluto? Well, this is a story, of course, based on Mighty Atom, or as you might know it, out here in the west, Astro Boy. This originally was supposed to be a one shot for the Tezuka Astro Boy celebration, I guess. You know, the story being so intricate and complex, it developed into its own, I think it was 65 chapter series, and we're all thankful for it. So Naoki Uruzawa decided to adapt his favorite arc from the original source material, The Greatest Robot on Earth, and if you've never read or seen that adaptation, I do recommend checking it out. It's not necessary whatsoever to enjoy Pluto, but it does give you a hell of a good context as to where the author Naoki Uruzawa is coming from and why his love for Astro Boy is so strong that he is honoring Tezuka by developing, sort of reimagining the series in his own twist, but of course grounding it more on reality, whereas the original of course had a little bit of a cartoony element, and they even pointed out in one of the afterwords of the book, or Uruzawa himself, if I'm not mistaken. Astro Boy has this reputation that a lot of people fondly remember it outside of Japan, but they like to think of the series as this wholesome kids animated series because of its anime adaptation, but if you go back to the manga and if you read some of those chapters, there is an underlying darkness to it, and Tezuka did a fantastic job of exploring many awesome concepts that to this day are still as relevant and are explored in sci-fi, in novels, in TV shows, in other manga, anime, cartoons, you name it. Concepts of inequality, racism, the advancement of technology, all these things and so much more get explored in Astro Boy, that a lot of people somehow aren't aware that the series is capable of that and they just remember the caricature, but there's a lot to Astro Boy and Naoki Uruzawa takes his time developing this story and retelling his favorite arc, which I mention now, the greatest robot on earth, into something much more grittier and complex and beautiful to read. This is the story of the main character, which you see here, and I'm totally going to butcher his name, Je Siecht, and I am terribly sorry, I am horrible with pronunciations when it comes to accents, and I know it's a German word, I know it literally means face, which is appropriate because a lot of the elements here regarding robots is their appearance. So our main character is this famous police detective and he's assigned to these mysterious cases where robots and some humans have been murdered, but there is sort of this dockerish creepy element to it because no evidence can be found for the perpetrator, but the actual murders have a creepy motif with like two horns placed on the victim's heads to signify something and it's up to our main character here to discover what this is and when certain elements reveal themselves and you find out that it may not have been a human, it may have been a robot, things just keep escalating onward. The series has to deal with the fact that our detective as well as six others are classified as the world's or the seven world's greatest robots. When the plot of the book begins, it is I believe ten years after the 39th Central Asia War and you're probably wondering what the heck is that? Urisawa has always tacked on themes of politics in his books. If you have read, you know, stuff like monsters, 20th century boys, and even in short stories, there's always hints of political play and the powers that be. Not necessarily a critique at a certain somebody, but just the nature of politics itself is present in these titles in some shape or form, maybe not so in certain titles but more so in stuff like Pluto, where in this war it is, you gotta understand that this book was written in 2003 if I remember correctly, so it is very evident that there are a lot of political undertones with the Iraq invasion and all that stuff and you have a conflict that is the source of everything that is going to happen in this series. Everything goes back to that specific war at that specific moment where you have the United States of Thracia, obviously modeled after the US, and their excuse to enter the Persian kingdom supposedly after they had received some intel that the Persians had these robots of mass destruction, so an investigation takes place and they form a survey committee and this committee unravels this huge vault of scraps of dead robots and it just sparks an international incident and the UN assembles and all that war is declared and as a result people are murdered, towns are obliterated and destroyed, but what is very cruel and interesting about this book is that robots are the one doing most if not all of the fighting, it's not the actual humans themselves so that is a very key component because this is a world where robotics are highly advanced and you have artificial intelligence that is able to feel and express themselves, they feel sadness, they feel hatred, anger, joy, all these emotions that we take for granted and part of the reaction from humans into story is of course of a racist undertone because they feel threatened, they feel humans are the superior beings and they cannot accept these robots taking over and being integrated as part of society. Obviously with the original series the famous international law for robotics is passed with you know the cardinal rules that no robot will injure or kill a human that is at play here and there has been an incident in the past before the start of the series where a robot actually committed murder and killed a human so people are already weary of these rules and are discriminating and hating on robots so with that setting you have a new set of murders taking place and Jaseesh is trying to do his best to understand what's happening and sort of find his way and realize that they're not like him and the other seven great robots they're not just robots they're more than that and the series I think does a beautiful job of examining just humanity and by having the main characters be robots I think it's similar to you know having anthropomorphic animals and you're able to examine things from a different perspective look at it from a different angle I should say the character of Astro Boy himself Adam I think he is fantastic and once you start going with his side of things and his story it becomes very interesting cinematic and beautiful the way his narrative unfolds and one of the central themes of Pluto aside from being a psychological action sci-fi crime drama is the emotional message at the heart of it it's something that I really took to heart and whenever I read it this is my second read-through of the series I always get emotional by it and it is the fact that nothing comes out of hatred that is one of the main messages in Pluto that is one of the main things that said here because obviously Urusawa has these themes running throughout of peace and anti-hatred and war and all that stuff unfortunately humanity has a tendency to resolve things through hatred whether it's for a good purpose whether it's for evil purposes whether it's just existing people rely on hatred to get through life unfortunately and it's an amazing reminder for the for the reader if you're reading this story then nothing good can come of it you know wars violence none of that is going to resolve anything in the end and it's only going to push us further apart love is the key here and not hatred I'm a huge advocate of that and I I believe wholeheartedly and I know that the world would be you know it yeah I get it it's it would be a little bit preachy to tell you oh don't don't hate and love and love more and you're thinking yeah in an idealic place that would be fine but the world is not going to adhere by that rule because the world's a very cruel place but we can have faith and believe that those things are around the corner and then we can turn it around and that we can aspire for greater things if we pushed hatred out of our hearts and that's sort of the emotional context of Pluto there's obviously a lot more you do get some really amazing set pieces and action scenes with characters duking it out because there are robots and some of them like Bruno and Hercules and even Adam himself have these extraordinary abilities so when you do see that in display it's really awesome and it's not just about hatred there are other themes explored throughout the origin or the basis of most of the conflicts in this book obviously stem from war so you do have elements of PTSD and you have characters trying to find the new lease on life you also have characters like Mont Blanc who became such a symbol for pacifism and nature and to have that be twisted around by his untimely death in the series at the start of the series is quite shocking you have the character of Epsilon who decides to be a pacifist and not participate in that war and as a result to this day at the start of the series still faces backlash for his decision of not wanting to take part in combat and take care of orphan children as a result which is extremely admirable and it's something that regular humans wouldn't even consider doing and you have a robot doing it so it goes to show you that you shouldn't really judge it book by its cover right that's one of the big things about this series also how you can take people and use hatred to manipulate others into doing horrible despicable things and twisting their emotions and sensibilities around and turning them from would-be protagonist into antagonist that is also a theme shown throughout it of course the mysterious bad guy that I don't necessarily want to reveal just in case you haven't experienced the world of Mighty Adam aka Astro Boy or Udu Sawa's adaptation the later part of the book after the climax of the story it's just one roller coaster of emotions and you can't wait and it's a page turner you'll read this in a snap you see these eight books here but this is such a quick read you're gonna have a fun time with this really well-written characters obviously Udu Sawa loves Tezuka's work and he's expressed that that you know Tezuka has is such a huge inspiration to him as a writer and that is more than evident when you see some of the wonderful stuff that he's doing in Pluto you see other elements from Tezuka's library it doesn't just honor Astro Boy itself it honors the man himself with concepts of that reminded me of things like Blackjack and even Phoenix stories like that are present here and I think it's a very accessible book masterfully written filled with suspense and just a beautiful ode to a beloved franchise from old but as well as the human spirit and talking about the wonderful characters and the you know this setting that they've created and like I mentioned earlier the original had these dark undertones and Udu Sawa was able to take all of that and expand and even further and really give you metaphors and allegories of things that are happening in real life and the positive message of you know anti-hatred and to have Adam be that anchor to represent hope in humanity and to have a character like Jazeesh trying to solve this murder at the same time figuring out things that are happening to him on an emotional level like I said earlier you don't expect robots to emote but they do this is a highly intelligent look at robotics and you know do robots have a soul and those thematics are explored in this and they're not just soulless things that are trying to live with humans they develop bonds and friendships with other robots and other people and are as integral to society as regular people we see evil characters spewing and telling others despicable things but we also see the goodness in these characters as well as they're trying to weave through this mysterious narrative of a murder mystery with huge action-packed explosive fights near the end that I was just entranced by so that's sort of the themes and topics that I wanted to talk about and what I thought of Pluto at only eight volumes this is a very quick read it's action-packed you get that delicious Urusawa mystery that he crafts so well he's a master at this I talked earlier about the art the art is impeccable and I think it's my favorite art art wise it's my favorite of Urusawa's material and it's just oozes his style and personality like I said you see a drawing of his you immediately know who that is and what you're looking at and this just excels what about you guys have you read Pluto I'm pretty sure you have let me know in the comment section what you thought of the series and if you want me to review other of Urusawa's work like monster or 20th century boys or whatever it may be let me know in the comments section down below guys this was a ton of fun to read this again and go over it and just enjoy a masterclass of suspense and action in manga form this is easily one of the best comic manga graphic novel collected editions whatever you want to call it one of the best stories around and I do wholeheartedly think this if you'd like sci-fi if you like noir mysteries I think this should be in your collection so thank you to all my subscribers who actually voted for me to review it thank you so much and look forward to the next batch of reviews on this channel I made a community post with the next reviews and it's pretty interesting what you guys are voting on so I'm pretty excited to talk about those books as well thank you everybody for being a part of a wiki geek them whether it's by liking commenting and just subscribing to the channel if you're new here and you want to subscribe I do kind of like this where I talk about anime manga and comics as well guys I've got to go I will catch all of you on our next video


Γεια σας, Είμαι Βικη και σήμερα θα κάνω δυο καρδιά, δυο καρδιά από Σαίμονσες Ταμπ. Στην ηλικία καρδιά, θα χρησιμοποιηθώ αυτές οι παρουσές της κραυτακής. Αυτές αυτές οι παρουσές έχουν μία καρδιά για τελείο, είναι δυνατές, αγώδια, ας αρέσει ποιο χαρδί they είναι, και θα χρησιμοποιηθώ αυτές οι σκάρδες της κραυτακής. Αυτή είναι η μπιλιά που είναι από την παραγή από Σαίμονσες Ταμπ. Είναι από τη Μαρτζ καρδίκη. Τώρα, as you can see, these are great for making project life or those pocket albums that lots of people use, but I'm going to show you how easy they can work out on a card. I have chosen a few of these 3x4 papers and I'll create two cards. So let's get started with card number one. For my first card I've chosen these three pattern papers from this booklet and I'm going to use my paper trimmer because there is a grey border at the top of each one of those cards. So I'm cutting this out and then I'm going to layer one on top of the other. Now the one with the shoes is going to be the focal point and all the rest of them are going to be at the background just to add a bit of interest. But first of all I want to embarrass somehow the shoes so I decided to use this embroidery floss which is gold and I am going to use my needle and a piercing mat and what I'm doing is poking the shoes with my needle to create some holes and then all I have to do is to shoe over the laces and actually replace them with my gold thread. As you can see I have finished showing the laces and I am securing the thread at the back with some scotch tape. I just love how shiny the shoes are and this really adds a tone of elegance on the card. Now with my clear wing of Stella glitter pen I'm going all over the yellow letters and adding some shimmer. I'm taking my time because I want this to be neat and once that's there I am poking another hole and I am going to use one of the star brads just where the word shoes is. I just want to emphasize that word a bit more. And now it's time to assemble my card so I am going to stick one on top of the other. I'm using my tape adhesive at the back and as I'm sticking them one on top of the other I'm making sure that I can see the different pattern papers from the sides. I am also curling up the edges. Oh and this is where Ginger decided to grab the lollipop from the card kit by Simon Sestamp but of course I can't let him have that. So as you can see he has grown up so much and he is just adorable. Ok now that he has left my table I can go on with my card making. I am going to stick that at the top of my card base. The card base is a standard card that's 4.25 x 5.5 and just because I like to have embellishments in 3's I added a couple of more gold stars here and there. So again I'm using my piercing mat. I'm making a hole and then adding the star. And now I'm finally ready to stick it on top of my card. I am going to use some foam adhesive at the back to add a bit of dimension. Notice that my foam adhesive isn't too thick so it does add dimension but it doesn't make the card too bulky. To finish off my card I am going to use some glossy accents over the yellow letters. I have one of those fine line applicators with a fine tip and I have added some glossy accents inside. So I am going to take my time and go all over the letters with this fine tip applicator. This makes the job really easy because I can really control how the glossy accent flows. Now just because a glossy accent is a bit thick you need to press a little bit hard on the bottle. I get a lot of questions of how I add my liquid inside those fine tip applicators. Actually it's not so difficult. All you have to do is to unscrew that blue top with the needle and you just pour in the liquid. You can use one of a tiny funnel if you have one or you can make one with paper or plastic. You will see photos of the card at the end of the video. Now let's move on to card 2. For my second card I will be using this 3x4 paper which has the mirror on top and I am again cutting out the border, the grey border that's at the top and I had this idea to create a sacred card out of this mirror. So I used my craft knife to create an axe and now with my scissors I am cutting out the inside of the mirror. This way I am creating a hole inside the mirror which is actually going to be the window of the sacred card. This is one of the papers that's included in the April card kit by Simon Says Stamp and I am cutting it out just slightly smaller than the 4x5 paper that I have with the mirror and I am going to be using some tape adhesive at the back and stick a piece of transparency. Making sacred cards is so much fun and actually makes the card special. I love to hand out sacred cards because it always brings a smile to the recipient and I love to see how they seek the card up and down to see how the particles are moving. I am going to use my tape adhesive around the window and make sure that I create a nice and tight wall, let's say where all the particles are going to be trapped inside. I am going to double up the adhesive so I have one foam on top of another and this will make sure that my little sequins are going to be moving nicely inside the window. So I am adding some of the smallest sequins that I have there and once I am happy with the amount I am going to peel off the adhesive and stick my cardstock on top. This will go to completely enclose the sequins inside the window. I have cut out a piece of this patent paper with the stripes of gold so I am going to stick that with some tape adhesive on top and this is going to be my focal point. For my card I am using a standard card that's 4.25x5.5 This is a top folding card and I am using some tape adhesive at the back of my focal point and I am going to center it on my card. To finish off my card I am creating a double bow out of these gold embroidery flaws. I am going to add the gold bow on the mirror and this is one of those little details that I always like to add on my cards at the end and actually think that this is going to bring everything together. And I have added some multi-medium by Ranger on this fine line applicator so I can add just a tiny dot there and stick the bow on the handle of the mirror. And these were the cards for today combining two card kits by Simon Says Stamp. I hope you had fun and got inspired. And here are two more cards to inspire you. The first one is from this month's April Card Kit by Simon Says Stamp and the second one is from last year's April Card Kit. Don't forget to subscribe if you haven't done so already and thank you for watching.


This video is an introduction to the Poisson distribution. Now Poisson is the French word for a fish. And so you might think that this distribution has something to do with fish. But actually it doesn't. It's named after the French mathematician Simeon Poisson, who invented it. So try to put fish out of your mind. OK, so what is the Poisson distribution? Well, the Poisson distribution is a probability distribution that's used when a random event happens at a constant average rate. It gives the probability for every possible number of events in a fixed period of time or a particular area of space. And there's a formula for calculating these probabilities. So for example suppose that a bear goes fishing and he catches on average 5 fish per hour. We might be interested in the probability that he catches 3 fish in a particular hour or 10 fish over a period of 2 hours. And we could use the Poisson distribution to find both of these and other probabilities. Also suppose that we're interested in the distribution of pandas within a forest. It might be that on average there's one panda per square kilometre and we're interested in the probability of finding 2 pandas in a particular square kilometre or 5 pandas over an area of 2 square kilometres. And again, the Poisson distribution would enable us to calculate these probabilities. There are some things to bear in mind though when we want to use the Poisson distribution. One is that the events must happen one at a time and the other is that they must occur independently. So for example when the bear goes fishing we need to assume that he only catches 1 fish at a time. And also that catching a fish doesn't increase or decrease the probability of catching another fish. Likewise with the pandas we need to assume that they live alone and so you only find 1 panda at a time. And also that having a panda doesn't increase or decrease the probability of having another panda in the vicinity. Something that probably isn't true because actually pandas are territorial. So how do you calculate probabilities in a Poisson distribution? Well the first thing is that we use the letter lambda to talk about the mean number of events that happen in the interval. So lambda is the number of events that you would expect to happen on average. And then if we say that the random variable x is the actual number of events that occur in the interval. We write that x follows the Poisson distribution with parameter lambda and it can be shown that the probability of having x events is lambda to the power of x times e to the power of minus lambda divided by x factorial. In this formula e is the base of natural logarithms and is approximately equal to 2.718. So this is a formula that we can use to find the probability of having a particular number of events in an interval of time or space when we know the average number of events that will happen in that interval. Let's look at some examples of using this formula. First of all, if x has the Poisson distribution where 3 is the average number of events what's the probability of having 5 events? Well remember that the probability of x events is lambda to the power of x times e to the power of minus lambda over x factorial. And in this situation you can see that lambda is equal to 3. So the probability of having 5 events is 3 to the power of 5 times e to the power of minus 3 divided by 5 factorial. And if you work it out that's equal to 0.101 to 3 significant figures. My next example is about koala bears. Suppose that on average tourists see 2 koala bears per day. What's the probability that on a particular day a tourist sees at least 2 koala bears? Well let's say that x is the number of koala bears seen on this particular day. Then x will have the Poisson distribution where 2 is the expected number of sightings. The question is asking us for the probability that x is greater than or equal to 2. And one way of working this out would be to add up the probability of having 2 koalas, 3 koalas, 4 koalas and so on. But actually this would involve adding up an infinite number of different probabilities. Something that might take you quite a long time. So a better method is to subtract from 1 the probability of getting no koalas or 1 koala. Because the opposite of having 2 or more koalas is having 0 or 1 koalas. Now according to the formula the probability of having no koalas is 2 to the power of 0 times e to the power of minus 2 divided by nought factorial. But 2 to the power of nought and nought factorial are both equal to 1. So this can be simplified to e to the power of minus 2. Likewise according to the formula the probability of having 1 koala is 2 to the power of 1 times e to the power of minus 2 divided by 1 factorial. But 2 to the power of 1 is just 2 and 1 factorial is 1. So this simplifies to 2 times e to the power of minus 2. So now we can say that the probability of having 2 or more koalas is 1 minus e to the power of minus 2 plus 2 e to the power of minus 2. Which is 1 minus 3 e to the power of minus 2. And if you type that into your calculator you'll see that the answer is 0.594 to 3 significant figures. Before I move on I should point out that this example about koalas only works. If we assume that koalas occur one at a time and they occur independently. So that the presence of one koala doesn't increase or decrease the probability of finding another koala nearby. My third example is about polar bears. Most of whom live in Svalbard in the Arctic Circle. Which in the summer looks something like this. Suppose that on average there are 0.05 polar bears per hectare on Svalbard. What's the probability that there are four polar bears in a given area of 100 hectares? Well the first thing we need to do is to work out the expected number of polar bears in our area of 100 hectares. And that's going to be 100 times 0.05. Which is 5. So this means that lambda is equal to 5. Let's say that x is the actual number of polar bears. Then x will have the Poisson distribution where 5 is the average number of events. Note that as with the koala bear example. We need to assume that the polar bears occur one at a time. And that the presence of one polar bear doesn't increase or decrease the probability of having another polar bear in the region. I think that these things are both roughly true. Because polar bears are solitary animals at least in the summer. Now the question is asking us for the probability that x is equal to 4. The probability of having four polar bears in this region of 100 hectares. And the formula tells us that this will be equal to 5 to the power of 4 times e to the power of minus 5 divided by 4 factorial. And if you do this on your calculator you'll get the answer 0.175 to three significant figures. My last example is about the North Atlantic right whale. Here's a picture that shows them to scale. Unfortunately the North Atlantic right whale is critically endangered. And they're estimated to be only about 400 individuals alive. They mostly live off the east coast of America. And in the summer months they mostly swim to the Gulf of Maine in order to feed. Suppose that we're interested in the probability of finding a whale in Cape Cod Bay. So suppose that the 400 Atlantic right whales are distributed evenly throughout the 180,000 hectare Gulf of Maine. We also need to assume that the right whales occur one at a time and independently. But again I think this is roughly true because they are solitary creatures. The area of Cape Cod Bay is 1500 hectares. So what's the probability that there's at least one whale in Cape Cod Bay? Okay well the first thing to do is to calculate the expected number of whales in Cape Cod Bay. And so we need to see what fraction of the 400 whales we can expect to find there. Well the answer is that the expected number of whales, lambda, is 1500 over 180,000 times 400 which is equal to 10 thirds. 1500 over 180,000 because that's what fraction of the Gulf of Maine, Cape Cod Bay takes up. So now we can say that the number of right whales will have the Poisson distribution where the average number of events is 10 thirds. The question is asking us for the probability that x is greater than or equal to one, the probability of having at least one right whale. And we know that that's going to be equal to one take away the probability of having no right whales. Using the formula we can say that that's one take away, 10 thirds to the power of zero times e to the power of minus 10 thirds divided by nought factorial. But 10 thirds to the power of nought and nought factorial are both equal to one. So this can be simplified to one take away e to the power of minus 10 thirds. And if you type that into your calculator you'll get the answer 0.964 to three significant figures. So this is the probability of finding at least one North Atlantic right whale in Cape Cod Bay. Okay, this is the end of my video about the Poisson distribution. I hope you found it useful. Thank you for watching.


Heather's one of our most amazing fantastic math teachers here at Mount Boucherie. She's a great educator. Her pedagogy is hands-down amazing. Heather's like a little energizer bunny, right? She's jumping and moving and it's never boring in her math class. She's got so much going on in her room. She's been teaching all of us so much about the technology. Something comes up, she sees an idea and she can immediately see how she can use that in her math class. She's just incredibly talented at having an idea and then figuring out how to implement that and get it into the classroom. My favorite thing about teaching is when a student has an epiphany. You can see it in their eyes that they've just finally figured something out and they become the experts in not me. I love that I get to create things every day. It makes me feel great to make an impact on the students that I teach.


Okay, so looking at the large models here kind of in the middle of the abdominal cavity again our arteries and veins So right up top here So this is our celiac trunk right here on top of the descending aorta Immediately below that is the superior mesenteric artery Okay, we can see our renal arteries and veins right here branching off of that is the Adrenal vein You can see so this is the spleen over here. So we can see our splinic arteries and veins there this branch that comes down along the sides here and kind of makes these Braided patterns a little bit. Those are my gonadal arteries and veins This next lump down here This is my inferior Mesenteric artery So just above the inferior mesenteric artery kind of behind it over here. We can find our lumbar arteries and veins you can see my Common iliac artery and vein the internal iliac artery and vein making this the external iliac artery and vein


All right, Sid's whitebound down on the field with Mustangs head coach Ed Hoddle after this 20 to 14 lost to Weidner. Coach, tough way to end the game, but you've got to be happy with the way team battled back down 20 to 7 in the fourth. Yeah, it's a resilient group. We've seen this in the last couple of weeks, so they never gave up. I just think we left too many plays on the field today. Coach, fourth and goal from the four. What are you guys trying to do to get ahead there? Well, you're trying to utilize some space. That's what we were trying to do. And typically, we're pretty good in space. So you roll the dice and hope it works out for you. What makes their defense so difficult to play offense against? Because obviously, the passing game has been amazing all season. Well, I think they don't miss tackles. You watch them, and I think there's a distinct physical difference.  The D linemen are big. They're big and strong, and they're weight room kids. And they don't miss tackles, and they don't make mistakes. I don't think they overcomplicate the game. They let their players play. And they're playing at a very high level right now, and playing with a lot of confidence. And that's what takes play great defense. Coach, you guys had three fourth and shorts, fourth and goal from the two, a fourth and one at the 16. And obviously, the end, is that something that you guys I guess we'll have to work on during the week? Or you'll take a look at a lot on the film, what you could have done? Well, I mean, the easy response is, hey, coach, you should have kicked it. You know, field position had been an issue all afternoon, and we didn't know how many shots we were going to get at it. So I decided that we'd be aggressive at that point and try to score touchdowns. But again, those things aren't fixed in a week. Those things are fixed in February. And we've got to get stronger. We've got to be a more physical football team to get the hard yards when we need it. Coach, obviously this shakes up the conference standings for you guys a little bit. How do you get the team ready for the next couple of weeks? Well, it's an opportunity to play football. You work all year, and you only get 10 opportunities to do so. And if you're fortunate enough to earn an 11th, you're in the minority, so to speak. 250 teams play Division III football. I still think there's some postseason opportunities out there for us, possibly, if we're able to have some success for the next two weeks, maybe get lucky and get into an ECAC game. But all year, we've talked about playing for one another. And regardless of where we are, we've got to strap it up next Saturday and Saturday after and play for the seniors and play for one another. It's another opportunity for us to get better as a football program. All right, coach, thanks a lot for your time. We'll see you in two weeks. Thank you. All right, that was my senior head coach, Ed Hoddle. Stevenson suffers a setback 20 to 14 at home to Widener.


Hello, everyone. I'm going to talk about our work, a non-heuristic approach to time-space trade-offs and the optimizations for BKW. First, let us recall the AAPM problem, which is about solving linear congruence in presence of noise, where in the search version of the problem, it challenges to find out the secret X, given the noisy code word, where X and A are uniformly random and A is public, and the noise follows the coordinate-wise independent bandwidth distribution, where mu is noise-rate. In cryptography, it is more convenient to use the so-called Decision European to facilitate secretive proofs, and both variants are polynomially equivalent. Therefore, for secret analysis, we can only consider the search version. The AAPM problem can be categorized by noise. When the noise-rate mu is a constant, the BKW algorithm by Blam, Kalein and Wasserman, self-sitting exponential time and sample complexities. Based on BKW, Rybyshevsky gave a meaningful trade-off, which compresses the sample complexity to polynomial, with a slightly lifted-up time complexity. And there are other variants of AAPM, where the noise-rate decreases with respect to the dimension, but they are not the focus of our paper. Let's recall the original BKW algorithm. It works in iterations. In each iteration, it classifies the samples based on the values of the first B bit of the coefficient vector, and within each group, it cancels the first B bit by subtracting them with the first vector. Therefore, each iteration reduces the dimension by B bit, and reduces the number of samples by 2 to the B, and doubles the noise-rate. We summarized the complexities of the BKW algorithm. To minimize time and sample, by choosing the block size B properly, we ended up with the exponential complexities, which are roughly 2 to the N of a log N. And it remains open if we can do trade-offs between space and time. This is especially meaningful when doing, say, security evaluations of AAPM-based cryptosystems. If the time complexity and the space consumption is both 2 to the 80, it's not a practical estimate at all, because in practice we don't have a memory of size 2 to the 80. So in addition, we didn't know if we can improve the exponential vector, which is highlighted corresponding to the number of iterations. Further, we would like a more efficient approach to reduce sample complexity. In this work, we give a tree-based structure for the BKW algorithm. The original AAPM samples were divided into several subsets. These subsets are mutually independent. Within each subset, the samples are only required to be pairwise independent. This will enable sample optimization, because we can use a small number of independent samples to generate a much larger number of pairwise independent samples. And in the meantime, the pairwise independent surfaces to give a rigorous estimate of the complexities. And during each iteration, we pick, say, C samples, one from each parent's node, and to cancel out the first B coordinates. And we do this all the way down to the root node, where we get many candidates for a single coordinate. Therefore, no repetition is needed. Based on our tree-based algorithm, we get our first result, which is a trade-off between time and space. Here, this C is a tunable parameter. By changing different values for C, we get different trade-offs between time and space. And compared with the previous work, we optimize time and sample complexity by a sub-exponential factor, which accounts for the number of reiterations in the original BKW algorithm. Further, compared with Rybyshevsky's algorithm, the time complexity is also optimized by a sub-exponential factor. That is a very brief introduction of our work. Thank you for your time.


Hey, this is Alex, this is Dan, and I got something really cool to talk about. How you guys doing? Last talk of the day, then you guys are going to go to bed right after this, I imagine. Thanks for coming out, guys. This is pretty exciting for us. My name is Alex Levinson, got Dan here. Today we're going to go through a tool that we wrote, the agenda today. We're going to talk about droppers and stages that some of you might call them. Not really going to get pedantic about the terminology there. And how we got here today. After that, we're going to go into this technology that we built and how it works. Then we'll talk about some of the real world applications and then we'll give you a demo which will inevitably fail. But, you know, we'll see how that goes. So first off, just an introduction for us. So my name is Alex Levinson. I'm a senior security engineer at Uber. I've been there for a couple of years. My specialty is really in tool development and red teaming. I am a core red team member at the national CCDC and also the western regional CCDC as well. Thank you. Hey, guys. I'm Dan Borges. I'm a senior red team operator in Dev. I also partake in national CCDC on the red team. And Alex and I play a lot of cyber competitions together. So we're just here to show you some of our cool tools. So we got to go back a little bit. We got to cover some basics. First, we're going to talk about what is a dropper. What is this classification of thing we're talking about?  This is your initial vector. This is how you're getting on the server. This is usually like a memory corruption attack, something like that. Next attackers usually move to some kind of stager. This is moving from memory to their next tool. Often this can reach out and download more shell code, do something like that. And then this is really where we're going to focus on. This is kind of your stage one some people call it the stage one, the stage two. This is the dropper. You're moving from your exploit to bringing over your tools. This is what's going to bring over your malware. It's going to put your persistence on the box, your deep, slow stuff.  These are your custom applications, maybe your specific TTPs that you want to put on a box. And again, using a dropper here is important because you can protect your TTPs, your tools and tactics and procedures by using the dropper. So where are droppers used? We're trying to emulate what we see in the wild. What we see is a lot of third party crime where people use these exploit kits and then between the exploit kit and their own private malware, they'll usually lever some kind of dropper. They can do this as a form of packing to either bundle it with other executables or just as a way to get their malware onto the system. We can also use a dropper to be contextually aware and have contextually aware implants. This is kind of like Stuxnet. So do you want to land on this system? Do I want to deploy my payload? Because sometimes you don't want to infect this host. And that's a good thing for a dropper to say and then kind of back off and not put the malware down. And then we use it a lot in our red team operations for CCDC. We like to go fast and hard. So this is the perfect tool for us to really like lay on the pain fast. So a little bit of history about how we arrived here. Back in the day on the CCDC red team, all these people would be bringing these super cool kits. We'd have really advanced techniques and they'd be going against a single team and they'd be using this technique on this team. And what we wanted to do is we wanted to apply this pain to everybody equally. So we started wrapping it in shell scripts and PowerShell, Bash, and all these great techniques to really just kind of drop six, seven implants, up to ten on a single team. So now each team is not getting just one implant made especially for them. They're getting all ten implants we made for everybody. So we can really share. And then around 2015, 2016 we moved to these, like I said, these scripts but they started to have drawbacks, right? They had like a forensic drawbacks, right? People could find the scripts on the systems, PowerShell, script lock logging and they could tell exactly what we were doing. They could get our source code which was pretty dangerous for us as operators. So in late 2016, early 2017, we moved a lot of our tool chain to Golang. We did this for a number of reasons mostly because you get natively compiled executables so you can get a binary that runs specifically on an architecture. This means you have to disassemble it. It's hard to decompile which means you can't get that source code back. It's difficult to reverse. And while we were doing this, we also started looking at what is a dropper, right? This had all of our tactics built into it and we really wanted to say let's abstract our specific techniques out and make a pure dropper that we can put any technique into. And at 2017 at National CCDC, we had a few friends, virus, Lucas and they put together this thing called Genesis where we had an SMB share and you could just drop binaries in it and we bundled them all into one executable and we just ran it on the disk. It run everything that you put into this SMB share. It's just a native executable. This was really cool. This was really good but it had a few drawbacks. We basically, instead of just running everything together, we wanted to specifically instrument them in a certain way. So I think it was late 2017 into the 2018 CCDC season, Alex started working on this prototype of G script, the Genesis scripting engine which we'll get to. And we used it. We used it all through this last CCDC season and it was really successful. We dropped it on every single team at Nationals. Everybody felt the pain. And then between then, which was April 2018 and now, we've added a ton of cool new features, like really sweet stuff. And that's what we're going to get into today. Thank you, Dan. Yeah, as Dan said, today we are going to show the world, you guys, the awesome information security community that we're a part of. Basically what we've done humanively over the last several years, but also some really awesome features that even if you were at CCDC, you really didn't get a chance to play with. But from now on, I'd like to introduce the Genesis scripting engine or as we call it, G script. What is G script? Dan covered sort of this thing. It's this dropper. It lets us take malware and bundle it together and tape it up in a big ball and throw it at somebody. Great, that's a good explanation. But how do you use it? What does it look like to you as the Red Teever? It's really easy. You have your payloads. You write a script for your payload. You use the G script compiler on the command line. You get out a native binary. It couldn't be more simple than that. I use this all over our documentation. G script is a framework that allows you to rapidly implement custom droppers for all three major operating systems. So let's talk about what makes this, what makes up G script, right? So first off, there's the engine. The engine is the thing that is inside of that native binary that you made that actually runs and executes the logic that you specified in your script. There's the compiler. The compiler takes your script and turns it into that native binary. There's an obfuscator that's hooked into the compiler that we wrote. Try and make it a little bit harder for you blue team folks out there.  We've got a standard library. These are functions that you can use inside of your Genesis scripts. We've got a command line tool. That's how you interact with the compiler and other things. And we also have an interactive debugger to help you develop these scripts in a more reliable way, let you test them out ahead of time so you're not doing stuff live. A high-level walk-through, here's what happens. When you use the compiler in that three-step process we just showed, what ends up happening very first is the compiler goes and creates essentially representations of engines within memory for each of the scripts that you pass into it. The next thing it's going to do is every one of the payloads that you gave into it, this is a, we'll have a interpreter payload, we'll have some shell code, we'll have some, you know, SSH keys that we're going to drop somewhere. It encrypts and embeds them directly into that virtual machine that it's got in memory. After that it's going to take all in number of virtual machines. Remember it has a virtual machine isolated for each script. It's going to take all in number of those and it's going to sew it all together, it's like with needle and thread, into an actual executable for whatever platform you're targeting. And then when that executable is run, that main that it's sewed up together is going to launch every one of those run times in parallel. So let's do just a quick, a quick walk-through. Can you hold my water? Thank you. So a quick walk-through of this, just to kind of hopefully illuminate you guys on how easy this is to use. So I've got a little example here. The example isn't, isn't crazy, it's really simple. So we're going to write a script, it's eight lines. There's some important things to note in this though. It looks like JavaScript, for all intents and purposes it is JavaScript. We've sprinkled some syntactic sugar in the form of comment macros, so compiler macros that you see in the very first line there. That import statement is telling the g-script compiler, I want you to import this file off my disk when we go to bundle this together. The next line, line three, is just a normal variable declaration like you would call in JavaScript. And then lines five through eight there is a function called deploy. Now when I talked before about when you run main it launches all those virtual machines, the JavaScript VMs essentially need an entry point to launch when that happens, that's what it launches. It launches the deploy hook. So every one of your g-scripts, no matter what you're doing in it, will always have a function deploy with something defined in it. What's defined in ours here? We get the payload dot text, the data that was in that file, we get it as a string called payload data, and then we write that to the destination file which we defined in line three. So very quick, very easy g-script that anybody can write. But hey, this is not just for one script, this can be for multiple things, right? So let's write another one. What's this one doing? It's simply writing a file, second underscore file dot text with the string rect. So what do we do now? Step three, just use the compiler, one command, g-script compile with an output file, star dot g-s. g-s is our file extension for g-script. That's it. And what did we get? At the top, we got dropper dot bin. What is dropper dot bin? It's a 64-bit macho executable. I'm doing this on OSX. What else is in? I run it on the bottom of the first box there. And then what happens? All of a sudden you see desk dot text and second file dot text in that directory. What's in those? Exactly the contents that we had placed in them initially. All of you guys seem pretty quiet. Was that too easy? Thank you. All right. So let's just talk about that. That seemed, you know, why couldn't you do that with PowerShell or shell script or something like that? Well, first off, you're getting a native binary. You're getting a native binary that I could have written the first script, Dan could have written the next one. And if Dan messed his up or I messed mine up, it's not going to take down the entire binary. It's going to keep executing, right? That's the whole point of this is to be robust and resilient in the case of failure. When you do these large scale red team ops and you have many people contributing code, you don't necessarily have the luxury of constantly testing to make sure that somebody's payload isn't going to mess up something in your process, right? So we really wanted to give the people writing the payloads the ability to come up with their logic on how they wanted this to be bundled in to the actual final binary. So you've got your native binary, you've got your isolated G script engines, you've got the user defined logic in those scripts that is actually encrypted and embedded just like the assets are into the binary. And then you've got the embedded assets in their payloads. Those all get bundled together into one container inside of your native binary. So let's talk about some of the features here, right? So first off, number one feature we saw was that you get to do this in JavaScript. Now I'm not a JavaScript developer, but I think that we need to be making tools that are as easy for the broadest selection of us to use, right? So I know a lot of people in here probably see programmers, a lot of people in here do a lot of low level stuff. I wanted to make something common that people were familiar with, there's a lot of people who do web pen testing. JavaScript seems pretty familiar right now to a lot of people, so let's just go ahead and go with that. So it's easy to write, it's easy to learn, there's good documentation on how to write JavaScript well. Next thing is it's resilient to failure. As we talked about, if script two failed, script one would have kept on going. Third, it's highly customizable. So things like order of operations of your script, timeouts, all of this stuff you can customize with those compiler macros that we showed you, right? We showed you one but there's many more you can go with. So how is this cross platform? It's written in Go. Essentially, this whole thing is sort of leveraging the power of the Go compiler to make cross platform malware for anybody to be using here. Number five, it's secure. We ran into this at CCDC where we had our droppers essentially be reverse engineered very easily by just looking at the power shell logs. I'm excited to release this today because I'm excited to see how hard it is for somebody to actually reverse engineer one of these binaries. That is a challenge. Let me know if you do. I'd love to see it. And the number one thing that is new to anybody who has seen Genesis in the past is now you can actually call native Go from within your JavaScript. We'll get into that. I know that sounds kind of wacky. So we talked about this initially, but this diagram kind of gives you a little bit more context as to what happens. You've got your main of your final binary and when that gets run, you have all of these engines running and you have all of these engines that are in their own isolated name space essentially get created. They initialize the JavaScript virtual machine within them. They inject the scripts, all the assets in any libraries, native Go libraries that you've called into it. And then it calls that deploy function, that entry point, if you will, on each of those. And that happens, pending any custom order of operations with your macros, that happens all concurrently. So what does G-Skip really let you do? What does G-Skip really do? It lets you focus on what your stature is doing, not how am I going to implement this for OSX, even though I don't really know OSX or Windows or Linux. So this has been a process for us, right? I'm not a computer science, you know, master's student who's studied the deep internals of how software is made. I would like to say I was, but I definitely wasn't. I started to take an operating systems class in college and I started to take an operating systems class in college and I started to take an operating systems class in college and I was way over my head. So this has been a learning experience for me and this is sort of some of the technology that I've figured out and implemented here within G-Skip. So when you go to do a compile, what happens? Straight forward, the first thing that happens is it looks through all your scripts and gets a, essentially a mapping of all the macros that you've defined.  What might the type be? What can I infer the type might be of that argument? It then goes through all the Go packages that you've included in that as well and does the same thing, walks all the AST there looking for places where functions are defined that you've called from your JavaScript. Next, it's going to start marrying those foreign function interface wrappers in Go on the fly for all of the functions that you've called in JavaScript that are instrumented in native Go so that you're, and then inject those into the VM that we're bundling itself together. That's probably another three talks worth of material to get into, but if you'd like to, it's definitely on GitHub, you can go check it out. After that, we embed all of the assets, we encrypt them, each VM has its own function that all the assets get embedded with, and the assets themselves don't actually get decrypted until you call them within your script. So until you retrieve the asset, the asset isn't sitting in memory unencrypted. And then the final step, optional, but we do enjoy it, is the obfuscation step. So we do the obfuscation both before and after native compilation, and we've got some interesting stuff we'll cover as to how that works there. Creating these standalone executables, right? How do we go about doing that? Well, I said we leverage the Go compiler to do that. Now, what's interesting about this is, if you can kind of see up here on this, on the picture, we take your scripts and payload, and we actually write out an entire Go program that contains the logic and everything needed that we just covered into this Go program. Now there's flags in our compiler, you can go look at that code and see what it's incredibly unreadable. We needed to make it that way for security, right? But it's been a really interesting thing to consider that we're in a place in time where it's no longer enough to just write malware. You have to write code that writes code that writes here that writes your malware, right? So we talked about this before too, and now I'm going to dive into this. Linking JavaScript in native Go, I was called crazy a couple of times in the process of this. This was definitely one of those. And I still think it might be crazy. It's probably not the safest thing you can be doing in the world, but it is crazy. Thank you. It's an interesting thing, right? You've got two languages on completely opposite ends of the spectrum in terms of how they work and figuring out a way for a user to almost not know the difference between them is a fascinating endeavor for me and Dan for us to kind of implement this and somebody in the back who shall remain nameless. So here I've got a little example, right? So we use the Go import macro, the compiler macro we talked about. We're going to import Redis. We're going to import Redis because as far as I know, other than Node.js there's really just not an easy Redis library for JavaScript. There certainly isn't one for G-Script. You can't import Node.js modules into this. So how are we going to interact with Redis and G-Script? Well we're going to import the Go package for Redis. So we import that and from there, you import it as you see there as Redis. That as blank, blank is equal to the namespace within the JavaScript program that you're defining here in your G-Script. So on the next one I call the functions directly. So Redis.parseurl is actually a exported function within that Go package and I can call it just like I would in Go. Now one thing to note, there's no multiple assignment in JavaScript. We're in ES5 not ES6. In this version there's no multiple assignment. So if you look on line 5 you'll see r0. r0 is because in our linker that we do, when we see that you're calling a Go function that's returning multiple assignment we actually make a dynamic array of that and give you back the return inside a single object that is an array of various types. So r0 in that is going to actually be the Redis client the Redis connection URL. So line 5 we create a Redis client and line 6 we simply interact with it as we would any Go program, right? And then down there you look at the script we compiled it normally and ran it and boom. Got the, was able to interact with Redis right from G-Script using this native bridge. So I wouldn't give you something incredibly unsafe without some way to at least play around with it and see how it worked and test your stuff, right? So we spent a lot of time on an interactive debugger. It's pretty nice and easy to use. So at any time after you've installed G-Script you can simply do G-Script shell and it will drop you into a REPL right there. The REPL has the entire standard library that you've bundled into it and you can do kind of some various things. So for example we talked about macros. How do you get a macro into the shell when it's something that the compiler knows? Well in G-Script shell you can just pass the dash into it with macros you can pass multiple as many as you'd like into it and then when it drops into that shell it says if you've dropped into the deploy function with that VM instrumented. Other things you can do is you can see that I'm essentially doing the exact same thing that we were in the previous demonstration of the native linking. Except now I've got some functions that as I'm stepping through help me understand a little bit more about what's going on. So the function type of which you can see is the third function I'm calling there. It's actually showing me that under the hood in JavaScript this is actually a pointer to a Redis client object in Go's namespace. That's a pretty nice thing to have to be able to use here as well. Also any time you're in a script if you want to compile a binary for yourself but then be able to drop into a debugger we have a compiler flag enable debugging and you can just use the function debug console just like you would debugger in Chrome or anything like that and when you run your binary it will drop you into the same console right where you're at in the context of your script. Outside of that as I mentioned before especially functions that are only available from within the debugger that's been something we've expanded on the last couple weeks to try and make the native linking a lot more easy for people to do. Another one is symbol table so you can call the symbol table function in the interactive debugger and that's actually going to go through and show you all the functions within Go's namespace that you've imported in there. Our standard library is actually instrumented in Go. You don't have to import it as a Go module because the compiler is smart enough to know oh you're calling a standard library function I need to link against that. So we talked about how cool it is there are some limitations and we'll just get these out of the way real quick. First thing no free VSD support I know that some of you neckbeards in the crowd I'm looking front row here are going to be real upset about that. But I don't think it's impossible it's just something where it was on a medium priority list to go and get done. I think as Go becomes more free VSD compliant and things like its OS and user lib we'll be able to extend support to this as well. One of the other limitations that kind of people I've seen have issues with is these are large binaries.   So things like look ahead and stuff like that you're not going to have compatibility in that so you've got to be careful you can't use crazy complex regular expressions in it. Another thing that's been kind of difficult for us has been versioning. Go's versioning story has not been the greatest part of the language as it's evolved over the years and that made it hard for us to do a version of it so as Dan and I have done this Dan will go write a bunch of G scripts and then I'll come around and I'll make a compiler change that'll break all his scripts and he'll be like oh why can't I still stick with the old version. Well a lot of that has been tied to this Go versioning problem. In the future Go is releasing in 1.11 their new Go mod support I think in the next major version of G script we'll actually release with an ability to lock it in and be able to have backwards compatibility. As we said before ES5 is the only thing we support right now. Working on ES6 support there's complicated reasons why that's difficult for us but something we'd like to do as we talk to people that write a lot of JavaScript they seem to think that would have been a really nice feature for us so we're working on that. Also something that we don't have is a lot of the JavaScript concurrency primitives that you guys might be used to because our virtual machine is actually instrumented in native Go we have to do all of this concurrency actually outside of that virtual machine's namespace. But as I mentioned before we have the standard library you don't need to be a Go programmer to know how to use this on a basic level. We've got libraries that cover almost every type of basic OS functionality you'll need. They're entirely cross platform they're supported by us if there's ever a bug in one of these and please file it against us we will fix it immediately. It is exactly the type of stuff where as we sat down and used GScript in our jobs and at CCDC we were able to say oh there's some parts of Go that are just complicated and maybe not straightforward for the normal person so let's just go kind of wrap that basic functionality in our standard library and present that to users for ease. So with that I'm going to hand it back to Dan to talk about some of the ways that we've used this in the real world and why it just has really been powerful for us. So like Alex was saying one of the number one reasons we use it is because we encounter a wide array of systems Windows, Linux and Mac and we didn't want to keep rewriting our techniques for these different operating systems it was really kind of a pain so we really like the cross platform features of it you can actually write G scripts completely system like let them completely cross platform where the binary itself will determine which operating system it's on using Go and then execute according to that obviously you have to compile it to a specific architecture so at the compilation time there's always that and when you're embedding assets you still need to embed assets that can run on that specific architecture but the platform itself is cross-platform so I love that. It's also really easy to use originally we were considering like having people write the Golang for that original software and then use that to embed their stuff and it was a really hard kind of ask for people to learn Golang so instead we decided to roll this out because now all they have to do is learn JavaScript and JavaScript is really forgiving unlike Golang where it's really opinionated and you have to like handle all your errors so we think the barrier to entry with JavaScript is a lot lower than Golang another neat feature of that is when we added the Golang native linking now it's also a good feature to learn Golang right? You can start with JavaScript, you can play around in the debugger and eventually you can just start writing your own Golang native Libs and then call them from GScript which is pretty cool. Just like I was saying where you can call any Golang native library like off a GitHub which is really freaking sweet you can also wrap your existing tools so you don't really have to change any of your existing tactics or any of your existing methodology you can just instrument them now with Golang which is this is now like persistence and techniques as code it's very auditable we can give somebody this script that says this is exactly what it's going to do when it hits disk which is really nice because as you'll see we've been building a community around documenting all of these different G scripts or I'm sorry documenting MITRE attack techniques in G script so now if you're familiar with MITRE attack we have these small little atomic techniques we've been writing G scripts such that you can compile native unsigned binaries with these techniques it's kind of neat because this way you can see can I detect an unsigned binary doing this from a blue team perspective as opposed to like a script doing this which might be easier or harder depending on your instrumentation so like I was saying we've been writing a ton of G scripts and we've been writing them to the MITRE attack framework I try to make them as atomic as possible so I try to keep the techniques as small as I can compile any number of G scripts into a single binary so the idea is you have a bunch of little techniques that all play well together and again we really want people to contribute stuff we want to continue to catalog that MITRE attack framework such that we can compile it to these native binaries so again this tool was really built with a community in mind this tool was built with multiple red teamers contributing payloads to build a single binary it's really collaborative first like collaborative post exploitation is the idea we want everybody to contribute a G script and an implant and we're going to run them all on the victim because we're a team so here's a quick little example just showing some stuff up here we have a go import of a native package which is OS we're going to use this to create a temp directory later but we also import a special library we we made called the X library we had a lot of help with a unnamed person in the back and this is an amazing library because these are the functions that yes they're platform specific but we would be remiss to leave them out right this is windows registry editing this is process injection this is kind of that fancy stuff that is platform specific and again we move that into the X library because the core of G script is supposed to be cross platform and then below that we're creating this croissant.exe this is any arbitrary executable in our case it pops a croissant because croissant rock we croissant okay so first thing we're doing is in this first block this is just prepping the asset this is just saying we have an embedded asset from compile time and we're just going to create this random temp directory string and that's where we're going to write this asset execution just to write that file to a path we're dropping a file so this is like a great detection exercise and then here is a run once key and we're just adding this to show this persistence method so the idea here is we're creating persistence as code and we're abstracting the implant from it right so now you have this arbitrary now you have this arbitrary persistence technique and you can just persist any old implant and it's great for detection ops because we do we detect persistence technique it's also really cool for hunting ops one thing that I really like is this idea of compiling a g-script with multiple techniques in it like a technique A and a technique B and we can run this and then later a blue team can find this they can dissect this and they can understand the techniques in it then they can hunt on those techniques let's say they had an alert for technique A they reverse it and they learn about technique B then they can hunt their data for technique B and then they can use these techniques in games where we also compile a binary with technique B and technique C and do they find that right something they may not have the alert for so it's kind of cool for these advanced hunt operations if you can get there in your organization so kind of just like why do we really love this like if I could give you like one line and number of techniques we keep the techniques really small and auditable we wrap our existing tools our favorite tools on disk or in memory but we can codify the techniques of how we're instrumenting them and then run them with a single click so like what's not to love so this always works right one really cool part about CCDC Dave Cohen is like the grand master and he has this great strategic vision and at the end of day two at some point he really like he unleashes the hounds and we have to burn things down so like taking down services is pretty straightforward right like service whatever stop pretty basic and boring so you want to get creative with it and you want to have some fun so one thing we like to do is make these troll payloads or troll wear if you will so here we've bundled a ton of different troll wear and we're just executing it on a windows machine the idea here is you just see how much stuff can happen at once you can really deal with it it's a little overwhelming when it will execute and then it blue screens the box but it's cool so I'm just stepping into the directory where it is I'm making the screen bigger so you can kind of see stuff as it happens but once we execute this the whole machine just goes to hell so this is going to run multiple payloads this runs the MEMS which was made by Leoric and Koot we had a good friend reverse a bunch of malware on the internet and we instrumented that so that's just some of the troll wear we like to throw around one demo down one more to go the next one is live the next one is actually live that was just a video but we're going to do this one live too we had another demo as well planned RIP in the back there but I'm going to save that for next year so I'm going to boot up a virtual machine here called Defcon 26 demo this is just a standard OSX virtual machine I'll make it full screen in a minute here but first thing I want to do is I'm going to let's go through and make one of these together so I've got my terminal up here you guys can read that I'll make it a little bit bigger for you guys cool so I've got my terminal I'm going to do an LS I've got in here we'll just go ahead and remove my test one so we can actually do it live in it I've got a folder with a bunch of G scripts this is all just Mac persistence technique doing things like disabling the firewall and enabling guests and doing some SSH key persistence and all of these I'll show you one like a service installer it goes through and uses a library that we wrote called xService so this is an experimental library but it actually is a cross platform service installer so it doesn't matter if there's like sysvnet or systemd or it's a windows box you can very easily in one unified library install a system service which is always fun we love to do that when we're red teaming I'm going to just go through and make one now live here with you so I'm going to do gscript compile dash dash output file users demo osx live.bin and then I'm going to say gscripts star.gs we're going to run this in what it's doing most of the time it's spending right now on this it's spending actually embedding and encrypting all of the payloads that we're putting into this into the binary itself so I think this takes about 20-30 seconds right now but as you see here it does tell you all the scripts that it's essentially bundling into this executable it lets you see some information that we're doing this for Darwin here's the output file which I talked about before so being able to keep the build directory which will show you the source code that was used to make this enabling upx compression disabled by default a lot of different options will give you and boom scroll down it's done I'm going to look in there it is a 26 megabyte binary what payloads are you putting in here lord thank god that's local and we have internet into while I'm here SSH into our Merlin server Tmux uh there we go we've got some old dummy agents but it's fine they're not connected yet let's go into our VM now and take the executable that we just built OSX live copy it over there we go I didn't enable any of that so it's going to be silent so we're going to say sudo dot slash desktop OSX live enter and a bunch of stuff is happening and then enter my password that's not phishing at all boom so something happened I don't really know what if I look back at my Merlin I've now received a new agent check-in let's just come in here and look and see some things file sharing, remote login, remote management all this stuff was turned on so all of the attack techniques that we just bundled into this were actually run on this machine so if you're a red teamer I think you can extrapolate why this is so valuable tool to use in your tool chain if you're a blue teamer if you work at a company that has a bunch of detection systems man how many of you guys have always wanted to know is actually telling the truth that they detect this thing or not you can write the g-script and I promise you they're not going to detect the binary if they detect the actual activity then you can validate that and that's really the fundamental problem right now in the blue team space is how do I trust that when a vendor sells me something that says it does X that I actually know it can actually do that what we're trying to do here is provide blue and red teams alike the ability to codify these techniques and ensure detection on a file is not going to just cheat the actual result of saying yeah I detect when something does shellcode injection well do you actually detect that or do you just detect that a file has a string in it that matches a certain thing right this is the type of evolution insecurity that we're trying to present to the world so we'll come back to our talk here and that's it version one is live right now on github I've written some documentations out I've got some shout outs for some awesome people who helped us with this on the side as well as somebody totally unnamed who didn't help at all with this project and he's not here he didn't help us his name is not at the bottom of that list of authors there so with that I'd like to open it up to you guys for questions, comments anything thank you good say that one more time you probably could I've not so the big problem with it has been the regular expression compatibility so the question was could you run a normal JavaScript application within g-script yes as long as it didn't break the regular expression or the asynchronous incompatibilities right now it should be fine so something like underscore for example does work within it underscore library into that and it would work just fine the ES6 compatibility is something where I think if we can get that actually implemented it'll give us a lot more flexibility in being able to allow more current JavaScript tools to be able to be brought inside of it yes right here yes no everything is so the question was does the dropper do such things from the github URL it doesn't when you run g-script compile it contains everything you need right then and there into the binary so everything happens at compile time all the embedding does it was one thing we were kind of on the fence about saying should our droppers reach out and get stuff or should we just really try and pack them tightly and safely internally one of the ideas there is when you're in a high security context solution you can do things locally and then use that existing c2 channel to shuttle stuff over right so we have a request library and you can like pull stuff down but personally I like to kind of do stuff and then go out of existing c2 channels and just operate through those channels I think we had a question over here yes yeah so the encryption of the assets is just 8 ES 256 I'm not going to claim to be a crypto expert I just follow best practices on that it is isolated per VM and it's unique every time you compile so it's not generated in any sort of deterministic way now the obfuscation I'm glad you asked the obfuscation I would say is implemented in a way that assures zero reproducibility of builds so if you're trying to reproduce an MD5 hash of two exact same inputs and outputs of a g-script binary I doubt that would happen the obfuscator is meant to try and remove the ability to find static strings within it it's meant to randomize things like function names and address space within the binary itself and then we also have a post obfuscator that is not turned on by default but you can play with it it works really well on Windows and OS X Windows, excuse me it works really well on Linux and OS X Windows it kind of has some problems sometimes it basically after Go compiles your native binary it just goes through and starts patching stuff out of the native executable it's really dirty but it does actually work it does a great job sometimes yeah sometimes that's why we test right anybody else have a question we've got about five minutes left maybe over here I haven't no come on everybody just wants to go sleep right yeah we got a question in the back there what if you want to write your own compiler that's a great question so we've implemented gscript basically as in everything you've seen here whether from the obfuscator to the compiler to the engine itself it's all implemented itself as a library so if you wanted to implement your own compiler you could actually take the engine library figure out how to translate whatever it is you want it as your input into an engine itself bundle that together and then boom you've got you've implemented your own essentially gscript compiler we've got some stuff on the works if you're going to be at our workshop tomorrow if you're going to be at our workshop tomorrow we'll touch on that a little bit of how we're actually looking at implementing a C2 in gscript so that the C2 itself can supply the binary with gscripts at execution time so there's not actually something bundled into it or it can say hey switch up the C2 channel talk to me now on this other channel interesting stuff like that is I think what you probably see from us next year in another follow up talk yes right here so we don't have a slack we probably should have a slack that's probably a good idea at this point it's just been on github if you send me a pull request I would love it we put a lot of effort into this it's taken a lot of engineering hours and we're excited to kind of share it with the community a lot of stuff we do at ccdc it's released so this has been something where we're excited to say look here it can be good for the greater community at large we have a few contributor guidelines too and then there's a lot of ways to get involved you can write gscripts you can help write different native libraries you can help add to the compiler itself and you can even just help with the documentation like anybody that wants to get involved we're really receptive to people helping I think we're yes so inside the documentation if you go to this github there will be a link to Dan's repo where he is actually doing all of that mitre mapping in a separate repo I'm open to suggestions so when you check it out if you think there's a better folder structure right now I was just doing it based on platforms and then I have each of the techniques linked in like the meta information in the top but if there's a better way to organize it I'm all ears cool I think two minutes left anything else anybody raise your hand do you think you might use this at some point maybe a little sweet awesome maybe we'll have a little gscript con sometime thanks guys


In order to change your version of Elementor from what you have currently, all you need to do is go back into the dashboard of our WordPress.  And inside the admin area, you'll go to Elementor and then go to the tools section inside Elementor.  Now inside version control, you can see that you have all these other versions of Elementor that are available. So you can choose any of those versions and then click the reinstall button to help you do that. But you need to be careful to back up your database before your site, before you actually choose to install any other version than what you have currently. Now, since I want to go to version 3, which is not yet released, is to go to the beta tester and then enable it and save changes. Now, after saving changes, all you need to do is go to the updates here and the dashboard, go to updates, and then click check again. This will allow you to see the latest version of Elementor that you can test before it actually comes out or if you want to get the beta versions or the alpha versions, this is how you do it. Now, I'm going to choose to go to 3.0 beta 4 and I'll update the plugin right now. If we now go to the plugins page, you will see that the Elementor we have is actually 3.0 beta 4. So I'll go into my posts, go into edit with Elementor, and if I choose to go, you will see that my settings is completely different from what I had before. So this is the new Elementor 3.0 and this will give us new settings for our global colors. So let's see that in the next video.