The next coming up is a topic. How is technology shaping the future of streaming? We have stalwarts on the streaming platforms, technology giants, of course, coming forward to speak on the topic, after which we also have a celebrity panel where we will talk about how OTT has it democratized creativity and stardom and post which we will have the dynamics and diversity of OTT content. So, lots of good information coming your way. Stay tuned with us. Coming up next, we have, like I've mentioned, how is technology shaping the future of streaming panel discussion here? And stalwarts of the industry joining us on this panel are Mr. Lokesh Johan, Chief Technology Officer, Irosnow, Siddh Mantri, Senior Vice President, Product MX Player, Rohit Thikmani, Head of Product and Growth, Wacom 18 Digital Ventures, Mr. Pankaj Kedia, Managing Director, Emerging Markets, Dolby Laboratories. And chairing this session is Aditya Olman, Co-Founder and Head of Marketing, Mylene Foundry. A very warm welcome to all of you. I request all our panelists and our session chair to please switch on their camera and mics and join us on screen. Eagerly waiting to hear from all of you on this very pertinent topic that our viewers will definitely take some key takeaways from. Once again, a very warm welcome and thank you for joining us this afternoon. Aditya, I'd leave the screen to you. Thank you very much, Kapi. And thanks for the warm introduction. I hope I am audible. Yes. Okay. So, thank you very much. We have an amazing panel here today and I'm really looking forward to this session. Definitely, technology is the most exciting topic to discuss about today, not just in OTT but in all streams where we are seeing how the pandemic today is accelerating the adoption of technology across industries, across verticals, but video streaming is specifically very, very exciting because all of us live and breathe content, video, and it's an essential part of our lives. But while we talk about this growth story, we talk about the next 500 million that is now coming onto OTT platforms. We're talking about tier two, tier three growth and the stellar growth overall that we are seeing in OTTs. It's also important to talk about what are those challenges that each one of you are facing while enabling this growth into tier two, tier three, and even rural India. And how are you going about tackling those challenges? I think I'd like to start with Rohit to get your views on what are those challenges, how are you tackling them, and what do you see as challenges even going forward as rural India also comes on board into the OTT bandwagon. Different parts of our business have different challenges in our journey into the hinterland for the subscription part of our business. Access to banking is an issue, basically enabling rural users to make payments. For the advertising part of our business, the usual connectivity latency challenges abound. In general, the prices of smartphones are still out of reach of the next billion users. So to speak, we've been hearing of promises of 2,000 rupees smartphones and 3,000 rupees smartphones for a long time now, but they really don't cut ice. It's a decent OTT experience can be only had on a 456,000, 7000 rupees device still. So yeah, typically these three would be the top challenges, access to payments, digital payments, access to high quality networks and access to high quality devices. Great, thanks Rohit. Then you talk about digital payments. Do you also see a lot more partnerships happening on that space to enable better, smoother transition into digital payments? Or do you see other kinds of solutions such as actually relying more on cash cards? I do know that there are a few regional OTTs that have looked at actually using cash vouchers for users in areas where digital payments is a difficulty. What do you see as that trend happening in the digital payment space? I think telco partnerships are the most, are the path of least resistance, is the path of least resistance. Cash, we haven't really explored. We've been seeing cash cards in India for the last 15, 20 years, but never really thought about it, that must be honest. Thanks Rohit. Sid, I would love to hear your views. Of course, MX player, primarily being an AWOD player has been doing phenomenal in terms of watch time and getting viewers to actually come back to the platform, but what are those challenges that you are facing for scale? I was about to say we kind of solved the payments and access to banking problem by making our content free. So I think for us, the biggest problem has been cost of data and data connectivity and data penetration. It's a big focus area for us. I think a lot of our customers, especially the OTT or three cities, they tend to live on our daily plan of one GB or two GB data, and they tend to burn it out. They have so many instances where users want to consume our content, but literally run out of their quota of the data that they have on a daily basis. So that's one. I think, again, telco partnerships is one way to go about it. Clearly, we live in a country where net neutrality has to be respected, and so we've got to find creative ways. I think the second challenge I'll talk about is as we start getting deep into tier two, tier three India, the preference and the taste of content is very different. And there are regional preferences. There's a very, very strong preference for region-specific content, language-specific content, and being able to cater to the diversity of preference that users have, and being able to target it, and that's where kind of product and technology kicks in. Being able to identify those tastes and preferences, and being able to number one, generate supply from a diversity point of view, and matching that supply to the appropriate demand. I think that's where we focus a lot of our energy on. Great. Interesting. And talking about localization, there's a lot of effort going in by multiple players. Rakesh, I did read that sometime back. You've also partnered with Google Cloud for AI subtitling for regional languages also. So would love to hear from you. How do you perceive overall the challenge of tier two, tier three, but also localization in particular? Thanks for the question at the end. Let me first start answering the larger question, the problems that we are facing. The biggest problem I think I speak for most of my colleagues is the ability to deliver content. The pipes are still small. The tier two, tier three connectivity is still a problem. It's only we can cater to a certain percentage of people who clearly have a line of sight with the network. That's it. The rest of it is still awaiting. So a large part of India is still awaiting options of offline delivery and cash payments, which kind of requirement. Right now, we're looking at a niche where people are aware of how to do things online and they're only serving that crowd. We need to get out to the masses and say, you know, this is available for you all. So that is where I believe the larger part of the problem solving has to happen. And it would be a very strategic option of working with the telcos, working with the government, working with partners and cash collection side. We have to do everything and the whole ecosystem needs to evolve. I would say that is where the larger part of the problem is. Obviously localization, as you mentioned, we're trying to do our best. We're trying to ensure that content localization from both subtitling and speech perspective starts happening more and more. And we don't believe going the human way is the right method now since we are a global service, we have to cover all geographies and it's physically not possible to getting all those renditions and all those stuff. So that's where we are saying we will utilize technology. We're looking at partnering with multiple players just to identify which suits are needed best in what markets. Thanks, thanks, Lupeesh. Absolutely. And while we are all trying to solve the problem of last mile and making sure that content can get delivered and even payments can happen for the tier two, tier three, it's probably also important to look at in the middle of all this, what is the quality of experience that the user is getting? Because while we are looking to scale, we are also looking to retain customers and make sure that they come back to the platform. And in our company also, we are looking at how can we help enhance that experience. Pankaj Dalby is trying to do something similar by actually looking at how can you leverage the power of the edge device of the consumer device to get certain experiences maintaining continuity of video delivery and audio delivery. So we'd love to hear your perspective and your view into this problem. And from our perspective, it's not a question of this versus that it's not an or problem, it's an and problem. So while we have to scale, reach new consumers, I think how do you engage and retain the existing consumer that you said? I mean, how can you whether monetize them better or engage them better, you know, along the view times, increase engagement, all of that. Audio video quality has proven many a times again and again that it helps engage, you know, increase engagement, whether it is increased view time, or you know, a better brand connection, many other factors. So, you know, and I told me we're in the business of enabling spectacular experiences, both for audio and video. And we do that by working across the entire ecosystem with content creators with the content distributors, you know, like we have our colleagues on this panel, and also the device manufacturers. And what we see on the device side is there has been a significant ramp up on device capabilities, you know, both on the audio video side and not just at the premium, you know, $1,000, $2,000, you know, TVs and phones, but even on the $100, $150, you know, so in Indian currency, $10,000, $12,000, those price points, both on the television and on the phone side. So the capabilities on the devices is constantly increasing. We did a pretty significant global survey, including in India last year in the middle of the pandemic. And what we found out is that over 90% of the respondents had recently upgraded over planning to upgrade the device in the next six months. So device refresh is also happening very fast now. But what is being delivered to the device is a lot of times is not optimum to what the device is capable of. So one is there's a missed opportunity. And there is obviously there's a mismatch in the expectation. So I think it is a mindset issue.  So let's create content that how people can hear that. But on the other hand, there was the cinema right down the road, which was state of the art. And so the references were all wrong. So and we made that shift, we worked with them to shift that, you know, mindset from trying to create with first, you know, content with broken speakers rather than, hey, create content for the best possible. But yes, let's make sure it works in the other side also. So I think this is not an or question to me, this is an and question. And I think service providers need to factor in more about device capabilities and leverage more. I think it's at the minimum, this is the best opportunity. Right. Thanks, thanks, that's a very unique but important view that we cannot think of it as an either or it has to be and because while and we spoke about it earlier as well, while, you know, there is a need to make sure content delivery happens across the board, the viewers are also getting more and more demanding, right? Pankaj and I were discussing how today, you know, on a small screen, we get Hollywood content and you also get Indian content, regional content on the same screen on the same platform. So the demand of a certain quality both from a content standpoint, but also from a quality of experience standpoint is really, really high. And so it's important to look at both of these together. Now, while we talk about all of these, I mean, it's always, I mean, why do we want it to be an and answer? There's always this optimization issue that exists today, right? I mean, because of the last mile challenge, but do you see, and I would love to hear from each one of you, your view on this, I mean, what we what we get to know now is that 5G is that panacea, 5G is going to solve everything, right? 5G is going to bridge all those gaps that exist, is going to bring in reality streaming. And I don't know if, you know, our dogs are, you know, our dogs will start dancing in augmented reality using 5G. But, you know, jokes apart, I would love to hear from the actual horse's mouth, what, you know, what is your expectation in the medium term, but also in the long term from 5G? Do you see it solve all of your problems? Do you see new forms of streaming emerging or are you a little more skeptical about all that, you know, picture that is being painted? I actually started location because I can see him smiling, and I'm sure he has an opinion on that. I have got both pros and cons of 5G in my head. Like, I definitely would want self-driving cars that people don't have to do anything except for watch content or that we are set. So I should be happy about, you know, 5G coming in and everything is being so great, immersive experience, interactive experience all across. But then I have to take a step back and understand where 4 5G is doing in developed markets because we also serve developed markets. And then we understand the line of sight aspect of 5G is becoming more and more important and India might not be the best use case with that. The high concentration of city, centers in India actually are far in view. Whereas a large part of India resides in a very, what you would say, far away from 5G antenna scenarios. And the way 4G rollout has happened and how it has changed thing, we agree to it, but the incremental change that 5G is going to bring, is it actually going to be there? It's a bigger question. I personally am trying from our side that we are as ready from immersive experience perspective for 5G enabled content delivery scenarios. But it seems like it's going to take a few more years, at least from an Indian perspective, it is going to take a longer period for it to become big enough to create the impact. And I would be judicious with the dollars that I have to spend and not go all out preparing for 5G onslaught. Right, absolutely. So basically be optimistic, but also think practically as to what is the impact that you can create in the medium term. Rohit, what are your thoughts? I mean, do you see, for example, 4K becoming a reality in India in the next few years because of 5G or other advancements in the infrastructure? 4K will become a reality if 5G or no 5G. I really don't know about 5G. I ask myself what can we do with 5G that we can't do with 4G? How better than 4G is 5G? Will people notice even? So we don't have a top-down system-driven approach to technology like we don't predict the future sitting in some room saying 5G will change the world and then start acting on it. We have a bottoms-up approach and we pick technologies that help us get to our goals and help our customers get to theirs. So I really don't know about 5G. It could very well be just faster 4G in which case, depending on how fast it is and whether that speed will be even discernible by end-user, it may not matter to the OTT business. And there's also basically the point that 5G might just be a lot more useful for industrial use cases, industrial IoT versus actually for consumers. But Sid, I want to hear your view and especially from the point of view that MX Player also has Takatak, which is sort of the short-form video content platform and which is fueling I think the next generation of video consumption. So how do you see not just 5G but newer infrastructure? How do you see that supporting the short-form video revolution if I may put it that way? I think you're on mute, Sid. Sorry about that. My son just walked into my room so I'd muted. It's a really good question. One of the reasons why I'm excited about waking up in the morning and do what I do is because a perk we enjoy is we kind of get to live and invent the future in so many ways. So I think the bigger problem is really data consumption quotas or data consumption capacity and then the cost like I said earlier. I think 5G will help in terms of enrich the quality of video that users get to watch for the same amount of data consumption. But we've kind of stolen the challenges we have today when it comes to speed and data because with the first OTT in the world who's commercially launched H.266, it's cutting down size of video as well as bandwidth requirements to about 50%. Those savings go all the way to 70% when you go into HD content, 720p, 1080p content. So I think 5G will help enhance the user experience because for the same amount of data consumed, the users will be in a position to get significantly better quality of content as we also push the boundaries of the codecs that we use along with the speed efficiency that 5G brings in. I think the second part is you mentioned 4K content. I think 4K content is a bit of an urban phenomenon in India right now and I don't expect that to change because the devices and the equipment or the infrastructure you need to consume 4K content needs to get cheaper and more accessible. And it remains to be seen whether the base at which mobile consumption of content is growing when that plateaus versus the base at which that 4K capable television that costs significantly more and not everyone can afford it. And in addition to the fact that the television becomes a very constraining consumption experience because it's not personal enough. I think where we find the strongest growth is where entertainment is very personal and is completely at your discretion. Television access to television tends to be a communal experience and it's not at your own individual discretion. So it remains to be seen whether that you know kind of kicks off in a big way. I think we're probably some time away from that happening but the mobile consumption kind of going at break next speed and will continue going at break next speed because it's a very, very personalized experience not just the technology but even the access to entertainment every user has. Absolutely and you know a very valid point that it's not I mean while the 4K living room is an urban exciting but urban phenomenon mobile consumption is just growing at a break next pace and will continue to do so. And Pankaj would love to hear your views on that because from Dolby's end you know you are trying to really create experiences now not just in living room but also on mobile. So how do you see this playing out with new infrastructure coming in? What is your view on 5G or on infrastructure being developed better? We did speak about it and you mentioned that you do believe that a lot of current problems will be solved but would love to hear your views on the same. I think two parts to that answer. So I'm pretty bullish on 5G. I mean luckily in Singapore they've rolled out 5G. I get over 300 Mbps on my phone on 5G. So it's pretty amazing. It kind of equals what I get at home with you know the fiber connection at home. So it's very you know it to me 5G yes will enable some new use cases whether it's VR or AR but you know how mainstream they will be I think needs to be seen. We need to see how you know how the consumer adoption is going to be but I do think you know being wireless it will have advantage for markets like India. India you know has always done well with wireless connectivity and I think there in terms of solving our existing challenges of content delivery in a robust reliable and high speed manner I think there's going to be a lot of advantages that's going to come with that and I mean one thing we have to also remember is 5G is very evolving right now. There are you know services being rolled out but there's a lot of work happening in on the innovation the evolution of 5G. So it's not at a point where we say no this is 5G and this is what's going to get rolled out. There are standards being written today there are new use cases being developed for 5G and you I mean there is experimentation happening on you know broadcast type linear delivery over 5G which can you know go mass you know so you don't have to send one stream to a million streams of the same thing to a million people you know you can do you know you can do broadcasting type linear distribution which works on phones and you know other places. I think 5G yes in terms of the wireless access does it really open up opportunities in the home. I think yes it does exciting possibility there because we obviously know the broadband penetration is limited right now so can that open up. I think that's on the 5G. I'm pretty bullish but I'm more bullish on our existing challenges getting solved and you know the around content delivery and experience in getting resolved and I'm sure there are going to be new use cases but I think one needs to watch and see what I mean there's been a lot of excitement about 3D and VR but they haven't really become mainstream so far so that needs to be seen. I think the comment on the screen what we have you know seen over the years and you know we've done this for a long time is what we have seen consumers usually would choose the largest screen that they have access to. Now it's possible that a young kid you know may not have access to the TV screen in the home that's totally possible but when they have access to a certain screen they will usually choose the largest screen now. It used to be the cinema it used to be the living room now people don't have access to the cinema. We've seen during the pandemic the growth on home consumption on television has really increased significantly and it's not really been at the cost of mobile it's been in addition to mobile so in that sense you know I'm much more bullish on the living room and the large screen and I mean if you just look at the market again the price points you're getting 4k televisions at it's very mainstream now so it compares to you know what we spend on phones or even sometimes lower than that. Right absolutely and I think again it's an answer there because it depends on the kind of content for example for short form content like you know what we have in Takata and other platforms the format is such that people really enjoy watching it on a smaller screen where there's a lot more interactivity in sort of watching the content versus let's say if it's a more immersive kind of content like a movie I mean I'm talking from personal experience right I would like to watch a movie on a large screen but if it's short form content which also by the way is growing really really fast we had done a survey internally at our company Myelin Foundry we did a survey with a thousand people and almost 30% actually claim that they on a daily basis actually watch short form content which is less than two minute content on a daily basis right as the primary form of content so definitely it is you know I think it is going to be both ways I think living room is definitely will be growing in the pandemic is accelerating that because people are spending a lot more time at home but short form content also from an interactive standpoint will be fueled by the mobile phone and the you know audience that is sort of always having access to their mobile wherever they are right I mean people take a break from work and then they watch a couple of videos on these platforms also great great insights and very very inspiring I can see there's a question as well for Rohit from somebody in the audience what are the investment plans for content delivery user experience and security that you have at Viacom Rohit wow that's a big question content delivery user experience and security that's pretty much covers everything I think everything investments we you know we make investments like I said in a bottom sub and I mean you I assume you mean investments in technology so like I said we have a bottom sub approach technology is a means to an end and wherever there is a need to help our customers get to their goals or our business to get to ours we don't hesitate to invest in technology in all those three areas and great thanks Rohit I hope the question was answered I don't have the person's name who had asked the question but thanks for the for the question I also just generally you know I'm sure everybody in the audience is curious to know why we've talked and we're talking about so many different key priority topics we would love to know you know for each one of you as a product and technology you know you know when you wake up in the morning and you're thinking about work what are those three priority things that you have that you are you know either firefighting or innovating on those top three things that come to your mind location would like to start with you any random alerts that you have missed because you have put your phone on silent to get a sound sleep is definitely there that's typically the start of the day but then then things move along so there's a BAU aspect you just check on things of what is the progress of things that is already going on and outgoing you know releases and roadmap and this and that but then the other priorities obviously is innovation you have to understand the way things are evolving how markets are moving how certain breakthroughs are happening on a regular basis and see does that use case apply to this industry does that make sense to invest in any of those what you would say innovations either building it licensing it or co-building it either of those situations we have to have our eyes and ears completely open all the time for hearing news around anything to do with video at least and anything beyond video is obviously there right right and when you talk about innovation what is a timeframe that you look for outcomes because obviously you know from industry to industry is very different but for OTT what is that turnaround time that you look for outcome from investments in innovation so typically a quarter out a lot of things typically take at least a month long effort to build in house or with vendor partners and then you have a typical cycle of releasing on beta for internal QA consumption and seen so typically for most features that we envision now can go out or innovations that we should invest now and see a possible release cycle it's a quarter out okay interesting uh Sid what about you what's what's the usual day like in terms of your priorities at MX yeah you know it's a great question I tend to think about it in terms of what is it that gets me excited get out of bed in the morning or what is it that I you know that I go to bed with thinking about you know can't wait to get up the next morning and continue you know these things that I have to put a pause to just because the body is going to get dressed I think there are three things I wake up with that are always top of my head first one is getting a pulse of the customer and so you know we cannot do a daily daily report on you know what the actual ratings saying we measure in ES at a very regular basis and going through those reports and so getting a pulse of the customer you know we do fairly frequent user research studies and so all the different channels through which we get to you know listen to customers observe how they use our product that's number one number two is how we how we create differentiation and value for our customers and you know technology is a means to achieving that end so how do we push the boundaries of technology with the skill set and the you know the tools available to us and create differentiation and keep winding the differentiation in terms of value we are going to customers I mean think about customers in you know in three dimensions you know and I think of all these three as my customers the end users the content creators whether it is you know publishers who are creating content on the cut up you know user generated content or whether it's studios producing premium content and the third one is the business itself and how we monetize the business the business is actually my customer as well so that's number two we differentiate and the third one is as a as a leader how we elevate and upskill the people that I work with the people who work in my team and the one thing that I kind of stress on because I feel all of the problems take care of themselves is if we push limits on taking pride in our craft and so pride and craftsmanship is kind of you know the most important right up there when it comes to how I help my team succeed and raise the bar thanks that's really inspiring Sid I hope you do get enough sleep after so much that you're handling you know being in Singapore and being two and a half hours ahead it's yeah it's gonna be very challenging because yeah but when I it's almost when I go to bed is when like it was peak activity in India right right at least thank god you're not in the US otherwise it'll be totally crazy yeah yes but you're also in Singapore I hope you get some sleep too after all the work that you're doing but I know that you're handling emerging markets and there's a lot of things that you're doing would love to hear about your priorities about what you do on you know in a usual day I don't do well if I don't get eight hours of sleep so I get my sleep very important but yeah I think important priorities number one is people especially right now especially with the teams you know and what's going on across the world especially in India so that's that's really top of mind but you know expanding on that people piece you know in better times really thinking about you know how do how can you know we enable our teams you know how can I enable my team to do the best work how can we enable customers externally whether it's a creative or it's a technician or it's you know it's a manufacturer how do we enable them so enablement is a big thing on my mind and what's the role I can play personally there and and the second piece is around you know customers you know how can we serve our customers better and still talked about it you know I think you know whether it is bringing more value to their businesses helping them meet their objectives you know what what is that we can do for our customers how can we be better partners and I think the third piece is around connecting dots so because we are in a very unique position that we work with a very large cross section of customers I mean it's a tall statement but we pretty much work with everybody in the industry from everybody who makes every device from everybody who makes your distributes every piece of content and people who create that content so we are working with a very large cross section of the industry and you know and we have people who have deep relationships in each of those areas and I think we bring some unique value in trying to be able to connect those dots together so I think those three great it's really great to hear that you know technology and customer are two of the things that is common across the board and which rightfully should be because a OTT is highly highly dependent on technology in terms of actually the you know the infrastructure itself and the ability to get actually deliver certain experiences but also the customer being in the center of everything Rohit you've been an entrepreneur and you're currently the head of product and growth I'm sure you bring in an entrepreneur spirit into what you're handling right now what's your day like what what do you focus on well every day is different but there are a bunch of things that always play on my mind mostly let's say from an outside in perspective the quant metrics for our viewers advertisers our business from a qual stuff keeping a finger on the pulse of the sector on the consumer this is like a you continuously pay you know partial attention to these things but the thing that I these days especially I'm spending most time on is inside of stuff like being happiness and their growth and alignment with stakeholders especially in this remote work from home situation how the culture shaping up things like that really so yeah outside in inside out and regarding the entrepreneurial part when I was an entrepreneur I did my job professionally as a professional I bring entrepreneurial spirit to the work so it's really doesn't matter who owns the shares of the company you've got to do a job and do a good job of delivering value to your users investors partners. Thanks thanks so much I know we have about five minutes to six minutes to go but I do have because this is a panel talking about technology trends we did talk a lot about the challenges about how we are trying to overcome them we talked about 5G but I would love to know from each one of you what is that one trend that's super exciting to you personally and you really would put your money behind it. Pankaj at start with you what do you think is that trend that you already seen happening and how has the pandemic impacted that you know in terms of acceleration or has it slowed it down would love to hear from you. I think as we've spoken I mean the pandemic has accelerated things I mean and then the obvious thing what we spoke about is increased consumption there are better devices you know better engagement but I think talking about the one trend that I'm personally very excited about is actually audio because there has never been more interest in audio than there is right now I mean if you look at Clubhouse you look at podcasting you look at music it's just never been more important than you know I mean just the people that are getting behind it the quality of content that's coming out you know we are working with a very interesting company in India they're a startup it's called Earshot it's a podcast service and they do scripted drama on podcast and it's just stunning content and the fun thing is that they're doing it in vernacular languages like Bhojpuri and Athamis and very different from you know the typical urban type of you know content creator that we would kind of usually work with so it's very interesting and I think the whole audio space is very exciting and it's just the start of where things are right now so I'm very excited about audio itself I mean it's strange that we come back the full circle and go back to audio but I mean I think there's a lot of excitement around audio right now absolutely it's it's just exciting how audio has picked up it's always been an immersive form of content I would say it's just not been explored to the extent audio video together has been but now you can see with you know so many podcasts going viral and millions of followers it's definitely you know a great trend and it's only going to keep growing thanks sir Pankaj that's very interesting. Lokesh what about you what is that one thing that one trend that you'd put your money behind? Actually that's more like working with Dolby. Awesome the immersive experiences that we constantly believe are going to be the real talking point of consumer experience the large screen with immersive audio or HDR content in itself that is where the world is headed I mean obviously as Sid and you both talked about that you know the four keys of the use cases are very urban right now but investment in content creation has to happen now so that you have a sensible enough library three to four years down the line right investing in creating the right library investing in the pipeline to ensure the content essentially is available with those bindings now itself is something that we're very excited with and we are going to constantly push towards your standards you're constantly working with partners specifically to ensure that we are not left behind the curve and later we are just trying to find how do I upscale audio how do I upscale video and kind of do a catcher this is not the time to you know wait and then see what happens this is happening people are going to buy new TVs people are going to buy new amazing sound bars and surround systems and if you are not providing the content which is enjoyable in that probably going to remain a mobile only player in a tier two market right absolutely that's a great point I think you know the devices world is always you know running very fast faster than the rest of the world it's I think important for the content world to also catch up and be able to provide those experiences that devices are capable of whether it's our mobile phones or our televisions all all kinds of devices that we're watching on great great point location Rohit would love to hear from you as well what's your personal favorite in terms of you know a trend that you're seeing has caught up recently and I think would really accelerate going forward sure there are a few but if I were to put my money on one it would be on synthetic media synthetic audio synthetic video I think it's so so we're at the top of the current S-curve there's only so much time shifting place shifting of existing filmed entertainment you can do I think the next S-curve starts with synthetic media so yeah very exciting absolutely Sid my personal favorite in terms of trend is actually interactive video and I know MX clear has dabble with that as well with right click but I would want to know what's your what is that one trend that you see you're very excited about you just you just told my answer yeah we are very excited about interactive video but if I can generalize that I think from a trend point of view what the pandemic has done especially India is it has created digital literacy for a very different segment of users you know like the 40 to 60 year old segment like my dad and my mom who would typically depend on me for all of their technology needs the pandemic has forced them to learn it all by myself or to learn it all by themselves my mom did her first digital banking transfer a couple of days back because although it was available to her for so many years and we were pestering her to do it she would insist on physically stepping out and getting it done maybe always her way of getting some exercise or whatever but she didn't have a choice now and so that lack of choice has catapulted and accelerated digital literacy in a segment of users that wouldn't have never happened if not for the pandemic but I think from a you know going back to the other answer the other part of the answer I think entertainment especially video led entertainment has for the longest time just not changed always been like two-dimensional maybe you know this tends to make it three-dimensional but it's still very passive consumption so interactive flavors of video whether it is you know the interactive video which was not linear in that storyline that we launched on mx you know a couple of months back or whether it is short form video that tends to be a lot more interactive the user is clearly commenting liking following a publisher you know we've enabled p2p chat and we have your communities and conversations happening in the context of short form video I think that interactive element and social element to consuming content and transitioning users from passive consumption to active consumption I think that's the one I'm really excited about because it's it has an untapped potential to be a hardly scratch the surface great thank you thank you so much Sid very interesting I'm glad you were able to get your mother to use digital banking it's still a nightmare for me to get my dad to do that so very happy that that's happened and thank you very much all panel members I think we've reached 45 minutes and it's been so engaging I just didn't realize time has passed thank you for getting together I think I had a lot of fun discussing with you and I hope discussions offline as well over to you Kathy thank you everyone thank you thank you thank you so much to all our panelists for your time and insights here thank you for stirring this very interesting conversation at e4m play second edition


Chris has been around the community for a really long time, guy with a huge heart, but a lot of knowledge. And he's promised to follow SE Village rules and keep this speech PG-13, which I, it's just gonna be, I think it's gonna be the biggest accomplishment, no matter what you all learn, that he can actually do that. We have SE him and the keep and get PG-13. So, help me in welcoming my good friend, Chris Roberts. Thank you, brother. So the other reason I have to keep this PG-13 is my wee band who, I kind of didn't see if she's in it. Yeah, there she is. I owe her $20 for every swear word. So I will do my best to keep this with no effing and blinding and swearing. I did a talk earlier. How many of you were at the Sky Talks one earlier? All right, come near a couple, good. It's that, but it is definitely the PG version of that one. Okay, so, again, welcome to the SE Village.  Give everybody here with a volunteers a frickin' big, a blasted big hug. Damn it. I gotch down into a lot of thug, please. All right, we're gonna have some fun. We're gonna talk about technology.  We're gonna talk about where we are, where we've been, where we're going to from a technology standpoint. As normal, we'll put the good old agenda slide up. Why and who am I in all the shenanigans without one? Obviously, the abyss. How many of you are familiar with Dante's Nine Circles of Hell? Yes, all right, we have an IT version now. Evolutionary parts are options. Why are we here? Why are we talking? Why are we doing this and everything else? A little bit of housekeeping. Yeah, as Chris said, I'm not blasted Welsh. I didn't have pet sheep, and I will try and keep the PG-13. And by the way, give everybody in here a hug. Please, seriously, this is put on by them from a volunteer standpoint, and it's a guilt. It's not a gosh darned old skill.  All right, the quick about me one. Yes, I've been messing around with this industry for goodness knows how many years. Started off by breaking things. We broke Nigeria, we broke the space station, the Mars rover, there's the occasional aeroplane that might've got in the mix or two. And as you guys will find out later on this morning, no, this afternoon, we're on our way, we're on an afternoon. We're gonna talk about trains and everything. I'm fine with people taking videos, I'm fine with recording. I'm going to also not do some of the disclosures I gave in side talks, because I don't need this as another piece of FBI evidence. And we'll go from there. And we're messing around with humans. All right, 2018. It is a poo show. Can I get? It ain't all pretty out there. Here's why. This are the statistics. In 2017, we lost, i.e. it was stolen. Some of it in two and three billion records. So that's passwords, that's records, that's identities, that's credit cards, that's all of that kind of data. Here's the irony of this whole got on and all thing. Oh, God, this is freaking hard. Blast it hard. I'm doing it, we're getting there. Anyway, we don't even know how much stuff we've lost. We've lost between 1.9 and 8 billion. There's a company out there called 4IQ. They're seemingly about 8 to 16 billion. There's a lot of blasted data that we've lost. All right, let's do a quick recap on some of the logic and some of the reasoning for this one. We'll talk briefly about humans. Let's talk a little bit about humans. Why we're doing humans? Because we're in the gosh-darned, or lessee village for crying out loud. Let's be nice to humans for a second. The beauty of humans, for all that we are, we have a capacity to evolve. It's a nice statement. It meets nice warm and it's fuzzy and it's gray. And it's like, yay, we're humans, we're good. We're wonderful, we can evolve. However, doesn't mean naturally that we are evolving. The fact that we actually have to tell people to tweet after we've left the burning building and please don't molest the crocodile. By the way, this is the correct way to hold the gosh-darned old chainsaw. This is not a good thing for evolution and for us. So we have to start taking over the very audience that we're addressing and how we're addressing them. And especially when we start taking and look at the numbers and the statistics. If you were taking it by about 2020, we'll have about five and a half-ish billion connected people. You do the statistics, you do the numbers and the interest of keeping this and trying to get us back on track. At the end of the numbers, we have about 9% of the people that we engage with and that we talk with outside of obviously the 30,000 of us that are running around the conference that understand or get security. That is a nice number. A lot of people put it a lot less than that. So when you are talking with people and when you are engaging and having conversations with them, really have to think how do I engage on a level and in a mannerism that you will understand not that I feel comfortable actually having the conversations with. If you need the visual that goes with it, here's the visual of the other 91% that you have to engage with. How do you get through to that person? The fact that the password one through six is not exactly the best thing to use. And by the way, putting seven, eight and nine on the end of the gosh-darned old thing isn't gonna help much either. This is who we have to work with and that word work with is where we have to be. We can't ignore them. Well, we can, but we probably shouldn't.  There is an element of truth to that. I'll go one step further. Smartphones and bloody, I gosh-darned old annoying vendors. Can I get away with bloody? It's an English word for crying out loud. It just means I gosh-darned old in English. It's like bollocks. All right, this is what frustrates the living heck out of me. We come out of RSA, we come out of Black Hat and we come out of all these conferences that say, oh, you must buy more technology. You must buy APTs, you must buy all of this used behavior analytics stuff. You must buy the new blinky lights.  Why? Because the statistics don't bear it out. This came out of NUICS. NUICS put out a really good report. 90% of attacks happen with known exploits. This is when you leave, open things on the internet. This is when I can get in using RDP. This is when we can get in using everything else that's left open. This is simple stuff. This also comes down to the simple stuff along the lines of policies, procedures and controls. I don't know how many organizations we go into that don't have these. This isn't stuff where you need to go spend tens and thousands and hundreds of thousands of dollars with companies. This is simple stuff you can do internally. So if we take a step back and go, where are we? This is where we are today. We're adding more complex technology. We're handing it to a population that doesn't necessarily question that technology, that doesn't necessarily take the time to understand the implications of the technology. By the way, for everybody that's taking pictures of the screenshots, I will make sure that these are available. Hit me up on LinkedIn, hit me up on Twitter, do something, I have a Dropbox, everything of all this stuff will be in there.  I'll also make sure that Essie and everybody else has got it. So we're putting it everywhere. We're giving it to a population that doesn't understand it. We don't have enough qualified people to deal with it and we haven't got good eyes on our environment. So I have to change it so we have a mess to clean up. There's a stronger way of putting it but we'll deal with that one. So what do we do with it? Where are we going? Where are we heading?  There are four paths I will argue that we have, evolutionary paths. This is some research that was done a couple of years back. It's up here because it's kind of fun and I've done some additional stuff on one. Molecular and cellular technology, basically the whole concept of nanotechnology. Nanotechs, basically carbon molecular systems that we can actually basically do a whole lot of stuff with radio frequencies, with laser frequencies and everything else. Strength, hardness, amazing stuff, really complex systems. And then if we apply what we know with Mother Nature we can actually have a lot of fun with it. Why? Because we take after Mother Nature with a lot of the technology stuff we do. We attack people, we use viruses, more the same as the humans get. So we build a vaccine in the electronic world. We build it with carbon architectures and we start basically looking at what does a vaccine do? How does it get into the body? Uses our DNA. So RNA, ribonuclear acid, all your bugs now belong to us. And we can build these in three different ways. We can let the body build them, we can have a combination build where we build them externally and inject them into the body or there's basically the assemblers that build them inside the body themselves, carbon architectures. Some fun stuff. Everybody's like, I haven't heard of this stuff. This was 2016. This is teaching carbon nanotubes basic language. This is also on the bottom right hand side teaching them basic shapes. In other words, as you work and look and go through the body, how do they understand what is in the body? Now, if I inject carbon nanotubes in the body, they have to be able to move around. So in 2017, just like kids, we teach them how to move. We attach tails to them. So you have a carbon nanotube on that top left side that basically is attached to a carbon tail and all you do is apply a heat source or another kind of RF type of source to it. Now I can make it move. The tail vibrates with the frequencies, not if it goes. Just like kids, we also teach them how to actually understand chemicals, chemistry and systems, which is the bottom right hand side. Now we fast forward to today, and this is where we are. The top right hand side, turbo charged sperm. Yay! Take sperm, wrap a carbon nanotube around it, apply a heat source, probably not too much heat because it's gonna hurt like it's not. And go. Now you have basically an RF frequency common turbo charged sperm. The one in the middle is the interesting one. For those of you that have been cut open or anything else like that, obviously septicemia is a problem or potential issue. So what you ended up doing is taking the stitching system, put carbon nanotubes on them as well as an antenna based architecture which can then transmit heat, it can transmit frequencies, it can transmit chemistry. So now you know whether that infection has actually gotten back into your system or not. Go to the doctors, it's all very nice. This is great, it's wonderful, but guess what, we're a room full of hackers. So we can hack the code. That is a very busy slide and I'll apologize in advance. What I'm trying to get across are two things. One, the language that you use is a very long language and cello is the actual architecture that is used to actually have the discussions on it. Gate simplifications. If we take it a little simpler, we'll use XKCD for a second, we'll try science and this is how we do it. We take assembler language and basic language, we turn it into an engineering language and then we turn it into a frequency wave. That frequency wave can now be transmitted into the body and can be received with receptors and with antennas that are built into the carbon nanotubes and we can now make them do things. What do we wanna do? Well, we wanna try and do some fun things with the body. This is the fun one, this is the easy one. We take a binder, we take a receptor key, we add all of the other technology to it and we have this really nice complex system that we can actually inject into the body. In English, what we've done is we took bird flu, we've bound it to multi-walled nanotubes, carbon architectures, we did a little Petri dish and studied it all up and had some fun with it and yes, we've done this in a lab. We fooled the body into thinking it was good, how a virus works and how a vaccine works. We have the propulsion system that tails itself on various other things, the tracking, the methodology and all these other good things, which means if we're doing good, we can go after cancer, we can go after Alzheimer's, we can go after goldstones, we can go after all these amazing things and actually target direct to the molecules. If however, like some of us do, go hey, if I can program it to do that, what else can I do? Well, if we're not playing nice, we can program it to go after red blood cells. And the nice thing about this whole thing is you don't need an entire rack of equipment to do it. That's $100 worth of equipment.  It's gonna cost you about 150 bucks in a whole bunch of research. That's the evolutionary path number one. And if it makes it more interesting and more fun, we can do the same thing with all the agriculture as well. This is some of the stuff that's going on in the agricultural world. The whole concept of targeting drugs into the foods, into the food systems, into the supply systems. So for most of us at this point, we're kind of feeling this way. All right, so that's evolutionary path number one. Evolutionary path number two is some of the stuff I'm currently working on. I have a lab in the basement right next to the whiskey room, which is really happy I can do drug coding, yay. We are gonna hack the brain. Why? Because it's fun. This is not how we will hack the brain. This is a really good way to put a USB drive in, but after that, it gets a little messy. This is also how we are not gonna hack the brain, but this is a really good one-time use pad.  We are, however, gonna do some other things. So one of the areas I've been focusing on for about the last year, year and a half or so is mapping the brain. I have a set of EEG monitors. I've actually got a couple of commercial ones and I've actually got a couple of ones I've actually built. One of them uses four EEGs, two at the front and two at the back side of the lobe system. Basically, another pair of glasses do it like this and they have monitors on them. On the left-hand side is the basic brain activity that I've actually got on one of my systems. What that's tracking is it's tracking me thinking about my computer. On the right-hand side on the screen over there, there are three different colors. Each one of those represents basically me either thinking about my computer, thinking about a phone or a module for the car. The logic here is simple. We've spent, what is this, DEFCON 26? We've spent 26 years screaming, complaining and growling, grumbling about passwords. Agreed? And then we have RSA, Black Hat and everybody else is like, ah, I can band-aid that, I can give you something to try to fix it.  To heck with that? Can I get away with hell? Yeah. What do you mean no? Damn it. No. No. No. No. No. No. No. Do you take check? No. No. No. No. No. No. No. No, I'm gonna need to do this point. Here's the logic. Rather than throwing another band-aid on the problem, why don't we fundamentally fix the problem? Why don't we go, hey, we, the squishy sack of water and bony stuff, can actually be our own authentication methodology? Why can't we actually turn around and get rid of passwords once and for all? Why can't we actually extract enough data out of the gray map to go, how do we do this? Here's how we do it. EEG monitors, get some good quality ones. We've had a conversation in the biohacking village earlier on today about how to use them and all the other stuff. The whole concept is to take the monitoring system from the four main loads, the interaction with you with the computer and the computer's interaction back with you and then some underlying noise, shall we say, if we wanna better put it, as to who we are from a uniqueness standpoint. There is a whole 12, 18 months of the discussion behind this one. Take the signal, relay it to the computer itself.  And he works. As I walk down the stairs now, I can open up the computer and I can open up basically one of the Android phones that I have. I have another set of these that have wires all over them, I keep them in a very locked up area because I don't want any of that stuff getting out but it's working on the phone, it's working on the laptop. It's working under all sorts of interesting conditions, stressful conditions, alcoholic conditions and various other things. There's, yeah, alcohol test is always a good one, let's face it. Two o'clock in the morning I'm like, I need a drink while I'm doing this and then basically the whole system goes, aha, I have to recalibrate, you've had a drink. The irony of the whole thing is it actually recalibrates differently for beer than it does for whisky and I'm like, yes. So here's the logic. We need to do away with this whole password mess. We need to actually do something different. Our simple existence needs to be that key. So how do we do it? And I look at everybody in this room, this isn't just me standing up here saying how I've done it, take this information and go build something better. Do something different with this and improve on it please. Why do I say that? Because I'm not the smartest one in the room and I need other people to take up on this. But do it better and do it differently. This is also part of the stuff I'm working on with uploading consciousness. One thing I haven't said publicly and I actually said it earlier on today, I now have a predictive engine on one of my other computers. What I'm doing is as I'm thinking about doing something with those glasses on, the predictive computer is now thinking two to three steps ahead of me as to what I'm gonna do next. It's 75% right at the moment. Which is really cool when the computer tells me I want a cup of tea before I know I want a cup of tea. The other is just sensed my mood. So, let's talk about actual artificial intelligence, not the rubbish that you get sold at RSA or Black Hat. How many vendors do we have in the room? They want to admit to being a vendor at this point in time. All right, how many of you have been sold something that contains or have been tried to be sold something that contains artificial intelligence? All right, bear this in mind as we go through this little set of slides. We're gonna talk about general AI, okay? We're gonna talk about the stuff that there is like, ah, we need to replicate humans. Well, here we have some fun with this one. This is security vendor artificial intelligence and this was the pitch battle of Black Hat earlier on this week with artificial intelligence, okay? Here's the provocative stuff. You want AI, you will give up on privacy. Hold that thought for a second and hold the logic on that thought and we'll go through some of the slides. Here's some baseline. It needs data. It relies upon data and quite honestly, the algorithms that we have rely upon a ton of data.  We need more data. Not only do we need more data, we need the right data. How many of you know what user behavior analytics are?  And they're like, ah, they'll protect your company. Well, a couple of things on this one. It won't, let's just answer that one straight off of that. And number two, it's only taking intelligence from the organization it's protecting. Doesn't have access to your home data so it doesn't know whether you're coming in the office early because you've had an argument with a significant other. It doesn't know what mood you're in so it doesn't know any kind of pedometer. It doesn't know any information about you. It's not listening on your Alexia or any of these other things. It is not situationally aware, it's dumb. Here's the logic behind it. Love this one. You want it properly, we hand over all the data all the time. No barriers.  Why? Because if you want actual artificial intelligence it has to understand everything about you. In order to make an informed decision as to whether you are good, bad, ugly or threat or anything else, it has to understand all the situational awareness. Why do we know this? Because we do Venn diagrams. This is machine learning. It is not security. Little subset of one subset. This is artificial intelligence. Again, not security. And everybody's wondering what the actual little circles are. Here's the circles. Here is us. We are made up arguably of three things. The influencers are surroundings and everything that has made us who we are. Unless something has access to all of that data, either from an intelligence standpoint and awareness standpoint, EEG standpoint or everything else, making those decisions and making them accurate becomes harder and harder unless you're willing to accept some large deviation from me. You want security, we have to have all three of those. If we're actually gonna do this right, we need to be able to hold that data and make an informed decision. And yes, we're getting a little dystopian on this. Not that I want to go there. Let's explain it in basic language. How many of you code? Cool. Regular programming. I wanna go from A to B. What does the program does? Sod it, I'm going from A to B. I can use sod it. From A to B. Great, regular programming explained 101. We good with this? Yes? Okay. Machine learning. You say, hey, I need you to get to B. You can start at A, because it's a nice starting place and you wanna go to B. Machine learning says, do me a favor, don't run into the wall and for crying out loud, please don't stop on the stage. So what does the machine learn? Do you guys? It goes... And it gets there at B eventually. It bounces off the wall like a dodger every now and again, but it gets there. Everybody good so far? Our augmented intelligence. It already knows that you wanna end up at Z. This is Z not Z, okay? This is the Colonials. Yes! Don't even go there, okay? I hacked cows because Scotland didn't actually separate from England. We'll get to that in a little bit. All right. So augmented intelligence. You tell it where it wants to go. It bounces around and then it's just like, sod it, we're gonna get there. This is actual artificial intelligence. It sits at A and goes, I don't wanna go to B, B smells. It's raining. Well, why can't B come to me? I don't really think I exist. If your artificial intelligence program that you've been sold doesn't wake up and question its own existence, it's not an artificial intelligence program. Yeah, it's machine learning you've been sold a bill of goods. Okay. We can have a long debate over this one, but quite honestly I have a bit of a problem with most of the stuff that's being sold out there. I think Snake Oil was RSA that year, wasn't it? Did anybody see the Snake Oil? Did anybody actually pay for a slotting ticket to go to RSA? Fuck, these are expensive. You can actually forge them if you go down to the King Codes. I'm a lap, this is PG. I didn't say how you can forge them. Photocopiers. Intelligence best case scenario. So here's the argument on this one. Best case scenario, any Sentinel system wakes up, takes a look at us and goes, why the heck are you in the driving seat? Get in the back and we'll take care of you from here. That's the best case scenario. We actually have a system that looks at us and goes, you guys can't take care of each other.  Get in the back seat, we've got you covered. Worst case scenario is obviously Hollywood. Let's take the last of the evolutionary paths that we have. I'm allowed to do this when I think even in a PG one. The stumbling drunk. It is death gone after all. Insanity. The fact that we still go to death and the fact that we still got a black hat and RSA instilled by Blinky Light Rubbish and we still expect to actually have it work. Guess what? It's gonna fail. Evolution of the doomsday clock. This is actually part of it as well. So the logic is, in 1940s we had a doomsday clock. Everybody was like, oh, I've got a bomb. And everybody was like, oh, I've got a bomb too. And everybody was like, oh, we've got bombs.  That was great. Those bombs have been replaced by these things. So you look at where the nuclear side of it was our deterrent. Now we have to look at the laptop and go, ah, we're putting them in the hands of everybody. It's not as much of a deterrent. Again, the technology looking at putting us over the edge. So, as we speak of technology, this next light, not this one, the next one, this was a rather nasty and tough one to put out there. And I don't like it, but I do like it. And it's a bit of a kick in the, am I allowed to use the word testicles? It's not nuts, it's testicles. It's a biological thing. It's a bit of a kick in the testicles for the IT industry. We failed. Let's be honest. 9 billion bits of information went missing last year that charges that rely upon us to secure them. We failed them. We've lied. Why have we lied? Because every single time, for years ago, and I was one of the people years ago that walked into the CFO's office and said, hey, if we buy a firewall, we'll fix everything. Five years later, we went, hey, if we buy this IDS, IPS, it'll fix everything. Then we buy DLP and it's meant to fix anything. Guess what? We haven't blasted fixed it. We still have issues and we still have problems. And we still have vendors and suppliers are telling us that they will be able to fix everything. Guess what? It's not happening. We know that. We have to get the message to everybody else. We have to be the ones that help influence. We have to be able to communicate effectively to the business. HR, legal, compliance, everybody else in the organization, we need to be the ones that communicate more effectively with them about our industry and about their industry and how we work better together to keep the blinky crap, taking that 20 bucks, we keep the blinky crap from being sold into the environment. Why? Because we've got to do a better job of it. My daughter's been next door causing chaos on Mayhem in the younger side of the world. I'm getting old and gray and let's face it, a lot of you here will be considered the next generation. You've got to do a better job than we did. And you've got to learn from our flipping mistakes, please. And embrace change. And as it says, diversity. We have to do a heck of a lot better than we're doing. So that's my plea. So what are our options? Kind of a bleak picture. What do we do about it? Well, it's simple. It's us. We have to be part of the solution. How many of you work in an environment where end user training is once a year? Actually, I don't. I work at Larris. We train ourselves daily. It's quite fun. This is something we need to do differently. Bring it on a continual cycle as you talk to the people that are engaged with you every month. Hey, it's January. It's tax season. Don't click on that data and tax document. It's February. It's Valentine's Day. Nobody loves you on the internet. And if they do, it's Bob and he's 45 and he's in a basement in Detroit. He ain't pretty. Okay? It's March. It's March Madness. Don't click the spreadsheet. This is simple stuff we can do. You look at Chris and the ILF. That could be April and May and June. Let's be perfectly honest. All of these are things we can do to help the individual. You help the individual. You help the family. You help the friends. Guess what? That will eventually peter back into the company. I don't need you looking after my company. I need you looking after yourself. And in doing so, you will basically, through osmosis, look after me. So we fix the humans. See that? Our technology's taken over. Take your pick. Preferably, I'd rather fix the humans. All right.  Please, and the toaster and everything else. All right, simple stuff. This is simple stuff. This isn't buying blinky stuff. The fact I can still go out onto showdown and find RDP on the internet. And I can find 3306 and 1433 on the internet. Make it go away. You don't need to buy new technology. We just need to educate people more effectively. All right, as it says, remove the easy ways in. So for crying out in crypt everything, how many of you know PrivacyRights.org? If you don't know it, write it down. PrivacyRights.org is an amazing website. It is also a very effective one when communicating the message of security. Why?  Somebody goes in, steals a computer, the gosh darn little things are encrypted, and now healthcare breaches are another couple of thousand. All right. As we're having security discussions, we don't have a perimeter. This is something that we have to help people explain and understand. It doesn't exist. We can break in, let's face it, to anything, any time, pretty much so whenever we want. And we could put money in escrow if we wanna have a separate discussion about that one.  Okay, help your organizations understand this. They buy perimeter defenses. How many of you are part of a discussion where maybe end user or end point detection is part of a conversation? Quick show of hands. Let me ask another question. How many of you know where every single one of your end points are? Yeah.  Yeah. How, oh, that, will we take on a collection after this please, otherwise I'm, all right, it's simple. We talk about end point protection, yet we don't even know the basics of where all of our end points are. Give me a flip and break. Figure that part out first.  All right, simple stuff. Physical security, stop ignoring it. Nobody inside an organization is a special snowflake, including us. Therefore, nobody should be exempt from social engineering, physical engineering, the whole gosh darn it a lot. And if anybody has a bad policy inside their organization and they find me wandering around it and I don't have a badge, you are welcome to taser me. Or anybody else.   The arse of a donkey, donkey's arse, that's actually allowed. It's allowed now, gosh darn it all to heck. That dammit.  So many keeping tabs. All right, another one, passwords. Good grief, this is simple, okay? Break your passwords into four sections.  Simple as that. And by the way, where you can use past phrases, use the darn things and get hold of XKCD and talk to them about that kind of stuff. It's simple stuff, this is easy, simple education. All right, stop buying the blinky lights. There is no easy button, the cake is a lie. That's about all I can say on that one. If you are sold a bill of goods by a vendor, get hold of me, I will taze at them. Why do I say this? I was in Madrid earlier this year and this is what I found. The first anti-hacking software apparently. So I got myself a copy of the first anti-hacking software and I decompiled the first anti-hacking software because it wasn't compiled properly and they gave me the source code after I asked them very nicely and then I put it up on GitHub. Needless to say, it's not the first anti-hacking software anymore. All right, why? Why are we having these conversations? Let's go through some of this stuff. This is some of the stuff that some of you know that I've been working on with some older stuff, some newer stuff in here, some fun stuff in here. All right, we talk about the IoT ecosphere. When somebody turns around and says they know IoT, show them that, pin it on their forehead. If they can't identify at least half of it, they don't know IoT. That's about all I can say about that one. FinTech, financial technology. The ability to basically digitize the brick and mortar banks, which is great until you realized last time we checked it, which is about a year and a half ago, 65% of the companies had not done any security testing. Yay. And we're giving it to everybody's mobile telephones. Now, for those of us that might be banned from about half of the world's airlines, we have to go break other things. In this case, we go break locomotives. Because, well, they're fun and they're all over the place. Why do we break them? Well, partly because they're fun. How many of you remember at school that blasted question, train A starts at point, train one starts at point A, travels at 45 miles? You remember this one? This is why we hacked trains. I hated that problem. So did about a year and a half with the research on it. Wasn't allowed to use most of it.  And we decided to hack trains. In doing so, we realized that it's an entire modular network. One of the fun parts of the module are the rail yards, specifically the intermodal yards. That is an intermodal cargo rail yard. User ID admin, I think the password for that one was admin one. Telnet to the internet, skates you into a web interface as well, the really nice thing about this is as trains come in and out of the rail yard, there's an RFID tag on the side of them. It gets read in, it's got the bill of goods on there. Each one of those little colors represents a different system and a different setup. The nice thing about the rail yards is they're semi-autonomous. So you can go into the database and instead of the fruit juice going to California, you can actually send it to Alaska if you want. Quite fun to do. You can have some fun. You can send California out like all the dead animals. You can send Alaska all the apple juice and fruit juice. It's simple stuff to do. This is easy stuff. This is web application attacks. Now, if you don't want to go up to the rail yards and you want the big actual trains themselves, GE is really, really good at giving you access to all of these trains because they send all of their trains out with a default user ID of GE and a default password of GE. Yay. We did a live demo on stage in another country and that bottom screen at the bottom was user ID GE password with six zeros just to make things a little easier for us. That actually went from us to the telecom communication system which had a public IP address into the trains front of system which then got us into the engineering part of the train. And as you can see, you can now do all the analytics on the train, the actual locomotive engine itself. So if you want to start it, stop it, have fun with it, you can't make trains go sideways though, I found out. Is there anything? Oh, tell me about it.  It's basically a geofencing application that you can put around anybody's area. In this case, it's around the house in Nevada, Colorado. Very good friend of mine, Jesse, who's been on stage a number of times with me. I put a Reef Offense around his house and there's a BNSF train track that goes right by it. So for a while, all the trains would hit the basically train system and just stop there.  So it's fun, so yeah, you can have fun with those. For those of you who want to mess with signals, GE's transportation global signaling system, user ID I think is admin password. I want to say it was either admin or it was just password. I can't remember exactly which one it was. That was nice and fun and simple. But if you want to have a little bit more fun with these things, this is the nasty stuff. So on the locomotives these days, there's the positive train control, PTS. The whole concept here is if the driver is not paying attention, something's happening or whatever, there's a whole bunch of autonomous systems that are basically going, ha, you know what? I probably shouldn't go through that next red light and I probably should only go around the bend at a certain speed. A lot of it is governed by these nice electrolytic systems which you can pick up on eBay if you want. Total cost of eBay purchase, I want to say it was around a thousand bucks, give or take a bet. But you can buy them and not only can you now buy the darn things, but also if you look on the top left-hand side, you can actually go out to the patent office and download the entire patent for these things. Which means when we look to this, we realize that the man not present button.  In other words, I want to keep the barriers up or I want to turn all the lights green or whatever you want to do. That had shared memory. For those of you that code, at this point in time, you're going, ha, ha, ha, overflow. Oh yeah. So what you can do is you can do both a web attack and a network attack at the same time and you get to a stage where you can basically do a man not present attack scenario. You can get in, basically plug into one of them because they're all a nice star network because let's face it, they've all got to talk to each other. The entire network starts talking from one switch. If you're sensible, you can scan the entire set of switches, get the IP addresses and put them into a batch file. That file actually is more of a Python script but you can put them into the script. The script runs against every single one of them and after about 20 minutes, you can turn every single light in both directions green. Which does we end up with this? Now we talked to AAR and two companies about this two years ago. Nothing has been fixed. Which is why I'm stood up on stage going fix your stuff. So if AAR, NTSB is listening, here it is. I did talk to DHS this weekend, they're actually going to fix some of the other stuff we're about to talk to as well. Cows. So this came about for two reasons. Reason number one, Scotland tried to actually separate itself from England and say what you did, the same thing for England what a couple of hundred years ago.  If you're crying out, seriously, it's tea, it's civilized. It was the cheap stuff. Tell me about it. All right, Windows machines. So we decided to hack cows. We hacked cows two different ways. One because we were going through Wyoming and we realized there were a whole bunch of signals and secondly because, well, it decided to go after the milk in the cows. All right, VNC opened to the internet milk robots. Milking cow machines. These are actually in Europe, in Wales and some other areas up in Wisconsin. Who's from Wisconsin? Everybody from Wisconsin here? No, good. All right, I don't have to apologize to anybody. There's a few in Wisconsin we own as well. I think we've got about half a million head of cows at the moment, give or take a bit. So on that bottom right hand screen is awesome. As the cow goes into the milking machine, it obviously automatically attaches. It measures the pH of the milk. It also measures the health of the cow. It can inject drugs into the cow and it can inject stuff into the milk. Bottom right hand side is the screenshot. User ID I want to say was like with the VNC it was like all ones are all zeros or something like that. And they're all the same because the vendor sold them and kept it simple. Yay. And if you want to have fun with a livestock, RFID and barcodes on the livestock, same kind of concept. We drove through Wyoming and my blasted RFID antennas were going nuts. I'm like, what the heck is it? They realized the cows are walking around with pedometers on them. And the pedometer's giving a GPS coordinate to an access database that's centrally stored in the cloud with a whole bunch of data. So we're like, hey, we can get into this. So we did. So Jesse's house in Arvada, Colorado now has about three courses of a million head of cattle in it. Because we keep overwriting the GPS coordinates with his coordinates of his house instead of where the cows actually are. It's fun stuff, it's easy stuff. But again, this is stuff that we should be able to fix. This is basic, simple security. This is stuff as a security team which should be able to help people understand and work through it. So it really isn't gonna end well because, well, this is what it is. Never get onto shipping. Back to that whole concept of intermodal. You know, we talk about firestorms and we talk about basically taking down the grid and we talk about all this other stuff. And yes, it's possible to take a lot of that down. Keeping it down is actually a lot harder, by the way. But let's talk about shipping. Let's talk about all the fun stuff. Again, not allowed to mess with aeroplanes so solid, but darn it, heck, we'll mess with ships. Four trillion dollars worth of goods across shipping. We go through 12 million, we bring in 20 million. You get the idea in pictures. The top 20 US ports are fairly large. Why do we care about this? Well, we ask the question, why do we care? This is why we care. Because years and years ago, the connected ship was, you know, not so much. Nowadays with SATCOM, with navigation systems, with upgrades, with engine management, with predictive management and predictive maintenance on the shipping systems, so much of it is now connected. The shipping systems have more connectivity all the time. The GPS hacks we know about, we're not messing around with those ones. We leave the government to play with those ones. But part of the reason is, is they have rather big things to play with.  So we decided to play with them. This is what we found. Yay. Top right hand side, Windows 2000 server. Chinese edition, it's a pirated copy. It was sitting on a tanker going into Adelaide, I think. Bottom right hand side, Windows Server 2003. By the way, these were done in March of this year. So not long ago, this is not old stuff. This is March of this year we did a bunch of this. We got in through the SATCOM systems and because the SATCOM systems are doing GPS and navigation updates and we're also updating the building and the management and the maintenance stuff, it's basically a very simple handshake to get into it. What do we do when we're in? Yeah, let's scan them and let's have some fun. How many did we look at? We looked at lots. That's just some of the list. It's easy and it's simple to do. And you start taking a look at where shipping is going and the amount more of interconnected. We talk about autonomous shipping. There will be go between localized ports and various other things. We talk about the transferable. It's the stuff going at all the rigs. All of this is completely interconnected. And you're like, okay, well that's cute and that's cool, I can get to a Windows interface but what else can I get to?  But how about we go one better?  This was ballast control module. So this was getting into a ship, going into the RDP system of a ship and then getting into the engine and ballast maintenance module of the ship. Total time to execute, 20 minutes. Maximum damage, that was an 80,000 ton vehicle. 80,000 ton ship going into San Francisco. We caught it going into the harbor. Rolling that over in the harbor would probably have caught some fun in games. Not probably would have gone, yell that again, let's face it. This is simple stuff. This isn't zero days or APTs or exploits or anything else. This isn't stuff that throwing more tech at it is gonna fix. These are simple things that we can all do. SE Village, it's about the humans. We need to be better at communicating these kinds of risks to all the people that we deal with and all the people that we work with. So, quick recap. We know we can deck out IoT, fintech. Oh, how many of you guys mess around with the vehicles these days? How many of you have been done to the vehicle hacking villages? I haven't been down there yet, but some of us, Justin and a couple of us are working on LiDAR bombs.  About twice the size of a cigarette package on placed on the side of a bridge. Both sides of a bridge puts a virtualized LiDAR barrier, a LiDAR barrier across the entire road, both directions. Yay! I just wanna deal with all the Teslas in San Francisco. We reckon we can get gridlock in San Francisco in like a Monday morning or something.  All right, some final thoughts. Let's have a wrapping up on this one so we can get everybody back on track. I love this quote. The ultimate measure of man is not where he stands in moments of comfort and convenience, but where he stands at times of challenge and controversy. We are there now. This isn't waiting. This isn't going, oh, we're getting there. We're here now. We have tech up the wazoo. We've got 20, 25 billion devices coming online in the next few years. We have to make a difference. We have to communicate more effectively. We have to be more inclusive. And we have a lot to do. Because quite honestly, this should be the future. There are ways to work effectively with the technology. However, we don't work with the technology. This is kind of where we're going to end up, unfortunately. It's a mess. So I will leave with a final thought. I put this up on LinkedIn and a couple of months ago, whenever it was, and it got some crazy amount of hits on it, but it's very true. I do a lot of work with the guard. I do a bunch of work with the government. We do a lot of stuff with the civilian side of the world with Larris. I as an individual, I'm going to fail. It's as simple as that. We collectively can be so much stronger together.  Next time when you bring a friend to DEFCON, bring somebody who's not even in the industry. Bring the accountant. Bring the, don't bring the lawyer, actually. Please. Bring somebody, bring family, bring friends, but bring somebody who's not in the industry. Because the word's got to spread. It's as simple as that. I would like us not to go off the edge of the cliff backwards, and the only way that's going to happen is if we all stand up and have a single voice. So with that, as always, Douglas Adams. So long and thanks for all the fish. Everybody thank you very, very, very much. A final tally. 120. Oh, shh, 120. Don't let go the heck. He actually did good, didn't he?


Welcome to Eurocooked 2021. So in this talk, I will present the paper on the ideal shortest vector problem over random rational primes. And this is a joint work with Dr. Penn, Dr. Xu, and Dr. Wedley. So this research is closely related to the lattice-based cryptography. So this lattice-based cryptography is very popular recently because it has several very nice property, for example, is quantum resistant. And also, it allows fast operation. In lattice-based cryptography, the operation is usually just addition and multiplicity or small numbers and no explanation.  So this is very, very interesting. But it does have a problem, since no dimensional lattice problem is usually easy. So this need some p-sized problem. That is why we want to use ideal lattice. So using ideal lattice hopefully can solve this p-sized problem. So what is lattice? Lattice is giving a linearly independent vector in the real space. And lattice is basically an integral linear compilation of those linearly independent vectors. So this vector is from a basis for this lattice. So you can see a simple picture. Here we have R2, a Euclidean plane. We have two vector. And the integral linear compilation will give you all those points. So lattice is discrete points, periodic discrete points. And there could be other basis going to be generated the same lattice. They will be generated the same lattice. But this new base is considered better because they are shorter, especially the red one. The red one is the shortest vector in the lattice. So finding this SPVP would be the most important computational problem in lattice theory. And then here we have this fundamental domain. This fundamental domain, this fundamental domain. And the volume of this fundamental domain is the determinant of this lattice. Determinant of this lattice. So the determinant is measure the size of the lattice. So for the shortest vector, we know a little bit about the length below some upper bound. So for example, there is a Hermit bound. The length is going to be the Euclidean length. Going to be less than square root of n time determinant of lattice over 1 over n. And this is a uniform bound. And then there's Gauss heuristic, which basically says on average, you should have a length square root n over 2E pi. And then determinant L over n. But this bound is a syntotic bound. And then there is Minkowski bound says that it must have a length less than square root of 2n over E pi determinant to the nth root of the determinant. And then the SVP is shortest vector problem of prosimid SVP. And Hermit SVP basically are three close-breed problem. The undefined vector of length less than lambda 1. Namda 1 is the length of the shortest vector. That would be SVP problem. You can approximate this. This problem is hard. So maybe in some case, you want approximation algorithm. So the approximation factor will be gamma. And then Hermit SVP problem is the problem we're going to study in this paper. And basically, we try to find a vector of less than gamma time determinant nth root of the determinant. So as you can see, if gamma is greater than square root of n, then there exists such a vector. So the ideal lattice basically come from the number field and number ring. So a number field over a rational number is basically you have a qx mod out by irreducible polynomial degree n by irreducible polynomial degree n. And then the ring of integer in this field is actually a free z-module. So if you see a free z-module, then you can see that there's a connection to the lattice. So sometimes this ring of integer is particularly less. This is called monogenic. Basically means that there exists an alpha such that the ring of integer is essentially linear combination of this power base. So you have a power base which generates the ring of integers. So in many cases, in cryptography, we like this kind of ring because it's easy to do the computation. So here we have a number field and a number ring. And we want to make a lattice out of it. So a number field have exactly any embedding into complex number. We call it sigma 1, sigma 2, up to sigma n. And the clonic embedding, we basically send this number field to Cn to Cn. And we essentially just mist all its complex embeddings. So we have sigma 1a, sigma 2a, and sigma na. And the image, which is just a subspace of Cn, and it is also isomorphic to Rn as an inner product space. Example, if you have a qx mod out x to the force power plus 1, then for y, you're going to send to 1, 1, 1, 1 for complex number. Or if you really prefer a real number, then that would be screwed to 0, screwed to 0.  And you can see that these and these conjugates with each other. And these are complex conjugates, which is z8. It's just e to the 2 pi i over 8 for 8. So then if you insist on real number, then you just write the real part and imaginary part. But you need to put a square root of 2 factor over there to make sure that they are isomorphic as an inner product space. So there is also a coefficient embedding here that suppose the ring of an integer is monogenic, then you just send to the coefficient. So for example, again, if for the qx mod out x to the force for plus 1, and we know this can be generated, probably it's just 1xx squared x cubed. So for 1, you just send 1, 0, 0, 0. If it is 1 plus 2x, just send 1 to 0, 0. And that's go directly into integers. So this is probably if you design a group system that's the embedding you are going to use. So the ideal lattice there, so first we can have a principal idea. It's basically generated by single elements like gx. So it's corresponding to this lattice. So here that you mod all the extra m plus 1, hence that other vector basically anti-cyclic. So you're doing this cyclic rotation, but you change the sign with the first elements. And a general idea can be generated by as an OK module, can be generated by two elements. One is an integer, another one is gx. So that means that in addition to this anti-cyclic matrix, you need a unit. So those prime ideas, they are considered as a point because they are also maximum ideas. They are considered a point. So you put those points together. And here that z, again, is just a straight line. The point is basically the rational primes. And then there are primes like over those rational primes. So for example, here we have a rational prime p, and then there are two points. But you can see that this is like a tangent. So basically you have a p1 square and p2 square. And in this case, we call p's a ramified prime. And there are only finite many prime which will be ramified. So we don't need to worry too much about those prime ideas. And then there are rational primes going to split completely into four different, in this case four, because the extension degree is four. So these four distinct prime ideas. So those, again, this is the case. And we think it would be the most difficult case. And here you have two prime ideas, not over p. So those prime ideas, they each have actually a degree 2. So that's why I use a large dot to represent them. And those prime ideas are actually not difficult. Those prime ideas, the SVP problem for them, are not difficult. Are not difficult. Well, this is not as difficult as those small dots. So the reason is because this decomposition field. So basically, we actually can have a very interesting subfield. So here, let GB the Galawar group of L over Q. The decomposition group D is basically the elements in the Galawar field, Galawar group, which fix this prime idea set-wise. And then K is a decomposition field. It's essentially the subfield correspond to that group. And they have those group and field have these two properties. If P is unremifed, then D is isomorphic to the Galawar group of OL over P1. The OL over P1 is an extension of the phylet field. So this Galawar group is essentially going to generate by a single elements, the Frobenins. The Frobenins. So that D is going to be a singular group. And if the prime idea is generated as an OL module by P and a polynomial degree over G, then the degree of K, which is a decomposition field of P1, is actually just G. And the more interesting that the P1 intersection with K, this actually gives you a sub lattice. And that sub lattice has a determinant, which is basically P. So that's the reason that if D is non-trivial, then the difficulty of SVP gets decreasing if you can move to this smaller field. So this picture is going to make things even more clear. So here you have a prime idea, which you want to find a shortest vector. And because suppose there is a non-trivial Dinkum-Zien group, then this field would be a subfield of L, a non-trivial subfield of L. So here you have this C would be a lattice in this smaller field. So it has a smaller dimension. The dimension is just G. And the determinant is just P. So the shortest vector in C, which again will be a very short in P, which will be very short in P. So you can think this is, again, a subfield attack. It's just you are using this decomposition field. Decomposition field. And then the map between the CG and CN is beta. It's very simple, very simple. Just repeat the coordinates if you're using the colonic embedding. So the main theorem, this is our main theorem. The main theorem, suppose our overall queue is phylet Galois extension with degree N.  And if K is a decomposition field, the solution to this Hermit SVP with factor gamma in the sublattice and the colonic embedding will also be a solution of the Hermit SVP in P with a factor, which is not very far away from gamma under a colonic embedding. So basically, this doesn't tell you to find SVP. You can simply just find SVP in a smaller decomposition field. As known as this decomposition group, it's not trivial. And then here that you have this, in this theorem you have this complicated factor. But for part of two, cyclotomic field, which has been quite popular in cryptography, the situation is actually simpler. Simpler that you can simply depend on the prime, whether it's congruent to 1 or 3, you can calculate the number r. And so the dimension of the lattice, the real dimension would be just 2 to the other rather than 2 to the n. Since in other cases, n is much bigger than r. So that's going to make this prime ideal SVP prime much easier. So especially if P is congruent to plus minus 3, minus 8, in this case, then the real dimension is actually just 2. So you just need to solve SVP for the dimension 2. And we know for the dimension 2, you can just simply use Gauss reduction. So this basically shows that for the prime ideal lie over a rational prime, which is congruent to plus minus 3, minus 8, those prime ideal SVP is very easy. It's very easy. And we have this kind of hierarchies that if the prime is plus minus 3, minus 8, then the dimension is just 2. And if it's plus minus 7, minus 16, you just need to solve the SVP problem for dimension 4. And if it's plus minus 15, or 32, the real dimension is just 8. So it's not going to be capital N but it could potentially be very large, but just 8. So this basically says that for half of the rational prime, the prime ideal, lie over those rational prime will be extremely easy. And then just to make it 2, so you can see that there is a hierarchy of difficulty. And the difficulty actually changes pretty big. So it's actually the double of the dimension. Every time you cut the dimension, every time you move out of this hierarchy. So then what is the average case complexity or prime ideal? That is SVP. Well, it's going to depend on how you select your prime ideas. So if that you first try a random rational prime and then find your prime ideal lie over this rational prime, then your prime SVP problem is easy. Average case complexity is easy. And so similarly, that if you just again choose prime ideal according to the rational prime downstairs, then it's easy. But again, if you choose your prime ideal according to its determinant or norm, well, in that case, our work will not apply. So the average case will be still an open problem. So again, for the composite idea, so those ideas will not prime ideas will also have a result. Again, it's dependent on the prime downstairs, the rational prime downstairs. Basically, the take home message for this paper is that the prime downstairs actually determine the difficulty of the prime ideal upstairs. So open problem, which we find very interesting, will be that to determine the length or to determine the exact length of the shorted vector lie over the rational prime, which are not congruent to plus minus 3, mod 8. For the plus minus 3, mod 8, we have determined exact length of the SVP of the shorted vector. And then again, of course,