Good afternoon. Welcome to the remote access, the advanced persistent threat talk, and I welcome you all here and thanks for coming to this talk. I know you've got a lot of choices. Key messages for this session, guys, I wanted to let you know that your current security architecture is flawed now. I've published everything you need to know. It's all on the website. From first principles to demonstrations, full code releases, the proof of concept, including a test framework for at least the first set of strategies, people are welcome to take photos of this and film this if they want to. The impact is going to be significant. There are no constraints to data theft for remote workers or offshore partners today. And there are no easy answers, but the paper has some suggestions. From my job, look, I've been both red team and blue team. I'm currently on the blue team in my career. In my spare time, this is one of my hobbies that I'm presenting today. This has nothing to do with any of the companies that I currently work for or have worked for. I laugh at my daughter's Barbie car. My poor daughter has suffered time for each of these projects. Her Barbie car remains outstanding. We'll have a look at that this Christmas. She shouted out Barbie car in the middle of the KiwiCon presentation, which was pretty funny. She's a cutie. I want to give credit to researchers. There's been a number of researchers in this field, and there's actually a whole heap of technology that's been reinvented completely uniquely a number of times. There's a short list here of people most directly related to technologies that I've also reinvented again, and I discovered them afterwards. Some of what I'm going to present is completely distinct from these. Some of these overlap with all other projects, but I wanted to give credit to these people. There's a much bigger list on the website. So let's start with the problem space. First principles. My assertion is that any user-controlled bit is a communications channel. Any user-controlled bit is a communications channel. The validation for this is that the screen transmits large volumes of user-controlled bits. I want you to imagine the screen as a fiber optic cable that's been cut through. Huge amounts of data is being pumped out into the room. So the question then is can the screen be transformed into an uncontrolled binary transfer interface? I've heard this guy exists. So we have a tradition at Depcon. First time speakers do a shot. This is our first time speaker. It's very hard to get acceptance. Give him a big round of applause. I got three. We'll all get one. Yes, we do shots in every track. He only does one. Thank you very much. Hold up a second. All right, this is also to all of our new attendees. Cheers. Thanks, Mike. There's a way I didn't practice the talk. So engineering a proof of concept. There you are going to want to join the talk. Going back in time. Terminal printing back as far as 1984. We talk about printing as a switch in the software. So data was sent to the virtual terminals and now sent to a printer device. Not really sending data out of the screen. Same as we did with X, Y and Z modem. We switch it from coming to the screen to going to a file. Not literally out of the screen. 92 to 96, there was a VHS tape backup solution that I stumbled across in the spare parts bin of my local electronics store. The way this worked was data was actually sent out of a video port and captured to a VHS player. You record that data as a chunk of grayscale blocks that could then be played back as video out from the VHS player back to your computer. Literally backed up as a visual signal but not literally downloaded through the display. Pretty close. The first real screen data extraction that we get is the Timex Datalink watch which was a Microsoft project back in 1994. Some of you may have even owned one of these. The way it worked was there was an e-prom inside the surface of the watch where it exposed its window and actual lines printed on the CRT, sent signals to the e-prom that programmed it through the face. It had to work on a CRT. There's been a couple of open source projects that I've referenced there where they've had to use an LED because it didn't work through an LCD display. 20 seconds to transfer 70 phone numbers. And here is that high quality ad. 20 years ago, the first computer watch revolution. Windows 95 had a tool where you could manage your phone numbers and actually export them to the watch. The good old days. There he goes. How through the CRT into the face of the watch. Now working into machine recognition, come 1994, we had QR codes. I'm not going to go into the complete background of this because this is a much more technical audience than I've spoken to before. But the features that I want to take out of this are the highly distinguished codes. The fact that they're easily recognized and machine recognizable and 360 degree scanning. I don't actually have to line this up. Quick response codes were formalized in 2000. They now support rapid scanning capability, automatic reorientation of the image inherent error correction and native binary support. The features I really wanted that error correction binary support and reorientation support. They later supported deformed and distorted codes. Really recognizable. Large capacities, but you'll see in this demo that we don't need the larger capacities. So the Zen moment here, if we consider the QR code as an optical packet sitting within the ether of the display device, then what it now represents is a datagram at OSI layer 3. So to get beyond the packet boundary, what we want to do is replace one code for another. So I've got multiple codes going past the viewer. The receiver then uses video instead of a photo, so we don't want to take one and then exit. We want to take a video and we want to keep processing. This creates a number of layer 4 problems. It's a unidirectional interface. What we mean is data is coming out of the screen. There's no way to signal the sender. So I've got no synchronization. I've got no flow control. This requires oversampling because it's a picture. I have to be able to take multiple pictures two to three times like any other sort of waveform to sample the screen to make sure I actually captured the image at least once. But oversampling creates duplicates, which requires de-duplication. De-duplication may have been intentional because that may have been part of the layer 7 protocol. So I may have had multiple copies of the same data because of what I was transferring. We're now at the point where we need a transport protocol. To create the transport data flow, we want to take the first octet of a packet. The smallest packet we have in QR code is version 1, which has 14 bytes of capacity at 15% error correction. By putting a header in there, we take one byte and create a header. That means I now have the choice of framing up this protocol as I like. I've separated it with a control and a data frame. The data frame has the control byte, which is the header. I've got a flag to tell me what type of packet it is and then I've got a counter and I know where I am in the stream, at least so that I can detect those duplicates. And the payload is simply the data mod, the actual packet size. So now the packet contains the data. The control frame, all we've got is a flag to say whether or not we're control or data. And then a major type and a subtype. You can see here the types, just as an example, this is a protocol I've thrown together for a proof of concept. File name, file size, QR code version, FPS and bytes, with a stop code, for example, that gives CRC. The payload is the contents for that control message and most of these messages are simply designed to give me good user interactivity, a good user interface, as you'll see in a moment. Now, this is a one way transfer between two or more peers. So don't forget, two devices can see the one screen, so I now have multiple receivers off one sender. The features at layer four through seven, I've got high latency. I have no choice but to support high latency because I can't tell the sender and I support interrupted transfers because I know my position in the file based on how many packets I've received and it includes error detection both within the packet but also end to end I've got a control message with a CRC so I know whether or not I've got the whole stream. I've picked there at layer three a number of specs just to make sure that we've got a good sampling without making it complicated, so one, two, five, eight or ten frames per second because I'm assuming that I've got a commodity 30 frames per second, ten is probably the most I can display. A range of QR codes, you'll see why I've chosen the smallest one, binary encoding and error correction. What does this look like? Well, most of this has no real impact on the protocol other than the MTU that we've specified. So here because of the ECC compression the frame will actually spill over to a larger size frame depending on some types of data if you push it up to that size. So what I've done is selected an arbitrary reliable frame size that makes sure it doesn't spill over to larger frames which interrupt the flow of the stream, the recognition from the receiver side. For reference the smallest reliable frame capacity there is ten bytes which means the rest of the protocol has been shaped around that. As a quick example here's our hello world, I'm going to send a hello world file out to the room now. That is control start file name hello world that's start control file size saying 13 byte file. There's start control QR code byte saying I've got 148 bytes per packet. Start control FPS I'm setting 5 frames per second so now my client can tell how long it's going to take for the user to receive it. There's my data with a counter of zero saying hello world and then I'm going to send a stop frame that says that this file is complete with this CRC now the receiver can validate it. What does that look like? This is what you can see from a transfer. This is a PDF that's being uploaded to the room now. To give you a quick feel of data rates if we apply the frames per second to the packet sizes you'll see that we've got a minimum of 80 bits per second and a maximum of 32 kilobits per second entirely limited by the receiver. If the receiver had been able to process much higher rates of transfer. This is an example of the PDF that I was showing you before stored in YouTube being downloaded by an Android phone in flight mode real time. This PDF is a letter that I sent to the, it's an open letter that I sent to the office of the Australian information commissioner advising him that the difference that was made in 2014 between use and disclosure and the privacy act was actually not valid. If I can see it on the screen I can download it. You'll see at the top the icon for flight mode and at the bottom you'll see a yellow status bar that shows that I'm real time storing this data. I've almost received that file and then there's a message to say that it was successfully retrieved. You can pull that down for Android and Apple as a proof of concept now from their stores. I picked that ridiculously low QR code version 1. It's a native resolution 21 by 21 pixels. We know that 80 by 25 will contain 21 by 21 pixels. What you're looking at here is the same program outputting a QR code flow using just the space character with ANSI codes for white on black and black on white. We'll see why that's important when we get to the architecture. What have we got at this point? At this point we've got if transmit software was on my laptop here at the podium then I'd be able to exfiltrate any file I want out of this computer and to a device you can't see to a camera in my hand. The question is how did I get that transmit software on the laptop in the first place? If any user controlled bit as a communications channel and I've got a keyboard now the Arduino Leonardo comes with USB HID support. USB HID support's been available to us for 20, 25 years. That means there's no drivers required in the target system for this to be recognized as a keyboard mouse or joystick. I'm going to use this as a keyboard. The top one's the DigiSpark which was a community project. That's got six kilobytes of flash. The bottom one is the Leostick with 32 kilobytes with a flash. That's about 25 kilobytes of space that I can use to upload a file. The question is what do we upload? The sensible thing would be text, source code because I can type it in as text but that's hard because I've got a compiler in the target system. What I'm going to do is GZIP a transmit binary, turn it into Hex allow it to type the Hex into the target system in a script form, wrap it around as a purl or a bash script and let it output that binary target system. This is a HP thin client with XP embedded that my wife ordered from eBay. I have no idea what the administrative credentials are for this box. I've used Putty to log on to a Linux system. Now what you'll see in a moment is I'm going to, I'm opening a text editor there so I can save the data but I'm going to plug in the Leonardo and when the Leonardo plugs in, there it is there. Beautiful hand modeling. I need to, I need drivers for an Arduino Leonardo. I don't have rights for those so I'm going to cancel that but it will also pop up with the USB HID keyboard. The Leonardo USB HID ID can also be programmed so this could look exactly like a HP Chikoni keyboard for example. Now it's typing in the script which is the payload that I want to output into the target system as it types and types and types or save that script. Change the permissions on it. Now when I run that script it will output the GZIP binary which I'm going to capture to a file. Gun zip that file. Change the permissions on the payload and I'm going to run that payload. That's a 64-bit Linux payload that just got uploaded through a thin client. Technology checkpoint 2. So what have we done at this stage? So now there's no barrier to getting it. We've obviously got data off the system which means at this point I've got a bi-directional data flow. So let's look at the USB HID interface. Now it's polled interface by the system. It comes up once every millisecond. Typical implementations include a packet full of keys and then a clear packet. Unfortunately it's a small packet. It contains only six keyboard keys by code which means it's non-binary. It's also an automatically de-duping interface so if you see the same key twice it'll strip it out. That means at this stage we have the same problem we had before. I need a transport protocol for the keyboard. In this case the packet. I'm jumping out at myself. It is still unidirectional going inbound to the computer. When I originally wrote the paper I hadn't seen an implementation where someone had done exfiltration which you'll find referenced on the site of data through scroll lock, caps lock and num lock up to 10 kilobits per second. You can use the status data which I haven't done. You create a binary payload again by using hexadecimal. That brings us down to three bytes per packet per millisecond. I've retained the key clear which gives me three bytes per packet per two milliseconds and we need to correct for the de-duplication so I've done my own compression and re-hydration which is all in the paper that you can find online. Again the packet is tiny so we don't want to steal a byte for a header so I'll actually bookmark a stream of these rather than putting a header in each one and we'll ignore everything to do with Firebase transfers because what I really want to do is I don't want to be limited to that 32K chip. At the top there I've still got the Leonardo at the bottom I've got a USB serial adapter so the attacker on his computer can see a serial port. The binary data going out of that serial port goes into the keyboard device and gets converted to typed keys. Combined I've called these a keyboard stuffer. I exposed a number of internal controls for the framework to make it faster and now it's a native binary interface for the attacker. Before we augment TGXF before we continue I augmented TGXF to strip out all of the file controls for that as well so now I've got a stream for TGXF and a stream for TKXF and we're going to join them together as a single console application. This is what we've got. On the attacker's computer on the left you'll find a TCP socket listening on that system. Anything received through that TCP socket will be sent out of a USB serial port heading towards the keyboard stuffer. The keyboard stuffer will type it in. Whatever is typed in is received on the organization side decoded and sent out of a packet of a TCP socket on that side inside the organization. Whatever comes out of the organization is rendered encoded and rendered to the screen that's then received by a camera decoded and output of the socket on the attacker's device. Through a screen and keyboard native TCP socket. The reference implementation is limited to the example protocols. I've got 12 kilobits up on the keyboard side I've got 32K down on the on the screen side there are ways that I've suggested you can improve the performance. Now at this stage we've got a bi-directional binary-clear serial connection with a native socket interface with insane portability and massive vulnerability in the environment. The ESA context, when we get back to enterprise security architecture TGXFTKXF and TCXF are a storage based covert channel attack and some people have referred to it as an overt channel because it's so in your face. But then where's the enterprise in all this? So far we've been working from a local computer I gave you one example where it ran over a thin client and over the network. But in the enterprise we abstract the screen and keyboard so that throughout the organization we stretch until it looks something like this. If I'm an offshore user today so I'm in that managed IT service provider offshore. What I see after I've VPNed in Citrix VDI'd SSH'd and gone all the way through every single one of your gates all the way through the deepest part of your organization the keyboard keystrokes I type here go through all those tunnels to the back and pixels rendered at the back come all the way out to me offshore it's a completely clear tunnel through the organization this is console abstraction in practical terms on the bottom of this picture if you can see it is an attacker on the left and the enterprise on the right but this means that the attacker device isn't the end user computer device that you gave me offshore this PC that you gave me offshore is the one perhaps maybe the VDI where you gave me the DLP the AV the anti-malware this is where you've got all your controls I'm not going to attack this device I'm going to plug in a keyboard and point a camera at it the attacker's device is in my hand and not connected to the network inside your organization that was on the left on the right in the deepest part of your organization where you've given me access to manage your infrastructure is the other end of this client which is right next to my goal and where you don't have anti-malware detection right an example on the left in the red is the attacker's device with no network connectivity whatsoever in the green yellow tags we've got that HP thin client which is my end user computer device and next to it I've got an application server that I've SSH2 you'll see I've got the keyboard stuff I plugged in and I've got a camera and a couple of Pringles cans pointing at it at this stage I've run PPP on that TCP socket and we've just negotiated an IP address so my attacker PC with no network connection is now sitting on the same IP network as the application server I'm now running SSH over that IP connection apologies for the blurriness on this I'm not a very good Elbe model it'll come clear in a moment you'll see all the negotiation there's the request on the left on the attacker's screen saying do I want to accept that SSH key I say yes you'll see another few packets come and go that's the request for the password type the password and that's the login so now the attacker's PC that has no network connectivity at all has just SSH into the application server so solution 2 new for Christmas 2014 when you present these things and people blog about them they say it's interesting but I can stop QR codes I know that's what I put in the paper so when I went to KiwiCon I released something new and that was an ASCII version so I believe this is an unsolvable problem and this was another variation to demonstrate that so at this stage TGXF is again transport at layer 4 I've got my datagram at layer 3 though I'm changing from a QR code to an ASCII character so text now it could have been graphics I threatened to do pixels because they'd obviously be significantly faster it could have been images I'd love to see an organization who was out there trying to filter 14500 logos the lawsuits would be exciting it could be letters, words, phrases whatever you choose I can adapt in this particular case I've chosen ASCII characters just to prove it was possible this is clientless because at this stage I no longer need a substantial client it works after 300 bytes of bash and I'll show you that on the next slide minimal server side indicators of compromise now what you're looking for is not a landed binary but simply some bash script or it could actually be Perl script or it could be in PHP or it doesn't matter and it demonstrates the futility of QR code detection there's the bash code all I need to do is display a counter and some data and I can make it run I've got a particular set of font and colors because I'm using optical character recognition it's just for the proof of concept you could train that away I've switched from a camera to the AVerMedia Game Capture 2 device anyone who doesn't know these devices these have been sold specifically so you can plug your XBox HDMI cable into this device so it man the middle and captures it for your YouTube uploads, for your replays but it saves to a USB key that's a tiny little orange USB key at the front of that picture this example is designed to capture data at one kilobit per second we'll go into speeds in a little while I've got a 1920-1080 display at 30 frames per second these devices don't run this fast and I'll show you an example of that shortly my recovery runs a lot slower but it doesn't matter what I've stolen it at is the kilobit per second so I'm going to recover this through an MP4 file in Linux now the red room last year at Black Hat at a bar late one night a gentleman pulled me aside and I was telling him about this and he said look seriously and that's cute and all and we see this thing off shore the red room is the room that has the secret source it's got the special recipe it's the place you have to go to access certain data assets off shore we tend to have rooms that classify to a certain specification and we put certain physical controls around them with variable success anyway he was focused on the red room the rules for the red room are a device can enter the red room but it's got to be formatted everything except the firmware the technology in and then the device can leave but it's got to be blanked again except for the firmware and so his question was well how am I going to get that USB mass storage out with the MP4 file and my response to him was well Captain Coon says be creative if you don't know the reference you'll have to watch the movie this is an example of that bash upload file descriptor 3 is being given et cetera password just as a piece of content to send I've put that bash script on the key so it just types it in for me and what you can see on the left is clearly a counter in binary 0s and 1s going through 0 to 255 on the right is the data also in binary so I'm getting one byte per packet effectively when we decode that and that MD5 does work out you can have a look on YouTube now what I've got is a Linux system I've opened the video I'm processing it one frame at a time doing optical character recognition on each frame if you can see it I don't know how clear it is on those you'll see a little rainbow colored boxes floating around the letters on the screen that's where it's recognized characters and attempting to process them on the left hand side this is in debug mode so for every line of et cetera password that comes out on the left you'll see another line of it appear on the screen so that data is coming out line by line as it's processing the video now new for today you release something like that and you think people are being impressed but then they say it's so slow I don't care it wasn't the point so at Christmas I got bored I was watching Deep Space Nine I think for the third time so I went for the pixel threat I assumed it wouldn't be too hard and certainly the encoder wasn't very difficult at all there is a pixel at layer 3 so I'm using HTML5 canvas and JavaScript so all I need now I've left text mode I've left text but now if I had that VDI in the environment or web browser presented in Zen App for example I can now encode the data visually and send it back out it uses about 20k actually that's now about 30k of JavaScript to enable a clientless mode it feels a little big to be clientless I can plug in a key and upload the whole thing again minimal server side IOCs again demonstrates the futility of targeting a specific implementation now I tried the same box I get 1.3 megabits per second out using two frames per second and one bit per pixel so this is simply black or white that's $120 box the over media I'm using 1280x720 at 60 frames per second now as you'll see and we recover up the same way so slightly different encoding that's me plugging in the key and typing in the client this is a web browser at the moment it's Firefox but it works in Chrome with F11 mode so it's full screen I'm doing a local file upload to the browser itself so the JavaScript can process the file and that's what the data looks like in black and white looks just like a static TV right I'm going to let this one run so you can see the progress bar actually counts up the speed as well the content of this file is the 5.5 megabyte white paper that I wrote last year on TGXF so that file has been uploaded and that was 1.37 megabits per second easy enough to do downloading is the problem here I've got the same program framework only I've distilled all the optical character recognition on the left you can see the line by line marking that's each individual frame of this video and what I've taken away from it this is debug output first thing you'll see when I upload the file is the big red box the big red box allows my software to locate the region on the screen that contains the packet so I can find layer 3 and there it's found it then what we'll do is every single there's a whole heap of control messages going past that we can't see at the moment full screen fulls of data now there's a CRC in this protocol and you can see there's two or three lines before a successful line before a successful frame where we've miscalculated we haven't got the full data as the over media captures you've got about 50% through this transfer and you'll see that the picture starts to res up it's like it takes 10 or 12 frames to completely capture I think there's an internal bit rate that's been encoded in this device and you'll see loads and loads of CRC errors before we get the one frame that works in the bottom corner you can see the PDF is slowly being restored from this file transfer so now I'm getting more errors there's loads of errors I'm almost going a full updated frame a full updated packet before I get a valid packet if I push this one more frame per second faster it's not successful ticking ticking ticking and that's transferring very close to not successfully recovering each individual frame and that's almost complete and the last packet will be the CRC32 that's successful so that's a big list of CRC32 validations on the file and there's the PDF but that's not good enough for DEF CON so that's what I had when I submitted to DEF CON this is pitiful and I'll show you why this should be substantially higher so I bought a better card for $30 more you can get a professional capture card unfortunately I didn't read the fine print this one is a YUV capture card even though it's an RGB data source so the burst I could do here was still one bit per pixel without getting a whole lot of mess however by being a better card I can now do 8 frames per second and that works out to 4.7 megabits per second for the low low price of 10 times that much you can buy the Declink 4K Xtreme 12G this thing is designed to capture real time 60 frames per second 4K video frames this thing will capture the next couple of generations of what your VPN users are going to use same resolution but now I'm doing 3 bits per pixel I'm doing 10 frames per second so I'm up to 300 kilobytes per packet and a total of 12.1 megabits per second in the demo the only reason why I'm not showing you today a 1 gigabit transfer is because I couldn't pass properly pass the AVI file that it made FFMpeg came the closest to converting the file and I was able to get the 3 bits per pixel reliably but I couldn't get 10 bits per pixel reliably which this card will capture but I couldn't convert so this is where I've left it that's the same file with this card capturing it let's recover that file you can see I've already captured the frame I can't even resize this picture fast enough there's the control you'll note that there are only two CRC eras there's only two times I didn't correctly get the frame the first time with this capture card that's done that was 12 megabits per second so architecture, look you can leave out the PPP example the PPP example is not part of the solution because it requires privilege you require privilege to set up an interface on our system so leave that aside but before we had that we already had a TCP socket that was working between two nodes I was just having a bit of fun but the important thing to note is the technologies I've shown you do nothing for privilege they can only do exactly what your users can do today so what you can type and read there's no privilege at all the distinct properties of the delta seem to be along the lines of volume accuracy structure and utility and the paper goes into a few views on that and the cat and mouse games that you could play on that the problem we have is in Australia in the Australian Privacy Act and also in HIPAA and I believe FISMA there's a distinction drawn between use and disclosure it's considered use and safe into your environment and works with the data in your systems that's considered to remain in the offshore case that data remains onshore it's not offshore even though the screen is displaying it that's use it hasn't left your system disclosure however is when the data is taken from that system take an offshore and the user can do whatever they want with it now obviously the tools I've presented today I designed to completely destroy that barrier but I haven't done anything with the privilege on that in the Privacy Act if the data is taken offshore the Australian entity is actually liable for that data going offshore if they didn't take reasonable steps and the only one of these steps that seems to make any sense in this context is monitoring so the question is what is reasonable monitoring Butler Lampson in 1973 wrote a note on the confinement problem brilliant, brilliant work his conclusion was quite a difference between levels of clearance, so a high level user not being able to leak data to a low level user his conclusion was it was probably cheaper if possible at all to just to leave it as a to accept the risk for this type of problem his work was rolled up into the TCSEC specification for B2 and B3 trusted systems the conclusion that document came to was a 100 bits per second data leak or 100 bits per second was considered a high covert channel because 100 bits per second was a valid terminal so if you had a valid terminal that was leaking at the speed of a valid terminal then they can't possibly be secure now at all the examples that I've given you today none ran under 100 bits per second not one including the text one that will run through your SSH service HDMI at 1920 by 1080 by 24 frames per second by 24 bits per pixel is faster than gigabit so in terms of acceptability the TCSEC spec said that the maximum bandwidth accepted for covert channels would be one bit per second and any covert channel that was above one bit in 10 seconds had to be auditable in your environment today the question I put to you today is do you have the ability to see every single key change caps lock light change pixel change and any delta in your environment that runs faster than a tenth of a bit per second not in any organization I've met the business impact I'm going to refer to an example from April this year here in the US the FCC went after AT&T they were correctly their offshore centers in Mexico, Colombia and the Philippines lost 280,000 records the lawsuits settled at 25 million which was then reported as the fine if I took one of those users offshore so that works out to about in rough numbers about $89 a record so $89 per personal record lost if I took one of those users working today with an A4 page whole records I'm saying here 2 kilobytes per record full bits, 8 bits that works out to a thousand words a day works out to about 5 kilobytes a day the worst damage I could do to you in four business days would be 10 records bit of a contrived example multiplied by 10 we're still talking less than $10,000 we're still talking less than 100 users stolen in four business days assuming the FCC doesn't give bulk discounts then what we've done in the last 45 minutes is taken that to 12.1 megabits per second I'm now moving in the same period of time 87 million records and with a cost to the US organization of almost $8 billion in fines but I don't have to work in business days because they're just business days they're 8 hour days I can now work in 24 hour days because in that same timeframe I can work for 9 o'clock this morning and pick up the results at 5 o'clock tomorrow afternoon when I go home in terms of 24 hour days we're now talking about one fifth of the US population being able to be downloaded per 24 hour day at a fine of around $6 billion per day and that would be the entire US pinched in one week or Australia in 8 hours so the punchline effectively there is no difference between use and disclosure if you're operating in that type of framework or the HIPAA or FISMA you'll need to pay attention to these rules there is no pragmatic difference once it's been displayed it's been uploaded to the room so far as off-shoring, right sourcing best-shoring whatever you want to call it if you as a name for remote access for untrusted users to trusted data onshore if you want your data to be yours and yours alone then this is not currently unlikely to ever be safe I would like you all to consider how many bits per second data loss is too many to accept thank you very much


What's unique about Avalino Labs is we are truly a multi-national and a multicultural collaboration of players who are focused on the advancement of technology and applied commercial successes. We now have established testing labs and offices in Korea, Japan, the United States and most recently in China. We've developed what we call an Avalino culture whereby we adopt the best practices and talents from our staff, developing a culture of embracing each other's newest ideas and approaches. The passion within Avalino Labs is to serve as a leader in genetic testing and personalized eye care solutions, playing a major role in what makes us unique and motivates us to bring important eye care solutions to the world. The most important attributes for an innovative company is to have talented people and inspired thinkers. Our company was founded based on people who are out-of-the-box thinkers who are focused strategically on finding cures for patients and for providing physicians with the tools that they need for meeting medical needs for eye care treatment. At Avalino we are very lucky to have these types of people who have inspired our company. Avalino Labs is improving the world with a new molecular diagnostic test that detects complications known as granular corneal dystrophy or GCD. This is a hereditary disorder which cannot always be detected by physical examination therefore the benefit of DNA testing. If a patient tests positive for GCD they should avoid excessive UV light exposure and surgeries to the corneas such as LASIK which would significantly exacerbate the advancement of protein formations leading to their loss of vision. Avalino Labs have now performed nearly one-half million tests in eye care clinics worldwide and in the process we have protected nearly 500 people from their loss of vision. Our company is committed to helping the world through the advancement of personalized medicine for the detection of inherited ophthalmic conditions. We will continue innovating and advancing a platform of solutions for improving how we see the world.


Leaving so soon. I was just going to I was trying to sneak away I mean no no I like children for breakfast. I like this it's coming along Nicely, it's got some balls hanging on down there I think the what I would focus on is now getting a bit more of the animation basically it's the voice acting feels detached so if you look at this here leaving so soon I think so as you start here this feels very spliny it's very very soft you can have a bit more like some tremble in the arms maybe some some head darts looking left and right because it feels like he's really focused but in a way he doesn't know where that big guy is so he might have you know different areas where he's looking over and then the thing is the moment he hears the sound it feels like he should react earlier you know unless if you do so right here on leaving you would have to have an eye blink and maybe he straightens already a bit maybe his arms go back like you know holy shit where is he then he sees him when that arm comes in you definitely want to dart over there so you could do like a really a small take like holy shit there's his arm that means he's right there and then he turns you know so all that just feels a bit late and then on the ogre you know so soon like it's a lot of head movement you know a lot of head accents with that audience right now I just feel like he's just there so I think that would be the next step to really make sure that they look like they're actually saying those lines so soon and then you know since he is so close on detail stuff like he's looking at one eye then he could dart to the other eye then he could dart to his mouth you know there's a lot of nervous behavior in the kid and then see how it sounds like he's all like just going to but then his arm movements are all very soft so I will make him a bit more um not poppy but you know there's some moments where I like where his hands can go up stop up stop and oh it's a bit more nervous and twitchy in a way and then especially on a move like this head move eye darts you know following the guy and I know you don't want him to move too much but at this point we're really losing his pupils so either you you follow him and then you blink and then basically he looks back not at us but more like that because he knows he's behind him or you turn the heads to really follow but it's kind of an in between where you don't want to lose pupils you know so you can do eye darts live a head move and then head move again towards us then that's fine then careful here see how much this is moving chest and the head here and that takes away from the audio because you don't release here all that movement in the audio so you would have to have big move and then then he's saying sneak away so sneak away would be something like here sneak away right and when he's done saying that then you move him then of course the laughter has all that in the body I like children on the bottom the kid here he's just drifting over getting dangerously off violence children and then here he looks like he's just looking over here so you can act I would rotate him just a bit more profile so look there's more stuff to look at you know that feels a little bit weird and we've seen him talk and then they might be more threatening actually you know to have something where like that's that's his profile in a way so you can see the big teeth you know that's a bit more menacing than that profile oh that three-quarter view all right that's it thanks all right there's an email you can sign up you can start whenever you want you can submit whatever you want you get 16 submissions either way a like and subscribe would be awesome all right thank you


Good morning and welcome to the Church of the Week video with me, David Madden. Today's date is Friday the 5th of March 2021 and the time has just gone 9.13 GMT. And this week's Church of the Week is the euro versus the US dollar, Euro dollar. As we can see here in the church, the wider term view has been quite positive. It racked up a multi-year high in early January, its highest level in over two years, going on three-year high. But since then, Euro dollar has been in a fairly clear dollar trend. We have the higher high, the higher low, the higher high. To be fair, the highs of February did manage briefly to take off the highs of January, but we have moved sharply lower yet again. In fact, this morning, we're actually back down to levels last seen in late November. Taking a look at the MACD histogram, the MACD indicator, we can see that there's been a steady rise in negative momentum. So the underlying currency pair is moving lower. We're also seeing a rise in negative momentum. So for the time being, the kind of momentum is with the bears. Why is this? Well, a lot of the moves I've asked recently has been actually to do with the rebound of the US dollar. The dollar was very weak at the beginning of the year and now it's firming up. Why is this? Well, we have seen a move higher in US government bond yields. We have seen yesterday the yield on the US 10-year government bond at its highest level since late February, which the highs of late February were a one-year high. This has all been fueled by a fear that higher inflation and growth is in the pipeline for the US. We heard yesterday from Jerome Powell, the head of the Federal Reserve, who essentially stated that he predicts the labor market in the US will take off as will growth. But with that, there's likely to be some temporary inflationary pressures as well. That's sent yields higher and in turn the US dollar higher as well. Also, the dollar has been benefiting a bit from the fight to quality play. Higher yields but pressure on stocks. So more money was poured into the dollar. So with that, we've seen added pressure on euro-dollar, hence why the euro-dollar has fallen to its lowest level since late November. Now, if we do move lower from here, because we're currently in a one-spot 1927, if we do move lower from here, we could head back down toward this zone here around 118. Not only was it 118, I think it's at the low point of mid-to-late-age in November, it also essentially coincides with this red line here, the 200-day moving average. It was also a decent barometer for a market, whether a market is strong or whether it's weak. We can see here all the way back in May, last summer, if that metric, the 200-day moving average acted both as resistance and support back then. So if the metric has been important in the past, it makes it more likely it will be important in the future. But what's also significant is that a fairly key support level here back in November also coincides with another important metric. So this makes it more likely that this zone in around one-spot 18 will be watched closely, because some people will be looking up for support levels, others will be looking up for moving averages to converge. It makes that price point potentially even more powerful, more in focus. If you do have a size of move below that, we can head back down towards the lows of early November in around one-spot 1745. And then below that again, it could take us back down towards the lows of the very early November down towards 116. On the upside, if you do manage to turn around the neuro-dollar, if you retake 120, we could be looking at heading back towards this yellow line here, the 100-day moving average, which acted nicely as support in early February. That comes into play in around one-spot 2029. Beyond that, we could be looking at retesting the fifth-day moving average, the blue line here in at one-spot 2131. What we really need to kind of take off the highs of late February in at one-spot 2242 to consider that, you know what, the kind of recent negative trend this bit here has come to an end, and the kind of road or wider trend is back in play.  Here at CMC Markets, we offer a number of forex indices, which operate in the same fashion as the stock market index. In this way around, it is currency. So under the product list, you'll find the forex indices. You have the CMC USD index. As you can see here, it's moved higher. In fact, today, it hit its highest level since late December. So we're talking, you know, multi-molk highs being racked up on the US dollar index. So the dollar is only gaining against the euro, as you've seen. It's also gaining across a basket of other currencies across the board. So it could be about a break above a potentially significant level on the CMC USD index. Should that be the case, that could potentially send the dollar up towards the highs of late November in the kind of 970 area here on the CMC USD index. If that were to be the case, then you're likely to see further pressure, downward pressure, that is, on euro-dollar, because one of the tenants of dollar theories are the averages must confirm each other. And what that essentially means is that if a market's moving in a certain direction, similar markets are likely also to be moving in a similar direction. And if they are, you could then be more confident of the move. So for example, if euro-dollar is moving lower and you're seeing, you know, the dollar itself move higher, you could then be more confident that the negative move in the euro-dollar is going to continue. Also, today is a very important day in terms of economic announcements. It's the first Friday of the month, so that means it's US non-farm payrolls. That report is going to be announced at 13 to 30 GMT. For those of you watching this video in the morning time, you can actually sign up for our webinar. It's been hosted by my colleague Michael Houston. You can sign up for our website, cmcmarkets.com, under insights, under webinars and events. And that is free to join. And it begins at 1315 GMT. And then lastly, quickly show you on our platform where you can see our economic calendar. If you look at this kind of swiggy line here, which is a chart, click on that. Third option down, market calendar. As you can see here, it's in the calendar here, respecting the US non-farm payrolls. The boarders' survey is expecting 182,000 jobs to be created in the month of February. That's all from this video. Thank you for watching. Have a good training day and have a nice weekend.


Hello and welcome to this presentation of the STM32 Digital Camera Interface Controller. It covers all features of this interface. DCMI stands for Digital Camera Interface. The DCMI interface is used to connect a parallel camera module to the STM32. The camera generates a parallel data flow together with a pixel clock signal, DCMI PIX clock, which allows the interface to capture the incoming data flow. Two optional signals, H-Sync and V-Sync, may be used to synchronize the image frame between the camera and the STM32. The DCMI also supports line and frame synchronization code in the data flow. The DCMI allows you to perform continuous grabbing. This process starts on application request and continues until the capture bit is cleared. Alternatively, snapshot mode allows you to capture a single frame upon an application request. With the crop feature, the camera interface can cut and store a rectangular portion of the received image. The camera interface has a configurable parallel data interface from 0 to 14 data lines, together with a pixel clock line, DCMI PIX clock with a programmable polarity and rising falling edge configuration. DCMI PIX clock and AHB clocks must respect the minimum ratio AHB PIX clock of 2.5. It supports color or monochrome cameras using different data formats. Uncoded parallel data, also known as progressive scan, which can either be monochrome or color, raw Bayer. Luminance color coded on 8-bit 422 progressive scan and RGB 565 red-green-blue information coded on 16-bit. Some cameras also use this parallel interface to transmit compressed images in JPEG format. This is an example of a simple application used to transmit the camera image to the LCD display. The standard way to use the camera interface is to store the received data in a frame buffer in RAM. The STM32 can then process this data or transmit it further through another interface, such as USB or Ethernet. In order to limit the bus contention in the system and avoid missing data, despite the high data rate of this interface, the received data are packed in a FIFO buffer, as shown on the next slide. Depending on the interface size, 8, 10, 12 or 14 bits, two or four data items are stored in a single 32-bit word. Once a complete 32-bit word is available, it is transferred by DMA to the memory. This allows us to reduce the bus bandwidth used by the DCMI even for high-speed cases. The DCMI also has a hardware feature allowing us to select one byte out of two or one byte out of four. The feature is used to convert a color image to black and white and or the reduction of the image size. In this later case, in order to keep the form factor of the image, the DCMI may only store every other line, reducing the vertical resolution by a factor of two. An 8-level FIFO is used in order to accommodate for any DMA response latency without losing data. The camera interface allows you to capture a single frame, synchronized on after a software request or to continuously receive the data flow. In capture mode, the capture is requested by setting the capture bit in software and starts with the beginning of the next incoming frame and the DCMI clears the capture bit when the single frame has been received. Cropping is another way to reduce the image size, in addition to reducing the pixel resolution, as mentioned previously. This option is valid for both single frame capture and in continuous mode, but is not supported for JPEG format. Five interrupts are generated. All interrupts are maskable by software. The global interrupt is the OR of all single interrupts. The DMA interface is active when capture mode is enabled. A DMA request is generated each time the camera interface receives a complete 32-bit data block in its FIFO. For DMA channels available to DCMI, please refer to the DMA section in the STM32-H7 reference manual. Here is an overview of the status of the DCMI module in each of the low power modes. DCMI operations are not possible when the device is in stop or standby mode. This is a list of peripherals related to the DCMI module. Refer to DMA and NVIC trainings for more information about the DCMI channel and interrupt configuration and to the GPIO chapter for setting up the alternate function pins used by the DCMI. Examples of configuration and use of camera interface are available in the STM32-H7 package available at www.st.com. The camera additionally needs to be set up through the I2C bus before the images can be transferred via DCMI. An example of two camera setups is available in the board support package driver files. Other camera types need different setup that users have to extract from their documentation. For more details, please refer to the application note AN5020 about DCMI on STM32 devices.


To see views like these we must travel clear across the Pacific Ocean. We are traveling up the Saigon River. The old way of life blending with the new and modern. We are in the city of Saigon, capital of South Vietnam. Everything is seemingly calm, outwardly inviting, and Americans are invited and welcomed. This could happen to our welcome anywhere in the Pacific. However, we have the wherewithal to put out such fires. Our United States Army Pacific's waters run deep, but they are far from still. They churn with memories of great battles, memories of devastation stretching for thousands of miles across a watery globe. This is the Pacific Ocean. So deep are these memories that the United States has committed itself to the resolution that never again will it permit the shadows of treachery to darken man's lifeline to freedom. Symbol of Southeast Asia determination is to be found in Thailand, in the capital of Bangkok. Headquarters of the Southeast Asia Treaty Organization, CETO. Her eight nations have joined together to defend themselves against the threat of communist aggression. The policy laid down by its members is a strong defense, but to meet force with force when necessary. Such a policy requires United States military support, and we are giving that. This is Hawaii, our 50th state. Command post for all operations in the Pacific Ocean area. Base of operations for the Army is Fort Shafter on the outskirts of Honolulu. Base of operations is Pearl Harbor, scene of the Great Deception. Hickam Field, base of operations for the Air Force. Even in the skies, memory runs deep. It is recalled that the attack on Pearl Harbor was made with 355 planes and six carriers. While the Pacific command tells the story of our strength and determination, the United States Army, USARPAC, has its own story to tell. Personal contact with top military officials, as represented here by General Maxwell D. Taylor, emphasizes the responsibility of the United States Army Pacific. At Fort Shafter, major planning and policy decisions concerning the United States Army are made. But so great are the distances in the Pacific, that operational responsibilities are decentralized into major sub-commands. These sub-commands reach out across 12 million square miles of ocean, stretching from Hawaii to Japan to Korea, Okinawa, Taiwan, the Philippines. Stationed at these crucial points are thousands of our soldiers, either with military missions in an advisory capacity or as combat troops ready for any emergency. In Japan, our mission is to advise, to help build a strong military arm within the framework of the country's constitution. Yes, modern military methods are the order of the day for Japan's new crop of soldiers. But there is in Japan today a growing awareness that freedom must be defended. In keeping with this concept, a mutual defense assistance pact has been signed by our two governments. This joint United States-Japanese airborne exercise shows how an exchange of ideas, in this instance military ideas, can produce a mutual respect, a vital element in collective security. Field maneuvers, American style. The payoff? A skillful and self-sufficient ally. For winter maneuvers, also American style. Scenes such as we see here reflect our Army's efforts to turn bamboo defenses in the Pacific into a ring of steel. A giant step across the Sea of Japan to Korea is Yusar Pak's strong right arm. Eighth U.S. Army. These soldiers, along with the forces of the Republic of Korea, help make up the United Nations command. It is relatively quiet these days along the 135-mile demilitarized border separating South Korea from communist-held North Korea. But our soldiers know and feel firsthand the tensions and pressures of communist aggression. This was South Korea in the wake of war. Whole cities decimated. Memories of aggression are truly deep. Our Army helps to rebuild South Korea, restore it to hope for the future. Yes, U.S. Army Pacific is much more than a combat force. Wherever its units are stationed, they contribute to the national economy and to the spirit of freedom. 1,500 miles from the troubled spots of Southeast Asia is another of Yusar Pak's sub-commands. With headquarters in Okinawa, gateway to the Far East. Okinawa is one of our major bases in Asia. Okinawa, where memories of a three-month battle are stark and grim. The Toll of Dead read 12,500 Americans. And a great news reporter. This is Okinawa today, reborn in the spirit of freedom. With the aid of our Army in the Pacific, the islands of the Ryukyus are establishing a modern economy. Our President has stated that he recognizes the Ryukyus to be part of Japan and that he looks forward to the day when the security interests of the free world permit its return. Right now, the Ryukyus are fully aware of the immense contribution their islands are making in maintaining the peace of Asia. Such is Okinawa's strategic location that an airborne operation can be launched without delay against an aggressor. Okinawa, keystone of our defenses in the Pacific. Hawaii, almost at the very doorstep of USARPAC's headquarters, memories of aggression run deepest. A comforting thought is the presence of the 25th Infantry Division, Tropic Lightning, a nickname that goes back to the Pacific campaigns in World War II. To the fame battles of Guadalcanal and New Georgia calls how the 25th struck with lightning force. About jungle warfare, it was hell. But they became experts in medals of honor and to Republic of Korea presidential citations. Its history is legend. Its mission today to be in a battle-ready state as a strategic reserve. The Pacific is a vast maneuver area for testing new battle concepts. This is Operation Hailstone, a war game held early February 1962. Place, Korea. Does it look real? Well, it is real, except that the aggressors make believe. The exercise plan assumed that aggressor forces staged an attack against United Nations forces. This exercise involved more than 75,000 Americans, Koreans, Turkish and Thailand troops. Lasting four days, it was one of the largest maneuvers ever to take place in the Republic of Korea. These scenes tell a story of combat readiness more vividly, more graphically than words. But a few words are appropriate. As elements of USARPAC's fighting units move through towns and villages today, there is no question of United States determination to meet force with force. And this gives comfort to those who recall the fateful period of the Korean conflict. 24 million square miles of the Pacific have become a sprawling testing ground for new weapons and training techniques. If it's guerilla type battle, the tropic lightning men have the answers. Remember Guadalcanal? Of course then there wasn't the helicopter, that ace of many military trades. Training is rugged. Terrain is rugged. The type a soldier might encounter in fending off all types of brush fire war. It is the American soldier who today is training the Nationals of Southeast Asia in the art of jungle warfare. A slip of the foot could spell providing additional teeth to United States determination in the Pacific on the Army's missile bases in Hawaii, Korea and elsewhere. From such bases, USARPAC can hurl ground to air missiles equipped with nuclear warheads if necessary. And suppose there is an atomic attack against our forces. This exercise shows how medics are prepared to handle the wounded. The advisor to friendly governments in the Pacific has taken us to within a short distance of the Chinese mainland, an area of conflict and irritation sparked by the Reds. Taiwan, island home and fortress of the Republic of China. Many of the Chinese soldiers on Taiwan, officers and enlisted men have received training in Korea, Okinawa, Hawaii and the Philippines. Help the Pacific Command integrate its scattered battle stations, the Army masterminds a worldwide communications network. Its name Starcom, strategic army communications. This Taiwan station is a one and a half million dollar operation. Another Taiwan station nears completion showing 60 foot antennas built to withstand winds up to 125 miles per hour. Wherever the Army goes, Starcom goes along with it. It all adds up to one thing. Communications is a vital link in our Pacific lifeline. Thousands of antennas of varying shapes and sizes help carry out a round the clock watch on this lifeline. To have a military mission is one thing, to sustain it another. Part of our logistical mission is to provide our Pacific allies with facilities for the repair and rehabilitation of equipment. As usual, civilians play a big part in this type operation. The Army in the Pacific employs approximately 100,000 civilians of which 90% are foreign nationals. These are located principally in Japan, Okinawa, Korea and Hawaii. If the operation is airborne, parachutes must be made as battle-ready as troops. Supply is geared to USARPAC's demands. Destination, Republic of China, Thailand, Cambodia, Vietnam, Korea, the Philippines. Millions of tons of military supplies and equipment now go to harbors once known only in romance and legend, but which are now known in daily headlines as pressure points of communist aggression to missiles. The means to survive and fight back off to a missile base. Delivery of supplies is often a monumental task. It's almost impossible to depend on conventional delivery systems. For routes of travel are dense jungle, steep ridges, roads that exist in name only. This then is the story of USARPAC. The arrow in its insignia represents strength and valor and the stars, locations of the Pacific Ocean areas. With this insignia, USARPAC is stamped with an unalterable mission. It is a strong army, a modern army. It knows it is here to stay, to focus an ever-watchful eye on the danger areas of the Pacific, to serve with its sister services and those of our lives, to preserve our lifeline.