Good morning everybody. We will continue our discussion on arrays and today we will look at how matrices are handled in C programming language. Specifically, it is multi-dimensional arrays that we use. Multi-dimensional arrays is the nomenclature used in the C programming language. A specific subset of this, namely two-dimensional arrays, will be equivalent of our matrices. Since a large number of computational problems involve use of matrices, I will discuss matrix computations with the example of Gauss-Siedel reduction. First some preliminaries. To declare multi-dimensional arrays in C, we note that our arrays can have more than one dimension. As a matter of fact, there is no strict limit on the number of dimensions that you can have. But if you have an array with, say, ten dimensions, it is not clear where you would require it, but you could have it. But the product of the sizes of all the dimensions will be the amount of memory that will have to be allocated. So, that is something that you would like to keep in mind. A typical declaration would be of this form. So, when I say A 50 comma 40, it effectively allocates memory for what we may conventionally call a matrix. The two-dimensional array will have 50 rows and 40 columns. Each element of this two-dimensional array will be accessed by a reference, which now requires two index expressions to be specified. So, in a single-dimensional array, we said, say, roll i or roll j. For this two-dimensional array, we will have to say a i j. For example, we may have an assignment statement which says a i j equal to 37, in which case what the computer will do is it will calculate this index expression. In this example, it is simple i, but it could be i star 3 minus 4, whatever, as we saw yesterday. This index expression is evaluated and the final value becomes the element index for the row number. Similarly, the second index is evaluated and the final value becomes the index for the column number. And then, once a row number column number identifies a specific element, that gets assigned the value 37. So, please note that the name A does represent 50 into 40, that is 2000 elements. However, a i j or any reference of this kind will refer to exactly one element, exactly one element, no more, no less. And that element will be identified based on the values of the row index and column index. We call it row index and column index because it is a two-dimensional array. If it was indeed a five-dimensional array, for example, we would have said the value of the expression for index 1, value of the expression for index 2, value of the expression for index 3, etcetera. Whatever will be the number of indices, ultimately such a reference will refer to exactly one location. We note the usual constraints which are same as those which apply for a single dimension, namely that each index, whether it is a row index or column index, must be within the limits prescribed by the size declaration. So, in this case, the value of i can range from 0 to 49 and the value of j can range from 0 to 39. And we note that all rules for index expression apply to index for each dimension. With this, we consider an important computational problem that arises in many applications which involves the use of matrix. We will specifically talk about representing a system of equations in multiple variables. This material is based on information provided in numerical recipes for C, C plus plus etcetera. I will show you the reference at a later stage. As I mentioned earlier, one of the best books I have seen which describes algorithms in details along with a very detailed analysis of how those algorithms have been arrived at. So, we continue our discussion with a simple example. We consider two equations in two variables, 2 y plus 4 z equal to 8. We call it equation 1. 4 y plus 3 z equal to 1. We call it equation 2. Actually, all of you will recognize that these are very elementary set of two equations and generally all our students who come to engineering college would have solved these kind of equations, simultaneous equations very many times. Here the objective is to demonstrate the use of matrices and the method of Gauss elimination by working out that particular algorithm on this simple system of equations first and then generalizing it for a system of n simultaneous equations. We note to begin with that this system of equations can be represented as a coefficient matrix 2, 4, 4, 3, a matrix of the variables y and z and the right hand matrix which consists of 8 n val. So, we note that if there are two unknown variables and we have an equation system of two equations in two unknown variables, then we get a 2 by 2 coefficient matrix. Please note that this matrix representation actually denotes 2 multiplied by y plus 4 multiplied by z equal to 8. Essentially, the dot product of the first row and the only column of unknown variables equal to the corresponding element of the right hand side forms equation 1. In exactly the same fashion, 4 multiplied by y plus 3 multiplied by z equal to 1 formulates the second equation. While our students may know matrices and this representation, we cannot make that assumption. So, it will be useful perhaps to extend this by describing what is a dot product. Even if the term dot product is not known, they will know how matrices are multiplied. So, 2 into y plus 4 into z equal to 8 is what amounts to the first equation should be clarified. Having achieved this, we proceed further to look at how this system of equation can be solved. In particular, we describe the Gaussian elimination. This method we observe depends upon certain standard facts. There are actually two facts which we will use which the Gaussian elimination uses. The first fact, any system of equations is not affected if any one equation is multiplied by a constant. That means the equation continues to represent the same factual position. To illustrate, we will say, look at this equation 2 y plus 4 z equal to 8. We observe that it is same as 1 into y plus 2 into z plus 4 which we obtain by multiplying the equation by 0.5. If we did that, we can now say that we have two equations 1 y plus 2 z equal to 4 which is the one which is derived from this first equation by multiplying it by 0.5. We call it equation 1 dash and we have retained the second equation 4 y plus 3 z equal to 1. This is equation 2. At this time, some students may naturally ask, why are we multiplying by 0.5? Why not by 0.8? Why not by 7.3? Why not by any other number? While it will become clear why we are doing this, but we can very minutely, very, very, very subtly suggest that by multiplying this equation by 0.5, what we seem to have achieved is that the coefficient of the first variable has become 1 now. This one has significance as we shall see later. We then continue with equation 1 dash which is 1 y plus 2 z equal to 4 and 4 y plus 3 z equal to 1 being equation 2. Representing these equations in the form of matrices, we get this representation. So the same equations, we now say 1 2 4 3 y z equal to 4 y. Notice again that people if they are not understood the notion of dot product, we can remind them again that this matrix representation really means that the first row is multiplied by first column and is equal to first element of the right-hand side. Similarly, the second row multiplied by first column, that summation is equal to the second element. So 1 into y plus 2 into z is equal to 4 is our first equation and likewise the second equation. We note in passing that the original coefficient matrix had we represented the coefficients in a matrix form would be like this. Why do I repeat this here? This is to show a comparison between what was the original coefficient matrix that we have and what is the modified coefficient matrix that we have now derived. We can again subtly emphasize to our students that ultimately when we apply the Gaussian elimination method to a larger set of equations, we would essentially be modifying the coefficient matrix and because of that modification we will also be modifying the right-hand side matrix. y z of course represent unknown which is what we need to determine. Clearly the objective is to find out what is the value of y and what is the value of z which together satisfy the system of equations. So we got this equation 1, equation 2 originally in matrix form and this is equation 1 dash and equation 2 again in matrix form. We now notice the second important fact that the Gaussian elimination technique uses namely if an equation is replaced by a linear combination of itself and any other row, the system of equations remains the same. The word linear combination may not be very easily understood by our students. So we say that we can add or subtract from a row a multiple of any other row. So that is what is meant by a linear combination of itself and any other row. In general actually linear combination could mean say k 1 into 1 equation plus k 2 into another equation. The form that we take is that we replace the second equation by subtracting from it 4 times the first equation. Again at this stage the number 4 might appear to be an arbitrary number but we will soon proceed to tell our students how we derive this number 4. In short if these were our equations equation 1 dash 1 y plus 2 z equal to 4 or now we can speak in matrix terms 1 2 4 3 was our matrix and 4 1 was the right hand side. I multiply the first equation by 4 and subtract from equation 2 the resultant combination of equation 1 dash multiplied by 4 and replace the second equation by that value. So what do we get? The first equation stands as it is because we are not doing anything with it 1 y plus 2 z equal to 4 remains as it is. What happens to the second equation? It was 4 y plus 3 z equal to 1. Now it becomes 0 y minus 5 z equal to minus 15. Now people can easily see what was the reason for the choice of multiplying the first equation by 4. In fact we will remind our students that when they apply these principles normally while solving a simultaneous set of equations they would like to eliminate one of the variables. Here we are talking about eliminating the variable y. Since y has a coefficient of 4 if I multiply the first equation by 4 and then I subtract that equation from this I will get 0 1. So when I multiply this equation by 4 this term becomes 4 into 2 8 z. When I subtract 8 z from 3 z I will get minus 5 z. Similarly when I multiply this by 4 I will get 4 into 4 16 and when I subtract it from 1 I will get minus 50. So it is a simple linear combination evaluation. We are using this fact which is a general fact and we are using this fact to reduce the coefficient of the first variable in the coefficient matrix to 0. In terms of matrices this was our matrix. When I multiply equation 1 by 4 basically I multiply the first row by 4. When I replace the second row by subtracting 4 times the first row from itself I will get the second row as 0 and minus 5 which is nothing but the coefficients of the modified equation as we see on the left hand side. And of course the right hand side also stands modified. The first element remains same as 4 because we have done nothing to it. Since we have replaced the second equation the second value becomes minus 15 which is nothing but the right hand side of this equation. You might find this elaborate explanation not worthwhile for the community of teachers who have assembled here. But again I will remind you the purpose of this explanation is to indicate that perhaps such details might be essential to convey to our students not all of whom would understand linear systems of equations really equally well. Anyway now is the very simple step. Everybody will know now that how to solve this equation. I have 1 y plus 2 z equal to 4 0 y minus 5 z equal to minus 15. From this two equations we further multiply equation 2 by minus 5. Now this is subtle. We had this 0 y minus 5 z equal to minus 15. Ordinarily a student will know that this equation is nothing but minus 5 z equal to minus 15 therefore z is equal to 3. So he will just divide minus 15 by 5 which is the coefficient of z because this term does not come. What a student will do naturally? We want to indicate how to do it formally in the context of a matrix representation. Notice that we have got 1 here on this diagonal by using the previous operation. We now tell our students that we want to get 1 here because if the coefficient of z is 1 then whatever is the right hand side is actually the value of z. So in fact what they would intuitively do for finding out the value of z namely divide this by the coefficient minus 5. We are actually trying to show that this is done by using the same fact. So by doing this we will get 1 y plus 2 z equal to 4 and 0 y plus 1 z equal to 3. This might appear trivial even to our students but the idea is to tell them that by doing this what I do is I get a coefficient matrix of this form. So I have once on the diagonal zeros on the lower triangular portion and non-zero values or whatever values I get in the upper triangular portion. It is a 2 by 2 matrix. So the notion of a triangular upper triangular lower triangular may not be very obvious here but essentially we say that we wish to get a matrix from the coefficients which have once on the diagonal and zeros below the diagonal. Why? Because by putting these equations in this form which now we call equation 1 dash and equation 2 dash starting with the last equation we can use a back substitution and get the solution for all variables. The last equation itself does not require any substitution. We directly get z equal to 3. Why? Because this coefficient equation represents 0 into y plus 1 into z equal to 3. 0 into y plus 1 into z equal to 3 that is this equation which means z is equal to 3. So we say we have identified one solution. Having obtained this solution z we substitute the value of z in the previous equation. The previous equation was 1 y plus 2 z equal to 4. When we put the value of z which was 3 here we get 1 y plus 2 into 3 equal to 4 which gives us y plus 6 equal to 4 and which therefore gives us y equal to minus 2. If we have more equations we can tell our students. We can keep on doing this. This process is called back substitution. So we keep finding out values of the variables at the bottom. Move upwards by substituting the values of those variables whose results we have found and finally we will get values of all the variables. This in short is the method of Gauss elimination. So we note that the essence of the method is to reduce the coefficient matrix to an upper diagonal matrix with all elements in the diagonal as 1 and then we use back substitution. We note that the process is susceptible to round off errors. Why? Because in practice the coefficients will not be nice ones as 1, 5, 3, etc. In real life for example if you are simulating chemical processes or as I said you are doing some finite element analysis.  And if there are arbitrary real numbers we know that when we represent such real numbers by floating point numbers inside we have the problem of limited precision. In particular we recall that if a large value is added to or subtracted from a very small value the result may not be significantly different from the original value that is what we say is the impact of the limited precision we can have. We just noted at this stage in the first course after all this is not a course on solution of linear equation. This is a course on algorithms programming and so on. But we are taking this example to show how matrix manipulation is done in C programming. If our students are interested and if we are so mathematically inclined we might indicate that there are other variations such as Gauss Jordan elimination, pivoting, LUD composition. Many of you would recall these to be the standard techniques which are used in several cases. We also note a useful reference. This is the reference that I mentioned. Numerical recipes in C. Actually this original book was Numerical Recipes in FOTA. Then when C language came about they introduced the same numerical recipes in C. Subsequently when C++ came they wrote the book, rewrote the book in numerical recipes in C++. There is an interesting dilemma which these people also face. This is what was raised by some of our participants also. Why does C indexing start with 0 when we naturally index our matrices or our way of looking at 1, 2, 3, 4, 5, 6, 7. Interestingly the same problem afflicted the authors of this book who had written it originally in FORTRAN and as many of you will know FORTRAN arrays are referenced, their elements are referenced by referring to them as 1, 2, 3, 4, 5 up to the side. So what they did when they wrote the book in numerical recipes in C is that they wrote a whole lot of backend software called they wrote actually they wrote function library such that in the actual algorithms they could use indexes 1 to n. Consequently while this book implements all the algorithms rigorously it is slightly odd. Why? Because if we want to ever use any other functions that we write in terms of the arrays that they deploy it becomes extremely difficult because our arrays we will refer to between 0, 2 whatever n whereas they will refer to 0 to n minus 1 whereas they will be referring to 1 to n. They have corrected this in the C plus plus series. By and large is one of the best books by the way some of you might want to just have this book because of the excellent treatment of variety of numerical recipes problems that the book offers. These are the authors and the book is extremely popular amongst numerical scientists. We now proceed to look at the generalization of what we have just seen through an example. This then is the general representation. We say that a system of linear equations in n variables can be represented by a11, a12, a13, a1n, x1, x2, x3, xn equal to b1. a21 into x1, a22 into x2, a23 into x3, etcetera, a2n into xn is equal to b2. In short, an n by n coefficient matrix and an n valued right hand side represents a system of n linear equations. We now note that while we as human beings might be accustomed to this notation of referring to coefficients of as a11, a12, a1n, etcetera, since the C programming language uses for its matrix indexes the notation from 0 to n minus 1. It is worthwhile for us to treat this system of equation as if it is represented like this. a00, a01, a02, etcetera up to a0, n minus 1, a10, a11, a12, etcetera up to a1, n minus 1 and so on and our variables instead of calling them as x1, x2, x3, we call them as x0, x1, x2. Why? Because clearly then the conventional matrix both one dimensional and two dimensional of C programming language using the index expression rules of C programming language can map one to one on to this system of simultaneous equations and when we do it at this stage it is not very hard. Particularly to programming student who are already accustomed to array indexes being between 0 to n we go to the previous slide show them that this is what we you will find in mathematics books or this is what you might have studied in your school algebra or this is what you will be studying in your engineering or science algebra. However, since you know how C programming treats arrays for our purposes we shall treat this equation to be like this. There is absolutely no change except for the nomenclature. I have found that most students immediately understand this particularly you show both the things side by side. Problem arises if we start only with this kind of representation and never compare it with the conventional representation. So, this is one rule I have learnt in teaching whenever we are introducing anything new as far as possible related to something that students already know and then indicate the variation. Now, we know that the Gaussian elimination technique essentially reduces the coefficient matrix to an upper triangular form. So, the C style matrix will have 11111111 on this diagonal will have zeros below notice that this is now an upper triangular matrix because the coefficients will be a 0 1 a 0 2 etcetera up to a 0 n minus 1 a 1 2 a 1 3 etcetera up to a 1 n minus 1 and so on and of course these are the variables with the appropriate right hand side values. Once we reduce this we can tell students how I can do simple matrix operation the last value x n will be simply equal to b n I can use these to back substitute in the previous equation and so on. We shall now look at the computational implementation of this particular problem we note in general the representation in C style will be that I shall have a 2 dimensional matrix a I will have a 1 dimensional array x and I will have a 1 dimensional array b. The 2 dimensional matrix a will contain the coefficients which originally would be all arbitrary values filled up in the n by n matrix starting from 0 to n minus 1 for rows and 0 to n minus 1 for columns the x matrix is trivial we just define it is a place holder actually it will not contain anything for most of the operations except in the end when using back substitution we are going to find out the value of the variables. So, these x matrix will represent actually our results and it will get filled up as we know because the back substitution not from x 0 x 1 but first we will calculate x n then x n minus 1 x n minus 2 and so on. We note in particular that if we recall our gauss elimination technique that we have seen then after the steps which will lead to modification of the left hand side coefficient matrix and of course the corresponding modifications on the right hand side we will get the coefficient matrix in the upper triangular form and then we will have the following system which using back substitution we can solve for x what will that be x 0 plus a 0 1 into x 1 plus a 0 2 into x 2 etcetera a 0 n minus 1 into x n minus 1 equal to b 0 x 1 plus whatever whatever lastly plus a 1 n minus 1 into x n minus 1 is equal to b 1. Notice that because the coefficient matrix has 1 on the diagonals the coefficients of x 0 x 1 x 2 etcetera will be 1 and now if we see very easily the back substitution means x n minus 1 is directly equal to b n minus 1.  A small question is this elaborate explanation necessary. My answer is yes I have tried shorter explanations some of the smarter students in the class understand that very easily. Those who have been playing with simultaneous equations for a long time in their school days or have picked it up in their first year engineering in the mass portion they can understand it very quickly. But there are a large number of people who are significantly benefited by some elaborate discussion of the Gauss-Elin. So, the question I am often asked by my colleagues is this a programming course or is this a mathematics course. Thankfully our course is named computer programming and utilization as I told you we do not name the language that we use although we use a combination of C C plus plus for teaching programming principles. But traditionally we take up an application explain what that application is about explain the underlying algorithm and then work out how the C programming implementation will be which is what we shall now proceed to achieve. We further illustrate our computations in terms of C matrices consider our example equations in two variables 2 y plus 4 z equal to 20 y plus 3 z equal to 11. We represent y by x 0 and z by x 1 then this will be represented as this. So, a 0 0 into x 0 etcetera where a 0 0 is 2 a 0 1 is 4 a 1 0 is 4 a 1 1 is 3 they are namely the coefficients here now we write the C program once again I will remind you the only reason why I am calling this Gauss dot C P P is because I am going to use C in and C out other than C in and C out there is no feature in our programs which does not match one to one with the features of C. So, we are essentially writing C programs but including input output statements of C plus plus for the reasons that I had mentioned earlier. So, for that purpose I of course have to say include I O stream using namespaces to the et cetera. I declare all my variables in arrays I J K N R common sense indexing variables that I will use L is the size of the system of equation I define mat A as matrix A, mat B as matrix B and x as the variable matrix. I describe as divisor factor and sum as float these are the computational variables or place holders that I will require during my computations. I have the usual input portion which reads all the values I read a matrix A first since I have to it is an n by n matrix I start by reading n and then I read the coefficient matrix in row order. So, for first row I equal to 0 I read all the columns then for row I equal to 1 that is second row I read all the columns et cetera I do exactly the same thing in matrix B matrix B is a single dimensional array. So, there is only one column for I equal to 0 to n minus 1 I read all the elements of matrix B having obtained the input I now proceed to do the Gauss elimination. Since we have discussed an example of a two by two equation system it is not very difficult for our students to understand these things very quickly what I do divide each row by the coefficients on the diagonal. People will recall that the purpose is to get 1 on the diagonal and therefore multiplication for any system when I proceed any row. So, I am starting with I equal to 0. So, I start with that row and in that row I make the coefficient of the diagonal 1. So, I calculate the divisor mat A I I which is the diagonal on the Ith row. Please note I am starting with the 0th row and please also note that before I complete this for any row I would have got by the elimination 0s in the lower triangular portion. So, for this row I say divisor is mat A I I and I simply say mat A I I equal to 1.0 I am forcing it to 1 and now recalculate all coefficients in that row. So, for j equal to I plus 1 j less than n j plus plus I recalculate the I comma jth coefficient of mat A by dividing itself by divisor. Divisor is the diagonal. Why I do not do that for even I I please note that mat I I is desired to be 1. I am dividing each row by the coefficients on the diagonal in order to get that as 1. There is absolutely therefore no harm in forcing that to be exact one or as close to one as possible because we know that internally the decimal fractional numbers and binary fractional numbers in which form the computer stores or number do not have 1 to 1 match and that is because 1 by 10 cannot be translated into an exact binary fraction. That is a matter which we have not yet discussed. I would suggest that the teachers amongst groups deliberate on these issue to discover what is the implication. Anyway, now normalize the corresponding right hand side element because I have to divide the right hand side element also by same I get this. So, for so good all that I have achieved is I have taken each row and converted the element on the diagonal to 1. Now replace subsequent rows by subtracting the appropriate portion of the ith equation from it. So, I am considering ith equation. Initially I is 0. So, for if I plus 1 is less than n because I should have a subsequent row. If I am already at the last row there is nothing else to be modified. So, I just check whether there exists I plus 1. That means I plus 1 should be less than n. At most it should be equal to n minus. Then for a value of k varying from I plus 1 to less than n I do the following. I calculate the factor which is mat A k, i and I set mat k, i to 0 because that is the purpose of the elimination. Notice what we are doing. We are now reducing the matrix row by row into an upper triangular form. So, just as I force the diagonal element to 1 I force the k comma of I element to 0 because that is what I am going to achieve after the substitution. And what do I do after the substitution after the subtraction of a linear combination and so on which is what we attempt. So, for j equal to i plus 1 to n minus 1. That means for all the elements in the I plus 1th row I calculate mat A kj equal to mat A kj minus factor times mat A ij. So, mat A ij is the deciding row. It is multiple that is factor. I am subtracting from the k a through corresponding jth element. The multiple of each row when subtracted from k a through it will not be the same factor. So, notice the factor is calculated separately for k a through. So, each k a through has one factor. All operations on the k a through are done using that factor. When I have completed that I will have to do the same factor reduction in the right hand side matrix B k. So, I calculate mat B k is equal to mat B k minus factor into mat B k. When this iteration finishes let us just look at couple of iterations initially i is 0. So, i plus 1 is 1. So, I start k equal to 1 to n minus 1. So, for each row second, third, fourth, fifth or the index number 1, 2, 3 for a plane minus 1. Let us take the next row. First row I have got one on the diagonal. Second row the first element I am setting to 0 because it is below the diagonal. The next row has been already set to 1 the next element because all diagonal element we converted into 1. So, now I am saying for j equal to i plus 1 I calculate mat k j equal to this, mat B k is equal to this at the end of this I would have got the entire matrix into an upper diagonal form with the right hand side coefficient matrix representing the effect of all these operations correctly. Notice how small the code is. So, it is not that one has to write very lengthy programs to implement even a complex process such as Gauss elimination. Now, I do the back substitution starting with the last variable. As we observed the last variable is simply the right hand side coefficient. So, x n minus 1 is equal to matrix B n minus 1 and then for i equal to n minus 2 to 0 that is I go backwards in decrement of 1. Notice that this is i minus 1. I will sum up i throw using values of x already determined. So, sum is 0 j is equal to i plus 1 for j less than n j plus plus sum is equal to sum plus mat A i j into x j. What am I doing? These x j's represent the values which I have already found out. I am multiplying the already found out values with the coefficients and I am summing them up. So, in a particular row where the diagonal is 1 and other coefficients are there I am using the values of the remaining elements which I have found substituting them here I have only one unknown in this equation which is x i. So, the unknown values are i plus 1, i plus 2, i plus 3 etcetera. I calculate x i by subtracting from right hand side mat B i the sum that I have calculated. This is back substitution. Let us very briefly go over this again to consolidate our thought processes. I read the two matrices A and B. For the Gauss elimination I divide each row by coefficients on the diagonal. Effectively I normalize, I convert all the elements on the diagonal to be one on the coefficient matrix and correspondingly normalize the right hand side. Then I do the Gauss elimination technique implementation of getting the entire coefficient matrix in upper triangular form. For that I do that subtraction of a linear combination of one equation from the other kind of stuff and I will get all of these done. At the end I use back substitution to calculate values of all my variables. Finally, I output the results. Well for good measure I also output the matrices. So, this is one matrix A, this is another matrix B and then for i equal to 0 to n minus 1 I print the values of x. Notice a very funny kind of printing because I am printing a string x opening bracket. Then I am printing the value of i. Then I am printing a string closing bracket, e's colon. This is merely to get some meaningful print out as we shall see in a moment. Then finally I print x i which is the value and go to the next line. Now here is the question. I have used the c in and c out. In an actual program you may use scan f and print f. It does not matter. But what is important is that every time you run this program you will have to give that input by typing in values on the keyboard. If you have to give a few values which is what we have seen in most of our algorithms it is not a problem. But imagine if it is a matrix. Imagine it is a 10 by 10 matrix. So, you have to give 100 values. Not actually 100. You have to give first n which is 10. Then you have to give row by row 10, 10, 10. So, 100 values plus you have to give the 10 values on the right hand side. So, 111 values you have to type. Now suppose you run this program and you find there is some problem. The program is not working properly. You go back, check that program, correct it, run it again. Again you have to type in 110 values. This seems silly. For that purpose we look for some shortcuts. Fortunately the Unix operating system provides us with that shortcut. In fact there are some other facilities I would like to discuss both of them at this juncture. So, as I observed ordinarily we use the keyboard to give our input data and screen to see the output values. But if you have to repeatedly execute a program during trials then the same input has to be given again and again. Also once a program executes if its output comes on the screen, we read that alright. But next time when we run it again after making some changes we get some other output. Usually we would like to compare this output with the previous output. But the previous output has gone with the screen. So, getting output only on screen it is good provided I am just running a program to get final results. The program is perfectly working. But during the development stage I may want to retail the output of these programs at least two or three major runs for comparison purposes later. Just as you saw when I had shown you the results by running the Pi estimation program using time. How do you do that? Well this is the objective to see here. If the input values are large in number we know we can store these numbers in a file. What is the file? It is a text file like our program file. Such a file is pre-edited and it contains the required input data in the prescribed format. For example, roll marks dot text. We have roll numbers and corresponding mark. Roll number mark, roll number mark, roll number mark that could be one format. In this particular case also we could prepare our input data in the desired format. The question is how do we make my computer read data not from keyboard but from a file? For that there is a very simple facility called a read direction. When we use C in greater and greater this or when we use scanf in our C programs actually the operating system gives our C program a standard input file called stdin. stdin by the operating system is normally connected to keyboard. So whenever our scanf is executed in C program or whenever CIN is executed in C++ program or C program then what happens is that the operating system connects that to a stream of bytes coming from the keyboard. That is why all input is read from the keyboard. However the Unix operating system can redirect that stdin. We can tell operating system that look while you execute this program please do not connect stdin to keyboard as you normally do but instead connected to something else and what is that something else? Well a file which contains the desired data in the desired format which of course we would have pre-prepared. Consequently instead of simply saying dot slash a dot out if we say dot slash a dot out less than input data dot text. Please do not confuse this less than or greater than sign as we see here with the greater greater less less sign which we use inside the program. C in and C out are the programming instructions which are used inside the program. Here we are talking about the operating system instruction not that dollar prompt. So this is not what you write ever inside your program but this is the command that you give to the operating system. After compiling your program if you say dot slash a dot out less than input data dot txt this less than symbol is called input redirection. That means for this program in its entirety now the keyboard will be disabled. So you would not be giving any data on the keyboard because operating system has decided that you do not want keyboard to be standard input file. Instead you want input data dot txt file to be treated as standard input file. So operating system will automatically open this file, start reading bytes from this file. It is our responsibility to ensure that the text which is inside this file actually represents the values in exactly the same form in which we would have typed it on the keyboard. So same blank space between two values or line feed whatever whatever. Similarly it is possible to redirect all output to a named file just as operating system has STD in which is connected to keyboard the operating system also has STD out which is called a standard output and which by default is connected to our monitor. That is the reason why whenever we say c out or print f for that matter the output comes on our screen because the operating system simply gives a standard out file and c out or print f right to that output file. Since that file is connected by the operating system to our monitor that is where we see things. But if we use the redirection by saying dot slash a dot out greater than output data file dot txt in our command line then instead of any output coming to the screen that output will go to that file. That file can be later on examined. Please note that both redirections can be used as simultaneous. This is important and useful for us because now we can run this program may be full time during trial every time giving a different name for this file. Note that this file does not pre exist input file must pre exist but the output file is created by the operating. So let us say output data file one output data file two output data file three or output data file third July output data file fourth July we can use meaningful names for our trial and later on we can print these files and compare the results it makes it extremely easy for us to compare things across multiple executions. In any case the most important advantage for us is that in a limited time if you want to run this program multiple times you do not have to type the large number of values that will accompany us. So far in our labs also you have been giving only small value. You will realize that the same thing will be happening to your students. Later on when with your students you declare large data handling you discuss large data handling there could be serious problems.


What's up? I'm Jason Ostrom. Can you guys hear me back there? Cool. This is Bill Borske. Hello. We flew in yesterday from Dallas and unfortunately our third speaker Carl Finehauer couldn't make it today. So first of all I want to thank all the friends and peers of myself and Bill for being here in the room. I really appreciate it. We appreciate it. This is a really, really special talk to us. We're really passionate about this stuff. Let me give you guys kind of an idea of what we're going to talk about here. Islands of Voip is something I could talk about for two hours. It's something that really excites me. So what we're going to do is we're going to talk we're going to at a hacker conference you would want to see like a live hacking demo. So we didn't bring that. But we have some surprise UC vendor research that's a major manufacturer that we're going to take a look at some potential vulnerabilities. And that's a surprise. If you guys stick around a little bit, Bill's going to show some technical details on that. And I'm going to talk to you guys about something that's really important to me. And what I want this to be is an exploration of an idea. And I think it could change the way we communicate in the future. And I want you guys to be a part of that. And I'm going to give this away to the community because it's something that you guys could be involved in. So this is a community effort and we're releasing two open source tools in addition to the vendor research and a configuration for something special. So let's go ahead and jump into this.  This doesn't necessarily represent the opinion of our employer. And just because we stand up here doesn't make what we say exactly right always challenge what's being said. We're here to explore an idea. And the idea could be disruptive to the traditional business of incumbents to the status quo. So what is Viper? Viper stands for voice over IP exploit research. Two main missions we have. We do VoIP UC pen testing and we have a security research lab that we look at vulnerabilities in VoIP and UC. Okay, so islands of VoIP. What am I talking about here with islands of VoIP? What I've done here is I've kind of shown an architecture drawing of this idea that I've come up with. Islands of VoIP has been something that a lot of people talk about. And what it means is I started doing this pen testing really with SIP like in 2008. And I've wanted to present this for like a long time. If you look at enterprise A, what was going on in the mid-2000s is lots of companies were using VoIP internally on their network and reaping a lot of business benefits from using VoIP. But they weren't actually using SIP trunks. They were doing, they would have a VoIP gateway that would translate from IP to TDM and would use like a PRI trunk and they were going through the carrier. So the idea islands of VoIP, what this means is we have many different disconnected separate VoIP networks where enterprises and organizations are using VoIP, but they're not connected together. They're not reaping the major benefits of VoIP. And so they actually all end up going through the PSTN and you end up paying costs going through the PSTN. So that was enterprise A was the first one. And then what we're seeing more and more here in like the late 2000s is companies doing SIP trunking. And so the predominant architecture for this that I see a lot and we do a lot of these VoIP pen tests, we go into the internal enterprise of the customer. We'll either have enterprise B and enterprise C doing a private IP MPLS network connected to a large carrier doing SIP trunking. And what's so ironic is that these two enterprises are they could be connecting directly to each other with VoIP yet they have to go through the carrier and pay the carrier for the cost. So what's ironic is that you don't do this with email in your HTTP traffic, right? You advertise yourself in DNS why should we be doing this with VoIP? It's something to kind of think about. Why do you have to go through your carrier to do your voice communications? Here's another representation of the islands of VoIP idea. So one thing that people are talking about with connecting the islands of VoIP is using Enum. And Enum is basically a special resource record where we map e.164 telephony numbers to a SIP URI. And so it solves the problem of interconnecting the islands of VoIP because you can look up the number and you can go over two different SIP networks can connect to each other directly by dialing by number. So that fits when you're still thinking in the terms of dialing by number. One of the issues with Enum is it hasn't seen widespread adoption and there's political economic barriers to this because the carriers, it requires the consensus of too many competing carriers on this. So we did an Enum experiment and this is actually how this all started with Enum. What we did is we wanted to look at the privacy considerations for publishing ourselves into Enum into the directory. So we took some numbers and started putting ourselves in and we found we couldn't add ourselves into this. This is the e.164 org directory. So it kind of was just seeming like I wanted to do this experiment with a registrar in the UK called Nominet and I wanted to basically create a tool that could do an Enum lookup on every single number in the UK and see if there were privacy considerations where I could actually connect to that point SIP device just by having a range of telephone numbers. So that was kind of how this whole thing started with this Enum. So there's got to be a better way and so there's got to be a better way of doing this and this is what we're, Enum hasn't proven itself to work because of these too many barriers. So the superior solution SIP peering using DNS SRV. If you've read this abstract everything that we're talking about here is in this abstract. We're just going to be filling in some details. So we dial by name and SIP address we peer directly using SIP DNS SRV routing. So this is how it works here. We can interconnect all the islands of VoIP directly using DNS. DNS is built for high availability and load balancing. It's already supported. It's a resilient protocol that's lasted for a very long time. So we can call via your SIP URI call via your SIP your email address. So not calling by your number and no more dialing by number and it's easier to remember and it matches your email address and your SIP URI. There's a large cost savings of direct SIP peering using this method and not having to pay your PSTN carrier and then the PSTN will be increasingly diminished. So the special DNS SRV records RFC 2782, RFC 263 specifies this usage for SIP. And so SRV service location, it has already built for fault tolerance and load balancing. This is a sample record here. So we have service protocol and name which is the DNS domain and the service returns the priority weight, port and target. So what we can do here, here's a sample zone file record. When we have all 10 for the priority, then we match it up with the load balancing group. So then you add up the numbers 60, 20, 10 and 10 and so 60% of the traffic will go to big box, 20% to small box. So we have automatic and it's just like MX records for mail transfer agents for matching. It works the exact same way. So why aren't more people doing this? We started thinking of this like why are all these companies directly connecting to the carriers and not doing this method. So here's a, let's look at a sample architecture for this. So Jason is connected on example.com and his SIP service with his enterprise is connected on the edge of his network. So he sends a SIP invite and the DNS SRV look up for food.com. So he wants to call bills organization and then the record returns. So then he routes the traffic directly to bills organization and the invite comes in via the AOR, the address of record for bills SIP user agent, knows the IP address with his registered user agent and routes the call directly to him. So we have a fault tolerant high availability method of routing SIP traffic, bypassing the PSTN, which can be managed by each organization. The important thing, it brings the power back to the organization, back to the enterprise and not having to go through, rely on the carrier for this. Then the carrier, you can use the carrier more for the network transport. So then Voight becomes another application on the network, just like email and HTTP and this is the way it was meant to be, in my opinion. And so then we, we set up the, we answer the SIP invite and then we have RTP media directly between the SIP servers anchoring the media. So we started looking at this as a research goal. We want to measure the growth of SIP on the internet over a period of time. So the first idea is, Bill and I were out in, we were out in another country doing a Voight pen test for four weeks so we ran out of time to do everything we wanted to do. But we want to look at the DNS SRV plotted over time, how it increases. We wanted to look at the proliferation of enum records on the public internet and then we wanted to do scan the internet for the number of listening SIP services. So I'm releasing a new tool that I had the idea to do like a long time ago. I finally released it and it's on the website right now on Sourceforge. It's enumerator.sourceforge.net What is enumerator? Enumerator, it's written in C. I'm the author, Carl, the other guy that's not here, helped out with it and it can be used for R&D purposes like we did. It can also be used for Voight pen testing in the recon phase. We've wrote some special features that can look for organizations for the existence of SIP services. It's optimized for Voight. The DNS SRV lookups can be for a single domain or for a text input list. It also supports MX record lookups because we wanted to compare SRV to MX and plot this over time and see how SRV was catching up with MX records as far as the, for all top level domains. So that was a part of the experiment and we support ENU in enumerator and that was one of the things that we were initially looking at. So what did I do here? What did we do with the research? We had to get special permission from network solutions in ORG to get all the top level domains for COM, NET and ORG and we wanted to find the number of SRV enabled. So we collected this data here about five gig, 292 million domains and so we had to do some benchmarking to figure this out. Once enumerator was coded, we basically split up, we decided to split this up into 11 different servers and then we benchmarked this to basically split enumerator into 800 separate processes and to parse a single large log file into 800 chunks and so each of the 800 enumerator processes would basically do its workload in parallel on the host. And so we benchmarked this at 140 domain queries per second was the fastest we could get this and four SRV queries per domain and I'm going to tell you what those queries are. It's those queries right there. This is the most standard way to host an SRV record. The last one is Microsoft specific for federation. So here's the results. 3.30% of domains on the public internet, COM, NET and ORG support SRV. So it was 8.7 million domains and those are the states. That's the what it looks like there. So enumerator in action, let's take a look at just a couple of screenshots here because we have a domain, the DNS SRV look up for a single domain and it returned the records there, the targets. And then when we can do the input domain list right there and the MX records as well and here's what it looks like for the input list. So if you have a large file, it'll just start querying through and that's what it looks like until it gets to the end at 100% and then it displays all the statistics. So here's what the enum support looks like. Minus E minus R, you can look up a range of numbers. So we didn't get to the point where we were going to scan. We were looking at all the North American numbers or all the numbers in the UK. So here's a single number. So this is what the enum looks like. It looks up the number and it finds it of that SIP URI right there, enum-test at sip.nemox.net. So here's another view of doing a range of addresses and you know it calculates some statistics at the end of its little enum scan. So I've already released this like I said and the tool, you can go into SRV.C and these are the lines right here. If you want to modify the code and add your own SRV look ups enumerator can measure the usage of UC federation services or SIP enable DNS on the public internet. So we're giving this away as a research tool and as we do more, find more SRV record types we can add this into enumerator. So now we're taking a transition into UC federation. Naturally as our research we were looking at public SIP DNS SRV peering we started hearing about this term UC federation. What is it? It basically allows business to business communication and collaboration the same way between organizations that you do it within your organization. So HD voice and video between different domains, collaboration tools like white boarding, desktop, application sharing between companies. It's the next killer app with UC that everyone's talking about. You can go out and google UC federation and this is what we started looking at and this is the next thing we're going to talk about. It does promise many business benefits and so we looked at two vendors initially. We looked at Cisco and Microsoft. I love Cisco. We have friends in the room here with Cisco. The Cisco solution uses the PSTN initially to do the federation connection and it builds like a hash of the two users and then after that they can use TCPIP. We wanted to focus more on for a couple reasons on the Microsoft because we like the way Microsoft does the UC federation. So surprise, Microsoft is the surprise vendor that we ended up doing research on and it looks like their solution is really taking off so we're really interested in it. What's going on here in the industry? If you look at this guy here, Matt Landis, he's published a public federation directory and so what they're doing, they want to create education and awareness around with other link users, with other Microsoft UC users to let other people know who's doing federation. So he published this directory and we actually with Carl and Bill and myself, we set up our own like Microsoft UC Honeypot. We built our own installation of Microsoft link which is the solution we're going to talk about. We published our, we got a root CA domain, we purchased a domain and we published ourselves into this directory. We tried putting ourselves into this directory but this guy wouldn't allow it. So he didn't publish us into the directory because we wanted to study and see like what would happen. Now this is really interesting because you can download his spreadsheet and you can go download it and you can see the top three countries are Canada, USA, and Norway and with 9,700 domains. So this directory is a second directory that we found. It's linkdirectory.com. It's a public directory. You can go look at that. We're able to add our test UC federation deployment in this directory. They granted us into this. I think we had something to do with the certificate that we initially had. We went out and purchased a real certificate and we advertised ourselves the right way. So we went back, we'd probably get into that other directory. But it is really interesting because there's more and more awareness about this federation. You can go out and look this up and companies are trying to communicate to each other using this peering, using DNS SRV. It's opening up a lot of business opportunities but it also introduces risk in the environment because you have the balance between security and usability. I'm going to hand this over to Bill. He's going to talk a little bit about the specifics of the Microsoft solution. This is a really high level overview of how link architecture looks. You have edge servers and that's how people connect through the public internet. And behind that you have the link front end servers for internal users. The front end servers really just negotiate authentication for the back end. And it still works the same way with DNS SRV lookups. So Gilgamesh can call, I didn't write these names, these are kind of ridiculous. Gilgamesh can call Marco Relius at his organization. And just like he said before, he just looks up the record and then the IP address for the other link company using link comes up and then they can talk. But what's different is there's a TLS tunnel between the two edge servers and it's pretty secure. The way they set it up, if you want to add anything to that. You have to go out, you have to buy a real certificate. When they negotiate a TLS handshake, if you have a certificate that doesn't match your domain, the connection gets rejected. We did a lot of research on this. We did a four week long security assessment for a customer that had this solution. So we were testing in our lab and we were actually testing against the customer. So we found all this stuff about the way this works. And also if you talk about the white listing, two edge services, they have public IP addresses and you can look them up with DNS SRV so you can find any one of these companies using this. And so these ports are open on the internet so this is an exposure point and it introduces risk where in the future you're hacking web servers and email servers. You can hack UC servers now on the public internet. So there are different types of federation. There's dynamic which just uses SRV discovery and that means anybody can connect to your infrastructure if they have a valid domain and a CA. They can connect and send your, they can enumerate users, they can send anybody messages which can be obviously dangerous. The next level would be the black list which you just put in there, a black list of servers that you don't want to be able to contact your federation. And then the best way to do it is a white list that has a list that just has trusted partners that you want to federate with. We started working with the dynamic setup because it's the easiest to attack. So that's what this shows here. So my co-worker Carl, he worked in C-Sharp to develop this code to make a custom link client so we could send our own messages through. And he worked for a few weeks on this and he used the official Microsoft documentation, but almost everything in the documentation was wrong. Yeah, everything from how they did NTLM authentication to everything. And he just used the logging engine on the link server and just kept sending messages and sending messages and he finally got it working. And we started sending and we looked and it just sends HTML over a special SIP message packet and that's how you do IM and we started looking into it and it looked like we could get something done, some people release something before we got a chance to get that deep into it, but the safe HTML issue that was Microsoft made a patch for just recently. We were getting right there, but we had to leave and we didn't really get much done, but it was a long process getting this working. And here's what this code is. This is actually how you send a message.  So, he made two tools out of working with this and one is called Link Spoof and the other is Federator. Link Spoof allows you to just act as a legitimate link client and send messages, but you can modify the messages and you can modify the fields, which can be pretty handy in this field. And Federator acts as a federated link client and you can connect to someone's federated infrastructure and do things like enumerate users or send high rates of messages to lock up link clients. So, we'll show you a couple videos here of both these tools going. Okay, video one first. So this is the Federator tool. I'm going to start it right now. Okay, so I don't know if you guys can see this, but you enter your local domain, it has to be a real domain, and then the domain name is the link server and he's opening up a word list for users. So, this is a user enumeration attack. So, on the internet you can use this tool when SRV discovery and you can basically enumerate all the target users in Active Directory on a UC hosted customer. So, open the file and this is going to send SIP invites and the differential response from the invite packets will tell you if a user exists or not. And this can be kind of damaging because as I said before, these are used in TLM authentication so these are likely domain accounts. So, from if you have open federation someone can just enumerate a list of user names. And if they use the other part of the link client then they can do a word list attack against the authenticators on those user names that were discovered. Yeah, so that federator was for when dynamic SRV discovery is enabled, that federation type. And anyone can do this in attacker. So, there's a, while it's good for like discovery, it's not so good for security. Here's video two. This is federator again. This is just a different attack. Yeah. So, he's doing an IM message. He's basically doing a spoofed IM message. So, you see that everything that's sent over is just in div boxes and they have, you have the ability of controlling the style inside the div. So, you can do things, you can still do things like CSS expressions and whatnot. So, here's sending just an href. And so, this could be kind of damaging if you make a domain that sort of looks similar to a trusted domain and send someone a link, click it. It's just a social vector really. Yeah. So, it's like a targeted VoIP spear phishing attack is what it is. When you have SRV dynamic enabled, you could federate to that. You do a malicious federation connection. You can put a fake link and the link client on the customer end doesn't sanitize the HTML. So, if you, so you could actually trick them into clicking on a link that could be like a spear phishing attack. Correct? All right. That's exactly it. Video 3. This is the link spoof where he, Carl did basically a malicious link connection and he basically reverses near the NT Landman authentication. So, this is the code. There's no real interface for this. And right now he's doing a flooding attack by sending a high rate of sip messages. And over here, you can see that the client is just locked up because by default and we asked Microsoft about this and they said that there are ways to sort of prevent this, but there's no real way to do it. You actually have to write code on the link server to make it rate limit the messages, but the UI of the link client is just completely hosed. Completely crashed. You can't, you have to go to the process manager and kill the process because it's done for it. So, that's a real vulnerability with a malicious link client and what it is is you have to be authenticated user. So, you're one, you have to have someone's credentials. You connect as that user, but that user can target all the other users and do a targeted DOS via the attack you just saw. That is a real vulnerability. And so, Microsoft, you know, their response was you, well, you can create a filter on the server to rate limit the traffic and that was basically their response is you can do security best practice, but by default, that is not enabled on the server. So, every link deployment is vulnerable to that issue. Yeah, and it's also not just an option. You have to write your filter and install it on the link server. Okay, let's get back to the slides. Thank you, Bill. So, we're doing good. So, here's what we're looking at on the SRV discovery stuff that I told you about with that enumerator tool. We kind of looked at what's really cool about, I really like this Microsoft link client. This is what it looks like. You have automatic configuration or you have manual configuration. This is the UI. With manual configuration, I can put in my different SIP servers if I want a different one, my internal versus external. And then automatic uses DNS SRV. So, basically link is like hard coded to look up certain SRV records, right? When you use your email client, normally you have to like put in the actual, you know, pop or mail or whatever. But what's interesting is you can kind of take advantage of this from a DNS attack surface for any customer. And so the enumerator tool could actually look at all the domains that support the Microsoft version of SRV discovery. See like SIP internal TLS and .domain.com. So, I haven't added support yet for enumerator for this, but we could actually have a special project where we could scan all the domains just for Microsoft enabled U.C. Federation. These are the two special records. And then this is another one that shows for like the Office 65, the hosted version of Federation, which you can do with link. That's the, these are some of the records. So, you could create like a tool that scan for like the CNAME records that resolves to Microsoft's online service. This is like their online hosted U.C. Federation in the cloud for link. So, we didn't touch this stuff, right? I mean we're not going to do any type of research or attacks against Microsoft's public web service, but you know you have that Office 65, that hosted U.C. solution. These are the actual servers that they use for this, for hosted customers, right? So, people need to start thinking about this, because as U.C. Federation takes off, all these customers, you know, for a recon perspective, they have to be locked down because these domains are like wide open as far as finding certain domains to attack and companies to attack. So, it's always the balance between discovery versus privacy. While it's easier to, when you turn on this Federation, it's easy to be discovered, but it's also easier to get attacked. Now, let's look at U.C. Federation technically. You know, we do have this Cisco way of doing it, but from a Microsoft U.C. Federation perspective, what it means is SIP signaling and control plane, SIP for signaling, RTP for apps requiring real-time communication, and then DNS SRV for service discovery. So, in the future you could have new records that you create to use for new U.C. communications and applications. Microsoft appears to be the market leader in this U.C. Federation. They have a strong default security with SIP TLS and SRTP. In our research, it was very difficult to peek into the encrypted SIP TLS messages, because the first thing we want to do is we wanted to we wanted to actually, you know, look at the SIP messages and we couldn't see them. So, Carl, you know, reverse engineered this, just using the link server logging tool on his own, but after the fact we started saying, well, we should be able to decrypt this. And so we started looking into this and we like to understand, we want to see these messages. So we wrote a SIP TLS proxy tool and we're able to peek into the messages. And so we're releasing this to the community. We're releasing this to the community objective one. Thank you. Objective one was decrypt the SIP TLS message flow and learn how it works. That's complete. That's up on the numerator source forge website. You can go to numerator.sourceforge.net. Now we want to have a fuzzing engine is what we're working on where we can freeze the message, modifying it using a UI, re-sign it and send it to the server and see what type of fun stuff we can get into. So here's a screenshot from the Python. This is kind of what it looks like. That's the actual Python script right there, threadpy. And message me if you'd like to know details on how it works. It's not too complicated at all. But what you have to do with your Microsoft link client is you have to trick it into connecting to your proxy instead of the legitimate server. And how you do that is you modify your Etsy host record on your Microsoft windows and whatever the automatic discovery is set to, the SIP server, you just change it to be your proxy server and then save it and it'll automatically connect to your proxy server. And that's what it looks like when it's gotten a 200 okay and authenticated. That's compressed data in the SIP message. So we need to figure out also how we can read some of that compressed data. So here's what the I kind of explain how it works. The proxy decrypser traffic, we can inspect the traffic in clear text and then it negotiates a TLS handshake to the remote server, the legitimate server, and it encapsulates that in TLS. It uses the Python TLS module. I had the idea to do this. I worked on the networking code. I got the initial connection working. Then I had to go to Paris to do this pen test for four weeks. And so there was another engineer in Viper that finished this. So we're going to give him a big thanks for finishing this code. But here's the first message. It's basically a negotiate and it's negotiating the compression of LZZ7 8K. It's the only value that can be used. And so we can play with actually turning off that negotiation or that compression algorithm so that we can actually see the message once we get the 200 okay. So the Microsoft Edge server inspects the compression header, matches it, and then responds with 200 okay that it will support the compression. Then the third message out of the eight is the first register message sent by the link client. And so this is always a part of the application flow. So this is NT Landman authentication in SIP. So if you're familiar with NT Landman with HTTP, this is the same thing in SIP. You see the WW Authenticate headers. It supports TLS DSK and NT Landman. The TLS DSK is like a certificate that gets stored on the client. And it's actually really, really interesting. We encountered that on the pen test. And then that 401. So then the link client sends a second register with the authorization header in NT Landman. So that is the authorization. I see it there. Somewhere there. Yeah. There it is. Authorization in NT Landman. Then the server responds with 401 unauthorized with actually the challenge with the GSAPI data. And you see it there in the WW Authenticate NT Landman there and the data right there. So then the client, the link client just uses that data to create the proxy authorization header with NT Landman. And the data section there is actually a Base64 encoded NTLM packet. Cool. So then we get the message number eight, the 200 OK. And there we go. We've seen the whole flow. It's pretty cool. We get the 200 OK at the top. You can see SIP 200 OK. Message from the read from the server and sending to client. And then the rest of that is the compressed data. So we can play around with turning off the compression so that we can see the SIP message and then we can eventually start doing some fuzzing attacks. And this is a work in progress. This is the first phase. I'm excited to show this to you guys because I think that we're the first ones that are really looking into this and trying to give away this research to the community. So hopefully other people can pick this up. Everyone can start looking at this because it's pretty cool and exciting. I think this is going to change the way we communicate. Many thanks to Anil Mahali. So Anil is the Viper Researcher that finished this code. And this is our goal of building education awareness. And it's on enumerator.sourceforge.net. No. That is not an ad for OKCupid. That actually is a ViperLab Researcher. It's not eHarmony either. It's speaking of thanks. I also wanted to thank Carl. Carl's an awesome dude. He couldn't make it here like I said. He's a Windows developer and he actually picked up Linux really fast as well. He reverse engineered the SIP messaging of Link. He authored Link Spoof and Federator. The guy is somewhat of a mystery. I can't tell you a lot about him other than he's a pretty smart guy. But we were able to capture a secret picture of him. And here he is. That actually looks like one of his shirts. So perfect timing, man. Two minutes ahead of time. So you take it over. Alright. So as many of you know, there's a panel discussion every year about how DefCon groups can stay in touch. I think this would be a good way to do this using open source, UC Federation, using asterisk, and mobile phone applications. I was pretty surprised when I came here and saw these Ninja tell guys who pretty much did this, but just for DefCon. What the benefit of it is, it's out of band, so you control the end points, you control the media, and it goes over the internet, but I mean what doesn't go over the internet. So it can be used for audio, video, and instant messaging, and you can save money by instead of using your cell phone minutes to call out of country numbers. It just goes over the internet instead. And all the software is open source. Asterisk is a little buggy sometimes, but it's free. This is kind of the architecture. It's similar to Link, only you don't have the front end and back end servers. So you would have a guy in America called a guy in Amsterdam. It would just look up SRV record and place the call. The media would be anchored between the servers and you could have soft phones or hard phones or just soft phones on a cell phone. And it would just use your data plan. You can enable SIP TLS and SRTP for privacy, and then you have a whole kind of dark net group of voice communications that's out of the side of the realm of the PSTN. So it could be pretty useful to people. Asterisk Federation works pretty much the same way as the Link Federation. Again, it's not as complex though. You just put in the config to enable SRV lookups and when you're on your network you call somebody on another network, you just use the SIP URI like their name at domain.com and the server figures out the address of the other server and negotiates the call. There's no need for the PSTN. The SIP Trunks do all the work and that means no long distance fees, no international calling fees. So it's good. We have an open source federation project. We have them running on line nodes so we can bring them up or down in an IP range of any country we want at any time. And we set up fake companies with websites and they all have SIP servers tied to them, email servers and all. I'm not going to tell you what they are because we don't want people attacking them. This is part of our research and we can call one another using our cell phones and it works very well and I think it would be a good way for people here to stay in touch with one another. If you want to check out our configuration files you can go to the same SourceForge website we showed you before for the enumerator tool and we have some redacted copies of our federated asterisk configs. I'll take over here, thanks Bill. So as Bill said we wanted to basically look, we started taking our smart phones on iPhone and Android and we registered them using a SIP user agent on our phones, our smart phones to our line nodes, to our UC federation, our SIP servers.  We had really good quality of service on Wi-Fi or 3G, 4G actually. We could do calls all the time and we were using it to communicate with each other and anyone can do this right now. You can go out and do this right now and this is what we're tying in here on this conclusion. Let's take a look at this. A lot of people, Asterisk is a popular vendor, it's an open source IPPBX and that's the way it's advertised. But in reality we kind of changed this when we started looking at our research. If you move the PBX on your Asterisk server from the internal network, which is what a lot of companies do because they use it for voicemail and get all the advantages of UC, if you take that Asterisk server and put a public IP address and move it on the edge of your network to move it outside your network, it can do something what's called RTP media anchoring. So what it becomes is it becomes a B2B UA, a back to back user agent. So all your Asterisk user agents register to Asterisk. Asterisk will terminate the connection with the media and re-initiate to a remote peer, another Asterisk server. So it's what's called a poor man's SBC. It's a back to back user agent. So since we're vendor agnostic, Viper, we're only talking about open source solutions for this SBC. There are other solutions out there. But that's the way this works. And so Asterisk could function for your organization for $20 a month. You could use a line node and you could host your own VoIP for your organization, exactly like what we did. You can have all your desktop phones be SIP on your internal network, register to your SBC, and you can peer with other companies. You can also use your smartphone using DNS SRV to register to your SIP server and place calls to other people on their smartphones. Why aren't more people doing this? You can all use it with DNS. It's the way it was meant to be, right? So peer directly to other organizations. There's huge cost savings here, right? You don't have to pay your carrier. You don't connect to the PSTN. And now another thing here, you can still connect to the PSTN while you do this, right? So for the people that you want to talk to, DNS, you use your email address, you peer to them, you still keep your SIP tron connection. So you still connect to the PSTN.  Whenever you want to communicate with everyone else, you use the DNS. So you can, it doesn't go away, it doesn't have to go away. One more thing, this is pretty cool, linode.com, we found these guys. Gotcha. So create your own UC Federation and SIP DNS SRV peering service. We're giving this idea away to you guys.  Go out and start playing around with linode.com and asterisk. Create your own new product or service. Create a hosted DNS SRV service in the UC cloud. See, more and more people can do this UC cloud service and then there could be peering out on the internet here and all we have to really handle is this IPQS problem. So carriers, the existing telcos, I mean I have a network engineering background. The telcos, you know, I mean there's a lot of incumbents, there's a lot of companies that will be threatened by the status quo with this business model, but you know I believe everyone can adapt to this. It's just that you'll be buying IPQS. The carriers in the future, mobile carriers or wired networks will become, will start selling IPQS networks. So they'll start selling IPQS for Federation, for SIP DNS to make sure that there's acceptable quality of service for video and VoIP and any data collaboration tools. And if you look at this, if you really look at this with the mobile carriers and the smartphones that's where this is really interesting too because with my smartphone, you know, we started calling all the carriers and we kind of researched this a little bit everyone in the US, it appears that you can't buy a date only plan on a smartphone. On a tablet you can, but not on your smartphone. Why is this? I was talking to some people and some insiders and I almost got the answer on this. I'm really curious, I mean to me it's some kind of regulatory issue, it's an issue that's hidden that we don't know about, but you know if I have to pay for voice, I mean that's why no one really wants to, there's no driver or incentive to go out and get VoIP on my smartphone unless I'm traveling internationally and use Skype, there's no incentive because I'm already paying for voice in the US. If I already have to pay my carrier for voice minutes in the US, why am I going to even be compelled to like set up a SIP user agent, you know, CounterPath Bria on my smartphone? There's less incentive unless they start unlocking this so we can buy data only plans on our phone. Then we can use VoIP as an app like we use everything else and then we can have presence. I see two killer apps right now for this. I see voice with DNS SRV and I see presence on smartphones. Video is probably, you're probably not going to use video as much on your smartphone. Data collaboration is not going to work as well on tablets like on the iPad. Data collaboration is really cool, right? But just voice and presence will be really cool between organizations for free, hosted by your organization.  That's the way I think this stuff is meant to be. So we're giving away these ideas. Again IPQS for real time communications, GSM on cell networks. That's where you're going to run into problems and you know the carriers, they dominate the network so they can, if they figure out you're running VoIP, I'm not sure how that works. I'm not an expert in that area. But there's been rumblings of this. There was an article just a few weeks ago, AT&T hints of data only wireless plans on smartphones. So this stuff is about to happen. I mean there's a lot of disruptive things that are about to happen in this area and we live in a very exciting time. No matter what, even if I'm not right, like this stuff is about to happen, it is very interesting and this stuff is really changing right now. I don't know if you guys have heard of this Project Fish Goal. This is freaking cool stuff. All the stuff we're talking about, the NSA did a secure mobility package and basically is what we're talking about within one company using security. So they had two layers of security. There's IPsec, IPsec Android built into the SIP user agent on smartphones and then there's SIP TLS SRTP. So they're creating a whole architecture recommendation. But how can we do this with security between companies is what combined this with between companies, and this is exactly what Bill mentioned, the ninja telephone that he got, they have their own cell tower and they're kind of doing that security within the organization with their own cell tower. Last thing, last point here, WebRTC could be completely disrupted to this. HTML5 and JavaScript natively and Web browsers, take a look at WebRTC, this stuff could disrupt all of the SIP stuff. And then last, I don't know if you guys have heard of Metcalf's Law, but that's what I'm really talking to you guys about today. Metcalf's Law says the more people using a telecom network, the more valuable it becomes. Since everyone's using the PSTN, it gives a lot of power over VoIP. If you started using VoIP, the more it becomes, more people on it with DNS SRTP becomes more valuable to everyone. And that's the end of our talk. And I thank you for coming. You can reach out to Bill and I, Carl as well. A copy of this presentation is on the SourceForge site.


And it's proved by the vegan, it's the only product that's proved by the vegan and vegetarian societies in the UK. So we can launch this over-the-counter, this product from the UK, as well. And just some of the research, I mean there's a lot of preliminary research and more research to come, but it's something that demonstrates some of the CBD oils effectiveness. But the hand plant is high in CBD and low in THC, and I'll just talk a little bit about the differences between what full spectrum is, broad spectrum is, CBD isolate for your knowledge. As I mentioned, our goal is towards zero waste, and these are some of the animal pet innovations that we can come out with in terms of using our by-products, in terms of giving them raw materials into by-products, and we can continue to work on these type of innovations as well. So what we need to do is we need to educate consumers in trade, we need to do more research, we need to consolidate our efforts, we need to maximize awareness. I'm working with Health Canada, Agriculture and Agriculture Canada, even the dieticians in Canada, organizations and the industry, CHT. Rich, let's find out what GCHD does. Any of their products look good, Rich? This is GCHD. I'm not going to need any of him or company. Are you guys a public couple? GCHD. Yeah, familiar. Any of your products look good? Oh, sorry, no, we're not strange. We're not strange, probably. Okay, great. Hi. Cool. Can you show us some of your products? Are you guys looking to maybe go public for a day? Or be acquired by all of you? Because I work with a lot of licensed LPS. We're looking for private companies like yours. You guys have some contact information, but maybe I can put a license on it. My name is Rich. I'm Rich G. I'm a local and I'm a writer for that. I'm a website and I'm a business owner. Awesome. And you guys are looking to be a public couple? Uh, I'm sure we are. We're actually a public couple. Oh, thank you. That's awesome. I wish you guys a best of luck. Have an amazing day. Thank you most. Let's check out some custom glass. I made everything here. These are all collaboration pieces. So it's my art mixed with another art. This is some of my production items over here. So you're all above glass? All above glass, man. Ooh, that's a nice one. There we go. And where are you guys located? Quadra Island. Who's your customer base? Customer base. Those people that are into Canadian glass over imported glass. I'm trying to show that there's another option besides imported glass. All this is made in Canada. There's a whole bunch of Canadian glass artists that I've worked with over the years. It's nice. It's beautiful. It's hard. Yeah, totally. This one's really cool. This one's actually cool here. This is the space. This is Elon Musk's Space X with the Falcon Heavy. There's Elon Musk's Space X. The Falcon Heavy is taking its new payload of the banana man, the giblock, up to space. Wow, there's a whole story there. This is actually a competition piece that I made for an online competition. Really nice. It was a 24-hour build. So I started at midnight. I prepped for two hours. I went to sleep. I came back in the next morning and I worked until like midnight kind of thing. Wow. The buzzer goes off and I answered it into the competition. For you, how did you do the competition? I forget how well I did on that one. I didn't win it, but it was eight of us and I didn't come last. So I think that one was like fifth or something. That's a cool one. Well, we have a YouTube channel called Rich TV Live. Cool. We kind of specialize on cannabis stocks. So we're here today as part of the media to just create more exposure for all you guys. So if you go to Rich TV Live, you'll see yourself on our channel. We? Thanks kindly, my man. Cheers. Best of luck, man. We also work with a lot of licensed LPs. So if there's anyone looking for a boss or whatever, we'll contact you. Send them my way. Thank you. Cheers. Hey, thank you. Thank you. Green Rush Packaging. Talk to these guys about packaging. I'm doing very well. How are you? We have a YouTube channel called Rich TV Live. Yeah, we got about 18,000 subscribers. We're part of the media today. We specialize in cannabis stocks. One of the companies that we look at a lot is called Push Bottles. They're heavily into packaging in America. But we also, myself and my partner, we work with a lot of companies that do co-packaging as well for licensed producers. And for private companies. So I see here you guys do packaging. So what is your situation?   You're a packaging company that's now changed to a supply goal, which is kind of cool. We're similar to that. We're a privately owned company. What we do is we do packaging supply. So we do not only do co-packaging, but we'll get you everything from the Canadian market. That is 100% up-to-car. All of your CR tests. All of your ACR needs everything. So you can get anything you need from us, child lock, non-child lock, grip and fold apps. We can do all of this. Very good. And you guys are not public? No, we are a privately held company in California and Toronto. Okay. And would you guys be interested in going public one day? Probably not at this point right now. Things, I mean, are going quite well. You know, we like to be good at selling things, but first of all, I'd like to be good at that. I've taken over 5,000 tests a lot. I've taken, yeah, just kind of an interesting test, built cap in Toronto. I've seen a couple of guys up there who are kind of with us. Nice. Yeah, one of the companies actually is going to post that. I guess. Yeah. Are you guys from the right sector? If we ever wanted to contact with you guys, if there's anyone interested in any packaging, would we just reach you through here? Absolutely. Perfect. Well, you've seen the last lot. Thank you for the good work. Don't worry. Stealth box. Check out what these guys do. Got some plants growing in here and some health box. There's thinking really low and you're going to hear them. We can't really record them. No, I know. So don't waste your time. Just don't waste those. Don't waste the film. Yeah, never know. Right with that rate. Well, I think we're going to be hours and hours of editing, right? So you've got to chop the videos up. You can't make it really long. You've got to...