What's up everybody jason for jazby's case breaks calm 2020 panini national treasures football just sold out This is a two box half case break around on teams number seven and again number seven and eight are from the same case 32 total spots everybody gets around team in the NFL. We did have to do two fillers guys mosaic 49 and 50 So from Matt L all the way down to Demetrius got those spots straight up and then Christopher from mosaic 49 All the way down to Tom got those from mosaic 50 Let's go guys. Good luck. And here's the teams. Let's roll the dice and it's a one-to-six seven times. Good luck one two three four five six and seven seven times Demetrius down to Matt seven times one two three four five six and seven Dallas Cowboys down to the Miami Dolphins So Demetrius you have the Cowboys Matt L with the Buffalo Bills ran with the Giants Matthew with the Los Angeles Chargers PJ with the Jaguars Matt with the Packers John with the Seahawks Matthew with the Jets Jonathan with the Panthers Terry with my Eagles Ryan with the Patriots Boondi with the Lions Matthew with the Vikings Matt L with the Rams Mike Tower with the Colts Patrick with the Falcons Robert Flores with the Saints Christopher Freese with the Ravens as well as the Bucks Matthew with the Steelers PJ with the Titans Robert Flores with the Chiefs Matthew with the Washington football team PJ with the Broncos Demetrius with the 49ers Texans David with the Raiders Mark with the Bears PJ with the Browns Demetrius with the Cardinals Tom with the Bengals and Matt with the Miami Dolphins So if anybody wants to trade I'll give you guys a quick minute If not stick to what you got and then we'll start I'll post up another one right now too guys While we're actually trying to trade And uh If you guys want to fill it up we can fill it up So I'll keep it 14 spots and three fillers, but again if we can sell out The fillers pretty quickly or the spots pretty quickly then We only have to do two fillers again. All right, man. I'm assuming no one's a trade, but let's give you that Raider mojo, man Try to trade couldn't trade mojo All right. Good luck everybody almost All right guys left or right one two three four five six Well, no this is six though. It was a six one two three four five six Here we go. Good luck guys Oh thick one. Give you a big booklet. All right. We have a blockchain And it is a rookie patch autographs midnight of Antonio Gibson. Very nice for the Washington football team Washington football team That's gonna go to matthews midnight's out of 20 and uh Live, I don't know what they are for blockchain All right, we got erin jones to 50 And patty mahomes to 99 All right. Green Bay Packers to matt chiefs. That is rower floris All right. We got cooper cup to 99 and Jaylin regger and brandon iuk dual patches to 99 That should be a randomizer there between the 49ers demetrius and terry with the eagles Let's put that right over there This should go straight to the round straight up Matt with that one We have a sunday treasurer's 19 out of 25 toller boyd for the bangles Toller boyd for the bangles A little dirty white patch right there Bangles that is going to tom Oh, you got a treasure chest 31 out of 49 treasure chest Wow, it's like the same one I got last time This is gonna be a randomizer. All right Tom brady paid manning big ben rothisburg court warner joe montana brett farve terry bratchel john alway These are all super bowl winning quarterbacks Patty mohomes roger starback troi akeman lendawson Russell wilson drew breeze joe nameth bob greecey Aaron rogers steve young phil sims nick foals Jim plunkett joe thysman joe flack one jim mcman I pulled a similar one like this Maybe about a month or two ago Very very nice 31 out of 49. So there might be multiple teams With one or more teams in here. So like Aaron rogers and like So our brett farver is in here So you have two packers in there. So some teams will have more more than one in this treasure chest But that'll be randomized to everybody That is part of this list right here There you go. Super Bowl winning quarterback right here Very very nice. Let's put that over here to the side. That'll also be randomized We have a marlin davidson tonight Or no, yeah, yeah tonighty. That's weird. Should be 99 That is atlanta falcons going to to meet you or sorry patrick We have an aj dillon little nfo gear to 99 greenbay packer is going to matt l Heinz ward did not expect that three out of 10 little patch autograph Steelers Matthew with the steel is matthew shearer. The last one here is a redemption And it is rookie material signatures rps card number 19 la visca chanalt jr That is Jacksonville jaguars pj. Yeah, you were wrong rex Next time next time Derek henry to 25 and patty mahomes throwing left-handed. Look at that. That is tonighty nine We got denzel mince tonighty nine chris carter patch to 25 21 out of 25 from the mistletoe vikings went to matthew Another one for the vikings back to back. Uh, that's 81 out of 99 You have a joke for me. I don't know 17 out of 25 three color patch or double three color patches limbutton jr for the dolphins Hit me with another one We have isa right 1099 Washington football team Whoa I was not expecting that how about a dual autograph joshua kelly and justin herbert For the chargers that's going to matthew shearer I was not expecting that One out of 10 There we go There you go herbie and joshua kelly dual autograph We got two left How about a rookie signatures field pass gold gold? Clyde edwards aller card number 11 That is robber floras and the chiefs. I don't know what the gold's gonna be out of someone look that up really quick And last one here is a jersey number short print rpa four color patch 10 out of 27 jk dobbins for the ravens Christopher freeze. There you go, man. That is a beautiful rpa And I love that their jersey number short printed to 10 out of 27 very very nice rpa And there you go guys that was nt football so That joshua jk dobbins clatter was aller jesson herbert and joshua kelly dual autograph And we also got this treasure chest It's my second one of these all super but winning quarterbacks peep nick foals. That's right And There you go So if you have a team in this booklet, you will have a shot at this Lewis gushanel that hinds ward patch autograph was pretty nice aj dillon as well sweet hit Sorry about there brother, but you did get the herbert rpa in the last break So it'll make up for a couple of hitless ones.  All right guys Let's switch scenes So the first one was tom brady. So i'm just going to go by teams. All right I'm not going to type in names because it could be confusing So tom brady was the first one. So that'll be bucks We have colts for paint manning We have big ben rothasberger stealers We have kurt warner rams We have joe montana 49ers We have breath farf packers We have terry bratchel stealers Uh john elway broncos We have patrick mohomes chiefs We have roger stopback cowboys And then i think back-to-back cowboys with troy ekman We have len dawson chiefs We have russell wilson seahawks And then on the back side of this We have drew breeze for the saints We have joma joe nameth for the jets We have bob greasy for the dolphins We have erin rogers for the packers We have steve young for the 49ers We have phil sims for the giants And nick foals for my eagles That's right Jim plunkett for the raiders We have joe dyesman for the washington football team We have joe flacco for the ravens Jim mcman for the bears So that should uh equal i think it was like 26 on this booklet i think Make sure really quick 24 So one two three four five six seven eight nine ten eleven twelve thirteen fourteen sixteen seven eighteen twenty two one two three twenty four There we go Good luck everybody. I know there's gonna be a lot of sad people But one is gonna have to win this booklet Roll it Four and a six for ten times. Good luck Team number one gets the treasure chest one two three four five six seven eight nine And tenth and final time Saints at the top Wow Drew Brees wins that battle after ten times Saints who has the saints in that one robert floris with the new orlan saints. There you go So congratulations, man. You just won that treasure chest. Appreciate it guys. This was nt football I already put up the next half on the website Uh 14 left plus a couple fillers jasby's case breaks.com


Yeah, so with no further ado, I'll give you your speakers. Hello everybody, thank you for coming at our session. I'm Masahar Paket-Lustin, this is Olivier Bilodeau, we're both from GoSecure Research in Montreal, and we're gonna talk about behind the scenes the industry of social media manipulation driven by malware. We have a lot of content, so we're just gonna dive right away into it. So, this is a four year long investigation, and it started in 2015. At that time, Olivier was working at ESET with Thomas Dupuis, and they were both working on malware called Linux Moose that was using infected devices to proxy traffic and go to social media sites. Then I came in, he switched jobs to GoSecure, and I came in as an intern, and we were looking for a research project to do all together. And that is when ESET shared to us a second version of the malware, Linux Moose, and we partnered up with my prof at that time at the university, prof Descarietsu, the university of Montreal, and my tax, which is a non-profit organization in Canada focused on research. And we decided to study that second version of Linux Moose. First, you must be wondering what Linux Moose mean, right? Like why are we calling this buttonette this way? Well, when Olivier was studying that buttonette in 2015, they found in the binaries the string Elan, and Elan is Moose in French. And since we're Canadians, they wanted it to give that buttonette a Canadian touch, although probably these guys are not Canadian, or we don't know. And that is why they called it Linux because it's targeting Linux embedded systems and Moose for the string. Linux Moose is an IoT buttonette that conducts social media manipulation. What is social media manipulation? Where basically it's just the process of creating fake accounts online and then using them to go and like and follow other people. We have a good story of an example of social media manipulation that was done by a journalist in Quebec called Émilie Bilodeau. So she decided for her investigation to become an influencer by cheating. So what she did is she created that fake account called The Pretty Runner and started to take pictures of herself running. And then she used various techniques to increase her following online. And we met with her after she published and she told us what she did. So she did follow and follow like for like. She also joined pods of influencers that like each other to give themselves more visibility. And she said that she had to bought fake followers to give her some sort of a base of visibility. So once you have like 10,000 followers and you're more credible, and then afterwards you start and you try these different techniques I just mentioned. Today what we're gonna focus is on this technique buying fake likes and follows. So it's the process of creating follows and then selling them so influencers can get popular with fake visibility. So this presentation basically is based on, it aims at sort of mapping the ecosystem of social media manipulation. It's a four year long investigation that started in 2015. It uses various investigative techniques. So we did traffic analysis, reverse engineering. We also went on forums, some sort of to understand what was going on with these actors and what they were talking about. And we sort of create that map of all the actors that are involved. And the ground basis is Linux Moos, which is what Olivier is gonna start with. Yeah, so again, like Linux Moos has been something we talked about for a while, but it's IoT button it. Now let's map it into our ecosystem. So it fits right in the ground, you know, far away from social media because it's only proxying traffic to them. You'll see that map evolved as our talk goes on. So basically, Linux Moos, we say, routers and internet of things. What we mean by that is embedded Linux systems with a busy box user land. So it's a subset of IoT, but it's still clearly a big subset of it. It has a worm-like behavior, so it spreads through telnet credentialed brute forcing. And it's main payload, or the reason why it does social media manipulation, it's offering a proxy service, which means that it leverages the reputable IP of people who are infected. So ISP IPs are more credible to Instagram or social network than data center or enterprise IP space. So the proxy is a good way for the malware operators to kind of separate themselves from the intent is not clear in the malware itself because it's only a proxy service. You need to detonate the malware and look at what it's doing to get an understanding of what the bad guys are after classic malware technique or deception. In order to catch it, and I'm gonna really go quickly through this because we have a lot of content, but we deployed custom honeypots. They were basically like one side, an ARM virtual machine where we could detonate or run the real malware.  So we kind of did both so that if the operator scanned us, he would think that this is a legit infected device. We deployed them all over the world and it yielded nothing. It cost me money and it was time consuming because it didn't change anything. We did this an HTTPS man in the middle because all that traffic was HTTPS. And so we redirected the flows to a MITM proxy project which is an amazing project for that kind of work because they do good raw logs of the HTTP traffic once you break the HTTPS. And what this slide is about, we didn't break or invent a new technique to break HTTPS. The thing is, we anticipated or expected that they would ignore certificate errors which they did. So we were kind of glad about it. And so at that point we had the raw traffic. We're really nice. And so Masera, what did we do with the raw traffic? Yes, so at that time when we were studying, what we had was several infected host used by operators, HTTPS traffic and plain text, yay. CNC traffic and publicly available seller market. So that is when we presented in 2016 at Black Hat Europe in London. We're not gonna go more in the details of the analysis that we've done there because there's the documents there that are published online that describes everything. But there's one thing that we hadn't talked about at that presentation that sort of led this presentation and it's a feature that was within the infrastructure of Linux Moos. So Linux Moos had seven white listed IP and we say white listed because these were IPs that had the right to use the buttonette. So they had the right to push requests through the infected devices onto social networks. So at that time when we noticed that, we were like, what are these white listed IPs used for? So our hypothesis was to think that it was a reseller model so that one white listed IP that was just a server somewhere that had access to the buttonette could have been sellers of Twitter fake followers and when they would sell it, they would just connect to that IP and just push the request through the buttonette. So we thought that, well, we wanted to find out what these IPs were meant for. So we decided to conduct several traffic analysis. So we used JupyterLab, it's an awesome open source tool that allows you to sort of use PCAP data along with MTM proxy logs that correlate them together and just use them for data frames and graphic. And we sort of developed that methodology of various variables that could have helped us understand what these white listed IPs were meant for. So we looked at Honeypot used per white listed IP. We looked at websites targeted, TLS fingerprints, but all of these didn't yield anything. It was a lot of analysis for few findings, except from two. So two variables told us what it was. It was, so the variables were account created on social networks and accounts followed on social networks. So basically for each white listed IP, we could find that they had their own lists of fake account, but they were actually all following the same account. So the potential buyers that we call. So we sort of figured out that these IPs, these servers were meant for fake account management. So where do we stand, right, at that moment? Well, we knew that each white listed IP addresses had their own list of fake account, and that was the meant, that was why they were there. And additionally, what we did is we scanned them and we saw that they were running Windows servers and that we talked to somebody at OVH who confirmed to us that they were using a remote desktop protocol was actively used. So we wondered, right, what kind of piece of infrastructure could glue all of this together? So you have Windows servers, RDP Open, so people connecting, and we know that they're managing fake accounts. And that's when automation software appeared. And so automation software is like we started looking at it like what would fill that gap, right? And we found out about software that exists that kind of turns social media around in the fact that what you're looking at when you use such software is you have a grid layout. You have like an Excel spreadsheet where your fake accounts are there and they're mapped to a proxy. And we're going to go through this and you're going to see this. But now I just wanted you to have an image in your head and we're going to map it to our ecosystem, which we love by the way. So it's in the three near the moose because automation software enables the moose, which is basically a button of proxies that it will leverage. So we tried to find the software that would be powering Linux Moose. And we based this research on user agents. So they were both using the fake accounts and the interaction with Instagram. We're both using mobile and desktop user agents. And although Linux Moose supported many proxying mechanism, we knew or we saw that proxying was the one that was used. And so we found different features from these vendors. Do they manage thousands of accounts or a few accounts? Proxy type, user agent? Can you customize browsing patterns and all that stuff? And also, we found different business models. So they all charge money for their software. By the way, their software is heavily protected. And as you'll see, some of them sported unlimited accounts. Some of them you would pay with one-time fee, et cetera. The first one we looked at was Gram Dominator. So Gram Dominator and all the Dominator names are very common. They have for everything. And so legitimately, you can pay with a normal credit card. This is really foreign for me as a malware researcher, where everything is like bitcoins or really shady or hidden. All of the social media stuff is still PayPal accounts. They probably declare taxes and all that stuff, which makes it more interesting and at the same time sad. And we should do something about it. But it has the features that we needed here. We highlighted proxy support, in which they mentioned public, private, socket. You see they're clearly not that technical, but anyway. They also support several Instagram account. So diving into the binary, I was looking for user agent strings. And so I found that they were generating user agents on the fly. And so looking at the code, they were really combining, like Android version, DPI resolution. And this is exactly what Instagram looks like from when you use the Android app. So they mimic that portion, but with a generator so that a single fake account would get its user agent. This would be put into a database. And then for that fake account, always the same user agent would be reused. So we found they were pretty clever. And so we looked at it through PowerShell. We kind of loaded the library and asked a few names to see what it looked like. And this was really similar to what we saw from Linux most. Let's look at another one, so social dominator, which is, again, under the umbrella of the dominator trademark. And what I want to highlight here is that grid layout. This, we only have one account, but it's because it was our own and we didn't have many accounts to put in there for the screenshot. But so you see the username, proxy, and it will gather the friendship count and stuff like that. You also have import capabilities, export capabilities. So it's really meant for scaling. And you have a log of everything that's going on down. This software supports Reddit, Tumblr, Facebook, Instagram, Twitter, Pinterest, Kora, and even Google Plus. RIP Google Plus. But so you see that they're into this business for real. I think this one uses the Chrome embedded framework. A lot of them use Chrome embedded framework. We have a little table that will summarize all we've found about the different software that we analyzed. I'm going to go really quickly through it because we have a lot of stuff to cover. But you'll be able to get the slides and look at the table on your own time. The other one that is interesting and needs because it's kind of a story in its own is Follow Likr. So Follow Likr uses a weird discontinued packer called Jet. Jet compiles Java into native code, but still uses a JIT engine. So we have like 100 or 1,000 of function and then a big data block. And when you look at it, it's binary and it's loaded by the thing. So it's really hard to reverse engineer. When I loaded it in Ida Pro, it gave me 267 megabyte of native code. And I was like, oh my god, there's no way I can go through this. But the packer costs something. Do bad guys pay for packer? Of course not. And so when you try to use the software without the launcher, you get an error. It's an evaluation version and it's expired. So when I looked in the strings, I see that they packed it with an evaluation version that was valid for three months. And so I was like, OK, but why when I use the launcher, this thing works? It's because they embedded in it and the UPX packed it the run as date program. So what basically the launcher does is it's unpacking or loading run as date. And then giving it inputs to fake the date, but only for that process. So your operating system and everything is OK, right? And so this completely bypasses the jet limitations so that they can use the evaluation version. I found that really funny, but I lost a bunch of time looking at it. And so this gives us follow like or running, but it's still like the same grid layout. Nothing new, nothing learned. So yeah, too bad. So we looked at many of them. We cut them for the slides. But here's the table that I mentioned earlier. But the gist of it is we didn't find the one for Linux most. No, there was always something off. And so eventually we hope that we might be able to find it. And by the way, like all the binaries I found, we have a company account for VirusTotal. I put in the domain name of this business in VirusTotal. And I was able to download the binaries and analyze them. So VirusTotal, thank you. You're like a binary distributor, and this is really good because otherwise we couldn't have those binaries. So now, where do we stand? We found several automation software vendor which we analyzed. The reseller model clearly now is not at the bottom level through the analysis that Masera told us about earlier. So where is the reseller model? This is what we're looking for. So Masera. OK, so at that time when I was investigating the crypto traffic, I was trying to find in the traffic some accounts that would, for example, an Instagram account that would advertise follows and likes. So in that case, I would be able to say, oh, see that account was followed by our buttonette, and it's advertising selling of fake likes and follows. So that must be our buttonette providers or something like that, right? So I started to investigate the traffic, and I was looking for keywords like social media, panel, and all that. I ended up finding reseller panels, just like this one called Medianesia panel. So reseller panels are basically just panels that sell fake likes and follows in bulk. When I told this to the journalist, she was really mad because she paid a high price for the fake follows that she bought, but she could have then have them at a very lowest price if she would have gone through the reseller panels. So we sort of decided to illustrate them as spiders and webs, and where they are in the ecosystem is just a little bit above the automation software, and next to Linux Mozart IoT buttonette. So reseller panels look a little bit like that, so you can log in with a fake account easily and just create a password, and they all sell fake likes and follows in bulk, and most of them offer the services on all social networks, so Twitter, Facebook, Instagram. What's interesting is the prices are lower than other sellers that we're gonna see later, but the lower your go and the more the shadier the payment process is. So I tried to buy a million followers for myself for my fake account at $1.8 for $10,000, and the only way I could actually pay for that was Bitcoin, so it's kind of interesting because as the price goes down, the payment maintenance become more and more shadier. So what was specific about the reseller panel that was interesting is the fact that they were selling popularity in bulk, but also that they all look alike. So when I was investigating them, starting to look at them, it was like, it looks like it's the same group behind these panels because it just seems like to be coded by the same person. So we did a simple investigation. We gathered information on 343 reseller panels, and we gathered information on the fingerprint of the web application, the main registration information, HTML content, and IP address, and we started to do clustering analysis. It did yield some results, but there was just one big result that we couldn't ignore, and it was the IP address. It's the fact that 66% of our sample was hosted on the same IP address. So here we just did a simple passive DNS query, and then we found that this IP hosted in the end a thousand other domains, and all these domains are related to the resell of SMM, social media inflation. So for example, you have extra like, easy boost, grand panel. And while investigating that, we found a specific actor, PerfectPanel.com, and what does PerfectPanel does? Well, it's a panel as a service provider. So that sort of answers why all the reseller panels looks the same. It's basically that there is a provider that allow you to sort of have a panel without having any technical knowledge. So they will provide you with the panel, and you can start reselling in bulk. So that sort of added another actor that we weren't expecting, an actor that we added in our little forest behind the webs and the spiders, because they enable the reseller panel sellers. Yeah. So basically panel as a service, we found five of them. What they offer is a ready to go software. They even provide web hosting, obviously all on the same IP address, and some of them even include the domain names, so you don't even have to buy that. They have specific features like API to receive orders and API to send orders. So what you could do is just connect to a panel and then to receive orders and connect to another panel to send orders and just act in the middle. They also allow you to track your workers. So if you wouldn't want to automate everything and you were in another country where you would want to have workers, then that would be something possible too and you could do it manually. So here I just give you an example of it's not perfect panel, it's in this rabbit. So we could actually just log in through a demo and you see that you have a dashboard with all the usernames and the people that are actually, that would be your customers in your reseller panel. You also see that you can select an API and just like connect your panel to another panel so you wouldn't have to have a link to Linux Moose. You would just have to have a link to a cheaper panel and sort of play in the middle. So we looked at, so we were wondering, right? Okay, so there's so many reseller panels, but how do they connect to Linux Moose, right? How are these two actors are linked? I know Linux Moose advertises them through the accounts, but that wasn't clear to us. So what we did is we went on Black Hat World. This is the forum for social media marketing and sort of found lots of discussions that were from reseller panel owners and they were looking for the main provider. So here I give you an example of somebody saying, well, mostly all panels use the same provider. The only difference is price. If anyone knows this provider, he is welcome to contact me privately. So you see that somebody who would have an efficient reseller panel would actually wanna connect directly to Linux Moose, wouldn't wanna connect to another panel, right? But then this guy, Dalton Media Studios, sort of shows well how the game plays. He says, no one will reveal the main provider. For them, he is the hidden ghost. So it makes sense, right? When you think about it, if there's a malware provider, a malware author who's actually detonating Linux Moose, that person would probably not be interested in dealing with all these reseller panels, right? It would just deal with one or two trusted party and then these trusted parties would deal with the reseller panels, right? And SMM snob here is really well showing this. So he says, guys, unless you're spending $1,000 a day on SMM panels, you don't need to search for the original supplier. A, he wouldn't be interested in your volumes and B, you just need to find the most reliable reseller for the most cheap reseller and get on with it. That would be enough. In this market, you have to put your effort not in buying cheaper, but in selling more. So you do, like, we sort of concluded from that that potentially a Linux Moose and these providers at the bottom would be hiding behind a few trusted parties. However, it seems odd to say one main provider, right? There should be many ways to sort of provide fake likes and follows. And this guy says it. He says there cannot be one provider. There are several, and there's several methods too. And while we were thinking about that, we found a new method that was possible and that's what Olivia's gonna present. And so, where are we at right now? There's a system of resellers and a panel of service providers and of course, there is shallow people wanting to buy fake fame, you know? We have the automation software that can create and orchestrate those fake accounts. But then, when you try, when the bad guys try to manipulate Instagram, well, they're getting blocked. And so what Linux Moose, the button that provided to them was reputable IP addresses and, you know, a set of proxy services. But what if there was another way, a more legal way not breaching CFAA? And so, what we're gonna talk about here is there's this ecosystem of residential proxy providers. And so, you can work around blocks using proxies and there are two types of proxies, basically that you can find online. There's the data center proxies which are easy to block because they're all together, you know, it's clearly labeled. And Netflix or, you know, Instagram can block slash 24s, like huge amounts of IP addresses in one shot without impact. But when you try to block residential proxy, the story is different, right? You, IP addresses, they can, someone can be really legit and if you block an IP, you might block legitimate account and false positive are really a pain in that context, right?  And so you really need to be really careful. And so, we even have like this guy next gen leads which is a junior VIP on Black Hat World who says basically stop using data center proxies period, right?  And so basically we understand what you mean next gen mister. So when you went, actor enters the games basically. So we had this botnet before, but now we have a parallel system which would mimic the botnet. So you could do things differently. And it's the residential proxy services which we, you know, present to you as a cabin because we tried to have this thing be Canadian somehow because we were crazy about Canada. And so what we have here is a cabin sitting on the floor. So the floor is kind of proxying and whatever. And so automation software right beside it and it's on the other side of tree because it's parallel mechanism to achieve the social media manipulation. We put a lot of thoughts into this. We kind of made a bit crazy maybe. But so the ones that we looked at were high proxies, storm proxies, RSOX and the glorious Valor solution which is a game of throne reference which I don't understand, but I appreciate nonetheless. The Valor solution product that we purchased was called Comet USA Static Proxies Residential IPv6. This was our only IPv6 proxy. And Valor, I need to see this later actually. Anyway, and we looked at Luminati. Luminati is very different and it needs a bit of your attention and it's kind of sidetracked from what we're doing today but this is scary as hell. But Luminati's use case has clearly says that account management is part of what they're doing. And so here what I highlight here is like, it basically says use our service to manipulate social media, right? But what I want to highlight right now is like their business model because it's completely different than the other ones and let me have a video about it and let me show you this is completely crazy. App revenue without hurting its user experience. Grow your app revenue without hurting its user experience by joining Luminati's developer community. Embed our SDK and earn $5,000 per month for every 100,000 of your daily active users. Luminati is the world-leading peer-to-peer business proxy network. We help Fortune 500 companies collect web data through residential IPs so they're never blocked or misled. We do that by partnering with app developers and inviting their users to be peers in our network. When users download or upgrade your app, they will see this screen, allowing them to join our network and get your app for free. You can offer your users other options like watching ads or purchasing your app. Users who choose to be peers would not feel any change as their device resources will be shared only when their phone is idle, connected to internet, and has enough power, allowing you to earn money from your inactive users. Implementing our SDK is quick and easy. Grow your revenues while increasing your app usage and retention. Join Luminati's developer community today. This is completely crazy and should be illegal, right? I mean, it's true, like this is crazy, but people will opt in and since people agreed, then it's legal, right? Anyway, I just can't wrap my head around them, but it was clear that it was not our line, it was not built on a compromise infrastructure. So this is why we're ruling them out of this presentation and this research was still, I wanted people to spend a minute thinking about this and pushing against it, right? We need globally to fight these kind of business models. So Trendmicro did a very good paper. So Luminati is what powered whole VPN. I don't know if you heard about them, but anyway, I refer to that paper and I advise that you look at it if you're interested in that topic. We're not gonna talk about Luminati anymore, but I'm mad about them. So Stormproxies, we got IPs from the US. There was conflicting information in the GOIP and who is database. I think this is how they pulled this off, but it said like digital energy, Chile, but the hosting organization was host one plus. We had like Victorio Mahe, which is an African ISP and the hosting organization was Joe's data center. And even though it should have been African when you trace route it, it was US. And so I think this is kind of a, you know, abusing the proper updates of the Instagram, not Instagram, but IP databases. So Instagram is kind of out of sync with these and they cannot block it because they're unsure if it's ISPs or data centers. This is our theory anyway. But then we started scanning and looking at it from, you know, using the product as we purchased all of those services. And so I use a squid for proxying. They don't protect scans from local hosts. It's a Linux system, most likely Debian Jesse because I was able, when using the proxy to scan local hosts to fingerprint, Xim version, which is a SMTP server and squid. And Debian is very rigorous about, you know, backporting patches. They don't update, you know, Xim for whatever reason. They just backport the patch themselves. And so because of that, when you fingerprint specific versions, you can be with a high amount of confidence, know that this is a Debian system. And so this one is a Debian. So is it compromise infrastructure like what we were looking for? Cause we were looking for criminal activity? No. So it's legit.  And so we don't have a bad guy here or, you know, we have a gray guy. I don't know. RSOX, it was all the IPs that we got were same subnet in Russia. It was backed by the admin, LLC, ISP. Admin, if you look it up, there's nothing. So you don't know if it's a data center or if it's a residential ISP provider. There's nothing on admin as an ISP. Tracerout confirmed it was Russia. The fact that it's all the same sumnet to us was like, eh, you guys are kind of lame. But okay, you know. They expose SSH when you scan locally to 3389, which is usually RDP. We were not able to fingerprint the proxy service itself so we don't know what binary or what proxy system they were using. And again, because of the SSH that we found and the SSH banner is, gives all the information. So we know it's again a DebianJSC. So again, to our original inquiry is this compromise infrastructure most likely not. And what I failed to mention so far is that this is not single IPs, this is several IPs. We analyze five, 10 proxies and they're all the same. So it kind of gives you the sense that it's not compromise infrastructure. And now let's look at ValorSolution. Unfortunately, they don't provide a management account so the screenshot is just the glorious webpage. But the IP we received was a DigiBox IP, which is clearly not residential in France. It's like a dedicated servers. But this is the first provider where the traffic was not going out from the same IP that you connected, but there was a tunnel. So it would connect in France and it would get out in the US. It would connect IPv4 and it would get out IPv6. And so it was a bit different to analyze. The outgoing traffic was labeled from AT&T internet services. So it was probably one of the best one, like a solid AT&T, no confusion whatsoever. So good job ValorSolution, I don't know how you pull it off. We geoIPed the information and this gave us a middle of a lake in Kansas. So at the time I was like, oh, that's cute.  I know geoIP is not precise and there's a radius involved, but I kind of liked it. But then that vision was destroyed when we presented that blackout two days ago. They told me like any IP in the US, not properly geoIPed or labeled, is in that lake in Kansas. And so I was like, okay, I got it wrong. There's a story about that lake that I mean would, we should do a lightning talk about it. Anyway, I'm gonna skip through because we have a lot of stuff to say. But, so Valor uses Triproxy. Triproxy is a very famous Russian proxy service that is kind of shady, but it's open source. You can use it like pentesters should use it because it's really flexible. But it's still like, I've seen it before in malware, but it's still legit, you know, but so they clearly proxy a lot of stuff on the same entry IP because they had a thousand continuous port exposing Triproxy. We had identified it both by NMAP and by triggering errors and looking at the error strings and matching it with source or code. So we're sure it was Triproxy. They protected scans from local hosts. So it was the first one who did that. And IPv6 was completely sealed. So any external scans to the IPv6 address that we got were giving absolutely no result. But we know that the proxy entry is, again, Debian 9, a lot of Debian in the SMM industry, I don't know why, but through fingerprinting of the NGNX and OpenSSH. And so wrapping this up, what we're gonna say is that there are several providers and everything we analyze, I don't feel it's powered by malware, but clearly, ValorSolution is the shadiest one and the one who protects itself the most. So if I had more time, I would definitely look into these guys because there's something weird about that service. There is a paper that was released called Resident Evil Understanding Residential IP Proxy as a Dark Service, which is very interesting. And they took a completely different approach than us and we found it while doing that research after we were accepted to talk about this stuff here. But so I just wanna give them a hat tip, because they actually, they collaborate with ISP. So we use the proxies and try to assess if it's compromised infrastructure or not, but they saw traffic go through these proxies and they know what they are used for. This is a very interesting paper. And it's a collaboration between Indiana University of Bloomington and Tsinghua University and it's more than 10 people will work on it. So I think they really need a hat tip. So where do we stand now? We have an IoT button which we started with four years ago, but now we know it could be done through Residential Proxy that you could pay for, right? We have the automation software which uses these two services in order to automate or make scale your Instagram interactions, right? We have Resetter Panels and Panelist Service Provider. So we have all of that stuff, but who buys from the Reseller panel? What's going up upwards, right? Masera? Okay, so what we did is we called them Customer Facing Sellers. So we just chill out. They just chill out on top of the tree above everybody because they're the one dealing with the celebrities or the agencies related to the celebrities. I just give you an example here of Divumi. Have you heard of Divumi? No? Okay, so this is a customer facing seller. It just, it looks really legitimate. They do lots of customer services. You can pay with credit cards, so it's less shady and it's easier for anyone who's not technical or who would believe that what they're doing is okay. And what's interesting is about Divumi is that they were in a legal procedure with some of their partners who were trying to sell to steal their customer. So they ended up having to publish their list of customers and the New York time took that as an opportunity to create a huge investigation called the follower factory where they actually sort of show names of people who bought from Divumi and names that are people that are well known in the United States. And following that investigation, the New York Atonate General did a legal proceeding against Divumi and sort of announced groundbreaking settlement saying that selling fake followers or likes is illegal deception. So Divumi was fined $50,000 for what it was doing, but according to the New York Times investigation, they made over like five to six million a year so it wasn't that of a high fine. And obviously what happened once this solution was sort of pulled out by the New York Attorney General is that Divumi closed down, obviously, but obviously also they just went down to their best alternative, socialboss.org, instagrowing.net, and youtubegrow.com. So it hasn't thought much of what's going on. And then lastly, the people that are driving this whole business, the buyers, you get it, squirrel? And where do they stand? Well, they stand at the top of the tree next to the customer-facing seller and nearby the fruits of social networks. How did we sort of end up analyzing the potential buyers? Well, it dates back to analysis in 2016. We knew that Linux Moose was proxying traffic and 86% of its traffic was Instagram, so we took only Instagram and then we sort of developed a methodology which said that if Linux Moose had followed more than five times the account, and if it wasn't a super popular person like Kim Kardashian, because we know that they're following these people to look more legitimate, and it had to have a very low engagement, so they had like 100,000 followers, but like when they post a picture, there's two or three likes and it just sort of shows you that it's probably fake following. And then we did a content analysis. So from this sample, we categorized as much as we could the people that we saw. So for example, first thing that we, 20% of our sample was the entertainment industry. So people like this guy who would have 30,000 followers, but in the end, when you clicked on his YouTube channel, it'd be like 10 to 12 views or you know, like a very low. And this person with 200,000 followers who calls himself reality TV personality actor, global jet setter, and you wouldn't find anything about him online, except from that. Then 21% of our sample was selling products of services. So example of watches being sold online. All of most of the products and services that were advertised on Instagram were like luxurious stuff. Maybe that's just a result of the social network, but here's another example of a jewelry in Paris who also we found in our buttonette. And lastly, the saddest thing is more than a quarter of our sample with personal profiles. So individuals who post pictures of their food or of them hanging out on boats, and then they have lots of followers, but they know they're false. So it sort of questions us as to, you post them and you think you have visibility, but inside of yourself, you know that it's not the case. But let's say that that's just another research for psychology or something. But yeah, and then that's how we ended up calling this market the ego market. And then there was the unexpected ones. So what happens is that I could categorize about, I'd say 60 something percent of the sample, but there was so many weird profiles that I couldn't say, oh yes, this is this or this is that. So for example, here I had an Iraqi military general who was in the special forces. And unfortunately, this is his profile and it's probably the person managing his account that has bought fake following. Or it's potential, right? Like we haven't seen these people doing it. We've just seen them in our buttonette. And we also saw some quite large amount of magicians, spiritual psychic, people involved in magic. Here I give you an example of a New York home witch as she called herself. So yeah, with 141,000 followers. And then there's the fascinating ones. Oh, okay. So here I give you a, it makes sense, right? An STD's testing account will obviously, if you were to want to have followers online, who would follow that, right? So it makes sense that you buy this. And then there's dogs with more money than you, right? How do you categorize that, right? Like, anyway. So we made an experiment, okay? If you get it, it's a duck face in a mirror. Okay. So we knew that Linux Moose was targeting Instagram, but it was also targeting Periscope, Fliipagram and Kiwi, which are unknown social networks. And we found a seller, a customer-facing seller, that was selling those fake following on these social networks. So we thought, well, let's just try to buy from that customer-facing seller and see if we'll see the account going through the honeypots, right? So what we did is we bought, I created a fake account called BeautifulBird33. We bought 6,000 followers, got 8,000 because I complained. And I wanted to increase the chances of seeing the account. And luckily, that day was one of our best day in our research is that the account went through the traffic in our honeypots. So that sort of confirmed our investigation even more, right? And if you think about it, what we did is we acted as the buyer and we went on a customer-facing seller and then we saw the account going through the botnet. We don't know what happened in the middle with the reseller panels, but we know that it happened. So in terms of the revenue, I'm gonna go a little bit quicker just because we're short on time. But in 2016, when we studied the botnet, we had the customer-facing seller's prices and we concluded that most of the profit was going to the botnet. So what we did is we calculated the amount of follows that we saw in each honeypots and then took the prices that we saw on customer-facing sellers and just added this together. And we said, well, if Linux Moose has 33,000 bots that it would make, on average, for example, $400,000. However, now we know there's much more actors involved, right? So you have the buyer who buys from the customer-facing seller who has a mid-price, on average, for $95,000 for 10,000 followers. And then the customer-facing seller will go on the reseller panel and then we'll pay a much lower price for the fake following. And then we don't know how much Linux Moose is going to make out of this, right? But what we know as the cheapest reseller panel is $1.8 for 10,000 followers, which I, honestly, I'm pretty sure that's a scam, but still. And then, meanwhile, you have all these actors that are still making money. So you have the panelist service provider who makes, on average, $47 a month per client. At Proxies, it's about $2 per proxy per month. And the automation software they're making on average between $10 to $60 a month per client, too. So let's just do an exercise, okay? You wanna be trending. You wanna buy 10,000 followers provided within a week. So you're doing something.  And then you know that each bot, we know that each bot performed, on average, 1,000 followers per month on Instagram. And how do we know that? Well, we just calculated that. We took the average, and if it's not that high, it's because the botnet has to imitate a lot of human behavior to ensure that it's not flagged. It won't go like follow, follow, follow, follow, right? And then that equals to about 280 followers a week. And for that, if you wanted to go through Proxies, well, you would need 36 Proxies at a median cost of $2 a month. So it would cost you a flat cost of $7 to $2. I mean, that's quite expensive, right? For the median price of $2 per proxy per month. So that sort of leads us to think that this is not for nothing, that Linux moves exist, right? Infected devices are cheap. And otherwise, that Valar solution or more shadier actors are involved. So Valar sells for about 50 cents a proxy for a month. And then if we just let's estimate Linux moves capacity, so if we say that Linux moves has, for example, 40,000 bots, then we could say that it could make, on average, 40 million Instagram followers per month. So that's quite a lot. And if we try to see how it sort of fits on the graph, then that's how you see that, if we take the minimum price of the reseller panel, it would make much less money than we expected. And then the first quartile is a little bit higher and the median price is even higher. But what's the main takeaway from this is mainly just to understand that we often try to estimate profitability just by adding one by the other, but there's often many actors involved and we don't calculate that. So we're always like, oh, this is millions of dollars for the malicious actors. But in the end, you see that it's much more complicated than that and there's other people making money out of this, right? So this is sort of how we concluded our investigation of the ecosystem of social media manipulation. So you see all the actors here. There's other research avenues. So obviously you'd have other ways to be able to create fake following such as ClickFarms, Compromised Accounts and TrollFarms. And just to let you know, there's some journalists that are working right now into interviewing actors involved in the ecosystem that we talked about. So, and they're gonna publish really soon. So if you have, you're interested in knowing more about that, you can come talk to me and I can put you in contact with them. And there's a prof in Germany called Patrick Vendero who's also working on interviewing reseller panels owner. So I think I'm gonna stop here because I had a what to do next, but it's the, oh yeah, okay. What to do next, okay? Really quickly, just keep your attention. Policy makers will look into the sale of social media manipulation, right? Because we saw the New York attorney general doing it and then we'd be wondering other countries could do that in other states. Law enforcement target the middleman panel as a service provider. They enable so many actors to sort of connect in between the customer facing sellers and the botnet. Social networks continue to flag a new robotic activity. We went on the Discord server of Valor solution and it was kind of interesting to see that just right now, yes, just right now people are having a hard time doing fake likes and follows. It seems that Instagram has published a new AI and thus they're really struggling to do it. So I mean, it works. And you will maybe try to focus on the content rather than the container. So if somebody tells you, look at this person. Like they have so many followers. Well, instead of saying, wow, just wonder what's the person bringing to society and what's the content being published? Is this pertinent or not? And lastly, just remember I bought 8,000 followers on my account and I only have 400s now so fake visibility doesn't last. Thank you very much and I'm sorry for rushing through the last part but it's very nice to be at Defcon and I hope you enjoy your week.


Hey guys, it's Anna, aka The Hazina Girl and the first thing I want to say before I start this video is welcome to all the new people who joined the Hazina fam. Hey, hey. You guys know it's always party, right? If you guys didn't know, my goal for this year was to reach 1,000 subscribers. So if you guys haven't joined the Hazina fam, please be sure to click the subscribe button. I'm gonna be making so many new videos but I want to say that I'm just so happy to have seen that you guys have been subscribing and you guys have been watching my videos, liking, commenting, asking me questions, sending me emails. I appreciate all of it, please continue to do that. I love it when you guys interact with me and I like to feel like we're having a conversation. You know, I feel like you and I, we just, we get along like that, you know what I mean? So yeah, with that being said, let's get right on to the video. So like I mentioned today, I'm gonna be talking about how to apply to Boonka and the reason is because, yeah, you guessed it, I'm applying to Boonka literally today. Like I put together my application and everything and I'm going to head there literally as soon as we finish filming this video. If you guys didn't know, I've been wanting to go to Boonka for like three years now. I'll leave a Boonka playlist full of all the videos I've made so far about Boonka so you guys can see that I'm not kidding. This is knowledge that I've like picked up over the past basically three years of me doing research and coming up to like today, which is me actually applying, it's kind of a big deal. So yeah, I hope you guys are just as excited as I am to start this amazing Boonka journey. So if you guys want to find out more about how to apply to Boonka, just keep watching. Okay, so the first step is learn Japanese, ta-da. You guys knew I was gonna say that, right? Yeah, you have to learn Japanese. Boonka Fashion College is a Japanese fashion school and there are no courses in English. A lot of people messes with me being like, Sana, I don't speak Japanese, can I go? And I'm like, no. It's not like, it's not to be mean or anything like that, but it's cause like all the classes are in Japanese. You won't be able to take the courses unless you actually understand, speak, read, and know Japanese. So if you guys are studying Japanese in your own home country, that's totally fine as well. One thing I suggest to you is to take the JLPT or the EJU. If you've taken the test and you haven't been able to pass it or if you haven't even started learning Japanese at all, my number one advice to you is to come to Japan and learn Japanese in Japan. It's completely different than learning at school in your home country because you're just gonna learn so much more while living here. And I think the minimum requirement for Boonka is six months. So you can come for just six months if you want to. I mean, I suggest that you stay for a bit longer. I have friends who went for six months and said that they didn't quite think it was enough. So yeah, step number one, learn Japanese. All right, so now you've learned Japanese. You're perfect at Japanese. Well, you're not perfect, but you're close. And you're like, well, Senna, what's step number two? Step number two is to go to Boonka. You need to go to Boonka. And this is why if you already came to Japan and you're already living in Japan and learning Japanese, step number two will be easy for you because you don't have to go very far. You just have to go down to Shinjuku and check out the school itself. I also wanna give you guys some short clips of me when I went to go to Boonka-sai. Here's a short clip of me at Boonka-sai with my friends. Maybe for those of you who don't know. It's a video, I hope you guys don't say hey. Welcome to the Hizuna Girl channel, guys. Say hi. She's gonna be a future YouTuber. Guys, I'll put her channel linked in below, okay? Don't worry about it. Not you, no, we're not gonna subscribe to your channel. It's fine. I said that you can see what kind of school it's like and see if it's actually a school for you. November 3rd, which is Boonka Day, I went to Boonka for the first time ever in my entire life. I went to go check it out. They had a huge festival going on. It was amazing. I got to see the school in person. And that was a good chance for me to be like, yeah, I wanna go here. Reason number two why you should go to Boonka is because you can go there and pick up the application in person. I'll leave a link in the description where you can find out more information about how to receive the application forms. So when you go to Boonka in real life in person, you're gonna get one of these. So this here is a Boonka Fashion College application package and inside, it's gonna be everything you need to apply. So let's say now you've done step one and step two. You've gone to Japanese language school. You've learned Japanese. You've taken the JLBT and then you've also gone to Boonka. You've checked out the school. You love it. You've gotten the application package. How do you apply? Now, this is what we're gonna delve into in detail because there's a lot of things that I learned. And one thing I want you guys to note though is I'm making this video in 2017 for the 2018 school year. Now, if you guys are watching this video in the future, things might have changed. But for the most part, I think this is kind of a basic outline of what you need to be able to give in your application at Boonka. So once you open up the application package, you're gonna get something that looks like this. So once you get this, you should open it up, obviously. And inside you're gonna see that there is also another document that looks like this. And this one is called documents for application. This is the real documents you're gonna need to sign to apply to Boonka. Now, the cool thing about this that I love is that in the first page, you actually give you an example sheet. You have to write your middle school, your high school, how many years you've studied, whether you've graduated or not. You have to fill in, you know, information about work if you also went to work in between some school years. And then you actually write here a little description as to why you want to study at Boonka and another explanation, talking a little bit about what you wanna do after you've graduated. One thing too that's really special about Japanese college applications is you need to get a picture of yourself. It needs to be a specific dimension. There's another side as well. This is the second part of the document. You have to write all your family members. You have to sign here. You have to put your Hanko stamp, which I mean, if you live in Japan, you probably have like a Hanko stamp. But yeah, so that's what you need to do. You need to write what your parents do for a living or what, you know, your financial sponsor does for a living. And then you have to write when you're going to, like, you know, what your Japanese proficiency level is. So if you did number one and you already passed the JLPT or the EJU or you've studied Japanese in Japan, then you should be good on this. You can go ahead and write that down. So yeah, so then this is what the blank application form looks like. You just fill it out yourself. And once you've done that, you can move on to the second part of the application process, which is getting an emergency contact. There are actually very specific requirements for the emergency contact person. I did not know this until recently. But this is what the form looks like. Essentially you have to put in your information, you put in your information and they need to be the ones to fill this out.  It needs to be somebody who lives in Japan and it needs to be somebody with a full-time job. It cannot be a student. So you can't ask your other friend who lives, you know, across the street from you who also goes to Japanese language school. So pick a friend that you trust. Pick a friend that's a good person.  So once you've gotten that done, the next thing you need to do is the financial support statement. So the financial support statement looks like this. And once again, you have to put in their information. You have to write what your relationship or what that person's relationship is to you. And even if you're paying by yourself, by the way, you need to get this signed by someone else who would be your financial support. You can't say that it's you, unfortunately.  So you need to make sure that, yeah, you get this filled by them. Now, in my case, it was, you know, my parents. What I did is I scanned this, I sent a copy to my mom, my mom signed it, and then she scanned it and sent it back to me. It even says like, if the person named above has admitted to your school as a regular student, I hear by pleasure that I will be a financial supporter during his or her studies. I will submit an income certificate or a bank balance certificate to clarify that in fact, a tuition fee and living expenses can be paid. And that's written in English, okay? That's how important this is. So yeah, great. Wow, whew. So finished, you finished that part. The last part is a lot easier. Just gotta fill out these little address labels.  And that's it. You've officially completed all of the four steps, all four things that need to be filled out in this document. The other thing that you're gonna need as well is you're going to need some documents to prove that you've graduated from your most recent school. Now, normally you get a certificate, right? You get a diploma, right? And when I went to apply the first time, I gave them my diploma, but they said that is not what they want. They do not want your diploma. They want something in Japanese called a shoumeishou. So shoushou in Japanese is what they call a diploma. It's what they give you when you're graduating, congratulations. They don't want that. They want a shoumeishou. So in my case, I actually had to get my guidance counselor to write me a letter saying, this is to state that Senna has graduated from Baba Blah school in the year, Baba Blah. And it needs to be stamped with an official seal from the school and signed by the person who wrote that letter. In my case, it was my guidance counselor. It doesn't even have to be your principal, I don't think, as long as it's somebody who works at the school and who can get that officially stamped. So that's what you need for your high school diploma. It's not your actual diploma paper, but it's more like a graduation certificate written by somebody. That's the first mistake I made when I went to apply and they told me to go back home and fix that. The second thing you're gonna need from your school, so you're transcript, basically. And in my case, I went to a French school in Canada, so I had to get that translated to English. I didn't know. Mine was like half in English, half in French, because you know, Canada, we're just, we're in bilingual like that. But they needed everything to be in English, not like some parts in French, some parts in English, everything in English. So I had to get my transcript translated in Canada. I got my parents to get it translated for me. And then after they get it translated, this is really important. Not only do you need to get it translated, but you need to get that paper to the school and then the school needs to stamp it for you saying that they approve of that translation. So that's what I did. I was blessed enough to have it shipped to me by my mother and it came in just in time. Today is literally the last day for the application and I got it last night in the mail. That's how crazy it was. You're gonna need that document and you're gonna need the real thing.  They need the real thing, the original copy. So you need your school to mail that to you or get your parents to go to the school, pick up that document and have them ship it to you. Make sure you're doing this weeks in advance because you don't know how long it's gonna take for those documents to get shipped to you, okay? The next thing you're gonna need is your Japanese language school's forms.  Now in Japan, attendance rate is a big deal, okay? You need to get over 80 to be able to get into the school. Now that's doable, obviously. If you show up to school on a daily basis, you'll get over 80 and you'll be fine. Make sure that you're actually studying when you go to Japanese school. Make sure you're not sleeping in class because they will look at those two things. Next thing is you're gonna need your passport. You don't need to make a photocopy. I thought I needed a photocopy, but you don't. You just need the real thing. I'll just look through it really quickly. Make sure that you're actually from the country that you say you're from. And then the next thing you're gonna need is your Zaibu card, which is essentially your foreign identification card that they give you in Japan. If you're living in Japan as a student and you have a student visa, you should already have that card. It shouldn't be that big of a deal. Unfortunately, if you're only coming to Japanese school for three months, this is something that a lot of people don't know. You won't get that card. You need to be living in Japan with a student visa for you to get that foreign ID card. Once again, you don't need a photocopy. You need the real thing.  And then the third and final thing is you're gonna need your card for your health insurance. This is to prove to them, of course, that you have health insurance and that you've actually registered under the ward where you live in Japan. So yeah, make sure you show them that health card and yeah, make sure, like I said, not a photocopy but the real thing that you hand it to them so they can look at it and make sure that you are living in Japan. There's, of course, some separate documents you need to fill if you want to live at the school dorm. I personally suggest that if you've never lived in Japan before and that you're maybe applying for overseas, then maybe, yes, the dorms will be a good option for you. I'm personally not applying, so I don't know all the details for that, but I'll try to leave as much information as I can for you guys to read and kind of inform yourselves. They also give you this really cool pamphlet as well that comes in the application package and it's supposed to explain to you what the different dorms are like, what they look like, how much they cost. No matter where you are in the world, you can actually apply for one of these. Now this is a book that can help you choose what course you want to take and I want to make a whole separate video on how to choose what course you want to take but this is a cool book that you guys should definitely pick up if you can. Just go on the website and you can apply for it. Now this is the one for 2018, as you guys can see. You guys can get one for the most recent year. They allow you to apply from wherever you are in the world and now they'll ship this out to you so you can read it and this is a great book because it has all the different courses that explains to you what the differences are. It's in Japanese, unfortunately, there is not an English version but it'll be a little Japanese study for you and worst case scenario, you can look at the pictures and at least see what the graduates are making and working on and see if that's the kind of thing you want to do. Oh my goodness, I'm totally forgetting.  You're gonna need to pay 33,000 Japanese yen with your application in cash. They don't accept debit cards, they don't accept credit cards and to come with that money in cash and hand it to them with your application and once you go there to apply, they will sit you down and walk you through each of these things that I just mentioned though. They make sure that everything is adding up before they even accept your application and give you the dates for the interview process and all of that. So yeah, I hope that this video was informative for you guys. Last time I made an informative video like this, I left my email and I told you guys you can ask me questions but I realized that I think it's best that you guys directly contact the schools because I don't have all the answers. I can only answer from my own personal experience but yeah, if you guys want to reach me then you can of course leave comments and I'll try my best to answer them as soon as possible and yeah, I guess that's it for this video. I hope you guys found it helpful. Make sure to subscribe if you want to see more videos about Bunka and I'll see you guys in the next one. Bye. Hey guys, it's Annette, it's Annette and today I want to talk to you guys a little bit about something that I like to call fun times, baby. It is a party though, actually. You guys are like, Senna, what the heck is going on here? Like, I'm so confused. Where are you? What was going on? I don't remember who you... We're gonna go to Bunka. Where? Why do I keep talking and me? It's just me and homie. It's just you girl. To find out more about Bunka and to kind of go on this Bunka journey. I don't know what that was, but it was something. Okay, you don't know how to focus and make a video on it.


So today guys I will guide you into getting yourself to complete police aka cops aka ncpd clothing slash armor sets. You want to run around night city pretending to be pcplud while today I have you covered. How's it going guys my name's dpj and if you enjoyed this video leaving a like really helps out and if you like what you see I'm going to see more cyberpunk on a daily basis be sure to subscribe and turn those notifications on. Also to give you guys back for the amazing support you showed me on my cyberpunk videos I'm doing weekly giveaways where you can win any game of your choice to enter simply drop a like on this video make sure you are subscribed with notifications turned on and leave a comment down below good luck. So as you know clothing within this game is all a mismatch and finding certain sets to look absolutely amazing is pretty hard I've covered a few already you'll find them on my channel just click my channel icon and today I bring you another today we're going to go all balls out looking like one of the ncpd and it does look absolutely amazing. Now what I will say is armor pieces are limited with mods slots and what each can offer you can see on the screen now so when it comes to farming these said items people before picking up said items create a manual save and keep reloading that save until you get that perfect max mud slur armor piece another thing to make a loot in a much easier on yourself make sure you have the reinforced tendon leg cyberwares which give you that double jump these ain't necessarily needed but they make looting so much easier as that double jump is so so handy these are obtained from victor the very first ripper duck you see within night city is location can be seen on screen now so this full ncpd armor you will see locations too now it consists of four legendary pieces with a glitchy top and like I said to get the most out of each piece make sure you create a save file before picking the item up and just keep reloading that save file until you get those max mud slur unsaid piece so guys enjoy the video and I hope it helps you out if it does leaving a like on the video really helps me out if you're new around here I want to see more cyberpunk on a daily basis be sure to subscribe and if you never want to miss a video upload you can turn notifications on by hitting that bell button but guys thanks as always for stopping by hopefully you enjoyed the video and hopefully I'll see you on that next one