Uh, so I'm Matt Johansson, Matty J, whatever you want to call me. Oh, uh, I'm Kyle Osborn, or the cause. This is cause, baby cause, sure. Oh, uh, I'm the cause. A lot of people know me as Jack Bauer now. So that's kind of cool. The internet's Jack Bauer for the LA Times. And someone joined, I don't know who it is, but someone's on. Who is it? There he is, cool video chatting with us on our Chromebook. So, uh, we both work for White Hat Securities, uh, Threat Research Center. That sounds pretty much as epic as it gets, right? But, um, we are web app hackers, uh, you know, you want to talk about it? Oh, yeah, yeah. I'm an application security specialist, uh, blah, blah, blah. Offensive security, fun stuff, uh, likes to make things scarier than they actually are, but not flood-like. Kyle breaks things. This is our obligatory, what our company does. We scan websites for vulnerabilities just past 4,000 sites. Very cool. Don't care. Okay. So, the CR-48, this is what started this whole mess. This is what started our research. Kyle's sitting on Google Plus on it right now. Uh, this is the beta version of the Chromebooks that came out back in the fall of 2010. Who, uh, who had a beta CR-48 in the room? Sweet. Yeah, they were sitting on about 25,000. You have yours right there. I have an extension I'd like you to install. So, uh, so, uh, they were sitting on about 25,000 of these. They mailed them out. They gave White Hat 1, uh, for us to hack on it and we wouldn't be here if we didn't, right? So, we found some pretty cool things. Um, so, before the CR-48 came out, Chrome OS was out as an open source project. You could install it on whatever machine you were running, whatever VM you were running, that kind of thing. It was the first device that actually was dedicated to it and, uh, you know, utilized all of its features. Utilized all the security features that, uh, Google put in place. Um, yeah, another thing is that, uh, this is no longer a beta product. Uh, these are, these are out in the public. Samsung put them out as Chromebooks. Did anyone buy them? Cool. See if you, nice. Alright, so yeah, they're, they're out there. They're in production right now. Um, so yeah, what we know about Chrome OS, right? It's a, it's a web-based operating system. Uh, we were actually shocked when we opened this laptop that it was just a browser. It was just Chrome. We were like, oh, okay. A machine with Chrome on it. I already had one of those. But, so, uh, this, this is all it is, right? It's just Chrome. So, um, in order to get any functionality out of this, besides the web browser, you got to use the extensions in the web store. It's kind of like the Apple App Store, but they obviously couldn't call it that. Um, so, because of all of that, uh, nothing is stored locally, right? The hard drive, you have no access to it. As a user of this device, you cannot touch the hard drive. Uh, there, you can't store anything on it. It's small anyway. Uh, you know, nothing is really on it. The file system is there. It's just Chrome. Um, so because of that, it's pretty fast. You open these things up and they're on, you're online, you're on the web browser.  They're pushing you towards the cloud, right? So, um, you know, this is what they're putting up against the iPads of the world, right? This is what they're putting up against Apple. Uh, you know, they're trying to steal some market share and it could very well sneak their way into the market. These, the Samsung Chromebook only came back, came out in June. So even though we've had these CR48s for a while, they've only been available for public purchase for a few months. So we don't really know what it's going to look like if, uh, this is going to steal a bunch of market share or not. So the analogy that we like to make, I've made it a few times already, is, um, that these things are kind of like mobile devices but with keyboards, right? So it's an iPad with a keyboard, but it's just a web browser on it. Um, so the same way that on those phones, like an iPhone or something like that, is very locked down. And in order, you can't install anything on it. You can't just go ahead and install Microsoft Word on your iPhone, right? Wouldn't that be cool? But, uh, in order to do anything with it, without jailbreaking it, you gotta go to the App Store, right? So how many people in here have more than three pages of apps on their iPhone in their pocket?  So people go app crazy, right?  Um, so those of you who have iPhones and have installed all these apps, how many of you have seen the permission warning that comes up, right? This app that you're about to install is going to have access to your GPS location, your call history, your text messages, your mother's maiden name, your social security number, all that kind of things, right? Who's hit cancel because of that pop-up box? Oh, not enough of you. This is Defcon. Come on. All right. So the same thing kind of happens in the Chrome Web Store when you go to install extension on Chrome. Right below the install button, it says what websites that extension is going to have access to talk to you. So we'll see some more examples of this in a second. Oh. Another thing we want to point out is that with the App Store, there's actually a code review process, or not necessarily code review, there's an application review process, sort of like a Q&A sort of deal going on. It's not a security review as far as I know, but the Chrome Web Store doesn't have any sort of Q&A process going on. So you go immediately from the third-party developer to the Google Chrome Web Store for anybody to download. So a lot of these extensions are developed by third parties, right? It could be Zynga, or it could just be a person, right? Google also has a bunch of extensions in there, but we found vulnerability in those, too, right? So there's the other thing I wanted to talk about. Oh, yeah. So because of the lack of review process in the Chrome Web Store, you can look it up right now. There's an extension called Cookie Stealer. I promise we didn't make it, but it's called Cookie Stealer, and that's what it does, and it's available for download. We're going to demonstrate a malicious extension that we developed later on in the talk. It's called We Named It Malicious Extension with no legitimate purpose whatsoever. I did upload it. And it got into the Web Store, no problem, right? You could have downloaded it. Well, we'll show it later. It's not there anymore. He took it down right away. I only let a few people download it. We put the icon as a picture of Justin Bieber. It had four million downloads. Okay. So what does a hacker see, right? So we're looking at this Web Store as web hackers, like heaven, right? This is a brand new attack service for us. This is months old. It's not even years old yet, right? So I'm sure this room, more than anyone knows, early on in our product lifecycle, where does security come into play? Just non-existent, right? So it's not making money early on. It's costing money, right? So a lot of these extensions are just coming out now. So, of course, they're going to have security holes in them, because that's what we find. Especially now, because it's all just HTML5 and JavaScript. So why do you need to worry about security in HTML5 and JavaScript? You do most of that stuff server-side. There are not very many attacks that a server can't block that get reflected back to a user with HTML5 and JavaScript. So the other cool thing about a lot of these Chrome extensions, it makes them different than a lot of Firefox or Safari or Internet Explorer add-ons and things like that, is these are just mini websites. They're just used to help increase functionality of these Chromebooks, especially, but the Chrome browser, right? You can install any of these on your machine right now. A lot of them just take up very little screen real estate, which is really important with what started the whole mess. So this is kind of their version of Notepad. It's called Scratchpad. It's just note-taking application. It was pre-installed. It was the very first one on the CR-48. Who's used it? Who's seen it? Who has CR-48 Scratchpad? All right, cool. So it's a little nifty note-taking thing. And the other feature that's cool about it is that it automatically syncs to your Google Docs account in a folder called Scratchpad. So when you're writing up your shopping list or whatever you're doing in this little tiny mini-website in the bottom of your screen, it syncs to your Google Docs account. Another feature of Google Docs that we've used in this exploit was that you can actually share a document or a folder with someone else who's using Google Docs and they don't have to give you permission to get that folder or document, right? Which has been, I guess, mostly okay because Google Docs is pretty well protected. But the Scratchpad extension was not, right? So we could go ahead and share our malicious document, which you'll see in a second. Do you have anything you want to say? Right. So just the key points that we wanted to push is that it comes default. Everybody that has Chrome OS has it. You can install it on Chrome. What was it? You're authenticated to your Google account to use it, right? The main feature is that it syncs to your Google Docs accounts. You're definitely authenticated. Everyone has it. It's on every single one of these Chromebooks and you don't need permission to receive anything. And then on top of that Google Documents lets you share across or lets you share to anybody without notifying them or allowing them to accept it. It just automatically goes into their documents completely stealthy if you want to. So not only do they not need to give permission, there's a nice convenient checkbox when you share a document that says turn off email notification to the person . So we can go ahead and share the document without the permission and they'll never even know that it happened, right? And this automatically syncs to scratchpad. So Google fixed this cross-site scripting bug right away, but I found it within half an hour of opening the CR48. It was the very first extension I opened. I threw in a tag. No sort of filter. I didn't do any crazy WebHacker stuff. I threw in a tag. And we were like, oh, what can we do with this? So at first we were trying to steal OAuth tokens that it was using and things, but then we just realized that it was talking directly to docs.google.com and www.google.com. So we were able to do some cool stuff. So we have a video since they fixed it right away. Right. So this is in Fall 2010. There's about 30,000 users at the time. Those are either Chrome users or Chrome OS users that come default.  And your browser history for some reason. So we're going to go ahead and show intent and functionality, which is actually just adding a document and syncing it. So this is a regular users account. So here is the sync right there. So there's actually a scratchpad folder on the left if you can see that. And that's actually where all your documents are stored. And that's important to remember that it's in that scratchpad folder because we're going to be utilizing that feature to attack this victim. So we're going to go ahead and move over to the attackers docs and you can see there's an inject right there that a document right there that has a HTML and JavaScript in it. That's completely sane inside of docs.google.com. It's not being rendered. There's no JavaScript being executed. It's just the title of the document. So from... Can you guys see the URL that we're calling? Ah. So we're basically using an onmouseover event just for illustration purposes. This could all happen automatically, but we're going to use an onmouseover event to fire our JavaScript and it calls out to an external JavaScript file on Kyle's domain.imawesome.com and that's the external JavaScript file. It expired so if you want to go buy it I guess I could have sold it here and made some money. Yeah, now we're going to share it. So we're actually going to be sharing the scratchpad folder. Now when we share the scratchpad folder from the attacker to the victim, the full folder actually gets moved over. So right here we go ahead and throw the user ID or the username, the victim's email address into there and we uncheck that little nifty checkbox that says Send me... Send email notification. So we can just simply share it to the user without any sort of notification. So go ahead and share it. We'll zoom back right over to the victim's account and in just a second his Google account will sync with a shared scratchpad folder. There it is. And then in just a second it's going to sync with scratchpad. Now this is just an on mouse over event so just a link with a JavaScript event. We can make this all automated. There's no reason that we couldn't just make it pop. So what we're doing here we sourced in that JavaScript file into this completely sane extension provided by Google and we have now taken over the extension. So we made some nifty buttons at a JavaScript that do exactly what they say on them. Right, for the purpose of the demonstration there are buttons all automation is pretty basic. So the first button actually grabs your Google contacts. Because you're logged into Google and scratchpad needs to access google.com we can just pull down google.com slash contacts. So I can have scratchpad just make a request, pull down the export functionality, pull all down as nicely formatted CSV format. Thank you Google. And then I can wrap that up. It's very possible. I can just wrap that up and spit it back out, send it back to the attacker without the user ever really noticing. Another bit of functionality that scratchpad app has, because it has access to docs.google.com and www.google.com I can actually spawn a tab with one of those host names in it and then I can inject JavaScript into that frame. There's a nifty built in function called execute script. Yeah, tabs.execute scripts. So it's great because now we can effectively inject JavaScript to any web page we want. And in the scope of this app it's only docs.google.com and www.google.com but we can effectively inject our own JavaScript into these web pages without any sort of vulnerability in these web pages. So there's no cross-site scripting that we know of in Google.com that we're utilizing here we've simply just injected the JavaScript directly into the DOM via these extensions. And so you can see on the screen we just you know, stereotypical alert box with the cookie in it. So what we could have done here is shared a malicious folder with a malicious document with someone that we knew that was using scratchpad automatically execute JavaScript in the context of it. Grab your whole address book and your session and then force you to share that same document with everyone in your address book and so on and so forth. And let's head and not notify anyone that we did this. So it's potentially a zero-click silent worm, right? So we can go ahead and just go steal every session of anyone who was using scratchpad at the time. One click if you had to open the extension. But this all could happen automatically if the extension was open. So how do we do this, right? So we've been talking about permissions a little bit here and there, right? So if you guys have played around with Chrome extensions at all, when you have them installed locally, the permissions are actually set in a file called manifest.json and basically it just tells you what websites this extension can talk to. Scratchpad can talk to docs.google and www.google. But of course it can, right? So like, if you install a Google document note-taking app, of course it's going to be able to talk to Google documents. Why would that stop me from installing it? But the cool thing here is that not only the permissions are set by the third party developer, right? So if they don't know any better, what do they default to? Talk to every website. You know, I don't want to deal with this later and it breaks something. So we've seen some, we've seen some extensions out there that have these widowed permissions just basically star, can talk to star that don't need it. But the other kind of scary thing is that some extensions need that permission. Something like an RSS reader, right? Is there any way to blacklist or whitelist an RSS reader for what websites it's going to be able to talk to? So if you have an RSS reader extension, it's going to need to talk to every possible website that's going to have an RSS feed on it. So it's going to have wide open permissions. And again, Google does not check these extensions or the permissions that are set by the third party developer before they're uploaded to the Web Store. All right, so a quick overview of the APIs that, as an attacker, I found interesting. So the first three bookmarks, cookies, history, those basically allow me to access, edit, do we insert bookmarks, cookies, and history. This is great because I can kind of pull down your whole history, all your bookmarks, all your cookies, and then if I want to make trends I can figure out which websites you go to most often. I can stage attacks based on that information. Or if I have direct API access to all of your cookies, I can just pull down all of your cookies and impersonate you on every website that you're currently logged in and have a session with. Now, windows and tabs. Windows and tabs, pretty much all the extensions have this. This is basically the API that allows them to create popups, create new tabs, and create new windows. It's pretty standard. This is also the... Or talk to any currently open tab or window. So if an extension needs to talk to a website that you're currently open, it doesn't need to pop something up or let you know. And this is the awesome one because this is the one that has the functionality of tabs.executeScript. So most of the extensions utilize this API, and most of them have the ability to call the execute script functionality. And that's great because if most of them have it, it just means it's that much easier for us to code into websites that we feel necessary to. So on the bottom there, you see that's a screenshot of what the manifest.json file. Like a sample manifest.json file. It just had permission to storage, notification, tabs. Tabs is what we're talking about. That's cool. And then you'll see a sample wide open permission kind of regex. So it can match on any protocol, any domain, any path. Any protocol is kind of tricky here. It's not actually any protocol. It's either HTTP or HTTPS. So even though it's a star, it's just those two things. We can't start initiating FTP connections and stuff like that through these things. And you see that scene very often. There are extensions in the wild right now with cross-executing. Every once in a while I pull down the top 1,000 featured or most popular extensions. I go through and I parse the manifest.json files and there's a good percent that we have exactly that. And of those, I can usually find a few that have vulnerabilities. So what are we looking for now? As web hackers, we're not looking for buffer overflows or anything like that in your software security. It was perfect. We were giving this talk at the executive briefing at Black Hat. It was a little quick couple of minutes of it. And this guy was talking before me and he was talking about, I couldn't have asked for a better person to be talking before me. He went up to ASLR and DEP and all this kind of stuff. Comparing Windows 7 and OS 10 and the latest and who's more secure. He gave this whole talk about that and I got up there and introduced ourselves and I said, this is exactly why we don't care what he just talked about.  We're talking about everything in the web now. I don't care about what's on your hard drive. These machines are not going to be able to make you lose your job quickly. Even if they did, you're storing everything in the cloud anyway, right? We were just able to hijack everyone's Google account. How many people live in Google? I know I do. It's all my email. We were cracking up. We were using Google docs to pass outlines for this talk back and forth through each other. We just found a vulnerability in it. While we were testing Scratchpad, I also shared with you that we're looking for a new set of usual suspects. We're not looking for insecure software on your hard drive or anything like that. We're looking for extensions that are going to take input from somewhere and display it back on the screen for cross-site scripting vulnerabilities. We're going to look for extensions that perform some sort of sensitive administrative function for you conveniently on some website for CSRF vulnerabilities. We're going to look at some of the web hacks that everyone's known about for decades. We're not doing anything fancy here. I don't want to write crazy buffer overflows, ASLR depth bypasses, anything like that. We're just writing JavaScript and we're doing some pretty cool stuff. The other unique thing about these extensions is if you find cross-site scripting on a website, you can attack the users of that website. If you find cross-site scripting on an extension with wide open permissions, that's completely different. We're not seeing that a lot today. This is kind of new. So we have a direct quote from Kyle here. So why are we going to spend all this time? Why are we going to spend all this time trying to learn assembly code or anything like that when JavaScript is really easy? So it says this small child. That is a quote that I said. So cross-site scripting is going to give you everything we want and more. Exploit development is hard. I don't have time to learn it. I'm not smart enough to learn it. Kyle agrees that I'm not smart enough to learn it. All these APIs are really easy and callable by JavaScript. Maybe we can get a memory-based malware keylogger in this system if it really felt like trying to break the sandbox or something like that. No one even showed up at Cansec West to try to break the sandbox. That's not what I'm going to spend my time doing. The return on investment isn't worth it there. The impact is so high with these vulnerabilities but the learning curve is so low. It's really just JavaScript. Most of the attacks can be done in two to five lines of JavaScript and it would be pointless to really do any sort of in-memory malware because as soon as you reboot the machine it's lost. Your attack window is shorter amount of time and you can't really do much once you get the code execution. The hard drive is read-only besides your home directory but nothing in your home directory is executable so you can't even maintain persistence with native code execution. The other thing that we haven't seen yet that we're seeing here is if we're going to fix this besides fixing just the cross-site scripting holes a lot of the sanitization might have to happen client-side. These extensions are locally. Usually when you fix cross-site scripting you're doing some sort of input validation or output encoding on the server side. What if these extensions don't talk to a server at any point? They're just grabbing information locally, things like that. Then the sanitization might have to happen client-side. That's crazy. We don't even know what that's going to look like. Let's get to another fun demo. This is a purposefully malicious extension that we threw together just to demonstrate the one really. This extension pretty much has the same permission levels as the scratchpad extension does. It's nicely named malicious extension. Anything we do here we could have done with scratchpad. I can't do it anymore because Google fixed it. Actually, I take that back. The only difference between a scratchpad extension is that instead of having only access to Google.com, we have access to star colon slash last star. We can access any domain, any hostname, any protocol. That's actually very common. There are extensions out there, RSS readers, things like that. I think at the time the top rated RSS reader and the top used RSS reader had an access bug in it and had permission to talk to every website when we found it back in December. This is just a little easier to demonstrate. With this extension here I'll go to maximize. Great. With this extension here we just have the nice little buttons again. Of course, we've seen the Google contacts. We can just pull that up and there you go. There's your Google contacts in a nice CSV format. This is a fun one. Did you update this? Yeah, we did. Who wants to come up on stage and type their phone number in? Wedgie. I promise it's a password field. No one will see it. One, the area code and your number. No, no. What we're doing here since this extension has permission to the whole website, it also has permission to Google Voice. We're actually able to hijack that Parse Google Voice at CSRF token on the fly. And then spoof a text message. Actually, I changed it. It's no longer a text message. It's spoofing a phone call. As a user, I wanted to get someone to call someone. I would have Matt with a vulnerable extension. I would pop his extension. Then I would force a phone call to his phone and then that would call whoever I wanted it to be. Our last one was also a text message. But it's not limited to that.  We can pull down your voice mail. It's really not limited at all. Your phone ring? Not yet. Mine ring. No. It's using the victims Google Voice account to call you. As an attacker, you were just using my Google Voice account which then called you. That could all be automated again. It's just buttons because they're pretty. The demo gods are not smiling. Another fun one which is Execute Alert. Execute JavaScript, same thing with Google.com. We're just going to go ahead Google.com, Facebook, JavaScript injected, Twitter, Yahoo, and Chase is still giving some air. Let's just go ahead and pretend there's an alert box there. Will it actually work? Look at that. These websites don't have any vulnerabilities in them. I'm sure they do. We don't have permission to test that. We haven't exposed or utilized any vulnerabilities in these websites. We're just injecting code to them. We can go one step further instead of alert. Why don't we just inject a JavaScript key logger? There's your in-memory malware. You now have a key logger in every page that you go to. It's not just spawning tabs. I can contact tabs that are already open and inject as much or whatever I want. We can listen for what tabs you're opening. We can view your history via the history API. We can watch I Love Lucy. I Love Lucy. Another fun one which hopefully doesn't kernel panic your Mac again. We can actually do XHR scans. Because we have access to colon, star, dot, star, whatever, we have access to everything. This also includes IP addresses. We can actually use XHR requests to scan your local subnet and look for anything listening on port 80. We'll go ahead and do this on this one and we'll see if anything pops up and hope to God that it doesn't dot. The button doesn't work. That's sad. We can basically do any port that's not restricted by the browser. The browser has it hardcoded. You can't access port 20 through 25. You can't do IRC. You can't do SMB stuff. You want to be able to do SMB scanning in the network to look for windows hosts. You could pull down a local list of web servers in your local area network. I could potentially fingerprint your internal network by taking over one of your extensions. Scan your internal network. Look for fancy things. Say you have Gira listening. Or maybe there's printers there that I can take advantage of. Who was at our black cat talk? Anyone? We found a printer. We did the XHR scan and there was a printer listening and we did that. It was pretty awesome. I don't know why this isn't working now. It's probably somewhere. There may not be anything. We might be segregated. It's cool because you can see it do its little thing here. It scans really fast. It made all those requests at the same time. It's a very quick scan. We can pull back not only the fact that the host is up to the content on all the pages we're requesting. We can pull back the full HTML page and the headers. If you do have Gira or some wiki or ticketing system on your internal network, we can pull that back, parse that page and find out exactly what it is. From there, we can, as an attacker, go, okay, great, you have Gira. I have Gira zero day. From your web browser, I'm actually going to own your Gira server. Load up a interpreter session and suddenly I have a shell from your Gira server that I attacked from your browser calling out back to me and I have a real shell on a server inside your network. So... Who uses LastPass? Who's heard of it, uses it? For those of you who don't know what it is, it's a password manager. Us as security guys, we're always telling people hey, you need to use different passwords for everything. Use a different password for every website or any of them all. This LastPass is actually a website that makes that a little bit more user friendly. You go there, you make one password for LastPass, it generates passwords for all your different sites, stores them securely. It actually is a really awesome service. Kyle used it and that's why we found the vulnerability in it. They have an extension in Chrome. It had cross-site scripting in it when we first were testing it, but they fixed it right away. They've actually been really awesome to work with. We're really into it right now. So this is kind of our demo of we can own an extension that has no vulnerability in it that's doing absolutely everything correctly and it's pretty cool. Right, so when I was testing the LastPass extension, I did find a vulnerability. Some pretty hard to manage on drag, whatever. They fixed that pretty immediately, but I realized as I was testing it, there's this functionality of the extension that'll, as long as you're logged into the extension, it'll automatically log you into the LastPass website.  You want to be able to access your Gmail account without being logged in. You don't want to have to re-authenticate. So you've always got the little red square up there saying that you're logged in. So when that's a case, you can go to LastPass.com and it'll automatically log you into LastPass.com. It does this because the extension notices that you went to LastPass.com and it kind of handles the login process for you. It lets the server know that you're actually logged in and then it passes your local crypto key from LastPass to the web browser, to the frame. So real quick, LastPass, like Matt was saying, great service, it handles all of your encryption locally. So your database that you send them is all encrypted. Your password is never actually sent to them. It's all stored locally. It's all in the DOM. It's all decrypted in the DOM with a representation of your password. So anyway, it passes that local key to that frame. Now we can take advantage of this automation because we can, if we say we own an RSS reader, just Joe Schmo RSS reader, some third-party developer that doesn't really know anything about security, but makes some great extensions and, say, has like 500,000 downloads in the app store right now. We can spawn a tab for LastPass, where, of course, not speaking of any actual top-rated RSS reader with a vulnerability in it currently or anything like that. So we can spawn a new window with LastPass. What this does is the LastPass extension then goes in and notices that window. So it thinks that you open that window and that you want to go to LastPass.com. So it automatically logs you in to your online vault and, you know, you can change settings there and all that and access all your passwords. And that's great. But instead of allowing the user to do that, we're going to have the extension automatically open this window, allow the extension to log you in and then inject JavaScript to pull out your crypto key. So now I've got your private key to decrypt your database. Then I'm going to just, you know, grab your database because I can do that. It's very trivial and we're going to demonstrate it right now. We can just decrypt it locally in our hacker den at home. It's like a man cave but with more green lights and Neo. So we're logged in right now. We've got recently used so, okay, Google and a bank. So if we go ahead and click grab LastPass database it's going to spawn it up. It's going to automatically load it up. So we're logged in. No prompt from the user. In just a second it's going to, you know, change. So, okay, so here is your actual crypto key up there. It's a weird way of passing it between the extension. Now I grabbed your database and then I just decrypted it on the fly right there. So what we can do with this is we can just grab the database, send it back to us with your key and then suddenly I've literally got the keys to the kingdom. I don't know about you guys but I put way too much information in my LastPass extension. I've been using it for about two months and I probably have close to about 50 sites or more that I just use because I slowly switching away from my weaker passwords to the long random stuff. But that doesn't matter if an attacker can just come in and literally steal my LastPass database and cryptographic key. That's my password too. So we did this at Black Hat and we didn't actually write this as not really my password. DefCon don't try to log in. And someone logged in and sent us an email. They were very nice and they didn't change the password on us and lock us out but we didn't trust you guys. You look shifty.  Anyway so the important thing to know about this is that there's no vulnerability in LastPass at the moment. We're not taking advantage of anything that LastPass is no cross-site scripting that we know about. What we did find they fixed immediately. The extension itself is not vulnerable anymore and actually this functionality is no longer there. They made it so you actually have to click it from within the extension. It's still ownable but the extension doesn't automatically log you in but if you are logged in we can still own it. So it's not as automatic and cool as what our demo was but it's still ownable. And that is the last version of LastPass. You're all safe now I promise. So we're running out of time so let's try to fly through some of this. How many of you guys know what beef is? You've heard of it. How many of you know what Metasploit is? So beef is kind of like the Metasploit of the web app. So you can store a lot of preloaded payloads and things like that to do cool stuff and help making hacking websites easier. So if you find cross-site scripting vulnerability in a website instead of just hoping that your JavaScript does what you wanted it to do the first time that you pass this injection you can pass it a beef hook which is what it's called it actually maintains access and you can just replay attacks over and over again. So it makes everything that we did just really, really easy. So I made this even easier and I pretty much just took all of the demo functional I did and I threw them into beef extensions beef modules. So now when you own an app all you got to do is hook beef and suddenly you have beef inside the extension you can maintain access and you can send commands as you want. I'm not there yet. So first check permissions like if you don't know what extension you're in for whatever reason all the extensions we tested are all local so we don't really need to check the extensions but if somehow you manage to own an extension that you're not really familiar with you can hit this module and it will give you all that information. Execute tabs, execute arbitrary JavaScript inside of all tabs. So if you want to inject a key vlogger it's pretty simple and my favorite is to inject beef. So basically if you have tabs open and I want inside of those tabs instead of doing execute tab I can just inject beef into those tabs. So I suddenly go from one beef session to 50 beef sessions because you have 50 tabs open. So now not only I'm inside your extension but I'm actually inside bankofamerica.com I'm inside your PayPal account I'm inside of every website that you currently have opened and it's very simple. Yo dawg I heard you like beef so I put beef in your beef so you can beef while you beef. Perfect. And the other three just do kind of with the other demos that we had. So basically our main point that we're trying to push here is that this is kind of the same problem we've been dealing with forever it looks different. So this isn't the end all be all of security but it's definitely a step in our direction. It eliminates a lot of modern malware and viruses because you can't talk to the hard drive but it doesn't mean that we still don't want the information that you're storing on the internet now and if you're using one of these devices you're being pushed very heavily to store a lot of information on the internet in order to get functionality of these. So like I said we're not looking for these buffer overflows, underflows any sort of stuff like that. We're just looking for cross-site scripting which is the most widely available on the web today. And since you're literally taking the desktop out of the desktop operating system you have to rebuild all the functionality that you're used to with your desktop operating system. You don't have a calculator anymore so you have to download a calculator extension. You don't have a mail client so you have to use some mail client or notification system to recreate that. So one of the things, one of the first things that people ask as soon as I tell them about any of this research is what about the sandbox? I hear about this chrome sandbox did you guys break it? Did you guys break the chrome sandbox? Oh my god, right? We didn't break it, we just went around it. These extensions actually live outside of the sandbox so what the sandbox does for anyone who's not familiar is it isolates each tab from any other tab that's open and also isolates that tab from the hard drive. So that's why it eliminates a lot of the modern malware and viruses that we see today. They actually control their own kind of intertabular communication and again I made that word up and I think it's awesome. So these extensions completely control the communication on their own the permissions that are set locally and they live outside the sandbox so instead of breaking it we're walking right around it. We pour water in your sandbox and make it all muddy. So again just a harp on this the permissions are set by the third party developer. They're not set by Google and they're not checked by Google. But a lot of that stuff that Google did put in place has made some awesome improvements in security. We're just kind of here to say hey that's not it that's not the end all be all. One other really cool thing that they did the Chrome Web Store is explicitly we're not allowed to attack the Chrome Web Store via any extension. It's actually hard-coded into the Chrome source that none of the extensions can interact with the Chrome Web Store. And the reason they did this is because if we could we could force you to install extensions. So we can kind of do a privileged escalation right. So if you had a scratchpad installed with the vulnerability they could talk to docs.google and we could force you to install an extension with wider permissions then we could do some more stuff but we can't do that. They thought of that way before we did so. So we're going to fly past this because we didn't do too much research on it but nifty new feature of Google themarket.android.com who's used it who knows what it is.  So you can install apps on your Android phone from the internet that's not blacklisted. So we can actually force install apps onto your phone via cross-scripting. And because it's part of Google services as soon as you go to that website you're automatically logged on and your phone is listed literally open up a tab spit some JavaScript at it and force you to download and install our own malicious extension again I'd probably adjust in Beaver wallpaper and then we can just harvest information off of your phone without you ever knowing because it doesn't really prompt you on your phone it doesn't tell you that something's about to be installed it just tells you Justin Beaver Live has been installed. Yes. Finally got it. So just in discussion with the Google security team we've been talking to them this whole time they're really cool guys. One of the ideas that they have for fixing this in the future is creating more restrictive APIs for common use cases things like RSS readers they're going to eliminate a lot of the risk involved with that they're going to try to create APIs for extensions that absolutely need to use this wide open permission set in order to function properly this unfortunately does not eliminate the threat of a developer not knowing any better and creating an extension with wide open permissions so it's just for common use case APIs so it's not going to eliminate it but it could reduce it. That's it. I have one more thing to know clap clap One more thing that we wanted to note is that all of this is the same for Chrome browser the only difference between Chrome OS and Chrome browser on a Windows, Mac, Linux machine is just another operating just another browser so you're probably not going to be installing tons and tons of extensions unlike the Chrome OS One other thing to note is unlike Chrome OS the Chrome browser can install extensions with binaries on them plugins so LastPass actually has the ability to sync your LastPass logged in status among your other browsers using the binary we can actually interact with some of those binaries with JavaScript and I haven't looked into a whole lot of it but with LastPass alone there's functionality to read arbitrary files on the file system so if I own your LastPass extension not only do I own everything in LastPass I can read random files from your hard drive as I feel Cool. Thanks guys. We'll be in the Q&A. Thank you.


Ostupale aiji, komments di kakuja ka sote, is the only faithful young brand in the 254, he goes by the name B-Mix and is here with us to share his story, Karibu Sanu. Thank you, thank you, thank you so much. Your camera is number four, introduce yourself Mr. B-Mix and aka Zakozote. My name is B-Mix, I'm an artist and also an actor. I've been acting quite a few episodes, Trapos too. I started my musical journey back in 2018 and I went to Kafika Mali to Mefika. Okay, you're in Trapos season two? I was in one of the some of the episodes in Trapos as a supporting cast. As a supporting cast? I have some of my friends there and I trust them. The famous lady, Aika. Aika was here, a very good friend of ours. She's a good friend of mine too. What is the name of that guy? From the states? Roni. Ron? Yes, exactly. They've been here, we had a good time with them. How are they doing? Aika pwa, aika fiti wa nilia pwa. I'm on a run of later, we're in a couple of music videos. Yes, he's a vexer now. Making moves man. Making moves and we're clapping for you man. Shout out to them by the way and shout out to Trapos for sharing a Kenyan story, the Kenyan way. Mr. Mimix, that is not the reason we are here today.  These questions are so many. You allow me to ask the five questions now. Okay, very much welcomed. The first one on the list, let's just get to IG and see what's popping, what's cracking. Yes, there. We have the first question and it's Mr. Ha. That was the first question. How did you start? That is the first question. How did I start? Well, my musical journey, I started back in high school in primary. I used to do, we had talent shows. So I used to go do the talent shows where ngeyanda ngerap angoma zakina Ken Reze, zakina T.I. First forward to high school, we formed a band. It was five guys to look at me and say, but kima leza shule, 20 to hit the studio. We do our thing. After high school kila mpa kenanji ya zake, but we I managed to catch up with one of the guys, Javik. We did a song, but it was released. So I got used to the studio in 2018 and it released our first collaboration project, which was me featuring Donado and a guy called 1999. And then officially in 2019, which is Sango Mayango. Officially. What is the name of the track? The name of the track is called, the first track is called Tron, which is also the name of the coming album by the same name Tron, the album. Okay, so there's somebody here and a backup news story is going on, it was the real T.I. official. We've seen him start from way back in high school. Tell him to tell us the challenges he has faced as a new hip-hop artist in the in a gangiton-dominated industry. Well, being the gangiton-dominated industry unatua wimbo, msa nakuliza, na bro, si ujaribu kufanya ka gangitoni viki ya si ujaribu. Popside. That's the music guys actually want. But you see, there's a difference between what I'm doing and the gangiton vibe. Uta pata the gangiton vibe, mandi mwada kam ko kwa video wa tachise, wa jinaise, wa hype. I'm not against gangiton or anything, but kuna vele, I'd like to take my music. Ikuna a direction na jerebu kuipelaka. So uta pata, for me as not being a gangiton artist, wa say when I expect, like in my videos, when I expect kukuna mwada, mwada kam, nudity and all that stuff, kukuna all that drugs and all that stuff, that's something I'm trying to avoid as much as possible. This is quite featured along with my brand. And uh, one enda show, una pata show wa saywa na piga gangiton na lafum, vaibiyako, it's so different before I say we're just, uja ma. It's a tough one. I'm not against gangiton. Ikuna yo hype, ikuna yo hype ikuna gangiton ikuna vaibiyake. And the vibe that I'm bringing is totally different. This person is asking, how are you surviving in this gangiton dominated industry? By pushing. Just pushing. Keep on going, taking a step at a time, kuna kwa ma, una pause, I'm going to re-evaluate okuna ume ume ume jishika, una sangambele. We just keep on pushing, keep on pushing. Alright. Thank you very much for that one. And then, kuna ume sayana uleza, why hipo? This goes by the name CYN, CYN ATWA. It's very hard to pronounce. Cynthia. CYN underscore CYN ATWA. ATWA. So is he not? Okay. But shall I think for that question? I would say why hipo in particular? Okay. The thing is, the music I'm doing is not necessarily hipo. My fans may say it's hipo. Now me may say it's okay. You guys may say this is hipo. Let it be hipo. How would you describe it? My music cuts across genres. I have a song that is thrown in the first song. It's hipo, yes, but ikona also some old school classical kind of vibe. I have other songs that are coming. Ikona aregi vibe. I have an afro vibe. The album that is coming, which is called Throne, it's a compilation of many different genres. Uki kachinu skiza kinli naf, from the very start to the very end, it's a story. It's a story from the very start to the very end. The first song, Throne, Uki skiza bilaku shaful, ni story. Nika story kana ndelia. Which is very hard to do, which is actually not something common in Gengeton. Actually, then ikakuna mi siya metua Gengetoni kwa story. Challenge to you, Gengeton artist. The story ends with you on the throne, or what? Actually, the story starts with me beaming for the throne. The first song being thrown, it's proclaiming who beemix is. This is now beemix entering into the scene. Uki skiza throne, inanza, I'm back baby while I'm back in Amberta. You can see it from a mile, I'm a goka nageira. Basically from the start on, nambia waseni me kuja. I'm back and I'm better. I'm back from what? The first project we did, which was back in 2018, which was a collaboration. I have my own. Now I have my own song, my first song. I'm back and I'm better. And you can see it from a mile, I'm a goka nageira. Basically from the onset, thrown in a proclaim who beemix is, what's the story, what's the journey. And then going into the next song, which is no lies, now nambakupata, a beach behind the story of who beemix is. Shout out to you Mr. Beemix. I'm at this accessory. I'm a rock star baby. This big thing. Thank you. Is this your jula? Because you're icy man, you're frozen. Actually I have a plug for this. I have a guy who I don't know what he's talking about. I don't know what he's talking about. Yo beemix, I have some stuff for you man. Come check it out. Alright, give me a shout out. Because you're looking icy as well. Yo, if you can see me man, big shout out to you man. Shout out to you Mr. Hegigo. Thank you very much Mr. Amifist for sending your comment. Remember we're still having that conversation on our Facebook page. That is at Y254, and we are asking, do you think it's right for white people or non black people to be sidelined when it comes to the genre of hip-hop? And this is derived from this conversation that is going around about Eminem and Snoop Dogg Dogg having some settle business. So tell us what you think. Do you think it's right for black people to sidelined the non blacks from this genre of music called hip-hop? Remember we are in white people's genres as well so to squabo. Anyway it's out to you. It's never about what I think. It's about what you think right now. Alright so we have that Kenyan artist Anauliza. What was the inspiration What did you mean? What did you mean? Shout out first of all to that Kenyan artist who is a very big friend of mine. He's also doing amazing things and we should check him out as an animator dubstaff. What did you mean as I said it's part of the story and in the story in this segment on what did you mean we catch up on beemix after the heartbreak series. We start with thrown beemix and all that stuff. We go to the next song which is no lies. Now we get behind the story on beemix and in no lies a confrontation happens between the partner and in a relationship. After the confrontation they separate and then there's a whole list of song apokatikati which plays part of the story and then we get to what did you mean and in what did you mean he reflects back on no lies after the whole incident because in no lies I never trust the same way twice I never trust the same way twice and then what did you mean once beaten something twice shy reflecting back on no lies so what did you mean in short it's a heartbreak that was inspired by true events and I twisted it, I turned it I tried to make it as much relatable to the outer audience as much as I can. Wow Man how long did it take you to compile this project before we can carry on with the fan questions It's been a whole like this compilation of this project from 2019 nambaka saizi it's not yet completely out it's been a whole process man like one year and from 2019 nilanda kwi compile 2019 nasezi toko 2021 who's on production the guy on production is a bad ass producer by the way the kenyan industry hasn't seen this producer this producer is bad this producer is sick he's called frankenstein the phenom he's called samflani see when I look for beats I don't just go to a studio and the producer gives me a beat and I was like let's go I look for the soul in the beat because that is what the fun it takes with first because if the beats ikona soul wung is the soul yako is imaj it becomes something so epic I try as much as I can to connect with the emotional side of the songs so shout out to Mr. frankenstein shout out to Mr. frankenstein frankenstein the phenom palaiji the same name to frankenstein the phenom actually he also has his own songs you can check him out on youtube too the same name frankenstein the phenom on youtube on IG on twitter too which kenyan rapper do you look up to? Mr. kiyarie kenyan rapper well I wouldn't say pa say that I look up to but I'd say that kuna wene kuna watu kwae industry nima angali anika seme umse nimnoma wuna chiki una petu umse ishi umse ama weza like ako fiti lani kiaza ko yo list nani ngash I know somebody that you can be friends with nash is number one on this nash nifadela kwae chitua mo nash nifadela from my bag that looks just a G one thing I respect about nash is that aki enda kwa shuoka na perform a perform kwa makia bada wa say bada wa say that's how you know somebody is a legend one thing about nash kenyan afanyanga niti nash lady sismiyake lady sismiyake kona so much maturity alafu kwa kwa kwa kwa kwa kwa kwa kwa kwa kwa kwa simple sana baka competition na itchiki kwa kiyo alright that guy is big man I see you nash if you are watching this or if you get to watch this you better find the e-makes because this is the future right here nifatia 2 nifatia 3 calligraph oji respect the oji umse usho na beliana speed ko flow as in flow ya hake umse ni muenda alright he's got that one oji because of that one number 3 I'm not sure I have number 3 from the underground okay breeder pia mewaza breeder mewaza breeder na katapila awa noa kufiti ume pandeyo flow ya waswa the leaders of the new school right there in association with b-mix okay na onapa evi kuna mse mse mma chatuku gasap kiasi kuna mse anase mma when is the next big thing apu evo ame church ambasana b-mix official to the mf world we cannot bhenji bhenji ulam jo bhenji is a big ass artist by the way that's a big type of artist that's the next one man okay Lawrence ame di baka di general anase mma big up bro you're making a big mr b-mix ulam tamboa thanks man thanks nitawa tamboa nikiya na nikiya angele kakomenseksu na nikiushu na nezawa tamboa okay so let's get to the questions now we have another one here hmm jenny mark anuliza do you feel hiphop has a positive or negative impact in society explain ha jenny if hiphop has a positive or negative impact in the society well I wouldn't speak on behalf of hiphop per se because it's a big thing but me being a hiphop artist I'd say it has it's effects like there's the positive and there's always everything that has a positive always has a negative like in the hiphop scene utapata there are those guys who are very conscious with their rap like Akina J. Cole wanna spit sense uki skiza kenya na saema kuna sense in it and then they are also on the other side kuna they are there for the hype so utapata so derogative so basically in the hiphop industry it has both kuna advantages kuna disadvantages everything has an advantage and a disadvantage and in the hiphop industry wanna help big time influencing this culture man so we can say for a fact that hiphop has a negative or positive impact to society it is what it is so you pick what you want you pick what you want because it's broad hiphop kuna kuna rapiasua kuna rapiangosa kuna rapia french not any hiphop see you that's a smart answer we have this person anitua cyn cyn twa tena she is back and she is asking what inspires you what drives you what inspires me what drives me what is the next big thing so i don't know if this is what's the next project come and drill down the next big thing we'll get back on that what inspires you what drives you well what inspires me is what drives me being a global world it says it's become a global village in the designer we can connect with so many guys from across the world and during e-corona time we got to see different states and all that stuff and in all that stuff we realize kuna villi tu kenya ahasi wamaju wanaju wa tu ko lakili kuna villi that tu pekaisi maketu na checki so the thing that pushes me is to try as much that's why i have ke kwa jina hangu na ju of course kuna those acts akina calligraphoji akina nyash they're pushing kenya to a big level already but i'm also trying to get nismamia apo nisemi kenya ninaoma numeka kenya kumapa kenya ninaoma kuna du desan aka kuna jaykol muna n singer piiisid kuna wase waka nivizuri and at the same time my mother is very a strong person fighting for racism and all that stuff and black hunts so it pushes me also to fight for the recognition of our hunts Kwa hivitana hifana kiwa? She's in Berlin. Oh, in Berlin? Ya. Okay, she's fighting for rights of black people from Berlin. Chantama ma bimix whenever you get to watch this. Much love. And amazing work you're doing right there. Aha, so that inspires you. Put in Kenya on the map. Put in Kenya on the map. And you also struggle ya mamaku. The struggles that I've been through, they just motivate me to keep on going. And the motto that I always have is, never quit. Kama na jubu, I'm saying when ya, where's he quit? I'm where's him shinda. Uta mping ya. Nisa wa? Ata umia. Ata umka na tender liya. Okay, we have the last question here. And Ulisa, where do you see yourself in a decade also? In a decade also. This is minus Jeff. And it was minus Jeff. Aha, big shout out to minus Jeff. My bro. Where do I see myself in a decade? In a decade it's going to be big man. Right now this is my second interview. My first being on Science TV. But in a decade to come, it will be a whole wave. Because we are starting. And me be mix. Sikapa pake hangu. I've been here through the help of a lot. And a lot of guys. Mr. manager in the area. Be mix nation. And be mix nation. It's going to be a wave. Soon enough. Tunafagia. Tunafagia. Tunafagia. So in ten years to come. Grammys. Prali. BT. And I hope that is not going to be our first gram. Because we are not going to wait ten years man. Probably. Before those ten years. But in ten years. By running. To come out. To come out. To come out. All right. All right. I see a glass safe up. We will come out. All bless you. All praise is to the most. And I think we are going to do an interview. And a photo on a baraka. Baraka zaki jaja. Bank festasime jaja. We are about to play your music Mr. Be mix. But before we play your music. I see you did a challenge. Up I made them back say challenge. On YouTube. We should really bone it up. We will bomb us up. Although I am not sure if kaka saw this. So the challenge. Because I think come on here. Challenge. I am going to consider. So it is YouTube. What will you do with social media? YouTube, IG, Twitter, all social media. Cross all media platforms. All right. Ya. What is the importance of a challenge to you? Whenever you see one that is dope and you'd like to jump on. What is the importance as a hip-hop artist? Well, first of all I look at what the challenge is about. Soon on a kamae challenge. The challenge is about peace. Mesi jakili kwanga ku unite wa say. And to bring peace with the Mbeksa sign. We do the Mbeksa in the sky. So actually mi antyangwa lukujaka nambiyo. So you check out this stuff. Come ya. So let me go check it out. Nikiwa nikiwa nikiwa nikiwa nikiwa nikiwa nikiwa. Nikiwa nikiwa nikiwa nikiwa nikiwa nikiwa nikiwa nikiwa. Let me try and see if I can tell on the beach. Ya. Then you did it. The message has to speak to you. The message has to speak to you. Actually before I complete the set. This is now a final song. Doinimetwa. Lazi ma kuna message. Dania wimbo. Every song that I write. I'm a storyteller. Thing is I'm a storyteller. Noki skiza. What I'm saying lirically. There's a story. Atakwa yon Mbeksa challenge. Bado tu ni ka story tu. Alright. So here's a brand new song. It goes by the name B-Mex. The name of the song is What Do You Mean? What did you mean? What did you mean? W-D-U-I-F. That is the acronym right there. Check him out on YouTube. Kila Mali Kama B-Mex. We're going to be playing a song here. It's going to be performing it for the first time. Umai perform kwa TV stationiwote? No. No. Okay. For the first time on TV. It's going to be performing it. Supported by Rajiz the DJ himself. Ha. But kwa sasa. Rajiz zwa kumbusi wanyu wata pata social media. Na wanyu wata pata mixes ako kwa zwa. Meni chosa paivi kwa kwa comments. Ya. R-A-J-Y-Z-L. Rajiz the DJ. On lower. Aha. Okay. So, kunam tuwa pamingia katika Twitter. So, I think this is in relation to what I ask you. Which Kenyan rappers do you look up to waluu me respect? So, umse a kwa paivi yana sema. Ujama ni kama atambui wakadinali? Ha. Ha. Wakadinali ni wazi? Ha. Sayi, sayi, sayi. Aha. Okay. First of all... Shalati mubi Mr. Rona by the way. On Twitter, Shalati mubi. But all the showbioh, everybody. By the way, mea tisa sasa I can't list every. Uo na jok list nirefu. List nirefu? List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. List nirefu. So, guys should stay tuned for the album. It's a story. Look them straight into the eyes right there and tell them. It's a story from the very start of the song to the very end of the album. It's a whole story. I'd really like for you guys to join in on this Jani Mui Cheki. It's going to be epic. And on our social media you can find me on Bmix KE official. YouTube Bmix KE official. Tweet at the same Bmix KE. Go drop a comment on the latest video in Niku Cheki. Whether any positive or negative. Drop a comment. I appreciate every comment. It's engagement and it's feedback. Alright. Thank you very much for that one. You had a story from the horses mouth. So this is hip-hop Thursday on why in the morning we are still having that conversation on Facebook. The topic of conversation is about white and blacks or blacks and non-blacks. Katikai genre hip-hop. So we ask and do you think it's right for black people to deny non-blacks the acknowledgement in this genre called hip-hop? Yes. A simple yes or no. Staki will explain. I repeat the question. I hip-hop ni etu sisi we usi a mother people are invited. Ah, this thing is for everybody. This thing is for everybody. Katikai is big. Shata bimi is performing his latest song. Life's Appointed by Rajiza DJ. Right here on Y254. Then we'll be back with some more of hip-hop Thursday. Hip-hop in Hopale. Fresh out and amazing music by Rajiza DJ.


Live from Anaheim, California. It's theCUBE, covering Nutanix.next 2019. Brought to you by Nutanix. Welcome back everyone to theCUBE's live coverage of Nutanix.next here in Anaheim, California. I'm your host, Rebecca Knight, along with my co-host, John Furrier. We are joined by Dr. Ayanna Howard. She is a professor and chair of the School of Interactive Computing in the College of Computing at Georgia Institute of Technology. Welcome, Dr. Howard to theCUBE. Thank you, thank you. I'm excited about this conversation.   You started your career at NASA. Correct.  Tell us what you're doing today. So what I'm doing today, and what I'm really excited about, is bringing robots into the home of children with special needs. So one of the things about kids, and those that may have a developmental disability, is that there's not enough contact hours with human clinicians. And so how do you augment that in the home environment? How do you bring technology into the home to do therapy with them, to do even education? And so that's what I focus on. So we want to hear so much more about that, but what are you going to be talking about at this conference? It's the future of AI and robots. Yeah, so I'm going to talk about the things that make my robots work. And so the future of AI and robotics and where it leads is a combination of things like wearables. So if you think about all the data around us, we have wearables with our phones and our smartwatches. All that data that's being collected about us allows our machines to do very interesting personalized things with us and for us. The other thing is that if you think about collaborative AI, collaborative machines, we're going to the place where the workforce and how you do your work, you are going to have an AI as a companion, a robot as an assistant. So you might not be sitting next to a human, you might be sitting next to a robot. And so what does that look like? And then of course, emotional AI. And so yes, machines do have emotions, which counts kind of weird, but in order for us to work with others, we typically have a bond. So why not have a bond with our machines? What's the software look like? I'm riffing in my mind here, just thinking about, I want to write some software that be dynamic, a neural network, these kinds of words been kicked around in the industry. How do you make software have emotion in AI? Because it has to be random, but yet not, it has to be programmable. It does, but think about it. Emotions are not necessarily random. Emotions are pretty repetitive. I.e., if you're hurt, what do you do? If you're young, you cry. If you're older, you hide the cry, right? I mean, it's very repetitive. If you're happy, there's a certain emotion and what makes you happy? There are certain things that we can all say, if I suddenly woke up and I won a prize, I'd be happy. Emotions are actually very predictable. They're not that hard to model. And the data sources could be coming off my Fitbit, facial recognition, you know, the morning. Well, facial recognition, you can see it in the face. In fact, your pulse, and you sweat a little bit when your emotion changed.  Sure. Okay, those were fake, but still, their concept about them was that, you know, your body gives a response based on the emotions inside. Yeah, it's so cool. So what's the state of the art? If you had to, you know, look at bleeding edge and state of the art kind of mainstream, where are people with the software, machine learning, AI? What's some of the things that are notable to you that are important to highlight? Yeah, so I think that the two areas that are the furthest ahead is, one is facial recognition and emotion detection. And it's because the applications that are out there, as an example, airports are putting in these systems. So imagine, I mean, the positive is, is that you don't have to book or print out your ticket, right?  I mean, just imagine that, and you're like, well, how would you do that?  So I don't have to make sure that you are who you are. I know. I mean, so that's kind of the benefit. Of course, there's some negatives that you won't talk about. But that's one area, this facial recognition aspect. The other, I think, is in healthcare. I think it's in the fact that our data and about us, about our health, it's so much there, and as we mine it, we just get better. There's, for example, some research that shows stress can be detected. And I can then have a, think about it, I can have an AI that if I know you're stressed, like, I'm not going to send you that email. I'm going to halt a little bit until I realize that your stress level is a little bit better. And then I will give you the bad news, right? Like, because we don't want to be stressed. But that's a manager with really good intentions. I mean, you can really see the perils of this going. No, that's the negative. That's the aspect of all these things are really have good return on investment, good quality. But the negatives are is that if you have a nefarious manager or an organization's like, I just want to make money, money, money, you can sway that. And I think, though, that most organizations are thinking about this. I think there's this push now to do things like regulations to basically protect us, but still ensure that we have a positive relationship with AI and robotics. What's the coolest thing you've seen or built recently that could tie into the robotics? So I will personally say it's one of our machines that has, it emotionally responds to you based on what you're doing. And so what does this mean? It means I have robots that are just looking so cute, right? You look at them and anyone looks at them and it's just, it's like, it's real, it's intelligent, it like understands me. Of course it's programmed based on modeling, but it's just as fascinating. And I watch people interact with the robots and it's like, oh my gosh, like this person, this individual is really engaged with my robot recreation. And you mean in conversation or just in feeling the camaraderie? Conversation and interaction. And the robots, they have a limited script, but people will adapt to that, right? And they will, it's just like when you talk to your phone, have you noticed that when your phone doesn't understand you, what do you do? You speak a little slower. You might choose different words, right? I see that with the robots. You change your behavior based on the limitations. You're speaking with someone who doesn't speak your language natively. Correct, correct. Same thing with robots. So describe what you see, returning to the beginning of our conversation, talking in particularly with kids with special needs. Describe what you see, the changes in the child who is developing a relationship, a bond with a robot. Yeah, so what we've actually shown, not just see and observed is that when we have a child interacting with the robot there, and what we call whatever milestones we're doing, so maybe it's movement therapy, which means I want them to say move a little faster than their normal space of moving. What I see is with the robot there as a partner, encouraging, guiding, providing them input on how well they're doing or in terms of correcting, the child improves their behavior. And so between day zero and day in, the child has gotten better. We see that, we have the data that shows that. Incredible. I want to also ask about women in technology. And this is really a theme at every single tech conference you go to because it's such a problem. It's such an issue that is finally getting the attention it deserves. We know about the dearth of women leaders, the dearth of underrepresented minorities, particularly in management leadership positions. What do you see as your role in tackling this problem? Yes. As the head of an important department in technology, and also as a woman of color. Yeah, so I think there's always been kind of two dilemmas. One is what they call the pipeline, which is now the pathway. Like how do you get women to come into STEM? And the data has shown that it's not that girls are not interested in STEM, is that they lose interest because of their society, right? So that's one thing. It's like make sure that where they are and the society is encouraging. The other is that when you get older, you look up and you're like, okay, there's no one there. Obviously I'm not supposed to be here or when things get tough, it's like, okay, I need to move out. And so the other is, is how do you do mentorship and sponsorship so that women are pushed forward as managers and supervisors? So those are kind of the two things. And so as a, and I consider myself a leader in this space, I actually feel it's my duty to be upfront and be a mentor and be a lead and actually be vocal and make others realize like if I'm in a room and we're deciding on a student or a candidate and there is no representation, I'm comfortable enough to say, hey, I should not be the one that says this, right? And eventually what you see is that people start looking and thinking about this at every instance of time. Do you feel like it's getting better? I do, it's getting better. And it's not perfect, but it's getting better. Like if I look at my in the classrooms or I look in like the computer science curriculums, I see more female students coming in and lasting and then going into corporate America and continue on to grad school. I see it being better. Of course it's not on parity, but it is better. That's awesome. And the technology has shifted the definition. It's not programming or electrical engineering. The surface area for tech is gaming to analytics, data science is a huge- Human-centered interaction. This new artistry around it. So I think it's a great surface area. It is. And I think one of the reasons why it's so important is that the world is diverse. I mean, in terms of all the different aspects. And so if you're going to create products for a diverse world, you should have individuals that are also diverse creating them for everyone and so that there is some equality in the process. As the analog world connects with the digital world. Fascinating, we're talking before we came on camera around the technology and digital. So the human experience from whether having robots detecting emotion and having some sort of new kinds of notifications like, hey, you know, cheer up or do something clever is that you can now immerse. So augmented reality has been the first killer app before virtual reality, but gaming is an indicator of what's happening on screen. So the on-screen digital realm is intersecting with our lives. It is. What's your view on this? Because this is an area that's new. It's cutting edge. It's a first generation problem, opportunity. Opportunity. I think this blending of the, I would say, even I will say the blending of the digital and the physical and the gamification aspects is really going to enhance two areas. One is education and the retraining. And so what does that mean? It means that, you know, instead of me having to, you know, not to say go to college for four years, but instead of me trying to study everything in this one semester course, it's like I just need some basic knowledge and I can then work in the field and I have my augmented reality. And so I see things and there's some scaffolding. There's some indication of here's the step one, here's step two. You did that step two a little bit wrong. Let's revise it. You saw you learn with real-time training and that's with doctors, well, except for live patients, but, you know, with doctors or residents or factory workers or even teachers, teachers who are teaching, say, calculus that may have an English background. That's where it is. So the progressions are not linear, like they used to be. They're different and now you have data and instrumentation with on-demand digital robots, agents. Agents, adaptation, taking things from other places. So if I, for example, learn the best way to provide information to this human and this factory, well, guess what? I can take that information, connect to the cloud, connect to the data centers and apply that information to another worker in a different factory but very similar characteristics. And so you have this transfer of knowledge as well. So education was one, what's the other one, healthcare? Of course it's healthcare, of course. As someone who is immersed in it and a believer in technology, what do you do to disconnect? Well, first of all, do you disconnect? Do you worry about our over-reliance on these little devices in our pockets? And what do you do to sort of leave the digital world behind for a while? Yeah, so I do worry about our over-reliance because we've shown, and other researchers have shown, that there's actually an over-trust factor. We will use devices and of course these devices, they have errors, right? Even if it's 1% of the time. And that 1% of the time when they have errors, we find that a lot of individuals will trust those errors because they're over-reliant. And they kind of go in zone mode and they're like, it worked all this time so that 1% they just don't question. It must be real news. It's, but it's scary, right? It's scary. I do worry about that. And we're thinking about ways to try to mitigate that because that does worry me. How do I disconnect? I think that with anything, mind, body and soul, so I love listening to music, although that's not disconnecting from technology because I'm using technology to listen, but it's this zone period exercise. I think most of us think about exercise. I'm fairly religious even when I'm traveling, like, okay, I'm going to find the gym and at least walk on the treadmill because we do have to have that combination in order to be healthier cells. Finally, for the little girl, the little girl, you, who is watching Bionic Women, I think that's the thing. We need more shows like that to get kids interested. Well, exactly, exactly. What would be your advice to the smaller you who says, I want to be a scientist someday? So I would, and this is like some advice that people told me as I was growing up, and I didn't realize I had really good mentors, is one is don't listen to the naysayers, i.e. believe in yourself, right? And I think that's the one thing we sometimes forget to do, like believe in that dream, even if others say that it's not possible. And it's like, no, everything is possible if you believe in yourself. Words to live by. Thank you so much for coming on the show. This was great conversation. Awesome. I'm Rebecca Knight for John Fourier. We will be back here tomorrow with more from Nutanix.next. We hope to see you then.


This is St. Tech Hawaii. Community matters here. The options and choices in life. This week, Hawaii begins the 76th commemoration of the bombing of Pearl Harbor. The day that changed the entire world. Today, we will visit with my new best friend, who was just a child when Pearl Harbor was born. So, if you're ready to join us, we ask you to navigate the journey. So, let's begin with Harako. Haranako, I'll get it right. Oh, tell us, tell us all about you. How old were you the day of the bombing? I was ten years old. I was in the fifth grade at Alieva Elementary School. And so, you lived in Alieva at the time of the bombing? Yes. How did you find out about the bombing? You couldn't see Pearl Harbor from up there. Did you see the planes fly over anything? Well, I noticed that some planes were flying overhead. Then later on, we listened to the radio and we heard that Pearl Harbor was bombed. Did they tell you what happened? Who it was? How did you know? The Japanese pilots bombed Pearl Harbor. Oh, that's when the radio said that the Japanese had bombed Pearl Harbor. So, how did you feel being Japanese? How did you feel about that?  Well, I understood, but my parents came from Japan. And I'm a Nisei, so we just had to do what we can to help with the war. So, now your parents came from Japan, so did they speak Japanese or did they speak English? They spoke some Pigeon English and some Japanese. So, did you live on a farm? My parents had a truck farm and they rented a place, at least some place in the Waimea area. And so, you lived in Waimea? No, on a vegetable farm.  So, how many siblings do you have? I come from a family of nine with three boys and six girls. And I'm the last one. I'm the ninth family. Ninth one, great. Right now, we have three surviving. My sister, I'm 86. My sister is 94 and my brother is 96. So, just three of us are alive. Were they all there at the time of the bombing? All of your siblings? No, some of them were working and I think a few of my sisters were going to school. I mean, they were working at Holly Homes and going to school from there. So, the day of the bombing, that was a Sunday, so what was your Sunday like? Once you heard on the radio what had happened? Well, we just had to do what we were told to do. We were told not to leave B-Home at eight o'clock, not to go out at night. And we had to darken our windows, apply black paper so that the lights cannot be seen from the house. And we were not allowed to go to the beach. Now, when your parents are from Japan, did they have any pictures or anything from Japan? I think my parents had a picture of Fiorido and they had a Buddhist altar there. So, they took away the picture.  The altar was there, but... When you covered it? No, it was okay. It was okay? It was just having to move the pictures. Did anybody in the Americans come to your home and see what was going on at your house? Any of the American military or the police? Because the martial law, so didn't any of them come out that far at the Hollywood? We lived in a place called a true lane in an isolated area. And there was a back of a house. There was about a hundred feet away, a little hill. And there were about five or six military soldiers guarding that area. And then when they needed water, they came to ask us for water from the outside faucet. First, they asked me if the water was poisoned.  Did they drink it? They drank it and found out it wasn't poisoned. So what were they guarding behind you? I don't know. It's an area where they could watch the area, the surrounding area. So was there a large Japanese... There were some hasu patches and rice fields or whatever. I meant local Japanese. So they were watching to see if you were spies. I guess they were scared of everything. So tell me now, when you went to school, once you went back to school, what was it like at school? We had to carry gas masks with us every day until about four or five months later that we had to turn in the gas mask.  Ten years old. With the gas mask? But did you have to carry it? You didn't wear it. Well, we had to practice and the school had a big air raid shelter. So we had to practice going in there and coming out from there. So how far was the school from your farm? Oh, it was about three quarters, about three-fourth of the mile, I guess. And I used to go through... I used to catch the bus, but I used to go to the back area where there were some hasu patches and tarot patches. And sometimes I would go to the cane field and go up on the railroad track.  And I said, okay, now I... And he kept on doing that so often, so I finally reported that to the vice principal and she talked to him and it stopped. And he said, you bomb Pearl Harbor, yeah. So did you get a lot of harassment from other people for the years that went on after the war? I meant after the bombing. I think there were some people that went to friendly, you know. In fact, I used to go to Japanese school and when they took away the Japanese, the Buddhist priests and those Japanese school teachers, so the Japanese school was canceled. And even those businessmen, you know, there was a tailor. He was interned and there was also this journalist, newspaper person. He was also gone. And then my girlfriend, they had a restaurant so their father was interned too. Were they interned at Pano Uli Uli or on the mainland? I don't know whether they were sent to the mainland. So that left you with no school? Yes. So when you go to Japanese school, was that after the public school or during the day? When did you go to Japanese school? After the English school. After the English school. In the afternoon. In the afternoon. So that you learned the culture and the language or is that what? Learning the Japanese and how to read and write Japanese. Japanese. But after the school was closed, I kind of forgot. So many years ago. But did you learn about the culture, about the history of Japan and coming to Hawaii? Really? Did your parents tell you why they came to Hawaii? My parents? Yes. Did they tell you why they came to Hawaii? I think my parents had a better life. In Hawaii. In Hawaii. And my, I think my mother was a picture bride. Oh. Yeah. Where was your father from? Hiroshima. And your mother? Where did she come from? She, in fact, my parents were cousins. Oh. So she was from Hiroshima also? Yes. Yes. And so he sent her a picture, I mean a letter and she sent him the picture. But how did that work? I don't know. I think between relatives, you know. Oh. Okay. He picked her out and sent her here to Hawaii. Yeah. So anyway, we need to take a break and we will be back in just one minute. Here, thanks to Think Tech will run only during the month of November and you can help. Please donate what you can so that Think Tech Hawaii can continue to raise public awareness to promote civic engagement through free programming like mine. I've already made my donation and look forward to yours. Please send your tax deductible contribution by going to the website, thanks for Think Tech, dot-cause-box-dot-com. On behalf of the community enriched by Think Tech Hawaii 30-plus weekly show. Thank you mahalo for your generosity We are back and we are talking about about World War two and the bombing December 7 now this week Here in Hawaii We have a week-long celebration or commemorations better the 76 years Since the bombing of Pearl Harbor the the day that the whole world changed everything changed nothing has been the same and What I remember You have to tell me this I remember that everything was rationed How about you do you remember about things being rationed? Yeah, I just remember that gasoline was rationed So it was hard to get from place to place And you know We were at school We had victory gardens mm-hmm We raised lettuce and string beans and During the sixth grade year We harvested string beans and Irish potatoes just to help with the war effort. Oh What did you do these you seldom send what I don't know whether We supplied The military all you supplied the military, I don't know what what happened to all the Harvested crops the harvested crops you supplied the military and we we also had projects like We needed yarn young Beans for the military soldiers and we we also had Knitted with the string About eight by eight inch this cloth. Oh So you made those in school. Mm-hmm all great and that was for the military. I think so So you you crocheted how do you make I think we We needed knitted. Oh eight by Did you have to collect stamps I? Collected stamps. Yeah, we bought stamps for the war effort. Yes. Oh, yes We collect stamps and we had saving saving bonds saving bonds. Yes, and I My husband and I I think we After a while when we cash out the bonds, I didn't realize that we had so many bonds Yeah, once I became an adult. I was amazed at how many bonds I had and stamps. Yes, like I Didn't know we kept collecting But it never occurred to me to cash in so it was 1962 that I finally cash. Oh, how old were you with it? Were you when the war started?  Mm-hmm. I was ten Yeah, I was three and So everybody was in that war unlike wars today Everybody children adults didn't matter where you lived You were in the war. They were part of the war and so We had a clean plate club You had to eat everything on your plate because there were children in Europe starving and I never could figure out how My eating everything on the plate is helping children And the victory garden yes, we had a victory garden so everybody Also with miles apart and everybody's doing the same things. I was I mean they really Worked at having everybody participate in this war. Yes so The war went on of course for years and with martial law. How does that affect you in halloweva or? Could you tell the difference out there as opposed to being in the city? It looked like there was a curfew and this blackout we had to darken the windows by putting a black black cloth or black paper We were not allowed to go to the beach Well, tell me now the first day of the bombing we understand Did did it did you think that the Japanese were going to come back or? Occupy the island did you ever? Have a sense did anybody ever tell you that? Any rumors that all they're gonna come back and get us? Did you ever have anything like that? I know on the mainland people were buzzing all they're gonna occupy They're gonna occupy. I just I wonder if you had that happened but you know on the mainland I thought the people who live on the West Coast Yeah, they were interned in areas far away from them The sickos right but I thought It was unfair that They had lost the property and business. Yeah. Oh, yes Yeah, lots of lost everything never did get it back. Well, even here Here Louie Louie was all Japanese farms and they took all of that and And The bank here the Japanese bank that confiscated all of the money. Oh No, this Everybody who was affected everybody was affected It's it's amazing now how we look back at that time and All of the this I Saturday this coming Saturday at The Air Museum, they are celebrating people like you That were children at that time that is children's day and they're celebrating So would be nice of you to Meet all the others that were children and survived on that day. We have a church project we we have We default to Saturdays in December To make to bake cornflake cookies Cornbread cook a cornflake cornflake cook conflate cookies So I am scheduled to help with them. Oh, you can't go and be honored Being one of the children that survived that that time That's I am just so delighted to meet you So have you drive all the way from Haleva to be with us this morning? That is just wonderful. You will come back and visit with us again. I Hope so Please do it's been a real pleasure and I love it's been a pleasure being with you. We'll see you next time