Hey guys, how are you today? We are back with another project spread prompt journal page for my creative year 2018 the month of April this first this month our topic is journaling and the prompt is Emotion I had to go check. Yes. The topic is journaling for the whole month of April and Today we're going to talk about emotion and expressing emotions in your art journal pages We'll talk about what exactly this is in just a second this particular little journal is a good one for this prompt because this This is a mull skin Weekly notebook for 2017 so it's an expired weekly notebook. I Like that it has you know calendars and dates and things in the background. I like Working on top of that and using it to add to my journal pages this whole notebook is about expressing different emotions and creating different compositions with movement in them Just looking at the pages with movement in them to create any evoke a certain feeling a certain emotion So here's a quick flip through Some of these are from submissions to magazines some of which are Otherwise unpublished on YouTube and you can see that these all have a really strong presence and Statement and looking at them definitely evokes emotion to the viewer. I Have to wax some of them because it's a little bit sticky. I love this one So we're going to create another page with the same theme These are from my Journaling with movement series here on YouTube and we're going to create this is one of my favorite ones We're going to create another one So we're going to go to the next page And I have these spring clips from Hobby Lobby which I talked about in my review this month For my creative year and these are really great for holding your page open When it gets to be thick like this the wonder clips work also so this is a smaller clip though But it also works and they're there's they both have the same benefit. They're small unobtrusive So it's easy to journal around them without having to worry about moving the clip This book is getting a little fat and chunky. So that's okay. We're gonna use a spring clip So then I went and I found these pieces are from a this is from a Kleenex box And I'm gonna cut this design out. I have some These are from flavored water. I don't know if I'm gonna use them, but I think I'm going to I Have this quote that was sent to me by my friend Cindy utter I do think this is some kind of paper where you can like spray ink on it or something I don't know if I'm gonna do that. I kind of like it just being black and white and To gather these all do evoke an emotion for me I usually when I'm working on journal pages and looking to express an emotion a feeling a movement Some kind of expression. I don't just Slap stuff on to slap stuff on generally that being said I also don't generally have too big of a plan I want it to be a very fluid organic process. It has to be for me to be successful. That's how I work So we are gonna do this. I'm gonna fast forward through the process and I'll be right back Okay, I love this page whether you're doing it in a traveler's notebook or you're journaling your year in a planner or Some other kind of journal or maybe you're just doing an art journal for the year like this one I love this express your emotions in your work. I Wasn't sure this was gonna work So this was one of those kind of designs where it's intended to have Alcohol ink sprayed on it and part of it will stand in relief while the rest of the paper absorbs an ink I believe that's what that was anyway I Really wanted it to be more transparent and not have that white piece of paper on there So I covered in packing tape. I rubbed it in really well with a gift card scraper thing that I have from Actually, this one's from art C. This is a scraper thing Then I got it wet and rubbed the paper off and I love and that was just plain old packing tape people scotch brand packing tape Worked great and I love the sentiment my kind of wonderful and what that Said to me was Finding joy in yourself. I don't know why that's what that said to me But that is what it said to me and I wrote always be your own kind of wonderful express yourself with joy and abandon Baskin the joy of your own sunshine Don't wait for joy from someone else's son And I think it's a combination of the words and that these images from the tissue box So express yourself and your emotions in your work. Don't be afraid to put yourself out there You don't have to be crazy and show it on YouTube like I do you can keep it to yourself And that's fine if you want to do this and you want to share it But you want to share it in a semi-safe place the Facebook group semi I should say semi-private and safe place You can join my creative year. There's the link is in the video description again the topic for this month is journaling and the Prompt for this week is emotion. So I would love to see you all bring some emotion into your work this week I'd love to see how you do it. There's a lot of different ways to do it This is just one and above all don't forget to like share and subscribe if you would and Don't forget to go out and have a great day and do something nice for yourself because you deserve it And I'll see you later. Bye guys


Moj tudi količe je Flore Gubert in Sorana Toma, tudi v Franciju. Tako, če smo prezentovali, je to več preliminarne stave. V komentari so nekaj, ker smo počutili naši argument in analizirati. Tako, če smo izvistimati v tem paperu? Tukaj, smo počutili, da smo izvistimati vsečenje vsečenje vsečenje vsečenje in sošiljej kapitali. Načo, ki je zvednji sečenje informacije, zvokaj smo pošli na Senegalizm vsečenje in izgledaj se način o data, ki smo vsečenje vsečenje. Nasložili smo, da se pri vsečenje Senegalizm vsečenje nekaj sečenje vsečenje in sečenje, in, drug observations of both network access and network IUs on labor market outcomes. So what determines the quality of their job, both upon arrival and later on in the migration trajectory. The peculiarity of our data sets is that it's a multi cited survey. So we have within our data, observation of Senegalese migrants, both in 중요한 kontekst and in African context. And we are speaking about migrants in France, Italy and Mauritania. Unfortunately, we still haven't exploited the fourth sub-sample that is composed by Senegalese migrants in Ivory coast that is one of the way forward part of the story. One of the questions that we will try to explore is how does the context of the reception shape the role of networks in labour market attainment. Why we think that this is relevant? The mayor of the del, before, towards the seasonal introvert, is the veryw scaffibo. He spoke at theize, which is important, as it speak for the individual everywhere, whether there is a direct current in their購oval. So, first because migrants' labor market attainment and trajectories are a major concern in the policy debate. On one hand, they proved to be ta z vsočiko tegoje zvaljuj Dra chemije, in poten bi bom vsoči, da zvoučalimi informacijne netvore na laborstvom prijovali, ker je tudi na neko jezpravnjo nječvom iz Technico.  Oželjno, in včasno bilo zelo, da so tem počke, tega je vse vse zelo v del, lahko kako je počka nekaj vsega vsošanja vzelo in tudi nekaj vsega nega nekaj vsega, nekaj nekaj vsega. Daj vsega počka se je zelo vsega vsega vsega vsega, ig nuevo in stvoでき sove in Excellence, the main focus of this literature is to identify, I would say it may be not over summarizing, but it is to identify which kind of social capital help and which kind of social capital do not help. So the distinction into bridging and bonding is the main point, I would say of this literature. This will not turn out as a very relevant point in our data. We will try to develop others, not saying that we is not relevant at all. But this will not turn out as main, as a crucial point up to now in our analysis. The data that we use, is the database, that is collected for the mid-dust survey that was conducted in 2009 among Senegalese migrants in France, Italy, Mauritania and Côte d'Ivoire. da ovo se razli, zdaj smo najbiha tudi predse data seti, zato sem zelo se včetnimo na 4. Se je da način včetnimo nekaj nekaj 900 obzervacija. Taj odse svet je zelo dozeni v modulji po vsega post-migrače in na kredne neselje in vsi frane in familije. To je neselje in vsega in vsega in vsega in in in in in. In je vsega in in in in in in in in in. Poj developed even in Fieri in in in Italy There are quite like say old data I mean we are used to work with this data That dates like ten year spec But a lot of thing occur in between So this is something that can be described So how far our emphasize can be useful to day Meaning that, in between there has been the economic crisis and there has been the refugee crisis And the political spotlight on migration Pozvo, da sem tukaj oznatil, da se je načo način. Tako pozvo, četko. Prosti, če se prihvozago na vnikosti skupci. Tukaj nekaj, da se prihvozago, je to izbog moritani in svojšeljšeljšeljšelj. Da to ni pozvodnji vstav, da se izbog moritani tukaj to izbog moritani, da način svojšeljšeljšeljšeljšeljšeljšeljšeljšeljšeljšelj. in zelo je však jezda v Italiji in Franske, as we will see more deeply in our analysis. But overall we can say that the migration to Mauritania with respect to European countries displays a higher share of women, younger, people migrated earlier, and on average less educated, just to have a snapshot of what we are, because of course we are speaking of very heterogeneous people moving. So what do we investigate and how? So as I announced we are doing an analysis in two steps, where the first one is to identify who are the people who rely on networks to find a job, so where the dependent variable is network use, so the job search channel, and the second step is how the different networks and job search processes affect job characteristics, so where the dependent variable is labor market attainment. For both steps we have measures of both first and last jobs. Methodological problems are huge when trying to identify the relationship between social capital and labor market outcome because everything is intertwined. So we have two main problems. One is reverse causality. You can get social capital from your employment, and to solve this we use time. So we have measures of social networks before the first job and before the last job. So in terms of reverse causality we try to use time to identify the good direction. But the main problem is endogeneity, so the idea that there can be some other factors that affect both network access and labor market outcome and both network use and labor market outcome. We will use instrumental variable techniques to try to address this, and this is one of the main points of our conclusion, is exactly that we are not exiting the endogeneity problem, and this we will see later on. So, which are our dependent variables? I am going through the variables that we use. So in our first step the dependent variable is the variable derived from a direct question. So how did you find your first and how did you find your current job? And so that we know if this is a formal channel or an informal channel, and within informally if it's through family networks or friends network. Labor market outcome is mainly measured by the ESAE score that is derived mainly from the work of Gazenbaum, Trayman and quarters done in the 90s, that is the idea of associating a score to the ESAE score classification, the international classification of occupations that tries to capture the average income and average education level in each occupational sector. It has a lot of limitations as an index because it's based on weighted average of education and income among male population in 16 countries. So really we are quite aware of the limitation of this index and comments are more than when come on how to deal with it. We try to couple this with other indicators. One is the probability of being employed at survey time, and lastly, we use categorical variables. So unskilled manual, skilled manual, unskilled manual, unskilled non-manual skilled and self-employed to have a more categorical distinction of employment. Social capital variables. We have, of course, the use of social capital in this is first a dependent variable and then an independent variable. And in turn, but it's always the same one. The access to social capital is measured as a family network, both at arrival and before the current job, size of network known before migration and before the current job, and whether there are some natives in the network, meaning French in France, Italians in Italy, and Mauritaniians in Mauritania. Again, so this is a snapshot of the descriptive statistics of social capital variables. Again, as we see, so there is overall in Mauritania greater use and access of networks, but this doesn't capture all because, for example, the network use to find the, sorry, to find the first job. So the share of people using network to find the first job is the highest is in Italy. So, I mean, this is to go back to the fact that we have to explore more also this aspect. We control for a number of intuitive variables, so education, education in the host country, location of the family in back home in Senegal, characteristic of migrations and especially whether the person entered undocumented.  So, first block of analysis is who uses networks to find a job and we have both, the first table is upon, for the job obtained upon arrival and the second one is for the current job. So, first of all, what we see is that here is that both in Mauritania and in Italy, it seems that, so the model, sorry, is a multinomial logic model where the reference category is formal channel and so the coefficients tells us whether both the family and the friends. So, who uses the family and the friends channel more with respect to the formal channel. So, we have a higher use of both informal channels, both in Mauritania and in Italy. So, overall, what we can say is that who uses network more? Women, both family and friends network. In undocumented migrants, especially on what concerns the family network, and the people arrived young, age at arrival, especially on what concerns the family network. So, these are the major results of who uses network. It seems that network access has a positive impact on network use. If we look at the number of the probability of using the family channel, it has a positive correlation with the availability of family members at destination upon arrival. And there seems that there is a degree of substituability between family and friends network. So, having relatives in the destination countries lowers the probability of using friends network. But still, there is a correlation between network access and network use. Basically, at surveys for the last job, it's not exactly a survey time, but the determinants of network use for the last job are very similar. Undocumented migrants display a different, so before they had a higher probability of using a friends network, now this doesn't hold anymore, but they have a lower probability of using the family network. What is interesting here is that education starts to play a role. While for the first job, education didn't play a role in the probability of using networks, here it does negatively. So, more educated people tend to use less to rely less on informal channels. So, main findings, just to summarize what I just said, is that, initially, youth, women and undocumented migrants have higher probability to find job through informal channel. These results holds for the current job, but not for the undocumented, for people entered undocumented. Education lowers the probability of finding a job through informal channels, but not for the first employment, only subsequently. And there is a correlation between family network access and probability of finding a job through informal channels. So, social ties seems to play a role in job search method, and they kind of substitute each other, family and friends channel. Second block of analysis. So, how does all of this impact the employment status? So, this first table displays some OLS, and finally, an IV model to try to account for endogeneity of the occupational status upon arrival. So, the dependent variables is the EZ code that I presented just before. I don't show some controls, but in the end, I will try to comment a little bit on them. So, what we have is that, apparently, so in the first column, what we see is that the size of social network, so, one of our measures of network access, seem to play a negative role on labor market attainment. I don't show this, but this is also holds, if we look to bridging social capital. So, to the number, not the total number of people in the network, but to the number of natives. So, the French in France, Italians in Italy and Mauritania in Mauritania. Still, the coefficient seems to be negative. If we interact, so, this result is also true for network use. So, I don't know if I have a pointer. What we see is that also, both using friends and family channels seem to have a negative effect. Okay, try to speed up. From this table, there are two main things that are relevant to our analysis. One is that these results hide differences in the different countries. So, it seems that friends network has a negative impact in Italy and Mauritania, while the family network has a negative impact in France. So, there are differences of the role of networks as we, this was one of our questions, but probably, second main result is that this is not robust to instrumentation. So, what we do in the last column is to instrument the network use, so, the use of network of informal channels with its predicted probabilities after a multinomial logic. And this, the negative effect of network use disappears. And also, I don't show it, but the effect of network access. So, this is the main thing that I would say should be retained is also in the following slides. So, we tend to find an apparent negative effect of both network use and network access that is not robust to our instrumentation techniques. So, here what we, we display is the probability of being employed, so a probit model and an IV probit. In the probit model, what we find is the size of social network seems to play a negative role, especially driven by the Mauritanian and the Italian sub-samples, but this is not robust to instrumentation. Occupational status for the last job. Again, we find that, let's look to the second column. I skip something if not I will totally run out of time. We find the negative effect of having found the job through the network that is interesting because it's totally driven by the French observation, while in Italy the coefficient displays a positive sign. So, this is another thing to be explored more, but again, this is not robust to instrumentation. I can go back to the instrumentation, so what we use as an instrument in the different cases, but I don't stay on this now not to run out of time. The last slide here, what we use is the categorical distinction of occupation. So, try to see which is the probability to shift from the unskilled manual to the unskilled manual, to the unskilled non-manual, to the skilled and to the self-employed. There is no endogeneity control here, so we cannot claim any causality link. What it seems is that the network seems to channel people towards the self-employment. And this is, I wanted to report this because it seems consistent with other recent research. So, even if we cannot, it's not, we didn't do any robustness check. So, two slides of just of a conclusion. So, the main findings of this part of the analysis is that social networks seems to play different roles in different contexts, and there is not a sharp divide Europe-Africa, but also the European sample displays a great extent of heterogeneity. There is an apparent negative effect of both network access and network use, but it doesn't show to be robust to instrumentation. So, we cannot claim causality in this negative effect, in this negative coefficients. I didn't speak about controls. Just say some words. Control play in the expected way. Education and diploma destination have positive effect on labor market outcome, while being undocumented upon arrival has a negative and long-lasting effect. Not on the probability of being employed, but on the quality of employment. Ethnicity variables are often significant. We are wondering what does it mean? Does it capture, like a rural urban divider, does it capture network, some network that is not captured by the other variables? So, this is the question we are left in mind. So, overall, networks, what we would retain from this work is that networks are highly endogenous, and this should put into perspective a big bulk of pessimistic literature on network and labor market attainment. And it is really necessary to look at who uses networks. So, in our case, especially women, youth undocumented, less educated. That means that we could be interpreted possibly, and this is open to debate, if there are more vulnerable categories who resort to networks, but probably in the absence of networks that they would be worse off. And so, this is the main message that I think can be drawn from the analysis up to now. To be done a lot, I already anticipated something, explore more the differences across countries besides the network interaction, introduce the devorian sample, do an analysis on wages that is the only continuous variable that we have on labor market attainment, and to understand more what this ethnic dum is represent. Trenk ju, I hope not to be too long.


So yeah, Defcon has a long standing tradition and uh you know if it's a speaker's first time on stage then um they do a shot. So it's not about uh alcohol although you know yeah it's uh it's a tradition that is intended just to honor our speakers and uh Defcon you know from times of viewer. So anyway um this is Matt Wixie and uh he's going to do a shot with us. Cheers. Alright so please welcome Matt Wixie. Hello Defcon. Uh so this is um Cenoevil here in Oevil. Hacking invisibly and silent with light and sound. Uh my name is Matt Wixie. I lead the vulnerability research function on uh the pen testing team at PWC UK. I also run something called the Dark Ought Lab which is a research blog looking at the more kind of esoteric aspects of security research. Uh I've been at PWC for about a year. Uh prior to that I worked in uh law enforcement in the UK for about eight years uh leading a technical research and development team. So today's talk is split into four parts. Um first I'm going to show you three custom tools I've developed to uh use light and sound to jump air gaps. I'm then going to talk about uh laser microphones, two different kinds of uh infrared motion detectors and different ways you can disrupt and disarm them. Part three, bands. Um I'm not sure if that term has made it out of the UK um but it roughly translates to lulls. So it's kind of stuff I've found during the course of the research that um has made me um laugh more than anything else um rather than kind of being of practical use. Um and as you'll see throughout this talk that's quite a low bar um but hopefully you guys will enjoy it as well. And then I'm just going to sum up and give some ideas for for future research. So a couple disclaimers, the views and opinions in this talk aren't necessarily those of PWC. Um all the contents for educational purposes only so please check legislation, get permission and so on. Uh this presentation isn't about uh exploiting vulnerabilities per se. It's about manipulating uh the inputs and outputs of a system in order to have a desired effect. Uh and lastly I am definitely not an electronics expert or a physics expert at all. Um in fact I've only been in security for about six or seven years. Um my bachelor's degree was in uh English language and literature uh which has been really helpful. Um so um yeah so just to give you an idea um I kind of regularly still poke myself in the eye with resistors and burn myself with soldering irons and uh I see magic smoke so much it's not even magical to me anymore. It's just uh it's just I call it routine smoke. Um so this is where I am on the uh the Dunning Kruger curve if you guys are familiar with this. Um so I don't want you guys to think that I'm kind of presenting myself as an expo on this stuff um but what I'm gonna do at the end of the talk is uh put my Twitter handle up on my email address and please do get in touch if you if you think I've got something wrong or there's something that could be improved or you've got any ideas or suggestions that would be great because um that's what Defconn is about at the end of the day right. Um so let's jump straight into it. So the first thing I want to show you is this. This is an example of LIFI, a data transmission through light. Uh in this case the data is music and this is uh adapted off a schematic on github and the uh that will be in a the references part at the end of the deck. Um but it's basically uh what we've got here is a phone that's playing music. The headphone output goes to a breadboard of LEDs which are gonna modulate the music data that's going through it and then you have a photo diode hooked up to a speaker uh that's gonna play the music. Yeah so that was my impression when I actually worked for the first time uh and then I did the same thing uh with infrared LEDs as well. So exactly the same setup even the same song it's just infrared LEDs instead of white LEDs that are modulating. So that kind of got me thinking about air gaps in different ways you can jump air gaps and uh I'm gonna assume that everyone here is kind of familiar with the concept of an air gap. Um there's been a lot of research on how to jump them and they all come with caveats. So um the first caveat is that we assume the attackers will be managed to infect at least one host with a bit of malware. Um that the attack has physical or near physical access to that infected host because we're talking about quite primitive inputs and outputs to a system. So we're talking about like heat, sound, light, um EM radiation that kind of thing. And then linked to that um the exfiltration of air gap systems is gonna be really slow and it's gonna be quite small pieces of data because typically we're talking about two bit channels um so high or low states. So this is some of the research that's been done in this area you guys will be familiar with a lot of this already probably um all the way from Van Ek freaking back in the 70s which is EM radiation from uh CRT monitors. Um there's been some great work done by guys at Ben Gurion University in Israel on jumping air gaps. Um particularly using heat uh Vizysploit which um encoded data as a kind of QR code flashed it up on the screen and the attacker would then film the screen um and be able to decode it. And Hassan and others in 2013 gave a really good overview of some of these techniques um and one of the things that they proposed was using ambient light sensors for mobile devices to be able to control smartphones um by flickering overhead lighting that kind of thing. So the first technique I want to show you is using ambient light sensors. Um so ambient light sensors are um essentially hardware components. They're found in the frames of laptops, smartphones, monitors, that kind of thing. And they're normally um uh photo resistors, photo diodes, something like that that increases or decreases resistance according to the amount of light that hits it. Uh and the idea is that you adjust screen brightness according to the amount of ambient light. So it's quite a um benign uh thing to have. Um and you can interact with it programmatically um through the Windows API. So um my plan was to create malware that could read in light intensity values from an ambient light sensor on a Windows workstation. Um and then execute different commands according to the amount of light that was hitting the ALS and the kind of changes in uh frequency, sorry, in changes in intensity. So a couple of problems is that um you have to try and make this like a covert activity because you can't just shine a massive flashlight um uh uh laptop. And you need some kind of exfiltration capability as well right because um being able to control malware is fine but for an air gap system ideally you want to concentrate on uh exfiltration. So uh I'm going to be brave and try and show you a live demo of this. So I've got a laptop here um that's got an ambient light sensor. The ambient light sensor is just here and what I've got here is an infrared torch. So if I turn this on you should be able to see anything other than like a red glow but for unfiltered cameras um they'll be able to see that. So I'm going to run the malware on this laptop and then introduce high values through the ambient light sensor and that then uh pops up uh calc on the screen. Okay so in terms of exfiltration um optical channels um for air gaps are quite difficult um optically um there have been some things suggested so VizzySploit like I mentioned earlier that relies on the uh attacker having a camera um inside what is probably a secure area. So I came up with this instead um so the idea here is that the malware when it wants the exfiltrate data it will read in a file uh convert it to bits uh and it will then make very subtle changes in the screen brightness um to represent that which can be then picked up by an external sensor. Um so the easiest way to um make screen brightness changes is with WMI um unfortunately that requires uh admin privileges. However changing gamma values in displays doesn't. So you can use a set device gamma ramp in the Windows API um and you can make very very small changes uh in the gamma value of a display. So the the device I've got here um is a light to frequency converter and this is much more sensitive than a typical photo diode or photo sensor. Um it can actually pick up changes in the bioluminescence of bacteria um it can read light intensity changes through through your hand um and it's connected to an Arduino Nano here. So what I've got here is a um the circuit connected with a micro SD reader writer module and I'm just going to do a test of this exfiltration function. So the malware is going to read in a file and it's going to make very small changes to the gamma value of the display. Uh what the malware actually does it takes like a baseline before exfiltration then it makes changes um uh increases or decreases according to whether it's a one or a zero and then after exfiltration is finished it will return it back. So you might be able to see that um the very kind of slight changes there um but from the attacker's point of view it's actually quite obvious whether it's a one or a zero that's being transmitted and then what you can then do is demodulate um the data and retrieve the the original bits. And uh that's not particularly covert kind of just plonking a breadboard down to a screen so this is a more uh covert application um so what you have here is the same uh light sensor, light to frequency converter, an Adafruit Flora board so they're conducted with a conductive thread and then you have the same SD reader writer as well. Um so the idea is you could exfiltrate data with an attacker could exfiltrate data just sitting in front of a screen and wearing that tie. So the second thing I want to show you is Dread Phone uh so Dread Phone is command and control using near ultrasonic sounds. So by near ultrasonic um what I mean is sounds that are um typically not able to be heard by most adults. Um so the the theoretical range of human hearing is 20 hertz to 20 kilohertz. In practice most adult humans can only hear um up to about 16 kilohertz. So 16 kilohertz to 20 kilohertz is like near ultrasonic. And whilst most adults can't hear that it's perfectly within the capabilities of a normal uh laptop sound card uh speaker and microphone to transmit and receive audio uh in that range. So there's been previous research on this um Tosted and others and Hans Back and Gertz did something similar. Uh one problem they've come across uh is this. So this is uh a recording of near ultrasonic sounds being played. So while you can't hear the tones there what's actually happening is that there's electrical discharge on the sound card uh which makes those kind of clicks and pops. So um what I did with Dread Phone was I pre-prepared 16 WAV files. Uh each one represents a different ultrasonic tone uh in increments from 18.5 kilohertz up to 20 kilohertz. So 16 in total. Each one representing a hex uh character. Um I applied multiple fade ins and fade outs to those. Um so it kind of smooths the uh the input into the sound card and then amplified it and you end up with this. So this is Dread Phone running on two laptops. Um this is the victim. And the attacker is here on the left. So uh this is monitoring the the microphone input. So what the attack is gonna do here is just tell the victim to pop count. Um which means it's gonna send it a sequence of those pre-prepared WAV files. And the victim then um executes that. Okay so the the next thing um is exfiltration. So this is uh a text file. In uh so Batman would be a really different movie if Bruce Ray was actually true to type and communicated with people at 45 kilohertz. Um so the attack is gonna exfiltrate this uh this text file. So it's just gonna send the exfiltration message. And I'll stay with the attacker here and what you'll see is a different tone start to come back. Now there is a case study of this technique being used in the wild. Um I haven't got a copy of the malware so I haven't been able to verify it. But bad BIOS you guys heard of that. Um so that um whilst it infected the BIOS um of um machines it also communicated other infected hosts. Uh there you go. Um using near ultrasonic tones. So um Dread Phone's fine for like small bits of data and small strings and stuff like that. But if you want to exfiltrate um uh more content say images for instance. You're a bit more limited. But you can actually use a technique that's been used in popular music before. Um and it involves spectrograms. Uh so a spectrogram is a visual representation of the frequencies in a piece of audio. Um and what the uh what these musicians have done is they've read in an image file. They've iterated through the pixels. Got the pixel values. And then they've written out uh frequencies uh to a way file that correspond to those pixel values. And when you view the audio as a spectrogram uh you end up with a an approximation of that original image. Uh so in this case you have a face on the left and a cat on the right. So these are both um uh examples from popular music. Let me try another demo. So let's say I have an image like this that I want to exfiltrate. This is a spectrogram tool that does that. So it reads in the image and then you can specify a minimum and a maximum frequency. So I'm staying with um near ultrasonic again. If I generate that it writes out a wave file. If I try and play that wave file you shouldn't really be able to hear anything unless you've got really good hearing or you're uh younger than I am. Some of you might be able to hear it. Um but if I view that in a spectrogram you can recover uh the original image. Now that the um there are tools out there already that will let you do this. So coagular, spectrology that kind of thing. Uh what spectrogram also does is it lets you merge your secret file with a legitimate audio file. So um in case you have got your kind of younger people working your environment they're able to hear that. Um so I've got a normal uh wave file here. So it just plays kind of ordinary music. And I can merge my secret file with that. And that writes me out a new wave file.  You can open that merge file and still recover uh the original image. Okay so in terms of mitigation for this kind of stuff for jumping air gaps in general. Uh you're looking at things like tempest standards. Um removing or disabling ambient light sensors if they're not required or covering them up. Um privacy filters for laptops do a really good job of muting uh screen brightness changes. Um and in terms of the ultrasonic stuff um you could look at things like white noise or ultrasonic detectors. Um but ultimately uh if you've got any kind of input and output to a system that's not necessary or not integral to the operation of that particular piece of equipment uh you're probably better off just disabling it. So part two uh surveillance and counter surveillance. Um so the first thing is a laser microphone. Um just a quick hands up who's heard of a laser microphone before. Okay quite a few people um so uh for those of you who haven't I'll just quickly explain what it does. So imagine that you're doing uh surveillance on a group of people across the street from you and those people are behind a window. Um let's say the the glass is soundproofed so you can't hear anything. Um let's say they've closed the curtains so you can't video them and do lip reading and assume you don't have any bugs or anything in the room. What you can do is use a laser microphone. So you sign a laser at the window and you capture the reflected beam with a photodiode or a photosensor. So what's happening is as those people in that room are talking the air is vibrating it makes the glass in the window vibrate which makes your reflected laser beam shift slightly and as that moves across the surface of your photodiode it will cause shifts in voltage which can then be converted back into sound. Uh so on the right here I've got a really cheap laser module um that's hooked up to a 9 volt battery and on the left I have a photodiode um this is actually adapted from a circuit that did something else. Um the output goes to a 3.5 millimeter audio jack. So uh to demonstrate this so I have the laser I've got the listener hooked up to a speaker. Uh the laser is firing at a phone that's playing music very very quietly taped to the back of the speaker is a bit of reflective material and at the moment there's a bit of obstruction between the reflected laser beam and the listener if I remove that. So um so that's obviously like a really cheap really simple model and uh that only costs like 25 pounds the whole kind of setup. Um if you obviously had a bit more budget you could use like interferometry um you could experiment with using infrared lasers to make it more covert um cause nothing says I'm using a laser microphone like shining a really highly visible laser um you could kind of filter interference use a shroud that kind of stuff as well. Okay um so moving on to sniffing analyzing cloning infrared so um I imagine a lot of people here will have done um or will have experimented with like clone and replay attacks using uh an SDR with RF signals and infrared is very similar um so with infrared signals assuming that like fixed codes they um will use things like bi-phase mark encoding, Manchester encoding that kind of thing as well uh they use a carrier wave um normally 38 gigahertz but it can be other frequencies as well. So we need a way to listen to the signal uh then a way to analyze it and then a way to replay it uh and if you guys are interested in infrared there's a really great talk um from Defcoin in 2005 by Major Malfunction who found a way to compromise hotel payment systems by messing around with infrared uh TV remotes and hotel rooms. So the first thing you could do is just use an RTL SDR so these things still have an infrared sensor in them um you can actually use the sniff infrared signals um it just returns you like the raw pulse data so it's completely undercoded um but you could do that. You could use a dedicated infrared receiver component um and an Arduino and then use uh the IR Lib Library and the nice thing about this library is if it's one of um kind of eight or nine popular consumer protocols it will actually tell you what protocol it is and decode it for you. So in this case this is the standby signal for my uh TV remote so it tells me it's using the NEC protocol and it then tells me what the value of um that code is and then you could also use the listener uh for that laser microphone um so that will do it as well and then you can expect the the inspect the signal visually which is quite nice. In terms of replaying it if it's a known protocol at NEC or something like that you can just play it back um so in this case I've used the IR remote library and you can just play it back with a normal consumer protocol uh like RF however if it's unknown um then you have to replay the raw array um that you've managed to sniff. So applying this practically um to uh motion detectors so the first thing I'm going to talk about is a passive infrared motion detector. So these have a passive infrared sensor on them that respond to changes in infrared radiation i.e. uh body heat. So there was a talk um Black Hat 2013 USA by uh Porter and Smith where they talked about different methods to defeat physical security and they mentioned passive infrared sensors and you can do things like move really slowly so that changes in body heat aren't registered by the sensor. You can um coat yourself in a reflective material the most practical approach but um it works um or you can like overwhelm the sensor with heat so with like a flame um so I think in their talk they used a lighter to do it. So here's an example of a passive infrared motion detector um so the gray sphere on it that's the actual sensor itself uh the red window to the top that's actually a receiver for that remote control. So the remote control was used to arm or disarm the main unit um quite why they've used infrared to do that I don't know um as opposed to RF um and then on the right is a circuit board that I can use to do a simple clone and replay attack uh and just clone the disarm signal uh from that remote. So it's now armed I'll just test it works and then I can use my evil device to just clone the disarm signal and that's now disarm so there's nothing kind of particularly innovative or interesting about that it's just a normal clone and replay attack. I suppose the one thing that is interesting is it's infrared um but there's two big flaws in this approach and the first is how do you get the disarm signal in the first place assuming it's you know because it's infrared you have to be quite close to it um so you're stuck with having to like um have a device in the vicinity or steal a remote somehow and capture the signal and the second problem is how do you get close enough to disarm it once you've got the disarm signal um without setting off the main unit. So I bought nine of these um manufactured by the same manufacturer but sold under different brand names um and I captured the signals from the remotes and here are the signals from the first six. Okay so straight out of the box um regardless of what main unit the remote was first used with it will arm and disarm any main unit. So here's all nine so I just pick a remote up then pick another one up and I can disarm all of them. So I'm almost like embarrassed to present that at Defcon um now so that's the first problem taken care of how do we get the disarm signal the second problem how do we get close enough to the main unit to disarm it without setting off here's the first solution um so this is a drone to clone to PON this is um the disarming circuit powered by the drone's internal USB port the reason you can use a drone is because the lithium battery and it doesn't get hot enough to set off um a motion detector until it's been in the air for about 45 seconds so here's the alarm in the foreground you can see I've dressed up for this video so if I arm this and then try and walk up to it it detects me so you'll shortly see that my drone piloting skills are about on a par with my fashion sense okay so I'm gonna fly the drone over and it won't set it off but it will disarm it okay second solution phone to clone to PON so um this is using an Adafruit GSM breakout board um this is heavily based on uh sammy camcars ding don ditch or digital ding don ditch if you've seen that um some slight modifications so obviously uses infrared rather than RF um it also doesn't use interrupts it just use a time loop and it deletes text messages of the SIM card once they've been read so the idea is you would hide this or pay someone to hide this near an alarm during the day when it's deactivated then after hours when the system is armed you can just send a text to a number containing a certain string and it will then disarm it okay so as usual the first thing I'll do is arm the main unit and then just test it okay and I'll just look quickly at the Arduino sketch which is just checking for new messages every five seconds on that SIM card so I'm now going to send a text to the number that's on that SIM card and in this case the string that the sketch is looking for is new phone who dis and then just looking at the sketch just to make sure so it reads the text message sends a signal and then deletes the message from SIM card now you could combine both those together and do phone a drone to clone to phone um but that would just be absurd so I haven't done that okay uh the next kind of motion detector is this so this is an active infrared motion detector so the idea here is you have two components of transmitter and receiver and the transmitter is constantly sending a pulse of infrared signals to the receiver and if the beam is broken the alarm sounds and if you continually move the transmitter away until you clone the signal from the transmitter and just put it right next to the receiver okay uh so in terms of mitigation for these kind of attacks so for laser microphones um you can get devices that vibrate the glass on windows and to try and disrupt laser mics I'm not sure how effective they are but things like wire screens and coverings on windows um as you've seen with the infrared torchlight I use you can detect infrared light if you're using an unfiltered camera so you could use that to detect infrared lasers um double glazing or curved glass can cause issues with laser mics um as can other environmental conditions like uh rain and snow and that kind of thing um in terms of alarms ideally you want to try and disarm with physical keypads not that that's perfect but it's better than remotes because the signals can be sniffed and if you do have to use remotes you want to go for ones that use like tried and tested encrypted rolling code algorithms and that are paired uniquely to a device you wouldn't think you'd have to say that explicitly um but yeah okay so our last part is bands um so the first thing I want to show you is speech jamming delayed auditory feedback um so this is a technique that's been around since the 50s it's actually um originally used to help people who stutter um the idea is you introduce a latency between someone speaking and them hearing themselves speak and when used with people who stutter enables them to speak more clearly if you use it on people who don't have a stutter it dramatically inhibits their capability to speak and it causes like mental stress so there were some um researchers in 2012 who came up with like a hardware version um I built a software version called double speak and I tested it out on some colleagues because I didn't want to look stupid myself so so what these guys are doing is they're reading a paragraph from a website about delayed auditory feedback uh while my tool is running on that laptop and they're wearing a pair of headphones delayed auditory feedback also called delayed sight tone is a type of auditory feedback that consists of extending the time between speech and auditory perception delayed auditory feedback also called delayed side tone is the type of all the would observe your feedback they consist of extending the time between the speech and the auditory perception Delayed auditory feedback, also called delayed side turn, is a type of altered auditory feedback that consists of extending the time between speech and auditory perception. And here's the voice in headphones a fraction of a second later. Some DF devices are hardware, DF computer software is also available. Most delays produce a noticeable effect of between 50 to 200 milliseconds. Daff usage with 175 millisecond delay has been shown to induce mental stress. Joy, this is stressful. So on the face of it that doesn't seem to have much practical application to security. One way that we came up with that you might be able to use it is say you're on a network and your goal is to kind of sow disruption and discord but in a very subtle way. You could find out when a very important conference call is taking place and use this and kind of affect the decision outcome of that conference call without kind of having to do anything and to blatant. Okay, next thing, demotivating malware analysts. So this is inspired by Christopher Domas who's speaking tomorrow I think. And he came up with this awesome thing in 2015 which was he created fully functioning malware which when looked at in a disassembler in a flow graph represents an image under his control. So he can basically choose the image that a malware analyst has to stare at all day long, which is awesome. So I used my spectrogram tool to come up with something similar albeit a lot cruder. So let's say you've got malware and when you run it it plays really weird music like this. So the first thing you do is disassemble it in this case it's .NET so it's very easy and you look at what's causing that sound. So in this case it's a wave file that you can then extract from the main binary and you're playing that wave file and trying to think what is this? Is it some kind of encrypted communication? Is it trying to exploit something? What is it? And you would spend ages and ages looking at it until eventually it occurs to you to look at it as a spectrogram and then you see something like that. Okay, do we have any Gilmore Girls fans in the room? Okay, so to give you a bit of background on this my wife is a huge Gilmore Girls fan. She watched it all when it first came out. They streamed it like two years ago and she's watched since then she's watched like season one to season eight. I've lost count and in that time I've gone from kind of passive indifference and thinking you know this is okay but I can't really see the appeal. It's a kind of active loathing of this program. So I came up with Kilmore Gilmore which I think on reflection is probably the best thing I've ever done. So Kilmore Gilmore is it comes at its two parts. It's a Python script and an Arduino device. Now the Python script uses an open source music recognition library called Deja Vu which is on GitHub. Again, the link will be at the end of the talk. And what Deja Vu does is it lets you write MP3 files to a database and it fingerprints them. I believe using a fast Fiora transform and it then compares audio coming into the microphone to what's in the database. So my Python script here is comparing audio coming into the microphone to the database. And if it gets a match for the Gilmore Gilmore's theme tune it sends a serial byte, it sends a byte sorry over the serial port to the connected Arduino device which clones the power off signal for my TV. So I have a video of this unfortunately because of possible copyright issues I've had to mute it but after the talk if you look at my Twitter feed I'll upload it somewhere with a full audio so you can see it. Okay so this is like the pre-credit sequence so there's no music here. So what the script is going to do is just listen to 10 seconds and it will conclude that the Gilmore girl isn't playing at the moment. Okay and then the theme tune starts. Okay and the last thing I want to show you is this. So this is Astro Drone so this is using echolocation jamming against ultrasonic altimeters in drones. So I've demonstrated it with a parrot just because I had one handy. It's not picking on parrots specifically other drones with ultrasonic altimeters will be vulnerable to this as well. So the idea with an ultrasonic sensor is it uses echolocation right so you have a transmitter that sends out ultrasonic pulses at a particular frequency they hit an obstacle get reflected back to the receiver and based on the width of the pulse that comes back the navigation board can infer how far away is from the obstacle. So when you do this with drones with ultrasonic altimeters because it's used on the bottom of the drone to figure out how close is to the ground eight times out 10 it launches it upwards at quite a frightening pace. Two times out 10 it tries to sink through the floor because you're making the drone think it's either at maximum or minimum altitude. So there's a talk last year at DEF CON by Lou and others against about ultrasonic attacks against autonomous cars against Teslas. So this is a similar technique albeit a lot cruder. So first thing I used was this. So this is an animal repellent alarm so you put this in your garden the idea is you have a passive infrared sensor when it goes high it sends out an ultrasonic tone to scare away dogs and cats and that kind of stuff when you fly a drone over it. So you notice that the drone became like completely unresponsive to commands and just refused to land and in that case you end up with a broken drone. So that was kind of the first part of this and then I thought well let's try and expand that so rather than having the drone fly directly overhead can we come up with something that detects drones in multiple directions and sends out a more powerful signal. So that's a colander because I ran out of money and you have four passive infrared sensors. There's two Arduino UNOS underneath and 18 ultrasonic transducers connected to it. So infrared is one option and then I also used acoustic signatures with the deja vu library again so record the sound of a drone flying and then compare the microphone to it and that works just as well just don't have time to show it but let me show you this one. So we are doing further research on that at the moment and trying to test it against different drones different kind of environmental conditions different kinds of echolocation jamming that kind of thing. So you could use this essentially as like a drone repellent if you wanted to you could use it as a personal drone repellent as well. Okay so I think I have about five minutes left so I'm just going to do a really quick summary if I don't have time for questions then I'll take them in a hall afterwards or you can tweet me or email me or whatever. So this is an overview of the research that I've done on light and sound and you can interpret this in two ways you can either look at it and think yes he had a really careful and comprehensive research plan or it's something he cobbled together this morning to give his talk the illusion of structure. Even one of those is good with me but they all kind of do fit into each other so as an attacker using light and sound for attacks pros are they're great for any environment that uses physical security devices particularly infrared stuff any environment where there's air gap systems they're really difficult to detect and to defend against and they live very little trace and you can as you've seen do this stuff on the cheap a lot of the time kind of at home and test it out. Cons are you need proximity to the systems you're attacking obviously subject to environmental interference particularly things like laser microphones and the range and power of your solutions are very much going to depend on the resources that are available to you. So in terms of mitigation definitely the first step is knowing that these techniques exist and that they're out there and the inputs and outputs could be manipulated so ideally if it's possible or feasible you look to block those inputs outputs completely if you can't you'd have like a reliable failover and lastly yeah chrono replay attacks and you know jamming that kind of thing are as much applicable to light and sound as they are to any other kind of technology. So ideas for future research exfiltration via infrared is something I've wanted to explore acoustic key logging which has been empirically proven to work but I've yet to see like an automated practical solution for it more work on li-fi and then some more work on drone repentance as well. So hopefully in terms of how you feel about this talk you're more on the left than on the right. So just to wrap up the music credits that are used in this presentation are royalty free or creative commons so thanks very much to those people for putting that music out there references I'll let you guys go through as in your own time. So yeah so that's my email address and my sorry that's my email address my Twitter handle so please do get in touch if you have any suggestions comments feedback generally criticisms anything like that if I've got anything wrong during the talk of this presentation you can just keep that to yourself. Yeah so that's it from me thank you very much


tracking. The next step is advanced corners. Up to this point the dog has done many trucks that are straight serpentines and obviously we did lots of soft corners so when you bait the dog through the kind of curve and the dog learns that the truck may actually go to the side one way or another. What I call advanced corners is that when the dog has to take a very sharp corner like this and so when you lay the truck when you need to turn you put your next foot like this so it becomes very sharp and it turns suddenly so if the dog when the dog tracks and it misses that point it won't be able to find so it becomes more advanced and so you need to teach your dog to look for those things and know that if the dog passed it they need to come back so that's the next phase and in this phase not only the dog learns to look for corners more precisely the dog needs to understand that they need to be very specific when when they follow the track and also you need to teach your dog to once the corner is missed you need to teach your dog to troubleshoot it and in many cases it means come back so today is the very first time we're doing this and you'll see that I've baited all my corners meaning that I put bait before the corner and when I'm doing the sharp turn like this I put bait here here then I put bait here here and here and then the next step over here so I'm baiting literally the dog through the corners so the dog knows to turn sharp and then at the beginning of the truck we'll see how he does I'll show him I'll hold him so he won't miss it and understand what I'm trying to do and the truck that I laid has corners every 15 to 20 steps so as soon as we started 15 steps I make a corner turn one way then turn another way so both ways I'm turning every 15 to 20 steps and I did it several times and depending on how he does I'll either will help him a lot or I'll help him a little bit at the beginning and let him make mistakes and learn but from now on that's more or less the trucks that will be doing with lots of corners and turns and for those of you who are still wondering I'm still baiting nearly every step I rarely miss the bait in the step and in places that I do I don't skip more than three steps without the bait and I don't do it too often and obviously I don't do it before or right after the corner obviously and then we haven't done articles yet articles will be the very last piece we do so let's see how we do today look good good look good good look good very good good zoog finish good zoog good zoog good boy good


Hi, this is Stu Miniman of Wikibon and we're here with Silicon Angle at SNW here in the heart of Silicon Valley. Joining me today is Jay Metz and talking a little bit about what's going on the show and specifically, you know, technologies that, there are some technologies that help us to kind of use what I have better and others that really help us innovate and really drive to kind of the next step of how we're going to gain more efficiencies from what I'm doing, really transform the way that technologies are. In one of these technologies there's a whole track at SNW called Convergence and specifically Jay and I are very familiar with Fiber Channel over Ethernet. So, you know, Jay, at SNW, you know, we've been talking about Convergence for a few years now. Most people know how to spell FCOE and so how's the attendance on these things? You know, what's beyond the kind of one-on-one level and what do you see in here at the show? Well, it's natural as technology starts to develop you're going to see some of the more sophisticated questions and answering coming up and fortunately with the sessions going on at SNW you're finding more and more of the presentations gearing towards the next step. So, we've had FCOE and Convergence at the access layer but now we're starting to get the questions as well what happens if I move beyond the access layer? What kind of benefits should I expect to get? And questions also relating to how do our teams start to work together because after all you are working in an organization and you need to know how the other side is working. So Jay, I believe I've read on your blog a term that it's called the SLAM administrator. Is that something you've trademarked? No, I haven't trademarked it, it's open for publication. Can you tell us a little bit about what the SLAM administrator is? It's more of a concept. The SLAM admin is a storage and local area management administrator. Basically it's a team member that works together as a holistic functionary for the data center as a whole. And as a result you maintain the same kinds of functions within that team but you have a broader sense of consequence. And as a result a SLAM team will work together to look at the data center as a whole rather than the segmented portions that we normally find. So if I understand right that's really about the convergence of, you're saying it's the storage and LAN networking teams. So I wonder at a higher level your thoughts about, virtualization has really changed a lot of management. So much can really be managed by that central virtualization administrator. Everything can be plugged into like vCenter if we're talking about VMware and it's really changing the roles of the entire IT team. Any thoughts on that? Well it really is one of those things where this is a process, it's not a quick fix. There's nothing that you can do as a LAN team member or a SAN team member or a server virtualization team member that is independent of what's going on. It's the interconnectedness of the organization that becomes paramount and every member of a data center team, of a SLAM team needs to be able to understand what those consequences are. And so every change in a data center has a ripple effect especially in a converged and consolidated network. So Jay let me ask you, you're saying I can't just throw out my entire data center, put everything in the cloud and I'll have no operations expenses anymore? I love your rhetorical questions, yes Stuart that's exactly what I'm saying. Okay, awesome, thanks Jay. So let's talk a little bit about what's near and dear to our heart with Fiber Channel over Ethernet, FCOE. Starting to get questions and people are saying, we've been talking about it for a while. There are deployments that we're starting to hear of but is it just slow for adoption to pick up or is this the general progression takes a while? We always think that Wikibon, we posted for FCOE that it's usually more of an S-curve, it takes a little bit longer than people think to kind of ramp things up and then you'll usually hit a knee of the curve and things will just explode. And so are we near that knee? I think we are, I think that one of the things that triggers the upsurge of adoption is the more choices that you have, the more flexibility that you have in terms of being able to deploy it on your own terms. And as recently as last week you had a major milestone of director class multi-hop FCOE being introduced into the industry which allows customers the options to be able to figure out how to plan their data center in the future. And that is a lot of the key trigger points that our customers have been telling us that they wanted to see happen first. Okay, so Wikibon, we covered the release last year and we definitely think multi-hop is a good step forward. I guess where I would challenge is if you walk around these halls and you talk to the storage administrators, they are all very reticent to change. They will go kicking and screaming and say the way that I've done things is the way that I want to keep doing them. And it's not until there's a forcing function. And where I think Cisco is doing a good job here is FCOE doesn't have to be the driver for these technologies. When I buy now a Cisco Nexus 7000, FCOE, you can activate it in that device. It's not that I have to say, oh, I'm buying this device for FCOE.  And then later when the storage administrator says, hey, I'm going to go buy a new device to do fiber channel. The CEO can be like, wait, can I just activate the software license?  And the storage administrator is going to say, wait, I can build the same core edge topology, isolate all my traffic, and make it even AB sand isolation, and make it look exactly like storage. And it's just built on ethernet. That's when they're going to have a forcing function. You want to write my blogs for me? Well, but the great thing here is that you have choice without being forced to choose. And that is one of the key things about the technology that you and I are very familiar with, with fiber channel over ethernet, you have the ability to bolt on the technology into your existing data center with no loss of functionality or the loss of your legacy equipment, and legacy is used very loosely. But you also be able to capitalize on the roadmap of ethernet with the 40 and 100 gig that will allow you to future proof the data center. But at the same time, you can determine what kind of implementation you want to have without being forced to choose one over the other. If you want to use iSCSI and the applications that you have, you still have that capability. You're not forced. It's a false dichotomy. Well, we're right. Not only is it not about FCE and about ethernet, but really, I believe we're seeing that fiber channel in ethernet are becoming a single, not mutually exclusive technology. So what HP announced last year with the Flex ports and what the Cisco now has with the unified ports are switch ports that can be either fiber channel or ethernet. So it's now not, oh, do I buy 8 gig now and is there going to be 16 gig? You buy a port now on the switch that can be 8 gig fiber channel or 10 gig ethernet in the future, 16 gig fiber channel, 32 gig fiber channel, 40 gigabit ethernet. And we're going to be able to switch between these protocols. And I think that's one of the things that's also really important to remember is that we are working on developing both technologies, both fiber channel and ethernet technologies are well under development. And as a result, that gives customers the comfort to know that whatever choice they have, there's a future in it. No technology is dead. We're not giving up on fiber channel. We're not giving up on ethernet, which somebody asked me yesterday, which was a really weird question to ask. But the idea is that as these standards and as these technologies continue to develop, we're continuing to add new features. We're continuing to add new functionality. And those unified ports are just one of the many things that are coming down the pike. As I heard someone said, this isn't quite Bob Metcalf's ethernet anymore, but it's maturing and moving forward. So later tomorrow, I'll be hosting a session. Unfortunately, it conflicts with your session because I'd like to hear your session.  And I think that's pretty interesting. So some of the stats I've heard from Cisco is, people say, is this technology rolling out? Over a third of all Nexus 5000 switches have had FCOE in them. Rough back of the napkin, there's over 10,000 Nexus 5000s. So we're over 3,000 FCOE customers just on the Nexus. Plus, every UCS has it embedded. HP and IBM Blade servers have it embedded. Any customer stories you can share for us? A couple, actually. I mean, we've got two in particular that are particularly of note. One is the University of Arizona, which has deployed FCOE at the access layer to tremendous amounts of savings in their CAPEX and OPEX for being able to reduce their power and cooling supplies on campus. And Amaviva TSF in Italy has deployed FCOE at the access layer and is also looking to deploy it on a multi-hop basis beyond the access layer and has been having tremendous success as a result of deploying conversion networks. And they're very excited about moving forward. You know, one of the things that's pretty interesting is that I was responsible, I am responsible for the early field trials of multi-hop FCOE. And one of the key things that people have not actually yet come to realize, and I hope that they will now, is that when you have an early field trial, we give them a boilerplate topology to build up. And then they knock it down and then they build up their own topologies to test. Right. One of the things that they were really excited about was that it only took a matter of minutes to reconfigure because they didn't have to recable anything. There was no new physical connections that they had to make. All they had to do was reconfigure based upon the switches that they had involved and it saved them days, even weeks. So when you're saying that moving from fiber channel, moving to ethernet, the optical cables, this is what we're talking about or I'm not sure I quite follow? The cabling was irrelevant. We use both copper cables as well as optical cables. But the actual topologies themselves, the amount of hops that you had from a fiber channel perspective was simply a matter of, not to mention the bandwidth allocation as well, but simply a matter of reconverging. Right, and as we said, that's really fiber channel and ethernet, looking the same, can configure them the same, looks and acts the same. And management's starting to progress a little further. So, to try to make that kind of orchestration of the entire land and sand together as there. And you're bringing up management, which is an excellent point and that the management tools that go along with these technologies are becoming very sophisticated in being able to continue to have the team's familiar tools available to them without interfering and that's critical. I mean, you're talking about the conservative nature of storage. Well, they want to be able to have their storage network under their control so that they can continue to be responsible and reliable for providing those services. And with the management tools that are coming out for multi-op FCOE in particular, you've got that ability to have roll-based access controls with a single pane of glass that allows your network to remain segmented logically and be managed logically without interference from anyone else. So, great, Jay, this is Stu Miniman. I'm here with Jay Metz of Cisco, talking at SNW. So, I'm at Stu on Twitter and you can find us at wikibon.org. W-I-K-I-B-O-N.org and wikibon.org.org.cifblog. Jay, where can we find your information? My Twitter handle is jmichel-m-i-c-h-e-l Metz-m-e-t-z. I know it's a long handle. What can I say? Jay Metz was taken. So, or you can just find me at cisco.com, I guess. Logs.sysco.com actually. All right, thank you so much for joining us and look forward to hearing more from you at SNW. Thanks, Jay. Thanks for the time.


All right, everyone. Good morning. So I'm back from vacation now, took a week off just to kind of clear my head went Iceland, but back now and I'm back to probably one of the craziest market action I've seen since the pandemic, right? For those of you that were not trading during 2020, this is what the market was like. We had 10, 20 different runners every single day, each of them were up 300 to 500%. There was opportunities for longs, there was opportunities for shorts and everyone was making just handover fist money. So as I mentioned at the beginning of the year, guys, my goal this year is to go long more because when that raging bull market happened in 2020, I was making a lot of money shorting, but I couldn't make double triple quadruple had I've been focused on longing more as well. So my big goal this year is to just go along the hot stocks more. And that's exactly what I did this morning on HTOO. So let me pull that up for you guys here. So H2OO, you could see my thought process for these long buyers trades is relatively simple. I'm pretty much looking for stocks that are day one stocks that are holding above VWAP and stocks are trading heavy volume and just looking to buy them. So on H2OO, that's pretty much exactly what I did. When it was kind of breaking out over 290, I bought some added to the winner above 320 and then I just sold into the push into four, and it went nearly all the way up to five. So I'm trying my best this year, just go along significantly more. I also went long a little bit on CPOP here from 7 to 850. I only used 100 shares here because I just didn't feel too confident on it. But you can see these stocks are going from 1 to 8, 1 to 6, you know, even GXAI is going from 30 cents to $1.80. So there's a lot of opportunity to make money on the long side. And that's exactly what my focus is this year. And I think so far I've been doing a pretty good job of going long in this market, but I can still do much better. It's just so much quote unquote easier to go long a hot market than to go short a hot market because the moves and the range are so expanded. I mean, look at CPOP, $1 to $8.  But on the flip side, if you buy 1000 shares, you're banking in just a few minutes. So as long as the market conditions are permitting to go long, I'm going to continue to go long based on the action. So coming into today, a couple ideas. So as you guys know, the way that I run the live trading is I like to start by building the watch list. After I build the watch list, I take a few questions and then I kind of focus on trading and making money. So first things first is because I was not here, what I usually do is I usually look at the previous days, watch list first, but because I was not here, I don't have the opportunity to do that. So I'm going to look at what Tom has here and I'm going to kind of start from there. CHNR. The CHNR was yesterday's really, really big runner. Looks like there's probably going to be some resistance in the 420s area. So I'll look for 420 and $5 to short CHNR looking for about 420s, $5 to short SOUN. SOUN, I don't really like this because I think it has like a PR catalyst with NVIDIA or something like that. I think NVIDIA owns a percentage of this. So yeah, I think that this one just kind of might be a little bit choppy. So because it's going to be a little bit choppy, I don't really want to play around with it. So SOUN, probably going to ignore that one. So JXJT was yesterday's kind of big runner and fader. I mean, I would love to see a bounce today, maybe $350, $375 and $4. But this is the type of stock that probably doesn't look like it's going to be bouncing much, but I'll try it. JXJT, ideally a bounce for $350, $4 to short. And now looking at what's moving today, guys. So there's a lot of crazy stocks moving today. Let's start with all the weak ones, SXTC. So SXTC looking for a bounce towards VWAP to short. SXTC looking for a bounce towards VWAP to short. This is already kind of broken pre-market. JTAI, same thing. Looking for a bounce for VWAP to short. OCG, pretty big one and fail. I would say probably $420, $450 and $5. LICN, looking for a bounce towards VWAP to short. Pretty simple here, guys. Looking for pretty much the same trade on everything. TCTM, once again. Looking for a bounce toward VWAP to short. CPOP, I see key support here, guys, at $460. So $460 breaks, it can make for a potential short, but I would just kind of wait for it. CPOP, I think backside of the move will be on a $450 break. So waiting for that key level to break to short. GXAI, GXAI I think is kind of $50.50. I'm not really sure on it yet. I would say maybe under $0.90 can look for bounces to short. Otherwise, just wait for a pop and fail. SMCI is way out of my pay grade, but this is setting up for a potential first red day. But out of my pay grade, but a potential first red day set up. What else we got here? Wafua will probably wait for bounce towards three. There's a lot of stocks in play today, guys. A lot of stocks in play. Like I said, this is what the pandemic markets were like.  So this is pretty much a watch this guys. So pretty much looking for the same setup on all these. These are all pretty much broken stocks. I'm looking for a bounce towards VWAP to short. So whatever, whichever one of these kind of pops there will look to attack it. H2O potential hot stock. So I'm not going to really be too excited yet. I would say that H2O, if it breaks 350 can look for short on it. So let me put that down to H2O. If it breaks 50 can look for a bounce to short on it. So that's currently the watch this guys. As I mentioned this morning, I went long. So like I said, my goal this year is to go long more. And my criteria for going long is relatively simple. I'm looking for day one stocks. I'm looking for high volume and I'm looking for day one high volume and above VWAP. So H2O day one high volume above VWAP and just kind of buying it with risk to the VWAP break. So if I'm wrong, I cut it on VWAP break. If I'm right, I keep adding to the winner. I think that, you know, first two months of this year so far were February 16. I think I went long at least 10 or 15 times already. And each time that I do it, I get better and better and better and better. So like I said, for everyone that came in late, one of my biggest regrets during the pandemic COVID markets was that I was making money hand over fist. I was probably making 10, 20, $30,000 a day every single day in like an hour of trading. And that's great. And it's a significant amount of money. But had I just kind of been focused on maybe going long a little bit more, I could have made $100,000 a day. So I always told myself that whenever we had a hot market again, which I think that we're in right now, that I would focus more on long buys rather than focusing more on short buys. Because although there's plenty of money to be made on the short side for sure, there is way more money to be made on the long side during this specific market cycle. For the last two years, if you were going long, it's very, very difficult to make money because every single stock was tanking, right? But now in this current market cycle with what we've kind of been seeing with all the AI and all these crazy moves, I think that there is a significant opportunity to make money on the long side, which is exactly kind of what I've been focusing on myself. So SMCI is setting up for a potential first red day here, guys. I'm pulling up SMCI. So it is setting up for a potential first red day. I just don't have the balls and the buying power to be able to short it. I actually get it. Maybe I should do it. Shorted some. 104 is the key level. It breaks 104. I'll add. Watching. We're approaching first red day. So this is very different action than this stock has been trading in the past. This stock has not really ever made a move like this. I do not recommend shorting SMCI if you are a new trader. Only using a couple of shares, guys. I'm only using a couple of shares. 104 will be my ad. Why 104 will be when it goes red. Indexes are weak. Indexes are weak. 104 will be my ad. I'm not using much size, guys. I'm not using much size. Added. Added. SMCI. There it is. Up. What is that? $50 a share. $40 a share.  There you go. Okay. Up $40 a share on it, but not use much size. So in my opinion, this is going to be... I wish I had more money, guys. I wish I had more money. I wish I had more money. Let me make my triangles bigger because I can't even see them. Carlos, you have 2,000 shares, bro. That's a $2 million position, dude. All right. So up. $60 a share. $60 a share. So you see the first red day, man? You see how easy the first red day can be? Oh, my God. That's like $70 a share, bro. If I use the thousand shares, that could be $70,000 in three minutes, bro. So adding short SMCI. Just got this SMCI and looking for a low-of-the-day retest, 5% down already. Within literally three minutes, you can make 5%. I wish I had more money, guys. I wish I had more money to throw at this. I mean, this lovely, lovely stock. Come on down. So my average on SMCI is about $1,000 a share. So I'm up nearly $40 a share. So I'm okay with this thing wiggling a little bit. $950. Come on, Phil. There we go. There we go. Come on. Come on. Come on. $920, 315 covered some for about $100 a share profit. So $920, 315 covered some. Pretty much dead lows there. Very, very good cover. Very, very good cover. H2OO, FME. FME. Good job today, guys. Good job today.   Oh my God, that's a pretty decent amount of money. I just wish I had more buying power, guys. I wish I had more buying power. I was telling Ryan and George last night. Fuck, man. I felt like today was a day. But this is the first red day setup, guys. This is the first red day setup.  And you make insane, obscene amounts of money. So do you guys understand the setup? Are you guys seeing the setup? Short it when it's red. Please tell me this makes sense, guys. Please tell me this makes sense. I guarantee you're going to see a lot of people on Twitter posting $5 million days today. It ain't going to be me, but I'll take what I can get. Guys, if you're not in live trading, just hit up Steven to sign up, because this is just ridiculous at this point. 923, let's see if it's going to break the low of the day. This is going to be a very key test for me. If it cannot break low of the day, I will cover some more. Unbelievable.   I mean, it's so tough, guys. It's so expensive. It's so expensive. Come on. Come on down. 911, 911. Covering more. Got it. Covered more. 911, 903. Let's see. Let's see. Come on. Break 900. Break 900. SSR is on. Break 900. What is this, guys? This is over $100 a share in profit in what is it? 10 minutes? Sounds like I should be taking a vacation more often, guys. I came in clear-headed, focused. So far. Don't want to jinx it. But a pretty massive day. Let's keep going. Let's break 900. 900. Come on. Give you 800. Survey says 893. 892. Covered some more. First red day. 888. Covered more. No bid. 882. Covered more. 880. Come on. All out. All out. All out. All out. That's it. I'm done. It's okay. All out. All out. That's it. That is. That is. So that is. What's my lowest cover there?  01. So 880. 01 is my lowest cover. And my short was at 102-2. 102-2. That is 880. I made $142 a share. $142 a share, man. Wow. That was pretty fun. That was pretty fun. Guaranteed people are going to be making millions of dollars on this. Guys, millions, millions of dollars. I'm expecting people to post million-dollar days today. Multi-million-dollar days. All right, guys.  I guess maybe I should take another vacation. Maybe I should take another vacation. That's it for me, guys. I mean, yeah, damn. I got nothing else to say, man. About $150 a share. Yeah, good thing I was reporting. So this is why the first red day is such a powerful setup, guys, is because it's so relatively simple and the payoff is so massive.  I really have no idea what you guys are doing if you're not in the live trading. Would I reshort a bounce? I mean, maybe. Like, I mean, guys, I already nailed it. I don't need to get greedy, you know? I made $150 a share, guys, a share. Like I said, if you have not signed up for the live trading, just send a message to Steven. I'll tell him to do some sort of promotional pricing. But this is every day, guys. Literally every day.  So today, guys, probably my biggest day of the year. $50,000. $50,000. So let's get that on the live trading tracker. $50,000, $55,000, $193,000. That's where I'm at so far from February. $83,000 with one, two, three, four days of trading. And that's pretty much it, guys. So if you're not part of the live trading, message Steven to get in. If I end up posting this on YouTube, I'll put a link in the description. I'll call it a day, guys.


Are the Indianapolis Colts in trouble this season? They're off to an 0-2 start, but can they turn their season around? It's tough facing the Seahawks, facing the Rams, facing that new and improved NFC West. It's tough, but does it get better? That's the question. Let me first read off the offensive stats and then I'm going to get to the defensive stats the last two games for the Colts. Team stats, 20th and yards per game, 19th and passing yards per game, 16th and rushing yards per game, and 24th and points per game. That's tough. That really is tough. Now going on to the defense, 18th and yards allowed, 24th and points allowed. Now they are decent in the amount of turnovers that they had so far this season. They've had three, and most of it came from fumble recoveries. Awesome. So that shows that they're a very stout and tough defense, can force fumble, get fumble recoveries, but yards, points on the offense, on the defense, giving up big plays. Hey, it's been a regular for the Colts so far this season. Can they turn their season around and get better from that? Now, the benefit of the doubt would be to give the Colts, hey, I think that the Colts can be better just because they face the Seahawks, they face the Rams, and our power rankings, these are two top eight teams, and our power rankings. It's going to get better, right? Those numbers might be a little bit inflated, stats lie. They're going to be better than 18th and yards allowed. They're going to be maybe 15th, they're going to be top 10, because that Colts defense is great. The talent is there. Well, let's take a look at the schedule that they have coming up for the rest of the season. They have the Tennessee Titans coming up this Sunday, which we just saw that they upset the Seattle Seahawks, so if they're capable of beating the Seahawks, then it won't make you think that they can't beat the Colts, who lost to the Seahawks. Then they've got the Dolphins, which is a game that, yes, maybe you have a chance of winning. Okay, so it gets a little bit easier for the Colts. Then after that, you've got the Ravens, top three team on our power rankings. The Houston Texans after that, which on paper, the Colts should win, but the Texans so far this season have been playing spoiler, almost topped off the Cleveland Browns last Sunday. The 49ers doesn't get easier, the Titans doesn't get easier. Then it gets a little bit easier with the Jets and the Jaguars after that, but then you've got the Bills and the Bucks, two top five teams that you have to face. The Texans, like we mentioned, could be a spoiler. The Cardinals, who are looking great with Kyla Murray as an MVP candidate. And then the Las Vegas Raiders, the surprise team of the 2021 season. So to answer your question, are the Colts in trouble? A little bit. Can it get better? Doesn't seem like it. Maybe I'm wrong. Maybe a lot of people are wrong. Maybe people are just riding off the Colts. Maybe they can get back to the AFC Wild Card race that they were in last season. But I think despite the talent being there, they just got the short end of the stick. It was just pure. The schedule is not in their favor, and it's just going to show that the Colts, even though they might be talented with the tough teams that they have to face, if you're giving up 20, you're 20th in the NFL and giving up yards to amazing offenses, you're not going to get any better in that category. I feel like you're still going to face the Bills, the Bucks, the Ravens, some pretty good offenses coming up on the schedule.  And they go 11-5, make the playoffs with Andrew Luck and Frank Reich in his first year. I'm saying that even though they won't be the worst team in the NFL, more likely than not, they might finish the 2021 season with at least a top 10, top 15 pick. And what you can do with that top 10, top 15 pick is you have to make decisions. Does Chris Ballard use it to improve the defense? Does he use it to improve the offense? You got to make decisions with Carson Wentz. Hey, he just got injured again. This is what we feared. This is what a lot of people feared. This is what people said that this is a knock on Carson Wentz. He just gets hurt a lot. We make the decision on him. Do we keep Wentz for another season, which I don't think would be a bad idea, or do you choose to move on with him and maybe choose a high-end quarterback with the top 10, top 15 pick, maybe trade up? There's a lot of possibilities that you can do in the draft and increase the talent that you already have on that team. Not to mention free agency on top of that as well. You have probably the fifth most salary cap, I think, going into 2022. I could be wrong, but I think it's top five, top 10, and salary cap going into 2022. Use that to improve your team in free agency. You use that top 10, top 15 pick to improve in the draft. Then can we be talking about in 2022, then getting back to the AFC playoff push because the schedule in 2022 is going to get a lot easier. Just to look at the 2022 schedule, we've got the NFC East coming up, which if they stay the same as far as talent goes, then they have a good shot at winning a lot of those games. And then you've also got the AFC West, which might be a little bit tough because of the Raiders, the Chiefs, the Broncos, all those teams are 2-0, but it seems like it's going to be a little bit easier this time around in 2022 than in 2021. But I want to ask you guys, your opinions, what do you feel like about the Indianapolis Colts? What do you think is going to happen? Do you think that they're going to turn their season around? Or do you think that they are just pretty much done for the season and you don't have high hopes for them and you think that, okay, it's better on just... Let's look at the optimism of 2022. I'm not saying let's tank. Obviously, you're going to try to win some games, but on the overall broad perspective, do you think that they have a better shot at making the playoffs in 2022 than they do this season in 2021? Leave your thoughts, leave your comments down below.


Everybody for us here ripping a box of 2022 limited football hobby for Matthew G Thanks, Matthew and good luck A lot of them did used to be coyotes Jeremiah and he's played well, and then he's still considered overpaid Demption or that's gonna be our Kyle Phillips rookie to uh and Brian Dawkins game day aesthetics auto Game day aesthetics. I believe it's a patch auto Very nice weapon X Brian Dawkins Take one of those all the time man That was that was nasty Yeah, he was Derek Henry is six out of twenty five six twenty five there and Dynamic duels dual Jersey is J. The waddle and to a tango by Loa eight of ninety nine Good deal They are good They are good. It was better Dave smells a brand of cooks and the RPA is a Jumbo rookie patch out of nine of ten green of Hewlett-Stone's junior Hewlett-Stone's three-color hatch rookie auto It's a ten. All right, that'll do it Matthew hoping for a bigger name in the RPA But Brian Dawkins should be pretty cool one to get in your hand. Thank you again. We'll get these out to you