Hello friends and welcome back to another episode of our Road to Rank roulette series. My name is Lee also known as Osiris and today we're going to be kicking off with this team that you can see on your screen in front of you that we selected from the roulette wheel. Thanks to your nominations in yesterday's episode and talking about yesterday's episode we kicked off with the team. It was pretty good. We played Ham the man in our first game and thunder happened and stuff went wrong and then we pulled it back in our second one so if you'd like to go back and check out those matches because they were both really good. The team has been performing really well. I will link a card up here for you and check those out and then come into today's episode or watch today's episode and go back or just rely on my recap right now. That might that might work for you as well but I hope you're all well. Looking forward to getting into some more battles today. As always the team is down in the description below. There is a raw paste poker paste. Check it out and if you're mad enough try it out. I wouldn't even try it out because it is pretty fun. Definitely try it last week's team if you haven't because I think that team is legit good. But yes it's going to be a lot of fun. Like I said at the end of yesterday's episode we didn't really get to see much of the linoons so hopefully today is the day we can unleash the little weasel if that's what it is. It could be a ferret as well. But who knows that's a topic for another time. Without further ado my friends let's get into it today. Remember tomorrow is the day where we can activate our bonus buttons. We've got a randomizer switch up and our legendary and our patreon buttons so we can change the team with tomorrow sitting on a rating of 1549. It's unbelievable and as always if you enjoy this sort of content please remember to drop a like on the video. It does really help out the channel and the video itself and do subscribe if you're not already because we have lots of pokemon content coming up for you on the channel here especially with the release of the new rules coming in which hopefully was at the weekend and amongst other things as well. I want to stay away from necrosma version 2 until we like get to a good point. We're going to cross my version 1 to kick us off today with our music and yeah like I say hopefully it doesn't take too long to find our first opponent. But I just want to get this linoon working. I've played linoons weird pokemon. I've never really played it myself but I've obviously played against it many times and it's a very scary pokemon to play against and I think the sableye compliments it so well. Sableye was probably the MVP from yesterday's episode um either that or kyoga and kind of putting kyoga down because of how many thunders it missed in our first game which definitely cost us but sableye's been really good and I think the ability to not be faked out and have that kind of ability to have a fast ish fake out in this sort of format where incinero is probably your fastest common fake out user then it's a really good option for us to kind of go down with linoon. Imagine if linoon got in a focus as well that would be pretty sick probably bust but um yes hopefully like I say we can we can get the linoon working today. We can't find an opponent so what we're going to do my friends I'm going to cut it here we'll come straight back when we bump into our first opponent of the episode and we've got a first opponent of the episode japanese player from rated 15 27 and we'll get straight into team preview. Okay so our first opponent is running a team of dawnwings nakrozma, tapulele, venusaur, garados, groudon and celestila. This is quite an interesting team composition you've got the dawnwings which is probably going to revert into that ultra nakrozma supported by that tapulele the psychic terrain there you can imagine that that's quite an offensive mode there if the the tapulele is scarfed it gives my opponent a really fast offensive mode straight away and then the other fast offensive mode is going to be that groudon with the venusaur which potentially could be the mega of the team as well it has chlorophyll before mega evolves of course so benefiting from that sun with double speed then you've got a potential other mega on the team which is going to be garados probably not I don't know it could be mega garados which has the intimidate support and then celestila which supports everything with that wide guard and everything else from that side of things so what are we going to do has scoff kayoga that great here probably not against the groudon so we need another way to deal with groudon we need a way to deal with the tapulele and the the dawnwings as well this feels tough already Ellen you're not going to be ideal for us here charabug maybe not too bad um let's go with me too sableye charabug and do i bring in i have to bring kayoga really i'm going into this first one today and apologies if you can hear any like kind of construction noises bleeding over in this recording i do apologize hopefully it's not bleeding over and you're like i can't hear anything but if you can i do apologize neighbors are doing work again and it's pretty loud so it's like come on it works on a weekend typical anyway anyway aside from that we're going to see groudon venus so it'd be great if it was scoffed groudon wouldn't it i'd love it we could then utilize that kayoga override the rain but it's sadly it's not it's primal primal groudon although how good would scoff groudon be in this series that would be good scoff groudon for half the week scoff kayoga for the other half that would that i would i would enjoy that anyway we're gonna see venus so we're gonna see groudon come out for my opponent um well we'll go mega mega evolve um hmm do i just start attacking the groudon i feel like the venus so probably protects here just to get around it's uh i'm gonna just go for the fake out into venus so it's with the chlorophyll it's pretty fast venus so switching out tapulele yeah i mean we're not i mean this works out fine for us if we switched sableye into chorobug that battery ability we may be able to knock out that groudon here groudon might protect as well but i doubt it not with the kind of player that you see my opponent wants to catch us out faking out into that groudon but the psychic train really boosting mega mutu wise ability to hit this groudon for some big fat damage can we knock it out that would be incredible if we can oh doing some nice damage though back sableye avoiding because it's a ninja it's a ninja um okay mutu huh that's that's nasty damage scarred lily i'd imagine it probably is um it's got for a protect there what can we do with sableye right now can we do anything not really i mean we could try and get a foul playoff into the groudon the thing is i think we'll probably see a moon blast and a precipice blades although you might target the mutu if you're tapulele to try and get rid of it so groudon's a bit protected i'm gonna see the groudon protect tapulele moon blast yeah it's into the mutu so that makes a lot of sense foul play there okay um i mean we can we can do the same again and maybe preserve mutu to later on bring in chara bug and go for that foul play into into the groudon because my opponent now has to double in to save light to get rid of it and i think you i think you have to prioritize the mutu because otherwise you lose groudon like it's it's that simple isn't it there's the moon blast is it into yeah it's into that mutu chara bug gonna sap that up quite nicely precipice blades does connect may take oh okay but we'll get rid of the groudon which is the a nice a nice thing for us although wow oh how do we not take groudon down with foul play from that range that's insane um i think string shots probably a good option here we can't use quash though um and we can't really do anything else and a precipice blade is just gonna absolutely demolish huh i don't think we can beat the scoffed lele um the psychic touring really really does affect this team quite quite badly and we need to really get the string shot off if we can get the string shot off it makes life a lot easier for um we'll go for a foul play again into groudon i guess it's the only option we've got i feel like this is yeah the moon blast coming out into save like we need a precipice blades to miss if precipice blades misses it could open the door up for us rock slide groudon okay hmm now we do get kayoga and obviously our rain will not be a thing so we can get rid of the groudon for sure but it's the lele is the big problem for us here this is what i really need to get rid of and i have to lock into an attack with kayoga and ice beam's not really gonna cut at all um you're locked into moon blast you're gonna go for you're gonna go for the me too we could try and call on my opponent i think they protect the groudon here to be honest because it's obvious that the rain doesn't activate here that we are scoffed so you know just go on yeah i mean if we get a freeze here that would be good but i don't think you can freeze can you miss please miss please miss for the foul play damage which is really strange okay that foul play damage is groudon still throwing out some big damage like that precipice blades onto the me too was huge um yeah we're just gonna have to try and shadow ball and go for the ice beam it'd be amazing if me too i would spend the lele but i don't think we're gonna be able to okay the groudon protecting might not be the fastest fastest lele that's the thing nah the moon blast's coming out that's game unfortunately it's not a really great way to start the episode today it's gonna put us down to uh two losses one win but it kind of shows how weak the team is to the psychic train um okay we'll try and get the groudon last ditch attempt we should outspeed the lele um but we'll see we'll see if we can do no we don't even do that that's uh is that timid scoff potentially oh we survived with one hp carloga still kicking around but really we've got no options now yeah psychic train is a big problem for us we need something to come in and be able to help out with with tapulele um and the cross man coming out i mean not the best of starts for us at all but what can you do i mean when you get something that really like kind of walls i mean the other options we could have looked at on the team would have been the noon wouldn't have been really that great here because of the tapulele um because you can't really utilize that extreme speed like we need to landeris might have been all right i think really we would have been better starting off with maybe charabug and going for um the string shot and spamming that that could have been an option for us uh because we really i think that the priority that we needed to kind of go down there would have been slowing down that lele and then it opens the door up a little bit more from you too to kind of knock things out but as it stood it was just protecting my opponent the rest of my opponent's team which is a little bit sad for us but at the same time that's why scoff tapulele is so good right what music we're gonna go for in this next one let's go for something like and let's go gladian i've been enjoying gladian recently and um hopefully again it doesn't take too long to find our first opponent they are coming in dribs and drabs but i guess it gives me a little bit of an opportunity to talk about um the reveal the sword and shield reveal news that we had at worlds how exciting was that normally i'm a bit like hmm is it gonna be that good we've had some years where it's been really kind of mediocre like i don't mean to sound bad on some pokemon like but mega slobro reveal was it 2014 in dc i think yeah i think it was the last time it was in washington and it was just like a bit like uh mega slobro great and that was after like the previous year where we got mega kangaskhan which is like damn that thing's crazy um so to get the reveal that we got this year was was really incredible we've got some really great mechanics um neutralizing gas i mean that is going to be really interesting and then whereas it reflects armor as well on um uh covid night that that's going to be interesting and i think like just the the mechanics around when you gigantamax you can't be faked out that's pretty cool so there's it's pretty cool as well when you'd look as as well at the battlefield it looks as though when you've got two pokemon out you've got your gigantamax pokemon out as well now i don't know if that was just me misinterpreting i'm gonna have to go back and check it out the video but it did appear like there was both sides of the field had two pokemon out and then their huge pokemon behind them which kind of turns it into a triple battle for as long as you've got your gigantamaxed pokemon out and like i say i don't know if i was just misinterpreting the the scenario the battle scene or just dreaming it up but i could have sworn there was when there was that huge ride shoe on the field there was ludicolor and another pokemon and then a huge gigantamax pokemon behind them which kind of indicates that there's three and three oh cracking we've got a really good good fellow patreon member stew who has just been phenomenal in our flinch god circuit this season and he will be playing in the invitational very soon so what a pleasure to have him on the channel finally and coming up against this week's team so he's gonna have a sneak preview before it goes up but nonetheless we'll get into team preview and see what he's gonna throw at us today stew on 1700 as well so if we win we're gonna really scupper his rate and he is playing a team of zernius groud on tornadoes kangus khan the incinero and tapu koko can we catch him out with scoff kayaga i really don't think we can um save like could be really handy here though um although the kangus khan with scrappy could be a little bit of a problem as well right um is this the one where we got lanune um potentially potentially is um scoff kayaga i'm not really i'm not gonna bring to this match i'm gonna bring lanune i'm gonna bring charabug and i'm gonna bring me too as well do we do this yeah we'll do we'll just throw a random bunch in now we are one win two losses obviously we need to win this one to tie it up going into tomorrow's episode which would kind of set us up nicely to activate those buttons and get a good result by the end of the week and obviously if we beat stew here we'll steal a bunch of points as well it's gonna be really difficult though not gonna be straightforward but at the same time we'll see what happens so we're gonna see lanune and save like i'm out for our good sales against kangus khan and tornadoes so um let's go for fake out do we go belly drum though uh because we could fake out the kangus khan we could fake out the kangus khan um that's the thing we could fake out khan although we're probably just going to trade fake outs here that's the thing it's fake out the tornadoes we could potentially switch in something like charabug as well i kind of tempt it just to go for the belly drum though i'm gonna go for the belly drum let's let's try and get it off to fake out it's going into sableye okay we might see a taunt yeah it's gonna shut down our lanune doesn't want us doing anything like that yeah it's pretty it's a nice lead to shut down that um now i think we go for far play and we switch do we switch we're probably better off switching keeping lanune for a little bit later we could pull a double switch i mean that's the that's the other option here where we go for mutu into sableye and then we go into charabug um with lanune we keep this lead for later when when hopefully the tornadoes the kang has mega evolved and the tornadoes is maybe still sitting there and then we can maybe get some traction that way uh i'd imagine we'd probably see the tornadoes go for tailwind now taking the opportunity to get the tailwind we could see as he moved from the tornadoes as well um but the kang is probably likely to go into the charabug with a double edge or a return i think um to try and get rid of we do see it mega evolved there's the tailwind um and the charabug probably gonna eat up a little bit of damage here from yeah the kang is gone so yeah we do see that but charabug taking that pretty well to be honest and like yeah that's pretty nice um so i think what we'll do protect we'll go for a we'll go for a string shot we'll try and get rid of the speed boost here with charabug charabug goes down i don't mind this too much because then we do get sableye back on the field there's the z move i think it will be into charabug i'd imagine let's see stew doing so well as well right now on the ladder with that 1700 rate and i feel like this is always going to be a really tough game but we'll not give up the match is still in the early days let's see what charabug does can you take this now it goes down but like i said does give us the opportunity of bringing sableye as a double edge um and the z moves burnt as well which is which is the other thing so we get sableye onto the field and that tornado is if it does want to attack it's got to go for blind hurricanes and they could miss so you can get punished for that we'll mega evolve we'll go for an aurora sphere into the kang and we'll fake out into the kang as well i'm not too worried about the tornadoes right now um we could get taunted from the tornadoes into a sableye but if it does that it kind of waits to turn and we potentially can pick up the knockout onto kangaskhan here with an aurora sphere i don't know it depends how bulky the kang is kang going to switch out though it's a smart play and groudon coming in okay taunt probably is the best play to be honest into sableye isn't it so we'll mega evolve mega me too and there's a little bit of fake out damage into the groudon icy wind okay yeah that's it's a tech that a lot of players are using at the minute on tornadoes which makes a lot of sense because when the tailwind does run out it kind of sets up their team to kind of keep keep pressing for the rest of the game and we get the aurora sphere into the groudon which is nice um the tailwind will be pittering out soon which is the big thing um i'm kind of tempted to switch into lanoon here and and try and taunt the tornadoes i just feel like when i'm going to be able to maybe a foul player would have been better into that groudon oh we do get the taunt so that's good it's actually going for an attack which is nice so we can't set up another tailwind it's going for another icy wind um yeah it's all going to be about this precipice blades hitting the sableye i think here really oh flamethrower wow okay don't mind that and because now my opponent has to we can try and get this belly drum set up now um because my opponent the side strike should take down this groudon um and the tornadoes can't taunt right now so we can belly drum my opponent's got to rely on a hurricane hitting a blind hurricane hitting so we'll go for the side strike into the groudon that should be enough to pick up the knockout there um we might see the groudon protect and icy wind come out from this meet from this tornadoes we'll see we'll see it's going to be interesting whatever but at least now we're kind of in a position where we can try and claw back this match side strike i can say from the damage from the aurora sphere this should be enough to take down this groudon oh no luna voids it flamethrower oh don't take us down too much oh no damn i can't believe it survived the side strike and now it's over flamethrower groudon has kicked that butt i'm gonna mark it down already there's no point i don't think we can do really anything from this point not with me too it's not that strong so sad so sad but it's just how it is you know we've had two hard matches today the lele kind of really screwed us over in that first game the tornadoes is that easy to take down we should have taken it down a lot earlier flamethrower coming out from groudon it's so powerful as well isn't it um i mean me too handling it pretty well thing is though i mean zonius or kan comes in now zonius yeah and like we can't split our attacks we can only target certain things and it makes sense to me if the zonius protected maybe now and kangas can't switch in for the groudon but we i can't see it there's no way for us to actually come back against three pokemon we can attempt to um but this is going to be it i think the germansi will get set up here there's no way we would be able to take down that zonius with a with a side strike from this position and even if we did um the groudon will be left open to flamethrower so a very good game to stew you did push you a little bit to the mark the hurricane miss is obviously unfortunate but uh we needed that flamethrower target into the me too not the linoon and um unfortunately we weren't able to uh to take the flamethrower mind it if we'd taken the flamethrower with a decent amount of damage you proc i bury you get the belly drum off then i think there's a game on but there's still the kang and the zonius to come in you got the fake out germansi which makes it pretty difficult from that point anyway so tough games today and not the best of results but we're not going to give up we're not going to be downtrodden by it and it's been great to have stew on as i'll last opponent today and we'll wrap things up there but we'll be back tomorrow and we're obviously going to be activating those bonus buttons tomorrow so that is going to be very exciting i've got three of those to activate and a fourth one obviously for my patrons um so hopefully they've put some nominations together so we can activate maybe even four tomorrow but i'm probably not activate all of them tomorrow let me know down in the comment section below which buttons you'd like to see activated and we can go from there and i'll have a think about which ones i think the keepers at the minute are definitely the sableye um lanoon because i want to get that working and i think everything else is probably up in the air i'm probably leaning on the side of keeping scoff kayoga but i'm not too sure at the minute but we'll come back tomorrow have a great day thank you so much for tuning in as always and we'll see you for another one tomorrows and til then take care and buh-bye


all right. So we're ready to go. It is six o'clock. First off, I want to thank everyone for coming out so late. If you can come in for my talk, I guess there's a lot of competition here. I unfortunately am not as funny as some of the other talks right now, so. All right. So this is staying persistent in software-defined networks. My name is Gregory Pickett with health fire security. I am part of our cyber security operations group. Overview of today's talk. White box internet. What is it? It's not common knowledge right now. Start emerging really.  Next is exploiting it. I'll point out a number of weaknesses and what we can do to take advantage of them. Next is moving forward. All right. How do we remediate those weaknesses and the vulnerabilities that they involve?  Where is all this taking us and what we're trying to accomplish, what I'm trying to accomplish with talks like this. All right. Let's start out with white box internet. Well, it's standard hardware. Blank slate. Running merchant silicon. Trident and chipsets. Intel AMD power PC processors. Using an open operating system that is often Linux. But I don't think I've seen anything that wasn't Linux. The idea is to remove the hardware from the equation. To make it a commodity by using off the shelf components. So from that point forward it would be the software that made the difference. It's critical for software to find networking. But it can be used without it. Of course the question is why do it? Why are we moving in this direction? Well it's the same reason why they're implementing software to find networking. Reducing the cost. Increasing the flexibility. Looking of course to gain more control. You can gain the control through traditional means. You can actually remote to white box either a switch SSH. You can issue commands to define the switch. To configure the network. Just like you would. Regular switch. Traditional switch. You can also script for management purposes. Or you can load an agent on it. Like puppet. Chef. To make it part. You know dev ops. This network automation orchestration. Or you can gain that control with software to find networking. With software control plane. This makes the network flexible. And of course responsive. Everything is in software. With white box either net your hardware or data plane. I don't know. Right out of the camera shot there. The data plane becomes just as flexible. You can use whatever hardware you want. You're not tied to vendors. Your technology. Any sort of commands. You learn all the Cisco certifications that require those sorts of things to point out one particular vendor.  To make all this possible right. To make white box actually plug and play. They adapt to ONI. It's firmware for bare metal network switches. There's a boot order underneath. You can grab or you boot the system. And then ONI is there to boot the network. You grab, install, network operating system. And in the event you like a new one. You have to change the software. It will then go out and grab another network operating system and install a different one. You can change whenever you like. ONI comes pre-installed. On the network switch it's part of the firmware. And it automates that switch deployment. So white box is in the net. The blank slate. And ONI is in the network boot loader. What could go wrong? There are a number of weaknesses in the operating system. ONI itself actually is Linux based, right? The privilege account. The root has no password. And ONI does not force you to change the password. So it's likely to remain stale. Management services. I'll use a telnet, right? Insecure by design. Multimally weak. SSH is weak too. Installation mode. The key is only 18 bits. An entropy there. I'll cover mode 26 bits of entropy. Now looking good so far. The installer has weaknesses as well. It uses a predictable set of URLs. I'm just defining the standard. Goes to, you know, it's a one URL first. Another URL after that basically goes through a series of URLs that are defined by the standard. The process it does or carries out to install. And where it goes is very defined in the standard. First off, you get an exact URL from DHCP. After that, it will build a URL from the DHCP response. After that, it will look to its IPv6 neighbors for an installation. And then, following that, all that failed, it will go ahead and go through a DHCP waterfall. And so, it's very predictable where Oni is going to be looking. And when it arrives at a particular location, it goes ahead and looks for particular files. It goes through a series of file names that are defined again by the standard. So as an attacker, you can pretty much, you know ahead of time where Oni is going to be looking and you know ahead of time what Oni is asking for. So you can actually hand Oni a compromised installation and Oni will install it. And that's possible because there's no encryption or authentication. Now, should you hand Oni a compromised installation or any sort of installation, once that nerve confidence system is running, Oni's partition is exposed. It's exposed, it can be modified. It can itself be compromised. And with most of Kibbut, there's really nothing to stop that compromised installation, that compromised Oni from continuing to operate over and over again and doing whatever an insurer is told to do.  There's lots of opportunities to blow Oni up. It is not very well protected.  And the first thought, of course, is compromise it directly. With a rip passer that starts up blank and is likely to manage stale, you could of course log in, right? We could sniff the traffic or perform in the middle, modify traffic flows, your telnet, or easily cracking SSH, but that's not likely. Oni is up, just throwing the number out, 0.001% of time. It's job is to install an error-coppering system. All 45 seconds, once it's done with that, it sets a boot variable, which basically says from that point forward, boot an error-coppering system, reboot to switch, and then an error-coppering system runs for the rest of that time at the 99.99% of the time. Next thought is then can be compromised installation, right? Be a rogue TTP server, a friendly IPv6 neighbor, or maybe spoof a TTP server. It's also very difficult, right? It's like right place, right time. If you happen to be there at the right time, you get it, you get a compromised installation to it. So you're there for a while, right? You're there for however long the out-print system lasts, but you don't gain that nirvana of, you know, of hecherdom, right, which is persistence. And I like that you're going to be in the right place at the right time again. So is there a better way? Compromise it indirectly. An error-coppering system is going to be up for 99.99% of the time. See what you have to work with. Get past an error-coppering system, modify Oni, it's an exposed partition, right? Sit in there, take advantage of that. Compromise Oni. No secure boot to stop you from doing this and take advantage of Oni there. So over and over again, this will retain your persistence, right? Oni will keep doing whatever you tell it to do. So if you compromise the nirvana system, you are able to compromise Oni. Then any time a new nirvana system is installed, you are basically back again, right? Because now you're in the firmware. They're essentially there forever. And that's what we're looking for, right? As attackers. Or as white hat penetration has, we're looking for that persistence. So, network-coppering systems. Installed by Oni. Operate the switch to actually do all the packet forwarding and provide all the different features that you like to see in a switch. Only compatible distributions, right?  But only handful right now that have Oni-compatible distributions. The number growing and they just added peak eight, I think, a couple of months ago. But when I started this, there's only about four that were really prevalent. First is open network Linux. After that is Switch Lite. Genius Linux and Melon Ops OS. Open network Linux. Next distribution for bare metal switches, as they all are, of course. Based on Debian Linux, this is very popular. It's bare bones with no features. It will run the switch, but you're going to have a real hard time defining the switch, configuring the network, because really it's just a reference. It's a starter that the open compute project came up with. They want you to use this to develop your own network-coppering system. They're obviously there to promote Oni. So, they're giving you the starter, so yes, it can work with it, and you can actually make something that will run with Oni. And that's what Switch Lite did. I looked at version 2.6. It's a packaged open network Linux. They took that starter and they added SLRest, which operates a lot like OBSDB to define the switch. Added an indigo open flow agent for loading on the flow table to configure the network. This is not a standalone though. It really is part of a total solution called Big Cloud Fabric. The idea is to plug the switches into the network, and then Big Cloud Fabric just takes over. You're actually discouraged from managing the switches. You are for all intents and purposes at least the way I look at it to ban on that switch to Big Cloud Fabric. We will see how well that turns out. And, of course, the whole, the total solution is maintained by Big Switch Networks. QMS Linux looked at 2.5.3. It's important to know that you're, that I'm looking at the latest versions, right? So, I want you to know what those versions were. It is based on Debian Linux as well. You would install Puppet, Chef, Ansible. It's because it's meant for DevOps environment. Managed to it the rest of your infrastructure. And it's maintained by QMS Networks. And finally we have Mellanox OS. This is version 3.3.4. It's based on Enterprise Linux 5. There's actually a newer version 3.4. But it turns out all the problems that 3.3 has, they're still, they're still there on 3.4. So, just so you know that. You would install Puppet, Chef, Ansible to make it part of a DevOps environment or e-switch to make it part of an SDN environment. So it's very flexible. Maintained by Mellanox technologies. So we, of course, this is what I do here. Introduce you to these and then talk about really the weaknesses. No encryption or authentication on switch lights in to go. Nor Mellanox OS e-switch. Within to go it's just a matter of spoofing the controller. e-switch, you just talk to it. It'll listen to whatever you tell it and just do whatever you tell it to do. Well, outdated OpenSSL. This was done because honestly I needed to fill out the fly a little bit. So, yes. I didn't want a lot of blank spaces. So switchlight, they are running a bit behind OpenSSL. And when I saw it, of course, I'm picking Heartbleed. And I did check that and Heartbleed is not a problem. But still, as someone who looks at these things, who looks at, you know, how hard these environments are, I don't like to see old software. I don't like any of us do. So, with no encryption or authentication, then these, of course, are normal to topology flow and message modification through unauthorized access. Add access, remove access, hide traffic, change traffic. It's been mentioned, I think, in the press a bit about, you know, eavesjopping. And that's, of course, something that is likely to happen on a switchlight network or Mellanox OS, right, running, Mellanox running the e-switch. But there are bigger problems. And this is what's going to end up leading to the persistence. All right. We start out with something rather simple. You know, default picks accounts. Switchlight has admin. Cumulus Linux has cumulus and Mellanox OS has admin, which are their low-privileged or, you know, safe accounts. This is a big deal for two reasons. The first is that you have a limited ability to add other users. So you are stuck with these guys. You're stuck using these. All right. The exception is Cumulus Linux.  All right. So, show that in a bit here. And then the second reason this is a big deal is because these accounts are the only obstacle. The only obstacle to getting on the switches. All right. Which is, doesn't sound good, right? There's a little tired key logging in, the switch is yours. And then the network. And this is where all that begins, right? Easy escape to shell. Switchlight uses a wrapper. Type enable. Deepabash, you are at the shell. All right. Cumulus Linux, you actually connect directly to the operating system. So you don't need to do any escape. You are already at the shell. Now, not so less. Well, it has a very, well, very well done shell. However, Puppet's there. And Puppet can do dirty work for you. So Puppet will actually open up a back door. Which, of course, is not in the documentation. But you will find it if you unpack the firmware. Okay. Not always helpful. And once you have that shell, all right, you get into elevation. You immediately become red. And switchlight. Turns out admin is UID zero. So when you have that shell, you immediately are red. So, Cumulus, you basically have unrestricted pseudo access.  Also not good. And now on OXOS, you start the back door with admin. So it's running under admin's privileges. And when you X back door and take a look at your UID, it turns out you are also UID zero. So it's also red privileges. All right. That one password, get that out of the way. And we know that compromising a workstation is trivial. Key logging is trivial. All right. Leads to full control of your network. First the switch. And then the network for unauthorized access. Add access, move access to high traffic, change traffic. All three operating systems. And then of course, compromise of the framework on unauthorized access because it gets you access to the flash. It gets you access to only, you can do whatever you want with it. You modify it and you have your firmware. Compromise. So seeing your network is one key logger away. Going to show you this here. Last year, you know, I did open source, right? Easy to get access to. And people always ask about vendor products, sorry, vendor products. Because, you know, you pay money, good money for vendor products and you want to see if the money that you paid it, you know, was worth it. So this year, I decided to make a point of using vendor products and actually run tests on vendor products and you pay forward and expect to be better secured, right?  But we always want to make sure that they are what they say they are. So I started looking at these vendor products and these are all vendor products running on equipment, right? Network equipment. I started with big cloud fabric controller. And I logged in as admin, the low privilege user, looked through the commands and I found you a bash and I like the word bash that sounded good to me. And I went ahead and got the shell there. And if you're paying attention on the account slide, right, you saw what? That was hidden and disabled. I said they wanted you to stay away. They just actively discouraged you. Switchlight they want big cloud fabric to really take care of everything. So with that in mind, we have that hidden and disabled account, right? They don't want you to touch the switch. They don't want you to touch that. Well, there's no password on that. So how likely are you to change the password? All it does is keep you from logging in. Once you have shell, you can go ahead and switch over with no password. Then you are, of course. All right. So I'm thinking to myself, I wonder if I can do that on switchlight. So I logged in as admin. I had to do a little extra work there. I typed in enable first. And then I came up as wet and I was a bit surprised. So I checked up my UID and it turns out that I'm UID zero. So I like that. Then we have, yes. Switchlight, yeah. So we have our access, right? We have our access there as wet. So we can start looking around for flash, right? For flash devices. And we can look for one that's nicely named the course, right? Oni. And we see that with the privilege we need to write to it, right? With the wet. So that's good. We got that. Cumulus, all right. I want to show that you can basically, yeah, I call it pseudo it up, right? You can go ahead and add to shadow, add to shadow. You can change the password or whatever you want, right? Sudo, everything. And then milanox. I open the back door. I will tell you what that is soon. At the end there. Save it for last. Netcat. Very useful. And I want to connect it to the back door. Admin, obviously. And then I can see password. And there I am again. Admin at UID zero. And then an extra account. Maybe I was good to know other ways to get in. Extra account there. UID zero. Excellent. And I mentioned that with cumulus links there were ways to restrict your permissions. And since you are dealing directly with Linux, you can add new users. There are some manage action problems though. In the tools that cumulus links gives you for low privilege or less privileged users, they might escape any sort of solid limitations. So sorry, cumulus linux. They do know about this. Now, I don't necessarily, I don't come out with a lot of zero days or any sort of, you know, brand new, it's, you know, vulnerabilities in products. I like to celebrate this a little bit. I like to show off up there. Yes, big across the top there. All right, cumulus linux has several command line tools that they have set aside for less privileged users. I won't name them because they're tongue ties. They're meant to be used by low-perge admin accounts. It's just taking care of the switch. You go ahead and you enter your arguments, which end up being sub commands and parameters. Those sub commands and parameters get passed to CLCMD server. I can say that pretty well. And that goes in comparison against the Rosetta. Rosetta is basically, this is what's acceptable. And if it's acceptable, it lets it through. The problem is there's command injection. So it's filtering basically. It's command injection that allows you to bypass the filtering. So you basically get to have CLCMD server do whatever you want, whether it's a Rosetta or not, and it runs as read. So any sort of implementation to put on you, you can go ahead and sidestep those. I'm running on a switch again, right? So here we go. That is a switch with a license and hopefully I'm not getting any licensing agreements that might have signed. ULIS. So there it is running on a switch there. CLCMD server. I'm going to go and demonstrate this. I did bring VMs, right? I'm not as resourceful as the guys that apparently brought a whole safe out here. Yeah, I didn't want to try to ship or carry a top or X switch onto a plane. So we're going to go ahead and make sure I get my address for this. I think I already have it. I'm my low privilege user. I got lots of VMs running here. It'll take just a second here. Okay. Is it clipped again? Oh, it's off the screen again. All right. Here we go. I have a touch pad up here. Never good at it. All right. So I'm going to go ahead. I'm greedy. And of course I have my solicitations. I'm that low privilege user. And let's say I figure out the command injection. They have a patch for this already. So I don't feel so bad about revealness in complete detail. So I have that one tool that I have pseudo privileges for. And there is my arguments. What I've done is I've injected so that my second command, my injected command looks like it's part of the label. You have to do that. Otherwise it looks at that label, that first piece as command tries to process it. And of course it's not the reset and it fails.  It is a VM. There's no guts back there. So it does say unknown command but it's inject nonetheless. Now you'll notice there's no spaces there. And to get around that you go ahead and just make a script. Put a script in your own low privilege home directory and you put any kind of command you want in there. And what this one did, someone asked that before, it just adds another user with no pseudo limitations. You can just do anything. So we can go ahead and, yes, it's a little bit of a cliche. There you go. Then I have everything there. No collapse. We work all year for collapse. Come on. Thank you. Now I feel satisfied. I feel fulfilled. So you can bypass any sort of pseudo limitations that you would change or password change, you know, and then use your account. But obviously you don't want to do that. You don't want anyone to know that, you know, you're around. All right. I'm going to go ahead exit and then pause my VM so I can release resources. All right. My back on the screen all the way. Okay, good. So once you, of course, have the Republicans, this is once again a live switch, you can go ahead and you can look at the M2D devices and find Oni and then dump from the block device. And you have your privilege you need right there to modify it and put it back. Now, a big part of this is implications, right? There's been talk about this of course, especially on the vendor side, that this is a common problem, right? We have Grubb and other other issues with different types of devices. It's important to know that personal implications are greater. All right? If you have a firmware compromise on a single server, you have important data, but a single server. If you have a firmware compromise, a firmware compromise is now possible on your switch, then you have your network. All right? You have the network on. One server, whole network. One server, whole network. There's bigger implications. And it's important to talk about how this is done because they assume first off that it's kind of firewall, it's safe. So we want to talk about scenarios that really are very possible, that makes it not as safe as they think it is. So I'm going to play the goateed, you know, network administrator, and this can happen in a number of different ways, right? You can browse the internet, you can drive by download, you can open a bad attach. In fact, that's what I'm going to go ahead and do.  Now, Big Brother is going to do, it's going to affect, it's a Windows binary, it's going to infect the Windows system. All right? It's going to go ahead and it's going to key log off those fixed accounts, the ones that you're stuck with, right? For simplicity's sake. Very easily could have key logged off connections to the switch. Once Big Brother sees one of these accounts in use, key logs the password. As a network administrator, you're going to touch the switch at some point in time. You're going to log in and it just waits around for that. As soon as it sees you do this and as soon as you're done, well, he logs in. And he writes a Linux compatible binary to the switch's file system. Nothing's downloaded from the internet, carrying the secondary payload himself, right? He's carrying Little Brother, writes it out. Stars Little Brother's a back door. He unpacks the firmware, shoves Little Brother in there. I mean, what are Big Brothers for, right? Reps, you know, Reps, only back up, puts only back. Now, before he does this, he modifies only so that anytime only installs an error-coppering system only also puts Little Brother back. And that's persistence over and over again and how sometimes you install an error-coppering system, Little Brother keeps coming back. But it doesn't stop there. He is a big brother. He helps out. He pivots. He connects Little Brother as a back door and then he also connects out to a C2 server. The C2 server can be anywhere. This helps get past things like VLANs, ACLs, firewalls. What he does is actually he browsers. It's a reverse HTTP shell. He uses headers and he's capable of using a proxy. So it likes to blend in. And I relay commands between Little Brother and the C2 out in the great wide world. All right. So we're going to go ahead and demonstrate this. I've got an attachment here. I'm not a malware writer. It's a little bit stealthy, but not really. He does hide a little bit, but it's still not hard to find. So make sure he's running there.  At some point in time, I'm going to go ahead and touch that switch. It just works. This has a wrapper just like Switch Lite. All 10 commands to get to the shell. Actually what Big Brother will be escaping himself. So now, I'm going to double check this because you know, the dental gods and all. All right. So now, while he's done this thing, we're going to go over to C2. A little bit of a delay there. So it's going to fire up. It's how it works a little bit like a web server, of course. It's something browsing. It's going to go ahead and listen. And as soon as the connection is made, we'll see a prompt.  Hopefully, it'll call up soon. There we go. Can we get that on the screen? Okay. All right. Now, here we go. So Little Brother has been started. The connection has been made. And Big Brother has reached out to the C2. It's going to relay anything. All right. So there I am with my access onto Little Brother behind whatever firewall that is there. All right. I'm going to move around a bit. We're going to go ahead and just look at the switch real quick. There's some timing and weight. It's very patient. There you go. So we are in the red file system there. There you go. But things aren't forever. Not entirely. At some point in time, it's going to be noticed. What's this mysterious connection? You know, as an administrator, you see these sorts of things. Reinstall the operating system. Well, of course, right? Because we don't really fix things so much. Especially with devices like this, the desktop. So we just re-image, right? So we'll go ahead and re-image. It's an infection. That's what we do. So I'm going to go ahead and bring up Oni and then reinstall another file system. Another operating system. This one happens to be a demo operating system. I'm just going to do it sitting there. It comes up and we'll go ahead. I'm going to stop this because it's obnoxious. And then I'm going to get my command to go ahead and get that operating system. I did this because I didn't have access to the operating system at the time that I did this. But I made sure that it operated just like switchlight. I want it to be realistic. So, I'm just going to do a thing where I move on to fixing this sort of stuff. And then we'll come back and see Little Brother resurrected. So available solutions. Right? I've been characterizing this as poor choices. And that's what we have seen with the vendors. And this is about fixing that. So these solutions are addressing primarily vendors. And vendors, what they're going to have to do. They have hardware, install environment, their operating systems, agents. That's your remediation stuff, right? The vendor stuff is remediation. Or NERC administrators themselves, architects, right? Changes enterprise architecture from mitigation. Things that you're going to have to do in the meantime. Okay? Hardware, obviously. Trusted platform module. I'm sure we're going to add big switch networks, have these put in for most XA6 based switches. You know, there aren't any new power PCs designs. I have not heard of any coming up. So that's maybe difficult to do to get them added to power PC switches. But if we can, that'd be great because we want to start using TPM. We want platform security to make sure that any sort of modification is only modified that the hood fails. So we know something's wrong. They are also working on, so we'll get them on the hardware. The next step, of course, is to get them in use. And they are also working on getting this in the standard. So it's a bit of a slow process, but they are working on it. That's a cumulus network, so the ones that developed only and got it adopted. So they're working on it. Install environment. Remove tell net. It's insecure. We can use SSH, it's okay. And then with SSH increase key entropy and force a password change, for God's sake. I think we are all capable of remembering a password or using a password safe password. So that's one of the issues not to. You know, factor reset. Who here has done a factor reset? If your hands are not up, they're probably lying. We forget these things, we screw up. Factor reset. You can do that. Remove IPv6 and TFT waterfall. Nothing wrong with having DHCP provide the installation URL. We can protect the DHCP server. We can make sure it's the only one on it. They have ways of doing this. No reason why we can't use the DHCP server. And of course, a good one would be sign installations. The best one would be, but there's always problems with keys, right, and signing and that sort of thing. I understand there's problems there, but ultimately that would be the best solution. Operating systems. Before we hit that, let's check out Little Brother. Operating system has been installed again. Let's check out C2. C2 is capable of issuing a reconnect command. If you enter commands and you don't get any back, you know that there's been a disconnect. Luckily, the operating system, the recovery system has been installed again. I did that myself, so I know there's a disruption there. I'm going to go ahead and tell it to reconnect. Big Brother is going to close his end of the socket. He's going to reestablish his connection to Little Brother. Alright, so there we are. Thank you. We're persistent, even after an installation. Operating systems. Now, we obviously can't do everything. These are ways to harden the environment. I'm an ops guy, so we think hardening. As many as you can, make this platform more resilient because there's a lot riding on this firmware, a lot more than we've seen, we've got bigger implications for this firmware being compromised. First one, changeable names. UID accounts. Change the UID zero account names. It gives the ability to do that. Reduce privilege accounts. It would also be great if we could add users, which actually cannot add users. No, actually can add a user, but you have two types. Admin and monitor. What do you think you're going to use to configure and take care of the switch? Admin has the ability to change passwords. Change the password of the original admin. Get your UID zero back. Okay? Force password change. Don't allow those to hit stale. Don't think I mentioned this at Black Hat, but one thing I've seen in our cops is the password that they use, the shared passwords. They usually have a shared password, and they have a lot of equipment. They have a big team. I've seen those passwords go for years and not be changed. So force a password change. And then, of course, remove UID zero from the admins. Remove UID zero from the admins. And then tighten shell access. Switch Lite. I would like to see a one-time password. They have self-service portals for support. Why can't they self-service themselves to give it and make it a little more difficult, a little more resilient. Human Slanks, how about a wrapper? Also with a one-time password. Now, Malonox actually does a pretty good job of protecting that wrapper. There is a way to get shell access from the wrapper, but it was taking way too long for me to reverse engineer their code. So I took a shortcut. I said I was an ops guy, right? If you unpack the firmware sockets there and you can plug that into Bash and you're in. If you were thinking about maybe modifying or having a public modified password or a shadow add user, they thought of that. But they missed sockets. Agents. This is common. In SDN platforms. They're not using TLS. So they need to use TLS. Not only just use it for encryption, they also need to use it for ops, especially for mutual ops. And then of course there's a concern with certificates and key distribution, but you've already got DevOps there and SDN to do the heavy lifting. Have them also lift the certificates and the keys. Enterprise architecture. I say the management plan. We need more than the LAN. We need to get as close as we can. I understand it's difficult to physical separation. Try to get there, right? Get as close as you can. What's wrong with jump boxes?  Network admins having two monitors on the desktop. Can't you remote in a jump box, maximize that in one of the monitors, use it just like you would on any of the other workstations. They're taking a little bit of news too, but it's going to up your security significantly. And then we have audit switches. We have audit. It was a painful process, but audit has good uses. They're your friends. Make sure their path changes. And then it wouldn't hurt to also hash only partition to make sure that it hasn't changed. I have a couple minutes left and I want to get to these last slides in a run out of time for any extra questions, but we can always talk afterwards. You're seeing something here and you're seeing vendors race ahead. And we want to talk once again about impact on security and keeping pressure on the developers, which is why we're here. We're here to freak them out, sometimes piss them off and talk about the difference that we're trying to make. Getting products features to market is important. We get it. We all get it. They're there to make money and they have to be out there first. They have something called best practices. I don't think you're reading them. I think you should. I think you should develop your own best practices. Start using them. Because you're not, we start this merry-go-round again. Every year at these conferences, we hack it and then you fix it. So now it's your turn, of course, to do cleanup. I'm here to evangelize. A lot of the companies doing this are either startups or small business and they know you have a limited number of people. One guy for security. One guy for security that's there all the way. How about some assessments along the way? Some are midway through the development life cycle. Maybe an assessment at the end before you release. The key is before you release. We would honestly settle just for that one at the end. All right? And when you go, try to sell it. Security can be a feature, too. All right? We want to make a difference here. We want you to learn from desktop and server operating systems. We want you to begin to harness these new platforms, dev ops and SDM. For the most part, what they're taking over, what they're taking responsibility for is defining the switch and configuring the network. They need to take over the entirety of the platform. They need to respond to the whole thing. Whether it's checking permissions and being responsible for permissions or they're checking audit advance or they're following those up and making part of the rest of the entire platform like a switch like to do that, right? Funnel up to big cloud fabric. Maybe a separate platform to consolidate all that. How have all that looked at? Or how about logging? You're checking logs on the individual platforms or you're already consolidating the logging so you have visibility there. So you are now taking responsibility for the entire platform, not just part of it. Logic probes. That's kind of my general term here. I have some electronics back on so that's why that comes up. You can check things. You can check state. You can make sure that the platform is in the state you expect it to be. You can, a good one, hash the only partition. It's a nice thing to do, right? Make sure everything is intact. So our final thoughts here. I think we are good on our time. It's a wrap up. The security of the network application is critical. We've seen has been neglected. And it's because they think the switches are safe. They're assuming that you're following all the best practices. They're assuming that it's an ideal situation. The solutions that you purchase and the different layers, right, are operating perfectly. It's a perfect world and they're catching everything. And that's just not the case, right? A single piece of malware could easily make the crossover from Windows to Linux. I did it right here. I'm not the first obviously. That pivot. To make a great pivot, you then are able to compromise switches and get that long-term assistance and this is immeasurable. Because you have an outside of the network and we are here today trying to avoid that. So hopefully we work together, we can't avoid that. Links. All the different products they are cool products. And that is the end. Thank you for coming.


What's going on everybody? Got Kyle and Sean here with the sports cars. We've got one box from Mr. Jonathan Elp. That is a 2023-2024 Bowman Chrome basketball. This one is a hobby. Good luck, Jonathan. Let's see what we got. Bowman Chrome U basketball. What's going on about the fake Bofa? I said, Bofa, what are you doing at Shed? He said, what are you talking about? I'm like, yeah, this is a Bofa in Shed. Here's a new Bofa in town. New Bofa in town.  I'm gonna go through them. That's awesome. Real question for today is, do the Niners win by 7 or do the 70? Or do the Ravens also win by four and a half? That's the real question. I think the riders blow them out, too. Really? Blow them out. It's gonna be embarrassing. Oh, no. Oh, no. Yeah. Unfortunately. Oh, no. Not good for the Detroit boys. No, no. I'm not gonna be very happy. No. My game was ridiculous. Double OT. And then it's got a reverse side. Got a reverse side.  Bet of the year, Niners minus 7. Could be, could be better the year. Gonna give him big advantage. I think so, too, Vaughn. I think so, too, for sure. Later, later round advantage, but I don't know, man. Lions have been good. Lions have been good. A Sharpshooters, Cody Williams. C-Dubb. There's Xavier Booker. Brawny. Refractor first of Prince of Lead Bay. Got a, as they call your insert. Extractor first, El Marco Jackson. And Lava, that one's gonna be Simeon Wilcher to 100. Rayweigh for Rayweigh to 100. Extractor first, Armando Bacow. Caitlin Clark, insert. And El Marco Jackson. Refractor of Georgia Amore. Brawny James, looks like a goal coming. There's a base auto, Brandon Garrison for Oklahoma State. First base auto. And goal first is gonna be Max Abness for Texas. Texas. Lions boys there. The Longhorns. Montaz Boussailas. There's Bofa, real Bofa. Kim McCuller, refractor first. It's a good picture of you on your other profile. Yeah, it's a good picture of you, Matt. There's a extractor, Malik Hall first. To 199, Simeon Wilcher. First out of St. John. Purple Shimmer, not numbered, is Reed Shepard. The Freshman for Kentucky. It's the Fawn Castle and Orisa Shea. Alrighty, Mr. Johnson, last stack here. Another auto, that is Red Wave. Red Wave coming. Got a Andre Soyakovitch. First refractor. Simeon's begging to get out of the chest. Dude, for real. Santiago Vescovy. And the Red is gonna be a Stéphane Castle. Red Shimmer auto for Yukon. Second Red of Stéphane Castle, I pulled actually. Nice one there, we'll get that in the mag for you, Mr. Jonathan. So good. Freshman for Yukon, two out of five. That in the mag, very nice red. Second Red of that guy I pulled. And Xavier Booker for Sparty, 299. Justin Edwards Sharpshooter. Alrighty, alrighty. That will do it for you, Mr. Jonathan. Really nice red there. Mr. Castle for Yukon. Get that right out to you, sir. What's up, Nathan?


I would like to share the experience of MSF in the creation and feasibility testing of a vaccination calculator for a mass vaccination campaign. MSF Switzerland decided to make a multi-antigen-preventive vaccination campaign in the Central African Republic in the Mamberek-Kadai prefecture. We wanted to vaccinate 50,000 children under five years old with five different vaccines, including oral polio, DTC, hepatitis B, hemophilus influenza B, plenumococcus, micelles, and yellow fever vaccine. We wanted to do three rounds with an interval of two months between each round. So we started the first round in December 2015, and we are currently at the third round. The vaccination prescription is done by health worker with limited experience, and it's a high work load, and the vaccination prescription is a complex decision-making process. What you have to imagine is that we just employ people just to fill the data collection, the tally sheet, and you can also imagine that every team starts at 6am the morning, including the vaccination supervisor of each team, and they finish at 6pm. And after the supervision, the national supervisor of each team has to continue his job until 8pm to calculate and to compile all the data of the day, which make a very painful and long day for him. So we decided to create an application, a vaccination application, to be used in this campaign. The main purpose of creating this vaccination tool was in fact to be a module inside the e-care applications that Maya just presented now. But as for each ambulatory consultation for pediatrics, we would like to avoid missed opportunity for vaccination. It makes sense to have a module of vaccination for each ambulatory consultation. So we took the opportunity of this vaccination campaign to use this application but to adapt it to fit with the campaign. The goal was not to collect the name of the patient, so it's an anonymous application and it's easy and fast to use for the team. We thought that if you record the name and the medical and the vaccination history of the child, it doesn't mean that this child will go to an EPI center between two rounds and get a vaccine. So you anyway have to check again the vaccination card of the child even if you record the identification. So in fact, so we took the opportunity during this campaign to use this vaccination application and it allows also to improve it for its future use in the e-care application. So in fact, this application has two components, e-decision support. So this is an Android application, computed roles of vaccination insights. And as you can see in the slides, it's look like a vaccination card. So you enter the age of the patient, you enter the vaccination already done, and it gives you indication about what to prescribe today. The second part of this application is a data collection tool. This application has also an on-device activity report working also offline. So it gives you at the end of the day, even if you have no connection, it gives you the number of children who went to your vaccination site and it gives you also what you use in terms of each vaccine or at least what you prescribe. Before the application, the fields were using such table to prescribe a vaccine. It's quite good table to decide which vaccine to give, but still the field we're thinking it's a bit complicated to use and some mistakes were observed during the first round of the vaccination campaign. Also, this table is a simplified version of the complete recommendation. So as it is more simple, it means that also there is some misopportunity and overprescription if you just use this table. We decided to assess the application via a feasibility study with the objective to assess the implementation, acceptability and efficacy of the vaccination application. The design is a mixed method feasibility study. We use it in two vaccination sites in Beberati city, so in Khar, during the second round of the vaccination campaign. We use four voluntary prescribers and we give them a one-day training and a one-hour on-job supervision and then we observe them during the study. For the implementation, we perform a systematic collection of the technical and environmental challenge. We look at how it is about the battery, the bags, the transfer of data on the server and if nothing was stolen. For the acceptability, we use a think-aloud method, a user-experience questionnaire and in-depth interviews. For the efficacy, we had 610 exit interview, alpha with paper algorithm and alpha with a vaccination application. We reassess the prescription to identify the missed opportunity and the unnecessary prescription. So we compare after the propulsion of children when vaccinated with the paper and with the application. So about the results. We had 1,324 consultation from the 23rd to the 28th February and we had no technical problem observed or reported and we had no delay in consultation process. It means that at the same vaccination site, we had one prescriber with the tool, the application tool and one with the paper algorithm. And at the end of the day, they perform the same number of prescription. And also all the data of the application were sent to the server so we had no problem about that. The result in terms of acceptability, the usability score were more than 70%. Note that we didn't assess the usability of the paper algorithm and it was an easy to use application for the people who test it and it increased the confidence in prescription according to what they told us. And also we improved the interface after the observation of the use. We changed for the date of birth and we also had an option about invalidate data if it was wrongly entered. So the result in terms of efficacy. So what we compare? We compare the application with a paper based algorithm and we look at the appropriate vaccine prescription. It means we try to see if the child received all and only the needed vaccine to be prescribed. And we use as a gold standard the paper based algorithm. So what you can see in terms of results is that the appropriate vaccine prescription was 96% with the apps versus 91%. The missed opportunity was 3% with the apps versus 6% and we had 1% unnecessary vaccine with the apps versus 2 and we had 0% of vaccine administered with contraindication versus 1%. Of course we can see that in fact we had few mistakes with the paper but we still reduced by two the errors by using the application. Also as I described before the paper based cannot include the complete recommendation. So we already generate some missed opportunity and over prescription if we take as the recommendation only the paper which is not the case if we use the application where all the recommendation could be introduced. So the conclusion, the vaccination application allowed to improve the vaccination prescription in the field and after a brief training on people who are not very trained and used to use such application. We had no technical problem. The user experience was positive and we reduced the number of walkers needed by the vaccination team and we make save a lot of time to the team especially during the day but at the end of the day which allows the supervisor to leave earlier. Also we are using currently this application in the third round in the vaccination campaign and all the prescriptor of all the vaccination team in this campaign now use the application tablets and it's going well till now and also this allows us to improve our application for the e-care program. I would like to thank all the vaccination team in Central African Republic and all the people who collaborate for this project. Thank you for your attention.


I don't want to rain on the parade that is the Easter promo because historically the Easter promo has always been So much better than the Christmas promo in terms of the Easter eggs These mystery Easter eggs are the exact same thing as mystery Christmas presents It's just that the Christmas promo was so underwhelming that I am nervous about this now ask yourself Do you really think that's gonna stop me from collecting every single random mystery egg?  No question about it cuz I am I'm trapped in that motherfucker. He's got Kirk cousins now There's no John who Smith whatever. I'm coping now on a real note super excited about the sugar rush promo the first ever Gold 99 limited available player. That's actually not true. I think Super Bowl Mahomes was a limited available player But there may actually be some merit to the re-rolls the re-rolls are an 89 plus overall sugar rush player I'm gonna open one right now cuz I just want to see the animation It's cool. It's clean. I don't know man. I think some of the animation in the past a bit better regardless Let's talk about this promo and the players that are available right now And of course the big boy what we're looking for today. Oh shoot.  So that tells me that a lot of people are pulling him So that's really good news But the real one that we're looking for rest in peace Demarius Thomas Demarius Thomas passed away two years ago way too young so respect EA for honoring him and hopefully we can pull This card and honor him as well with an insane game gold 99 Demarius Thomas limited six three two thirty insane stats 99 short route running 98 spectacular catch this card looks nasty. That's what we're looking for today There are also some set 98 overalls. I'm not too impressed with them to be honest. There's a Stafford There's an eco Collins who I'm excited about Barmore March on Ladmore always gets an Easter card And those are the 498 and then there's the two gold 99 limited. So really right now It's Demarius Thomas or Leonard Williams not too excited about the 98s But here's one more thing I want to say if you're still playing Madden Ultimate team And you're interested in collecting these mystery Easter eggs, please for the love of God Do not buy them right now. We had the same conundrum for the Christmas promo and the Christmas promo I was shelling out all my money to collect Christmas presents and then like two days before Christmas They dropped an excellent offer I think it was like ten bucks and you get all the Christmas presents which Completely devalued all the work I did beforehand So wait is all I'm saying be patient and see if there's gonna be a better offer for these eggs Because I wouldn't be shocked at all if there is all right. I apologize. Yep session is over finally You get the idea there are random mystery Easter eggs that will hatch on Easter which I'm so excited to see there's two gold 99 Limits let's start open in some packs The pack I'm gonna open is this ladder up pack and on the 89 plus I get a 92 Jonah Williams good start the next ladder Step is three times 92 plus. Let's make sure we're checking these odds So you got a 3% chance and a 98 overall better. It's just not good, but a 10% out of 95 plus Let's hit those 3% odds. Why not, bro? Jim and Davis?   I'm not gonna lie boys It's been a while since I've played on the pack of play squad. I don't even remember what's on this team anymore I actually don't oh we get Queen Johnston wide receiver one for the Chargers Okay, I'll be totally honest with you if I was not a youtuber I would quit right now. Did I am so far ahead if this happens to you guys you get a limited like this Stop pulling it's only downhill from there regardless. I'm a gambling degenerate underdog fantasy by the way code MMG They'll double your first deposit up to a hundred dollars. Yes. I am cheating on prize picks I signed a new deal with underdog. It's for two years long. So get used to the cell Luke Godic 95 overall heater. So the oh Nelson Hegel are cheese. You got a 95.  Those are really good 95s in good positions wide receiver left end and right tackle And then looks like the final piece of this ladder.  Can I see a limited egg out the gates? Oh, so this I'll tell you right now This is not a limited crazy egg. What's interesting though is this is very descriptive. It's a wild card egg So obviously it's a weekly wild card Honestly the fact that I'm seeing this tells me that they acknowledged how pissed off people were in the Christmas promo So they're just blatantly telling you what's in it I don't know if I like that. Hey EA instead of just blatantly telling us you could just increase the packouts. No Second whoa It's brian branch. It's brian branch. Those are Detroit Lions colors. This is branch out.  I just pulled Leonard Williams in a limited egg out of like six packs Now remember the best way to tell the value of something is to check the quick sell value. This quick sells for 9,560 Chocolates, right? If we go over to the chocolate shop the cost of an extravagant egg is 4,900 so that is double the value of the basket itself that is a That's a spectacular poll no way. I get demarius thomas here, right? It's a 92 or a 98 plus. Don't tell me this is demarius thomas Oh, it's a 98 though Whoa, whoa Dude, what are we on right now? I'm doing this.  Give me deep out elite Okay, round tech for one is excellent. And then this is this man was built for double me. Yeah, I'm far ahead I'm not opening another pack I'm telling you what you're not going to see another sugar rush pack opening from me until They drop a really good offer and I promise they will it's going to be two days before the 31st Or like maybe three days before they're going to drop some excellent offer regardless. Let's go look at the pack and play team I don't even know what my team consists of right now. All right. Here's the pack and play squad right now I know this isn't even right. Who cares guys.  Nico Collins is now wide receiver one and then the homie. We didn't check yet Leonard Williams So what are you rocking? No outsiders. Mr. Big stop an edge that'll leave for one I haven't seen that in a long time under pressure unpredictable. This is interesting I think you go no outsiders super good ability this year take unpredictable for free and There's really no reason to run anything else. Gosh. That is a good card. No outsiders unpredictable for zero AP There was once a point in time where pack and play had rules.  I'll sell him after the episode He technically can't be on the team because I didn't pull it. You know, I'll be honest I don't think any of you are keeping a spreadsheet So let's just play ball de Marius Thomas gold 99 does he get special abilities? I assume not can still rock double me. So de Marius Thomas and Nico Collins He gets red zone threat mid out elite and mid in elite. Oh for zero AP You get improved catching on all medium passes. That's sick. All right gentlemen. Let's have some fun Did they give us a house rules for Easter? Bon bon bonanza. Can you make it through this bonanza to the playoffs? Both players get seven downs What? Okay, you get seven downs and you rack up points based on how big of plays you make All right, so it looks like we have to chuck absolute piss missiles What if we just go de Marius Thomas to the end zone and we'll have aj brown on a corner out as kind of a safety valve here Let's check this out.  Oh my god. Is that doable?  We're gonna go with a little post corner over here So Collins got the post de Marius Thomas got the corner who wants it more de Marius Thomas wants it more How many points do I get for this shit?  Oh, and he's gone. That's a free win. Nice job de Marius The servers cannot process this doubler All right, madden head to head is tweaking balls. So let's let's believe our way through this starting out on defense So I think you get seven straight plays. So he's gonna get seven straight plays to rack up as many points as he can by getting I don't get anything for that though. It doesn't matter. So he gets points by having. Oh, you don't get seven straight I somehow have the ball now. Okay.  Maybe we alternate. I don't I don't know I do know that if I get 10 plus yards, I get points and I just got a flag for calling two audibles Are you shitting me? I'm gonna lose the ball now. Oh no. Okay, we're good. Settle down, Matt Somehow de Marius is not in on this route combo.  So that should give me some points. Okay. I get a point for that I'm just gonna hit McAfrey. I'll take a few. Oh, maybe a little bit more if you want to break some tackles I'm gonna go a coyote again. Dude. He can't stop that row coyote breaks the tackle. That's my that's the nigerian nightmare Boy, I wonder if I could get McAfrey over the middle here. Yep That is the most frustrating thing about madden 24 Oh Shit.  I can't let him score. I can't let him score good huge Honestly, I don't know how he only got one point for that. That was a huge play But we saved ourselves from getting scored on Which definitely saved us some points. So that's really good. Damn fourth and goal He has seven plays to get in the end zone.   No, it's a pass same guy same guy same guy His own wide receiver busted that up sixth and goal You ever seen that before? Oh, good ball. Y'all poo. I respect it. I think he's gonna try the same thing I just gotta fly to the halfback because this is what he wants Yay, didn't matter couldn't get it off. It's eight to eight and now we're back on offense When does the game end? How long does this go on for? I feel like knowing the answer to that is probably pretty important But I just I can't find the answer right now. That's bad ball It's not a bad ball. It's a great ball any jump ball to nico collins is probably actually a pretty good pass Considering how ridiculous he is. All right, second and goal. What do we think about just a demarius thomas helmarie? Don't need to help marriage could just do that. Oh Oh, Jesus Have a little respect for the guy. Oh wait, the game's over when the clock runs out. Obviously. I knew that taking the Foot dog ship pass and we hit stuck and oh my god that reset the downs Wait, I'm back on first and goal now.   I don't know what I'm throwing right now But all right, we got a third and goal here.  Don't fumble. Don't fumble. Look at the push All right, we're rocking a fifth and goal here. Everybody knows that classic scenario Now we're rocking a sixth and goal earn as much clock and don't let him get in the end zone We'll be all right here. I'm gonna take the check down I'm gonna take this to nico collins set up seventh and goal. So this is my final play I gotta go end zone here. If I get end zone is ballgame. You know jamir gibbs jamir gotta get in there jamir get in there Oh, the gates are open. He got to the one All right, we got a five point lead every time he gets 10 yards. He gets another point He gets a touchdown. He obviously wins the game, right? We know this we know this He is passing. He's almost throwing an interception second and 99 god This is have you ever in your life seen that before? Have you ever seen second and 99 before? I have to imagine it's your first time third and 99 once again. Does he take a short check down? No, he wants it all. How are we not intercepting this gentleman fourth and 99 And oh No fifth and 92 this game is not over gentleman. It's not over. He could get in the end zone somehow No No, wait a second. I kind of got to let him score, right? That's insane. The game is not over Wait a second, but I still think I have a chance now. The only problem is if I don't get out of bounds. I kind of lose Giving a j brown a chance, baby. That's not cool, man. That's not cool. Let me go out like that I have to post this on youtube.com. You can't do this to me All right, gentlemen and madden servers are down once again. So that I have to end on that That's brutal. All right, my luck ran dry But hey, I had my I had my luck for the packs and that's what's important. All right boys Hey, I love you short one today, but insane pack opening and awesome gameplay I hope you guys enjoyed it was a blast. I love you. I'll see you guys in the next video. Peace