I could get everything set up because a lot of questions on a lot of questions on assignment to the reflector. So I wanted to talk about that. Let's see if it works. Another reflector. Man. There we go. Got it. I think it's going to be really bad drawing, but. Fairly good. Okay. So here's our switch. Right? We have the network. All supports. Okay. So we have. These are cords. I don't know if you know what that says. This is D. We'll call it the attacker. We'll call it A. So this is the attacker. Right? You have our computer. We'll call it B. It doesn't matter what it is. B is running the reflector. So this is where your program is running, right? So reflector is running. Where's the victim computer or the reflector computer? They don't exist. They're not real. They're not plugged into anything. Right? But in a program, you have a victim IP and a reflector IP. Now, I'm slightly confusing. I can bring it out and that's all. The program is called reflector. You have reflector IP and reflector IP. They also have ethernet addresses. So when an attacker wants to send a packet to the victim IP, what's the first thing it has to do? Yeah. It has to say, okay, who has this ethernet address? It's going to send an ethernet request. So how does it know that there exists an IP on that network? An ARP reply. An ARP reply. Right? All it's looking for is an ARP reply. So it sends a packet out. The ARP request can go to every single device that's on the local network. It's going to be a sent to this network where your reflector will be this thing and it will say, oh, this is an ARP request for the victim IP. Right? I should reply to that so they can go out and talk to me. Right? So from the attacker's perspective, all they know is that, okay, great. They're on a piece on the victim ethernet. Right? Does the attacker know that it's on the same port as this V? No. The attacker has no way of knowing, right? The switch is dealing with all of that. On the outside, you don't see any of that. So then the attacker sends, we looked at ICMP echo request messages. So it sends an ICMP echo request message to the victim. What happens next? Can I just see a request to the attacker? Yes. So the victim, your program gets that. See that it's for the victim IP. It takes the body of that message, changes it so that it's from the reflector to the attacker and sends that out. And then what happens? Yeah, the attacker says, oh, somebody's trying to ping me. The reflector IP. Great. I should respond to them. What does that have to do first? Probably has to do an ARP request, right? So it's going to do an ARP request for the reflector IP. It'll be a response back from your program. Right? And then it's going to send its ICMP echo reply back to where? The reflector. The reflector, which is going to go where? Back to the attacker. Back to being into your machine where your program is listening, when it sees this packet, what should it do? Send it back to the attacker as if it came from the victim. So in essence, this is the reply to that first packet that it sent. So where does ping actually come from? Or the echo ICMP reply come from? The attacker, right? So the attacker is getting back whatever the reflector sends to it. So in this way, anything that the attacker sends to the victim will actually be sent to themselves, and the results will be sent back to them. So we want to keep these two IPs separate so we have different victims and attackers. A, because they look really weird if the victim is just, like, every time you send a packet, they just send it back right back. And also when you reply, how would you know that it's a reply and not a new packet that you should respond to? Right? So that's why you need to separate this reflection from the representation. Questions on that? We start playing around with it, and we're having some trouble with the layers. So we can do a normal send to the victim. And it receives it and we'll send, we'll go to send something back, but our reflector, like when our reflector reflects that, it's requiring that we send a sent piece or a letter to, instead of a send, a normal send. Could you figure that out? It stands up and you've got to figure it out. It's also not a great document, but, you know, you got it. There we go. What's that? Can the map that is for both victim maybe and reflector maybe the same? What do you think? Probably it could be. Yeah, I don't see any reason why they cannot and don't have to be, but you don't have to worry about that. Just take the parameters and use them, right? Don't try to do anything to them. Just a general question, like a computer receives a packet, would it be standard for it to just cache the address in the IP parent so that it doesn't have to make an ARC request at a future date? I don't know. The question is, if a computer receives the packet, for instance, when a reflector just sends a packet to the attacker, does that, will the attacker always have to make an ARC request? I don't know. Is it also going to hash it? Because the IP could be a non-local IP, right? So it doesn't need to store that, but maybe it does keep track. That would be interesting. Doesn't that mean you could also bring in the protocol? The protocol you should ask if you don't know, right? Just assume that you know based on packets that you get. Yeah. So here we are simulating the reflector, but in actual case, we use reflector. So first case, any packet to victim machine? How does reflector know that the attacker has already sent a packet to the victim machine? Well, reflector has a machine. How many machines are there here? There are only two. Two. reflector has to be on the victim machine. Well, no virtual machines. There's only two machines here. A and B. I think it is virtual machine. It's virtual and confusing term, because it's virtual machines, right? There is no physical machine that is connected to the network that has the IP of the victim and either has the victim. You are essentially telling, how does any, so if any of these computers want to talk to you about a local network, how do they know that the other one exists? They send an ARP request and if they get an ARP reply back, they assume that that IP address exists. There's nothing. So that's all of your leveraging here. Because the attacker doesn't know you're just on this port, right? Remember what we said, the switch is keeping track of MAC addresses it sees on this port. So as soon as it sees an ARP reply of, oh, this MAC address is on this port, it'll keep that mapping there. It'll make sure that packet that gets sent with that ethernet address of the victim or the reflector gets sent to the meeting. So I'm a little confused, we're sending it, we're being the attacker, we're sending packets and then we're trying to listen. You're not meeting the attacker. You're writing this program. So we don't make anything that sends packets to try to attack and like sniff on the network. So you're just reflecting. So we don't have to do the attacker part of anything. Correct. You don't need to do that to test, right? That's all set. But we can both test it. But it's not part of your program. So we have to build it if we want to test our program. Build it. You can just try hanging. You can try art. You should TCP dump everything to see exactly what's happening. You need two computers or a virtual machine. Yes. I did it with two computers. That was kind of an easy way. I'm sure you knew a virtual machine, but I just need the exact... I don't know yet the exact configuration about to do this. But yes. It should be possible. Does our network in our case have to be able to do this? Do you have any trouble with the packets from the other back addresses? Yes. You're interfacing with each other so you get all the packets. But the scampi does that for you. As long as you're out of this room sitting out over here on that. You may have heard this. As I said, my client was not free. So it wasn't... For whatever reason, I didn't debug you very much. So my wireless on this wasn't sending out, I think, correctly. I couldn't debug it more than I just plugged in directly and it worked out. In that case, we might find the 5.0 or the... Yeah. So I have to change the interface and then send it out. That's why that's part of the argument. Attacker, we should be in the same network. Yes. We need to be on the same subnet. The attacker could be Windows, though, right? Yeah. You could be anything about it. It doesn't work on Windows. This is a network might be something special. Yes. You said... You said run it on Windows 1404. Does that matter? Wait. So when you're developing a yes, it needs to run on Windows 1404. If it doesn't run, it's the same as if you try to develop it on Windows. But I'm not saying it's... I can't guarantee it's going to be the same rate. That's why I can't say yes. If you want to make your own risk, you can develop on there if I have it. It does not work. Okay. On the no attack, which was what? Put in an ARP request, and you get, like, replies. And then you send those replies directly to the one that you want to do this outcome. Yes. So, except for ARP replies. So you're sending out ICMD echo requests to a broadcast address which means that that goes to so that they will all respond to what you're trying to take off the internet.  So we were looking at... The reason we looked at smurf attacks is because we looked at different ICMP messages. And remember, ICMP messages are at the IP layer. So we haven't moved up at all there. IP debugging messages. So you get an destination and a reachable message to state when a gateway says, hey, sorry, I can't access the router. There's lots of subtexts of this. There's never been a reachable host or a reachable protocol or reachable fragmentation needed, but don't fragment it to the set which we saw so the gateway couldn't fragment the packet. The destination host was unknown. We don't know who we were trying to send it to you. Or even the destination network was unknown. I don't even know how to get to that network. There's a huge list of them. So there used to be... So... You used to be able to try to cut notes off from the network by spoofing these messages.  And then the computer just kind of gives up and doesn't ever reply or try for a while to access the network. So yeah, you basically spoof a destination and a reachable address and then you would basically trick the machine into thinking that it can't access that. This one's super interesting. So ICMP time exceeded. So this is one of those... So what do we look back time here? Are there any times and time stamps in the packets? Yeah, the number of pops, right? There's no time stamps. We look at the headers of every single frame from Ethernet to IP to ICMP. There's no time stamps in there. So the time exceeded here is the TTL. So the time to live value is an IP packet. And so two things, either the TTL becomes zero, in which case this timeout will be zero, or if a fragmented diagram timed out. So we missed one of the fragments and we couldn't get one of the fragments. And ICMP time exceeded message looks like this. Basically what we've been looking at. And this gives us a super interesting networking tool that is very handy that you can use. So the idea is we used to be able to, and we kind of saw this, there's options in the IP header to say, hey, use this specific route when you're routing this packet. Or there was the logging of the route. So basically say, hey, every gateway along the way put a little time stamp telling me about yourself who you are along the way and see what route my packets took. All those got removed. And so now kind of the network after your hop is essentially a black box. But that's where TraceRoute comes in. So TraceRoute is a very cool idea of how we can actually try to map the network from us to wherever our packets are going to go. And it uses these ICMP time time exceeded. So the idea is you send out a packet with an ICMP of a packet with a time to level one. So then what will happen when that gets to the gateway? The TTLB 0, it will drop it and then it will send an ICMP what were you saying? The ICMP time exceeded message back and that will tell you and that has a source IP and it will tell you who actually that came from and then you send out another packet with a TTLB too so it will go to the gateway and then it will go one more hop die. It will send you back an ICMP message. So you have to know who that is and you can keep doing that by incrementing the TTLB out of your desk. Ah, you don't. You have no guarantee. You just know that at that point well, you don't even 100% know if things could happen or rather you or sometimes as we'll get an example in a second they don't even, sometimes they'll routers won't send a response back so it will just get dropped. So yeah, the networks are constantly changing. You know, it's pretty things I would say but yeah, you know, there's no guarantee that even when you trace out from one IP to another that even when you try to go backwards it's going to be the same. So the routes may be symmetrical. Trace route, very cool series of IP diagrams and so you need to specify the destination IP that you're trying to trace a route to. You can basically try to reconstruct this route. It's super useful. Like this is actually very cool. If you don't want to know like how many hops away are you from Netflix or Google or Facebook or you know, anything this is actually a very cool way to do that. So yeah, here's another example. This one has more names. So this one has more like router names depending on how you get to do this. I believe it's trace route, right? I'll try to find it. I think somebody uses this to do a trace route into their network where it starts printing out the text of Star Wars movie in all of those names here. I can't remember how to find it. So let me find it. It's a very cool useful way of using ICMP as it is. So moving on up. So we finally finished the IP layer. Now we're going to talk about what types of packets is that IP layer actually sending. So we saw ICMP is one type but that's really kind of an IP level thing. Now we want to think about at a higher level what are applications actually trying to send. So the first and there's two protocols we're going to talk about. They have a name that we're getting once that we send TCP and UDP. UDP is what we're going to look at first because it's a little bit simpler and similarly we're going to look at this and how we're going to tax that are related here. So the IP protocol sits on top of the UDP protocol sorry sits on top of IP and tries to provide connectionless unreliable best effort diagram delivery service where you do not get no delivery, no integrity no non-duplication, no ordering and no bandwidth is guaranteed. So what all these things mean? So what does connectionless mean? What was that? No handshake. Why do you have handshake? My question. Connection, right? So you can just send a UDP packet and you want it to already have a relationship established which would another way to figure out the connection. So unreliable? We send it, do we know if the other side got it? No way, no idea if the other side got it. Best effort means that kind of the same thing. It's just going to try and it doesn't get there and it doesn't get there, sorry. And the worst part is your application doesn't know what to get there. Datagram, so that just kind of means I think that is in terms of packets. So we're sending some data in a little chunk. So we send some data in some chunk and hopefully the other side gets it maybe they get it, maybe they don't will never know. At least UDP doesn't provide that we know. So it doesn't guarantee delivery, it doesn't guarantee integrity which means that our packet could be tampered with along the way. What about non-duplication? Non-duplication. Say again? No. This packet is not reductated again. Could be, okay. So one thing to be, we don't recent admit the packet twice. Well we may not, there's no guarantee maybe we send it twice. The other way to think about that is what if the packet somehow gets duplicated in the network somewhere? There's no guarantee when it comes, so when the person receives it we send it for three packets or five packets even though we only send one packet. So that's what that means. Ordering, so we can send one packet and then half a second is kind of a long time. But then right afterwards send the second packet and there's no guarantee that it will arrive in that order on the other side. Ordering and bandwidth. So there's no guarantee about having a bandwidth for these things or anything like that. So UDP kind of sounds like that's why we say this. It's super simple. Yeah. Is this broken? I mean it shouldn't but that's the thing is UDP does not provide the guarantees against that. That's the key thing. If you, so. And so what does UDP offer on top of IP? Why create a new protocol? Why not just use IP? So when we talked about kind of delivering and routing of packets in the IP network, what do we say the IP address was like? An address, a physical address. Right? So a physical address would be I don't know, I don't know any of the dorm rooms here. I assume there's like dorm rooms on campus that have an address. So if you wanted to talk to somebody who lived in that dorm room could you just use the address? What else do you need? You can either name or, we don't want to use names, we want to use dorm numbers, right? So we wanted to say what exact room number are they in? And so that's what UDP provides on top of IP is it provides an here set of dorm numbers or apartment numbers. We're thinking about court numbers, so that's what we use. So the idea is to allow send different messages to one IP address but be addressed to different services that are listening there. And so UDP is used a lot is for reasons because it doesn't provide any guarantees. It can often be faster or less overhead. So it's used in multimedia often or voice communication because there you only care if your bag gets duplicated or transmitted twice or comes out of order or whatever. Or if you lost a baggage, you don't care about it because it won't be sending. And there's a lot of services that are based on so the big one that's based on UDP is DNS. So DNS is domain name resolution. So translating the domain names that we typed in so like a trace route or a browser into IP addresses. So different applications can have different ports that they're using, right? Okay. And two can use the same port that then it's like they could like some sort of benefit indication. No. So two can't use the same ports? Correct. So yeah, one application that's a big application because the process that's running on the server, it can open up as many ports, you know, it can try to open up as many ports as it wants. But once it's listening on one port, another application can't try to listen on that port while that program is running. So it tells the operating system, hey, I'm listening for any UDP traffic on port, I forgot to be in that port, whatever, port 1000. And the OS will say, great, any packets that come in for port 1000 are directed toward to you. And that's how it gets done. Unlike TCP and our snippers, when they're listening to the physical interface, they see all the traffic. But normal applications especially if you don't want them to run as root, don't need that privilege. And so they get this UDP port of traction. And on the flip side when we want to send out a UDP packet, you say hey, I want to send a packet to this IP address on this port, and here it might have it. And the OS will worry about sending it out. So a UDP message is composed of the source port, the destination port, what do we need so we clearly need a destination port, I need a source port. Yeah, how to send it back, right, we need we're going to send them something, we need to know who can they talk, who can they reply to to send this response back, right. Especially something like DNS, and we say hey who has the IP address google.com you want to get a reply back that says hey google.com is at this IP address. Based on this, how many ports do we have? Sixty. Yeah, two to the sixteenth, right. Anyways, yes, about 65,000, that's the power of two that's around there for source and destination. We have a message length, so a header that says hey this is the size of the UDP packet, we have a checksum, or the checksum provides some guarantees that the header was not modified, and then we have the data. So actually even simpler than IP, right, IP had more headers in it, it had all kinds of flags and fancy stuff. So IP is super simple on top of that. Just say this is the port I'm trying to talk to here's the port that I'm coming from and here's the length of the message that I sent you. So how does on the receiving node get a UDP packet, so it uses the UDP port, but how does it know who to send it back to? IP, remember we have nesting malls, right, so we're going to have the outer most layer, we have the Ethernet frame, which will occur on our local network, inside that we'll have the IP frame, or the IP header with the IP data and the first part of the IP data is this UDP header, and so by looking at all that, that's how we know who to reply to. So, let's correct me exactly what I was going to say. So we have our header inside the data part of an IP packet, right, so this is when we looked at IP headers, then a whole section of data, well, the very first part of that data will be the UDP header. So how does the OS go against this packet, know that it's UDP, so a protocol field in IP, yeah, there was a protocol field in IP that's specified and says, hey it's either an ICMP message, it's a UDP message, or it's a TZP message, and inside there remember, so for each hop, which of these changes, yes, a frame header, right, every hop, new frame headers, right, but the IP header and everything else stays the same. Cool, so UDP actually pretty simple, so if it's based on IP, what kind of a tax can we have on UDP? What was that? I don't follow, I think you're on the right track though. The link player and the actually still affected. Yeah, so what kind of a tax can we do on the IP header? We can spoof, we can try spoofing a UDP packet, as if it came from someone else, right, and because it's connectionless, all we need to do is just inject this packet with a different source IP and source form destination, destination form whatever we want. So we can actually do UDP spoofing, right, and we can do this again, either if we're on the network, the local network in which case it can become a little remotely because nothing checks that we're actually spoofing the source IP address in any package that we send. So we have a trusted client, we have a server, we have an attacker who's, let's say, somewhere in the middle, doesn't really matter, they're not necessarily in the middle of their connection. They can send a spoof UDP request to the server and the client will get a UDP reply back. So this is fundamentally what we can do. So depending on what we have in here. So there's a variant on the SMIRF attacks that I believe it was what's the networking, the network time protocol, which is what all of your servers and laptops, well at least Linux uses to synchronize time. So there's a vulnerability in there that allows an attacker with a tiny packet request to achieve I think it was like a 100x response back. And so what attackers did was they would spoof the source IP the IP they wanted to take down they would send spoof NTP requests to that domain, to these servers, they would all respond with these huge responses back to the target and eventually taking them offline. So this was a really big deal and it was really bad because the people who were running these NTP servers they're not really vulnerable right they're allowing attacks on other infrastructure and so actually the big problem in the community to clean up and fix all these servers I don't even think they're still all fixed but I think their number is much, much smaller now so that the attack is not really feasible. So yeah it's kind of interesting right because the attacker can send something and you can get a reply even though you never asked for it right cool. Now if we are in the middle right or if we can see well let's talk about this actually so the client can send a request to the server so if we can see this request what can we do yeah maybe we can respond back beforehand but why do we have to see the request what was that yes we don't know what port the client is listening on and waiting for that reply right because the client in their message chose a destination port well pick the destination port because they wanted to talk to that application on the server and the source port they usually will randomly generate from all the ports that are not being used so there you have a 2 to the 16th you have 65,000 possibilities that the attacker could try to reply on if you try to do all of that it's highly unlikely that you're going to win the race back from the server but if you capture that packet now you can reply now how can you capture this packet sniffing sniffing if you want to hug or anywhere in the middle of these hops what else man in the middle so that would be well what kind of man in the middle of that using what yes so if we we're in the same which network do we have to be in the client's network or the server's network either we can get either one as long as we see this packet we can respond so one thing we can do is if we're inside the local network and use these two machines and we're going to route all of the traffic from the client to its gateway through the attacker and then we'll be able to see all these packets and then when this UDP request comes in we can just respond quickly hopefully faster than a server can respond and so then we can get a spoofed UDP reply back and the goal is to beat that UDP reply so you do terrify based on what you just learned so what critical critical network functionality uses UDP video streaming video streaming is not critical yeah DNS right when you type in google.com into your browser do you want to go to Google's site or do you want to go to my site you want to go to Google's site and you want to be assured that you're actually in Google's site and so this is part of the reason why now we'll get into later HGVS and all that other stuff that we've built on top of basic HGV and all those things but even if this is why being on an unencrypted wireless network is very bad because people with the right equipment can see all the packets that are being sent and so if they can see all the packets that are being sent that means they can see any DNS requests that you're making and so they can send a different response Jane Winterton who's in the GSI of the old screen initiative had a great article where she likened it to using an unencrypted Wi-Fi as like going into a public bathroom with avi shoes it's something that should be gross that we think is business so public toilet with avi shoes on and yet security hygiene speaking using a public Wi-Fi is basically the same the same thing but we just don't equate that in our minds but now you know the technical reasons about why is because anybody on that network can be messing with your DNS traffic look at it, what does it say? it's about the wireless so if the wireless has a lock next to it so if you have to give a password for a wireless you're fine it's when you get signed into a network and you get no password and you're just connected to that Wi-Fi that means every single machine that's connected to that Wi-Fi can see your traffic the application asks for a request they got a reply from who it was thinking about and so it just keeps it not listening so the protocol is hey who has the IP address at Google.com and the server will say hey this IP address has Google.com so I made the request, I get my reply good, everybody's fine above the HTTP above TCP so it uses TCP which we'll talk about in a second and it does encryption on top of that so yeah that's why these things were created back when people we really didn't think about all of these problems and how networks can go bad and how you can easily sniff or spoof networks or even back in the age when things were all wired and we had switches it'd be like oh you know you could never get these packets or sniff well you can art poison you can't do that now we've moved to the days where everybody's talking to the same wireless access point with no encryption so yeah so we've had to build so it's very difficult at this point to change the raw TCP UDP and IP layers so now we're building on top of that in essence to fix and patch all of their problems yes look at all the replies you get and try to make it a qualitative determination how do you know that you're right I think the first one wins every time yeah so you have to make your application smarter and maybe that maybe the request that you get back was a duplicated packet or maybe something else went wrong there's a lot of weirdness that can happen in the network but yes it's not done the first reply wins that could be something that you're talking about an intrusion detection system somebody's whether you then essentially it's a DNS poison so they do look for these kinds of things but no applications don't so now we're the attacker if we want to find out a local network what are the IP addresses what do we do that are computers that are active on a local network we can ping them all what's that going to do you might get a reply back from them if you were trying to ping Microsoft.com it does not work but you drop all your packets isn't there like that broadcast like 255 what could we do you could send the ICMP yes but they're not worth applying the ICMP messages ICMP after every request but it doesn't drop it I don't really look for every not working getting the IP addresses on a local network and sending the ICMP request to the broadcast right but you could broadcast all of them but they can choose whether to respond or not so they can just say not applying what's the other way how do you know if an IP address exists on a network not there yet I'm talking about previous stuff not new stuff yeah ARC request you can just send out a bunch of ARC requests for every single IP on your network right for all the hundred or ten that you don't know what you can do you can just send those out and for them to be on the network they have to respond to any ARC request and so using this you can get a list of all the ARC oh that's the other thing I should write it there's a cool tool called ARC ping which is like ping but uses ARC so you can ARC ping a certain IP address which could be very handy and I'll re-sign it and you can choose to ARC ping you can try ARC ping everything to see what posts are up so that can tell us whether an IP address exists on our local network on the remote network yeah we may have to try using ICMP echo request try a ping an IP ping so now we're trying to maybe learn more about a computer right so we know it's IP address we know it exists but we want to know what servers are running on that machine why might we want to know that right so maybe there's a vulnerability in that service right the only way we can try to influence a computer or another network is to try to get it to interpret our data in the wrong way or try to crash it or do something that way but we need to be able to send data to it and so we need to know what services does this computer offer and so to do that we need a way to do what's called port scanning we have 65,000 ports how can we know which ports actually have servers listening on them so what do we do you can send a UDP request to all the ports what will that tell you use end map end map I'm teaching you how to build end map you don't know what it's actually doing so you can send UDP request to packets to every single port what's the pro and non if you get a reply back what do you know yeah you know that there's something listening on that port if you don't get a reply back what do you know something on a venture yeah no one's listening on the port or someone's using it intentionally not to listen to you that type of request yes this is the problem right there's some specific protocol so like DNS is listening the data of a DNS packet better look like a DNS request if it doesn't the DNS server is likely to just ignore it right so yes if you send a bunch of UDP packets you may be able to get a reply back but you may not know if you don't get a reply back that doesn't mean that nothing's listening there exactly so this is the problem it doesn't give us enough information you can try actually as we mentioned there's actually a lot of ICMP error messages so some systems will actually send a port unreachable message so if you try to send a UDP packet to a port that's not listening it will tell you hey there's nobody listening at your port and here you do have to do a negative confirmation right so in this if you know that it does this then if you don't receive this message then you know that something is listening on that port maybe you didn't speak the right turn of the call but at least now you know that something is listening on that port unfortunately well unfortunately depending on how you look at it from the attacker's perspective unfortunately a lot of IP sacks limit the number of error the error message rate that can be sent and so you can't just send 65,000 UDP packets at this host you have to space it out so you stay within just ready to make sure you're constantly getting error messages and so yes you can use MNAP to do this so MNAP the dash s with capital U often says do a UDP port scan it will start up it will say hey all the interesting ports on here my default I think it only scans it doesn't scan all 65,000 it will scan the lower about 1400 I think I think it has a list of ports that it thinks are interesting and that's what it chooses there are command line options for MNAP for you to choose exactly what kind of scanning it does so I'll tell you port 137 of UDP is open which usually is the net bias NS service so can you take that for a fact no you don't know right when you don't know 100% you just know that there is a certain that yes there is something listening on this port but we don't know exactly you know it could be this it could be something else so yeah it will tell us everything that's on there so how I just kind of tried to tend to your expectations with this service component but I didn't get this information like a registry of which service would choose ports yeah so part of the problem is right so if you want to talk to a DNS server that's on a specific IP address what other information do you need to know what a port right and so at some point I guess probably hopefully it was very early they realized hey if DNS is running on different ports on different servers that's going to make it a nightmare to switch between different DNS servers right you got to switch servers also know what IP address and what port of every single server that's running and so they standardized a number of services and said okay port 22 is for SSH and port whatever this is 137 for UDP is NetBIOS can somebody look up DNS it's really annoying 53 that's right so port 53 on UDP is DNS probably also a tcd2 you can run a tcd5 but I'm not going to go really anyways so that's how those are there they're reliable-ish when you see something that's on a non-standard port that's when things get weird because you don't know what to say so if we look and we capture using tcd5 this traffic right this is another really, really good thing to do and this takes you beyond the level of somebody who can run NMAT to somebody who knows exactly how it's working and what it's doing is use tcd5 to capture the traffic to see what is this tool actually doing so if we look at this we can see that from our machine from source port 41481 to 192.810 which is our target port 138 UDP size 0 tdL46 and ID so we're sending 138, 134, 137 140, 131, 132 and so we get back port 134 unreachable so it tells us when we scratch that off and out of it we get back 140 unreachable 131, 132, 135, 139 and so we use this to scratch everything that we test off until we see that the ones that we didn't get these ICMP error messages back from were were 137 and 138 questions about UDP UDP is actually pretty straightforward introduces ports has the same problems as IK but has kind of cool scanning characteristics of how we can write scans to the outside so do we have any questions on UDP since the port for standard services are constant it will be easy for an actor to use UDP yes what makes it hard is well here it's all the same for example the source port is what makes it hard and I believe after review DNS I think there's a request number even if the DNS requested itself so it says hey I want to request by the way and I requested whatever some random nonce so it's increasing the space besides just a receiving port number I believe but it's not but still if somebody listens to that packet and sees that packet they can reply back there's nothing that stops them if they can see the whole packet and this is the whole problem because you're not establishing a connection with that server you're just sending something back and waiting for a reply can you choose not to reply the port that you configured can you choose not to reply who the one who has been requested can they choose not to reply like DNS server any port so an application you can configure your server however you want so you can tell your DNS server hey only serve requests from new IP addresses so you can ignore requests from other people but when you send a request you're waiting for a reply it's unreachable yeah if it's unreachable what are you saying if you didn't send these unreachable messages you'd just be passenger yeah so that would be a way to increase the stealthiness of your system would be to disable these port unreachable methods I believe in that case since the UDP ports are known what services they are I would try sending a DNS request and seeing what I got back or try sending a net bios or whatever that one was that's what I got back so yeah it would it would make the attackers job more difficult but I don't think it doesn't make it impossible on to the main show so TCP is the king or queen because I'm pretty sure protocols don't have genders of the internet so TCP moves essentially everything pretty much everything unlike UDP it is connection oriented which means we're setting up and establishing a connection with the other IP address it's a reliable which means that there's no loss no deduplication no transition errors and as the correct ordering and it's a string delivery service what does that mean yeah so it's continuous so you send a UDP packet with some data they get your packet with data they look at it reply with a packet of data and that comes back with TCP once the TCP connection is open can I set up your series I don't want to try to do it probably you might so TCP once the TCP connection is established the application can send whatever and however much it wants it can send an A, B, C, D, E, F, G whatever longer than the size of the packet and it's TCP's responsibility to make sure that the other side receives it in exactly that same order right so the idea is you always get A before B and you always get B before C and C before D and so on and the other thing is I'll know exactly where the other side is so TCP just like UDP has a port abstraction so this is really good it allows us the same size of ports so this is key so how many people have done TCP before so the rest of you need to pay attention TCP is complicated but in order to provide all of these features these are absolutely necessary so first key concept with TCP is what makes up a circuit so how do I know I'm talking right so this connection oriented nature of TCP what defines this connection so it's source IP source port, destination IP destination port so that's what I'm trying to talk to google.com I will create a TCP packet well we'll see exactly how that works but I will talk to Google's IP so that's the source IP, destination IP Google's source port will be port 80 that's the standard HTTP port so that's defined in those standards and my source port will be just like UDP, some random port that nobody's listening on on my computer and that defines a connection now there is a connection between our two computers and we'll see how this circuit is created and how it's destroyed the circuits allow for too many communications so I can talk to the other side and the other side can talk to me and they both provide all the same reliability there so IP port are commonly called sockets and the two streams are usually called socket here but I don't know anything like that so you can think of when you're listening on a socket means you're listening on an IP address to a specific port and when you get a connection now you have a socket to that other computer so you can talk to them which should be handy for your back door cluster so if we look at a team so remember, even though two so this is where you can see they're saying at a high level our application sees TCP as send this data hey what data did I receive send this data, it doesn't have to think in terms of data grains and sizes IP is what? IP which has packets and sizes and so we need to look at how essentially TCP achieves this abstraction by looking at the headers on the TCP packet so just like UDP, source port destination port the next one is a 32 bit sequence number which is used to keep track of the conversation we'll see the exact details of how this is used and acknowledge the number which allows how the other side is able to tell us hey I've seen it all the way up until E of your message the length of the headers are reserve bytes a bunch of flags and a window so we'll get into the window in a bit check some and an urgent pointer which says this packet is really important options so there's a section for all the options any padding is added up as often so it's a 32 bit and finally the data that's being sent in this BZD packet important things source port, destination port sequence number, acknowledgement number those are kind of the core parts here and so just like UDP it always helps to think that we have these nested null situations TCP packet with the TCP header nested inside the data segment of an IP packet which is nested inside the frame of an usually an Ethernet frame okay so I think it's in the wrong order okay we'll go over it at a very high level of these different things the sequence numbers and all these fields and then we're going to look at it in detail so the sequence number identifies where in the byte string the payload of this packet should start so for instance if the sequence number is 13 423 means the payload of this packet contains the data from 13 423 to whatever the size of that okay so there's what's that I think there'll be any options each blend is a header light so there's an extra header in the options okay we'll look at that okay so the acknowledgement so the sequence says hey here's where this data should go the acknowledgement says hey I've read up to this many bytes and I'm expecting this byte from the sequences that you have sent so the acknowledgement number specifies the next byte that the other side is receiving so if I've sent you a sequence number 1000 through 1010 your acknowledgement number would be 1011 because that's the next byte you're expecting from me so if we have 16754 that means I've read all the way up to 16753 that you sent and I expect the next byte to be 16754 so these are going to be super important because these are how each side keeps track of where each other is and what they've sent so this will handle retransmission, deduplication flow control, all kinds of cool stuff so now the TCP window is used to provide flow control so part of the problem with UDP is you can just send a bunch of UDP packets at another machine and it basically has to accept those with TCP now from the applications perspective I can just send like a gig of traffic on a TCP socket the problem is what's the problem there what if I'm talking to a phone does a phone have a gig of memory to receive all that modern phones yes I don't know if you want your OS season on your gig of memory so the idea is this window allows the receiver to say hey only send me this many bytes like a hundred bytes or a thousand bytes that's the only amount of data all accept and this way we can incorporate older devices and you can talk between any kind of number of devices this is our way of saying hey we're only going to take a segment if we've seen if the sequence number is between the last act that we send you and the act number plus the window size so it's in this way of saying hey this is how many bytes I can actually receive and the receiver can actually change the window size as the conversation continues depending on their capabilities so it's kind of a cool way of like built in don't overload me kind of things and once again you know we're security people so we have to look at this and say well nobody's enforcing this like this is a request from the client that says hey don't send me anything larger than an act number plus window but it's nothing stopping the receiver from doing that except being a good member of the protocol what if you spooked the receiver and you said oh send me a ton of stuff we'll look at that we'll look at that the tzp flags so the tzp flags unlike the other ones which we kind of lost over are very important to understand so the flags we have are sin flag which requests well it's using the connection it's interesting organization which is called a sin packet we have an act flag which states that the acknowledgement number field is valid so you don't always have to send a valid acknowledgement over a field but if you have an act that tells you that it's valid we have a thin flag which says I'm not going to shut down this string I'm not going to send you any more data a reset flag which states that we need to actually we should tear down this virtual circuit and create a new one because something went horribly wrong urgent states are the urgent pointers valid and push requests like hey this is data that you want between acts of the application as soon as possible again I've seen this a lot in traffic I actually don't know I don't know if it's actually used it's kind of interesting maybe it is because when you look at all of your UTCP on the linear web traffic all the browsers are saying yeah I got to push this but I don't know how much that's actually used I don't know if you guys hear 50 or 55 I'm looking at you because you don't know what I trust I'm trusting that alright so I will briefly go over this because I have to go over it twice okay so when we want to set up a virtual circuit just like a UDP we need to know what source IP and source port right we need to talk to a certain IP address on a certain port so to do that there's some server listening so the client is always the one initiating the request right that's how we think about it client and server so this is where we get to the three way handshake so the first part of the handshake is the client sends a SIN packet with a SIN flag set and a random sequence number to the server the server so let's call it SC the server answers with a packet that has both the SIN and the ACT flag set so it goes SIN, SIN ACT and so remember the other side is the two way conversation so the other side has its own sequence number so we'll have a sequence number it will randomly generate from the server SS then as the acknowledgement number so have to prove that it got that message by original SIN yeah it should send back as an ACT but what should it put as the value of the acknowledgement number field so one thing that could be you would first think about is yeah you use the sequence number SC right because that's what you got it's actually the sequence number that the client sends plus one Y because you're expecting that next byte what else how many of you are familiar with endian this so there's little endian big endian right so it's for an 8 for a whatever 4 byte number which number is the most significant byte or the least significant byte so on different operating systems different CPUs they're different the network order is actually different than most operating systems so if you can take the number that I gave you on the network add one to it and send it back to me that means we're both speaking the same endianness on the network so it's also a built in check on the network to make sure we were both talking the same thing because if you just took that value and just put it right back to me there's no telling me that you actually interpreted that number I said then finally the client then finishes the handshake and says yes I got you I'm going to send you an act with a sequence number of SC plus 1 and acknowledge the number of SS plus 1 so does this anything backwards now we have a full handshake so what I want you to think about is what does this give you that UDP does not give you especially in regards to some of the spoofing vulnerabilities that we talked about and I did that being vulnerabilities so think about that we're going to go back and we're going to review this


Hello, and welcome to the session. This is Professor Fahad in which we would look at CPA exam questions, specifically on the regulation section. These topics could be also covered in an entity or corporate income tax course at a graduate or graduate level. Specifically, I'm gonna be focusing on C corporation, which is a major topic on the CPA exam. The way the CPA exam is set up, there are certain topics that you cannot take any chances on. In other words, you have to understand very well as corporation, C corporation partnership. In other words, if the AI CPA software on the exam day notices that you have a weakness in C-corp, more likely you will not pass the exam because that's a major topic. And I will talk about how I can help you overcome this difficulty. Linkedin is where you would need to connect with me if you haven't done so. Please subscribe to my YouTube channel. I have 1,700 plus accounting, auditing, tax, finance, hundreds of CPA questions and Excel tutorial. C corporation is covered heavily in my income tax course and my corporate income tax course. If you like my lectures, please like them, share them. If they benefit you, it means they might benefit other people. Share the wealth connect with me on Instagram. On my website, farhatlectures.com, you will find additional resources such as this corporate income tax course that's gonna help you with this topic to supplement your CPA exam. And I have dozens of accounting courses that's gonna help you increase your knowledge and understanding of the topic, which that's what's needed for the CPA exam plus practice questions. I strongly suggest you check out my website if you are looking to add 10 to 15 points to your CPA exam. So let's take a look at the first question. As I said, on the exam, you really have to know your material. You have to have a good understanding of the material. Sometime you might have to memorize certain things in other places you have to know it. Let's take a look at this question. And sometime they'll try to trick you. That's why understanding the material, you can answer any question that they throw at you. Life insurance premium paid by a corporation on behalf of its employee. So the corporation is spaying and the benefits are the employees. Are deductible for financial reporting purposes to arrive to book income, regardless of who the beneficiary of the policy is? Is this a correct statement? Or are not deductible for tax purposes if the corporation pays the premium on behalf of the employee and the employee can name the beneficiary of the policy? So here what they're asking you is, do you know how do we treat life insurance premium paid by a corporation? Listen to me carefully on behalf of the employee. Look, if the corporation incurring an expense on behalf of the employee, that expense is deductible. That expense is deductible. If you're paying on behalf of the employee, that expense is deductible. Therefore, I would say, A, one is correct, are deductible for financial reporting purposes to arrive to book income, regardless of who the beneficiary is. So as far as book income, it's deductible. Now, number two it says, are not deductible for tax purposes if the corporation pays the premium on behalf of the employees and the employee can name the beneficiary of the policy. Now we have to be very careful. So we already know that they are deductible for book income. If it's an expense, it's an expenditure, it's deductible. So we're going to keep A because A has one. We can take out B. We keep C because two could be right and we could eliminate D because we know one is correct. So now all what we have to do is to find out if this statement is correct. If this statement is correct, the answer is C. If this statement is not correct, the answer is A, which is one only. We have to read this very carefully. Are not deductible for tax purposes and the life insurance premium, we have to be careful about this because we know in certain circumstances, they're not deductible and they're not taxable. Why? Because when we receive, when we settle life insurance by law, it's not taxable. So life insurance premium, I'm sorry, life insurance proceeds. So if we receive life insurance proceeds, they are not taxable. That's what we know. And if something is not taxable, if something is not taxable, it's also not deductible.  That's what the IRS is saying, but we have to read this problem very carefully. Are not deductible for tax purposes? If the corporation pays the premium, that's fine. On behalf of the employees, and the employee can name the beneficiary of the policy. That is true. When it's not deductible and not taxable, if the company is paying the premium and the company itself is the beneficiary, so the company gets the money. That's not the case here. Who's going to get the premium? The person, the individual, the employee, and the employee can name the beneficiary of the policy. So that's why that statement is not correct. If the proceeds were to go to the corporation, then the premium is not deductible and it's not taxable, but that's not the case here. Therefore, two is not a correct answer. The answer is A1. So you have to be careful. It's not deductible and not taxable if the corporation is paying that premium and the corporation is getting the proceeds. That's not the case. That's not the case here. Let's take a look at this question. Fast chip industries is a C-corp. How does fast chip ink treat net capital loss for federal income tax purposes? So on the exam, they cover a lot how the corporation treat capital losses. That's very important. Well, it's something you have to know. It's something you have to memorize. If we have capital losses, what can we do with capital losses? We can offset capital losses against capital gains. What if we have access capital losses? That's fine. We can carry it back three years and we can carry it forward five years. So you have to memorize. So this is a memorize and you could see this question on the exam itself. This question on the exam itself, okay? Now, here's what where students have a misunderstanding about this capital loss. Maybe I should keep it for the next question. No, it's okay. I'll explain it now. Some students, they know a little bit about capital losses. So they don't have the full picture. They would say it's deductible in full from the corporation ordinary income. So simply put, some students, they say, well, guess what? Ordinary income. Here's what you need to know that ordinary income and capital gain are treated the same for corporation. So be careful for corporation and specifically for C corporation. Whether you have ordinary income or capital gain, they're taxed at the same rate, okay? Which is different than individual, okay? So when the students think, well, ordinary income and capital gain, they're both taxed at the same rate, well, guess what? I can deduct, then I can deduct the capital losses against ordinary income. That's not true. Although they are taxed at the same rate, capital losses cannot offset, cannot offset ordinary income. That's what they cannot do, okay? So they are taxed at the same rate, but they cannot deduct it. Also, some students will choose A, and I'm gonna tell you why you will choose A and why it's wrong. And you have to be very careful. Deducted from the corporation ordinary income only to the extent of 3,000 per year. That is a true statement against ordinary income if we are talking about individual. If we're talking about a person, yes. For a corporation, that's not the case. For the corporation, you can take your losses, capital losses, offset capital gains, anything left. You can carry it back three years or carry it forward five years. Carry it forward 15 years is wrong. That's why this question is a little bit tricky. It's something that you have to memorize and understand because now you have to kind of differentiate. They expect you to differentiate how capital losses are treated for personal as well as corporations. So you have to know the difference between the two. And let's take a look at this question to reinforce what we just said. Bake corporation, a calendar year had the following capital gains and capital losses during year five. In addition, Bake realized taxable income of 56,000 from its regular business operation for calendar year five. What's the total taxable income?  Here's what you do, net them out. So this is a gain, a loss, a gain and a loss. And a loss. So basically gain and loss, they cancel each other. What we're left with is 2,500 gain. For corporation doesn't matter whether it's short-term or long-term. Here's what's gonna happen. We're gonna take this gain. And remember what I just said earlier. It's treated like ordinary income. So if we have ordinary income of 56,000, we're gonna add to it 2,500. Therefore, our taxable income is 58,500. This is our taxable income for year five. Let's take a look at this question. Which of the following costs incurred to organize a corporation are considered amortizable organizational expenditure? Here, what do you need to know? You need to know what are your organizational expenditure? Well, your organizational expenditure are legal and professional fees to incorporate your business. To incorporate your business. You have to be very careful. Professional fees, that sounds like right to issue a corporate stock. No, to issue a corporate stock that's not an organizational expense. Print and cost to issue corporate stock. That's also related to A, basically the same. If A is wrong, B is wrong. And when you're looking at this, you should be thinking basically issuing stocks and printing stocks are the same. So they cannot A and B because if it's A, it must be B. If it's B, it must be A. So that's why you could take out A and B. Legal fees for drafting the corporate charter. Yes, when you are drafting the corporate charter to incorporate, that's a legal fee. C is a good answer. Commission paid by the corporation to an underwriter? No, that's not the case. The legal and professional fees to incorporate, not to issue stocks, not for the underwriter to incorporate. Let's take a look at this question. And this question is important because it deals with the Schedule M1 and I have that Schedule M1 heavily covered on my website. In year four, Adam Corp in a cruel basis calendar year, C Corporation reported book income of 480,000. In that amount where rent expense of 5,000, municipal interest income, federal income tax, interest expense on the debt incurred to carry the interest fund. So let me show you how I like to show you Schedule M1. So basically they want you as what's the taxable? What's the U.S. Corporation income tax return? So we're gonna go from book to tax. So here we go. So for book, you have a total of 480,000. And what's included in this number is those items. Let me just show it to you here. Let me just, oh, okay. So we have 480,000, of which we have rent expense of 5,000 that was included. We have money bond of 50,000 that was included. We have federal tax that was deducted 170,000. And we have interest on money bond deducted of 2,000. So those were all factored into coming to this 480,000. Now the question is, now you're gonna go from 480,000, which is the book income. This is the, they're telling us here, it's the book income or gap income. This is book income. And we're gonna go to taxable income. Here, what we have to do. Well, when we go to taxable income, we have to look at these. Is rent expense okay? Can you deduct rent expense for tax purposes and book purposes? Yes, we don't have to do anything with rent expense. Money bond, we included 50,000 of money bond. Are these taxable? No, money bonds are not taxable. Therefore you have to deduct $50,000. So those money bonds, you have to take them out when it comes to tax purposes. So notice I took them out. Federal taxes, the word deductible to come up to 480. Are they deductible? Can you deduct your federal income tax? No, therefore you have to add them back since they are not deductible, you have to add them back. Interest on municipal bond, you are able to deduct to come up to 480. Are these interest expense on mini bond deductible? And the answer is no, therefore you have to add them back because you deduct them, but you cannot deduct them. Now what you do, you will take 480,000 and you deduct 50, add 170, add 2,000. You come up with 602,000. This is an important topic. This could be a simulation on the exam. You could have many questions about Schedule M1. Make sure you are familiar with it. Again, I'm gonna remind you, I do have an entity tax course that cover these topics and details on farhatlectures.com. And this is how I can help you succeed past the exam. And you will find hundreds, if not more than 1,000 tax and CPA questions on my website to help you pass. And one subscription gives you access to all my courses. So whether you are taking tax, audit, anything you have access to everything. Good luck, study hard and stay safe during those coronavirus.


So, in the previous part we had arrived at this expression here where we had agreed that the minimization can be brought down to minimization over u n minus 1 can be only brought down to this sort of expression.  So, notice the form of this particular this particular optimal control policy this is this is given this is now the optimal control policy at time n minus 1. So, notice the form of this particular this particular policy this particular policy what had multiplies by some multiplies the conditional expectation of the state it multiplies the conditional expectation of the state here with an with a constant matrix outside. So, in other words it is a linear transformation of the conditional expectation of the state further if you think more in fact if you go back to your to your lectures on the problem of perfect with problems with perfect state information you would notice that this underlined matrix here is in fact the same as the one that we had in the in the case where we had perfect state information. So, this this here is an important fact. So, what we are finding is that the optimal policy has a certain form the optimal policy. So, optimal policy is equal to the optimal policy is for this for for the for the problem with the imperfect state information is equal to the optimal policy perfect state information, but with the state replaced by the conditional expectation the conditional mean of the state conditional mean of the state given the information. So, so the optimal the optimal policy with the perfect state information is in fact equal to the optimal policy with the imperfect state information. Only thing that you need to do, so you apply the same matrix transformation, you multiply by the same matrix as you did in the perfect state information. The only difference is that when you have perfect, when you have imperfect state information you multiply that matrix to the conditional expectation of the state whereas if you have perfect state information you multiply it with the state which is already known to you. So, this is a tremendous result, because this is telling us that there is something that telling us a way or for reasoning about problems with imperfect state information. It is saying that the way to reason about these problems is that you pretend as if the problem is one with perfect state information and find the optimal policy and then just use another technique all together to compute your best estimate of the state and then apply that optimal policy on the estimate of the state or essentially by estimate I mean basically the conditional mean of the state given the information. So, this is what we have found at time n minus 1. Let us see if this in fact carries over to other time steps as well. So, let us do a few more calculations to see how far this can be pushed. So, now substituting this mu n minus 1 star in J n minus 1 to get J n minus 1 we get J n minus 1 of I n minus 1 is equal to the expectation of the expectation now remember the in J n minus 1 we still have these terms remaining with us this is still a term that is remaining there is this term that is remaining. This here has been substituted for with mu n minus 1 star which is this expression. So, let us put putting all of this together gives you that the J n minus 1 given which is a function of I n minus 1 is the expectation with respect to x minus 1 of x minus 1 transpose k n minus 1 x n minus 1 conditioned on I n minus 1 plus plus the expectation with respect to x n minus 1 of x n minus 1 minus the expectation of x n minus 1 given I n minus 1. This transposed with p n minus 1 times x n minus 1 minus expectation of x n minus 1 given given I n minus 1 the whole conditioned on I n minus 1. And then you have also the trailing constant which comes because of the noise the system noise that is w expectation of w n minus 1 transpose q n w n minus 1.  Notice that this expression here is also eerily similar to the one that we have seen before the there is now in there is now an additional term that has creptin this that additional term is actually this term here this is the one that has creptin and but so if the we would not have had this term if we had not seen this particular term when we were when we were doing problems with perfect state information in that we had we only had this particular term and and this term. So, the this term is actually arising because of the imperfect state information that we have notice that this term would vanish if i n minus 1 was had in it information of the state. So, if if i n minus 1 gave you the also had it had in it the information of the state then this conditional expectation would be i x n minus 1 and then there as a result of that this entire term would vanish. So, this is effectively the cost that we are paying because of lack of information perfect information of the state. But nonetheless although the expression of the optimal value function or the cost to go has has changed remember the policy is still the same we are still using the same policy that we would have used in the absence of in the absence of imperfect information. So, we are using the same policy that we would have used as in the case when we had perfect state information. So, now let us now let us apply this for the next time step and let us try to do this for j n minus 2. So, j n minus 2 of i n minus 2 it can be written out as follows.  So, first let us write out the DP equation and then this directly write the simplified form. So, it is a minimum over u n minus 2 of the conditional expectation. Now, with respect to x n minus 2 w n minus 2 and z n minus 1 this is the conditional expectation of x n minus 2 transpose q n minus 2 x n minus 2 plus u n minus 2 transpose r n minus 2 u n minus 2 plus remember we have now the cost to go which is coming from what we have calculated about is j n minus 1 i function of i n minus 1 and we have to condition now condition this on i n minus i n minus 2. Now, I will write in this case explicitly the u n minus 2 so that we are remember that it is also present in the when we are conditioning and then this is being minimized with respect to u n minus 2. So, if I open up this expression here what I will once again get a quadratic expression in x n minus 2 i the quadratic expression there is one quadratic here there is also another quadratic. So, this is a quadratic in x n minus 2 here. So, now I will also get a quadratic in u n minus 2 out here. Now, in addition to this I will also get I also have j n minus 1 of i n minus 1. Now, j n minus 1 of i n minus 1 remember can be written out from this above expression out here but so it is it has to be written out carefully as a function of i n minus 1. So, but remember so it will have it has a conditional expectation of i n minus 1 here and outside here we are also conditioning on i n minus 2 and u n minus 2. So, as a result of this the since i n minus 1 has in it more information than i n minus 2 and then i n minus 2 comma u n minus 2 as a result of that it the conditioning that is the conditional the expectation actually transfers to this particular term. So, you would end up conditioning on i n minus 2 and u n minus 2 instead. So, let me write this here write the expression and then we can explain it. So, we get we have conditional expectation of x n minus 2 transpose q n minus 2 x n minus 2 given i n minus 2.  So, when I do that when I take the condition when I condition when I have I therefore have a conditional expectation and nested inside another conditional expectation by the laws of conditional expectation this becomes this then becomes simply a conditional expectation over the weaker information. So, this becomes x n minus 1 transpose k n minus 1 u n minus sorry x n minus 1 conditioned on i n minus 2 u n minus 2 plus now I have my error term the error term is much more complicated to write because it is not it has a conditional expectation inside but then there is also a conditional expectation outside the outer one gets replaced by the weaker conditional expectation.  So, this expectation is over x n minus the this conditional expectation here is over x n minus 1 this condition this expectation here is is over x n minus 2 and then I have my last term here w with respect to w n minus 1. So, this w n minus 1 transpose q n w n minus 1. So, this becomes our final expression now this expression will require some analysis because it is it is not as simple as the one we saw for the case of perfect information. So, this will need some thinking on to how to on how this can be simplified and how it can be extended to the to the further time steps we will do that in the next lecture.


Seven signs your parents are gaslighting you. Number one, they don't listen to you. When you don't feel heard, especially in your own home, by your own parents, it can plant the seeds of insecurity and self-doubt in your own mind. Number two, they decide things for you. It can become toxic and problematic when they don't allow you the freedom to decide things for yourself. Number three, they tend to dismiss your problems. Instead of empathizing with you, they may simply tell you to move on and forget all about it because it won't matter in a few weeks. Number four, they tell you you're overreacting. If your parents do it to you so often that it starts to make you feel guilty or ashamed for feeling a certain way, that is a clear sign as any that something is wrong in the way your parents treat you. Number five, they deny their shortcomings. This may mean feeling like you have to keep certain things such as how you want to be treated or when you don't like what they said about you to yourself. Number six, they shift the blame towards you. Instead of owning up to their mistakes and taking responsibility for it, they simply shift the blame towards you often by playing the victim. Number seven, they never just take your word for it. They have to hear it from someone else before they believe it. Did you relate to any of the signs?


A second addition reaction is called halogenation. As it sounds, and let's start again with our ethene, and this time we're going to add a halogen. So let's add chlorine. If we add chlorine gas to this particular substance, then again the chlorine is going to add into that spot where the double bond is, and one chlorine atom is going to go either side of that bond. So we'll come back to a single bond. Once again we have a hydrogen, hydrogen, hydrogen, hydrogen, but this time we have chlorines adding across the top. So this time our product would be a 1, 2, di-chloroethane, a 1, 2 di-chloroethane where this time it's our halogen that's added across the double bond. Then two reactants and just the one product. Now the same thing would happen if we added fluorine, or bromine, or iodine, all of which are diatomic molecules, and all of which will add across the double bond in order to produce a 1, 2 dihalo, in this case ethane.


Hello and welcome to Newsclick. Today we have with us Professor Satyajit Rat and we are going to discuss some of the issues which is relevant to the COVID-19 debate, particularly the role of Remdesivir, how well it's going to be able to be effective against the COVID-19 epidemic, the SARS-CoV-2 virus and the linking of the Wuhan laboratory and trying to cut funding, talking about how the bad virus was being funded by various agencies including the National Institute of Health and why this is a problem. Now Satyajit, let's first discuss the Remdesivir issue. Interestingly, Dr Fauci seems to be related to both the issues at the moment. Now the Remdesivir trials have taken place and we don't really have what will be called the double-blind trial results in a peer-reviewed form even as a pre-print. What we have is reporting of this using the White House actually to promote a particular trial. Now while it may be that the trial was really useful and so on and therefore this is justified, how do you feel as a scientist about a double-blind trial results being announced in this particular way which seems to have influenced a huge number of people in thinking this is a real treatment and that's what everybody should be using. Yes and it's disturbing in part because Anthony Fauci has so far been correct and evidence-driven despite the precedent that he serves but for him to announce the Remdesivir results the way he did is disturbing because clinical trials should be formally reported in a full publication with all necessary details that are looked at by people in the field at most at the very least as a pre-print. None of this has been done. What has been done is an announcement from the National Institute of Allergy and Infectious Disease Director from within the NIH that's formally Dr. Fauci's title has been for many decades now and that's unusual to say the least. Not only is it unusual, it leaves me a little puzzled about why the hurry because despite the fact that it was presented as though Remdesivir was efficacious the data that were claimed in support of this efficacy are not startling or spectacular improvements. Medically we can call it modest improvement rather than really a magic cure so to say. Oh it's certainly not a dramatic cure. If I remember the numbers correctly hospital discharge median periods went down from 15 days to 11 days. In the first place let us agree that this is not back. It's useful but in the second place let us also agree that this is not a dramatic cure. In the third place also let us remember that the decline in mortality in this trial did not appear to be statistically reliable. It went down from some 11 or percent to some 8 or percent. Fauci himself said statistically not significant. Which reminded me of the paper that was published in the Lancet just a few days ago from Chinese researchers who did a Remdesivir trial perhaps a somewhat smaller one but did a Remdesivir trial and had data that are actually remarkably similar in their conclusion to the mortality data that Fauci has reported let us say. And that is that there is a trend to reduction that's not as yet statistically reliable. All of this put together makes me think two things. Number one is Remdesivir making a difference? Probably yes. Modest difference. Is Remdesivir going to change qualitatively how seriously ill patients of COVID-19 are treated? I don't think that that's going to be the case. In other words it's not a magic bullet cure. And if it's not a magic bullet cure then this much of enthusiastic prepublication publicity is a little difficult to understand. So one can think of all sorts of other reasons for doing this. One can think of generous reasons such as the fact that this is a US presidential administration that is not known for being science and evidence driven and is desperate for good news. And here is one piece of kind of sort of science and evidence driven good news. And therefore it got pushed forward let us say. One can also think all said and done this is Gilead and NIH collaboration driven outcomes. And one can also be a little more cynical and think of this as a means of establishing Gilead's credibility shall we say. And global push for Gilead therefore. So one can think of all sorts of practical reasons why this was done. But let us be clear about this. Regardless of the absolute rights and wrongs step by step of how and why this was done Remdesivir is likely to be used in modest fashion. So the two follow up questions. One is a lot of the scientific community has said this is going to distort all other drug trials because people are going to say don't use as guinea pigs already established Remdesivir works give it to us. So in effect you are also going to therefore distort all other drug trials. This is one issue that has been raised. And the second issue which of course did your round has raised who is the hydrochloroquine guy if you will. He has said why is it the clinical trials what was originally set out as a criteria the endpoint. And one of the criteria was reduction in mortality. Why was it taken out of criteria midway through the trials. It's as if you are changing the rules of the game midway when the game has already started. Yeah. So the first question that you raise I'm not as seriously worried about primarily because I think that everybody concerned even distally professionally with COVID-19 is going to look at the data of Remdesivir and say it's useful but we need more. So I'm I would seriously doubt I grant the point that you're making but I seriously doubt that anybody is going to stop looking for drugs. And let me come back to that point about drugs antiviral drugs for COVID-19 in a while. Let me address your second point of the rounds criticism. And to an extent how shall I put this. It's a little bit a case of as it's currently called. What about is it. Professor Raul has been accused of fiddling with his inclusion exclusion criteria in the hydroxychloroquine trial that he reported. And he's understandably just if I believe not but understandably upset about it. And therefore he now has a chance to indulge in what about this. Is he is he reporting correctly that the primary and secondary readouts were altered in the in the trial? Yes. Is it that unknown? No. Many clinical trials do this. It all essentially boils down to egos clashing, to people getting upset and to storms in a teacup. We keep coming back to the core point which is remdesivir is not more than modestly effective even if you take everything at base back. And but really from the public health and from the societal point of view that's all we are interested in. We don't really care who's quarreling with whom and calling whom. The only question is dressing it up a bit more attractively. Of course has an effect on gillian share price. Exactly. That of course does make a difference. Which is why that's the second issue I brought up. And I said one is for the administration for the current US administration to look good. The other is for gillian to look good. And both of those I have very serious reservations about his intentions. But from the broader point of view I would say this is not a terribly effective drug. That is the central point that does emerge that it's a modest gain. And in fact this that is a question that you actually should be able to really show some light on. Dr Fauci also said well you know when the AIDS drug started they had also only modest benefits but they have worked. Okay they have really changed dramatically. Correct. Do you see any parallel in that? So this now risks bringing my personal opinions and speculations in the biology of infectious disease into contention with people like Dr Fauci for example. And I bring that up to underline point that this is now a public airing of a civil disagreement. And our audience should take it as that. But that said and those are caveats that I'm advancing. But that said they point out two things. Number one let me point out that the HIV infection that Dr Fauci was alluding to where antivirals over the course of about a decade from the late 80s to the mid 90s came to protocols that really were effective treatments. And I'm using the term effective very carefully. There are two issues there. The first one is that unlike COVID-19 AIDS is a chronic infection. Lifelong disease. It therefore does not either kill you or leave you cured in a matter of days and weeks. It goes on and on and on with the viruses ebbing and flowing and growing in your body if you're infected. It therefore gives you the operating space in which you can prevent the virus slowly painstakingly carefully and hope over time to make a difference. That's the first point. This is not how SARS-CoV-2 and COVID-19 are facing us today. Severely ill patients of COVID-19 tend to die in days. So a 30% reduction over 15 days is very different or a 30% reduction every 15 days over a year which is what we are talking about. Which in a sense is what we are talking about. There are more even more striking differences because of these differences in the rates. But yes, broadly that's what we are talking about. Secondly, let me point out something. The HIV treatment doesn't cure you. It's lifelong treatment. What the treatment allows your physicians and you together to do is to keep the virus under control so that you can live a close to normal life. HIV cure is still nowhere on the horizon in any practical sense and this brings me to my second and broader point that most of my friends and colleagues think I'm being pessimist about which is once a virus has established in the body and is growing controlling virus growth is unlikely to have as dramatic an effect on improving illness as the same thing with bacterial infections and antibiotics. I've said this in some of our discussions in the past. See bacteria grow by one becoming two becoming four becoming eight becoming 16. So you interfere and this is the rate of growth that you bring down.  Viruses don't go from one virus to two viruses to four to eight in their rate of growth. They go from one to a thousand to a million. Even when you bring this down with great efficiency you're you're interfering in an extraordinarily steep growth curve because effectively it takes over our sense to produce copies of the billions of copies of the virus and therefore I think that both biologically and empirically effective antivirals will not be as dramatic game changing treatment as effective antibiotics are for material for acute bacterial infections. But coming back to Dr Fauci making this kind of claims and then we put it very crudely is to put a bit of a lipstick on the pig. Well to be fair if I'm being unkind since I don't have to be civil but it does seem to have dressed up the results a little more attractively than perhaps science wanted.  He just pointed out repeatedly also that it was a pretty good looking pig. Okay okay coming back to the second issue of which Dr Fauci also is there and this time I am going to ask you questions from his corner so to say. Now here is the attack that has come on National Institute of Health for having funded bat virus program and collaborating with the Wuhan Institute Wuhan lab which was researching bat viruses. Now the whole world on the issue of pandemics knows that bat viruses have cost repeated possibilities of pandemics. We have for instance the Zika virus the Deepa virus the Ebola all of this are there. So we have almost looked on the bat as a reservoir of possible pandemic viruses and with SARS the earlier version which is the SARS-CoV effectively one if you will that virus also came from bats so did the Mars virus the Middle East respiratory syndrome. So bats being researched would be the first line of defense world over and collaboration would be something which is in the scientific community taken for granted. Why is it becoming so controversial? Is it that the United States the huge number of cases having failed to protect its population now really looking for shall we say complete bogus arguments and bogus pointing of fingers. In some sense China did it it was either China hid it or China did it. This seems to be the new shall we say narrative coming out from the US. Absolutely and do I think that the NIH the National Institutes of Health of the US were wrong in participating with a multi-institutional collaborative study with the Wuhan Institute of Virology for studying coronaviruses in bat not at all the NIH funds has for decades funded these sorts of efforts. I think even in India we're right. Yes we have collaboration absolutely the world over the NIH has funded this not simply the NIH a large number of shall we say prosperous economy funding agencies have funded exceptionally multilateral multinational collaborative efforts to understand zoonotic viruses. There's just no question that this was the right thing to do it was right scientifically it was right ethically it was simply the obvious thing to do. So for the NIH to be forced as one gathers what I don't know if this is a certainty as yet but one gathers that the NIH is being or has been forced into cancelling the funding that or at least holding in abeyance the funding that involves the Wuhan Institute of Virology is clearly therefore a purely political especially when you consider two things number one is there any evidence whatsoever that the SARS-CoV-2 virus is anything but yet another natural animal to human zoonotic transmission of infection no all available evidence says that that's what SARS-CoV-2 is that's what MERS was that's what SARS-CoV-1 was that's what Ebola was that's what Margot Margot fever was that's I can go on and on and on naming zoonotic viral infections they all came like that this is yet another in a long list and therefore to hold the Wuhan Institute of Virology which was working on the original SARS-CoV-1 virus in common let me point out with the whole range of laboratories across the world all of whom including the Wuhan Institute of Virology have been complaining and grumbling under their breath for the past decade that funding has been drying up and is being withdrawn because people have forgotten SARS and it's not been a problem only 8,000 people infected so people didn't bother after that and and and we haven't seen a case for over a decade so and and and this is the normal everyday bread and butter stuff of life science and biomedical science research so for for for the US okay let me be careful for components in or elements of the US government to suggest repeatedly without providing evidence that this is an engineered virus or that this is a laboratory virus at the very least that escaped or was released is irresponsible and is clearly therefore so did it when you say irresponsible you're being very scientific absolutely finally that's why i needed to look for the appropriately balanced work and is clearly in pursuit of a political objective that's not supported by science and the evidence in the case so in fact it would also be that those who have been in the front line and the researcher in Wuhan she's known popularly as a bat woman who spent a very large part of her time in inaccessible places hunting for the virus as a protection for the people who could be exposed to pandemic this is really trying to make scapegoat of people who are in the front line of science against such pandemics and researching on such pandemics so this is really in some sense making somebody the victim or largely or essentially political ends as you put it yes let me let us let us also point out while we are in the um in the unfamiliar territory of defending my fellow scientists um let me also point out something else that biologists are being scapegoated for you see when there is an outbreak of a new infection that is a dangerous at least for some people infected by and large the physicians and the biologists involved tend to be looked at suspiciously when they point it out first as are you just trying to make yourself sound more important than you are after all your funding has been drying up you've been complaining we've heard that you've been complaining now you are suddenly discovering that there is a SARS-CoV relative um out there again um how sure can we be that you're not making this up is what the bureaucracy of government the world of response with and it takes some time and accumulated evidence and many a miscommunication and misstep driven by this this this this shall we say mutual unhappiness that invariably and inevitably delays matters beyond what in retrospect we would have liked to see did this happen in this case in all likelihood it did because it happens in every case it has never I think not happened under those circumstances I'm a little resentful that that inevitable likelihood of delay is now being used to beat up on biologists and physicians who've been trying their damnedest in China and elsewhere um keep in mind that the Chinese scientists working in this have been collaborating the NIH grant is evidence of that with their colleagues the world also and they put up the genomic sequence January 11th January 12th they announced it a couple of days earlier and it's also interesting once you shut down Wuhan you sent a clear message that you think this is highly dangerous so to see that after one and a half months two months of that people still thinking that it's a mild flu now that speaks volumes over the seriousness with which you took the message well let me point out there seems to be reason to believe that on the third or the fourth of January the Centers for Disease Control of the US were told by people in authority in China Dr. Gao who heads the CDC China and he was in tears when he was talking to Dr. Redford this is reported by New York Times you know was this a case of related discovery when it should have been discovered in November it should have been discovered in December in hindsight we can say many of these things but let us point out also that country after country from the end of January onwards told by the WHO still did exactly the same thing delayed it said oh it's not here we haven't found any cases with the parenthesis that we haven't looked for any cases and therefore really we haven't found any cases every country did this in their own peculiar way of trying to minimize the upset the damage the turmoil in administration in society that would inevitably result we in India did something similar by not undertaking testing on a wide enough front early on in fact we just instead took the easy way out of not just imposing the lockdown but imposing the lockdown and giving our people the impression that the lockdown itself would solve the problem which clearly at the moment it's not thank you Satyit for being with us essentially therefore the accusations on the Wuhan lab is much more politically motivated and a gimmick to rescue President Trump's shall we say disastrous handling of the of the epidemic in the United States it's it's five one third the one fifth the population of China and seeing figures which are many many times more than that both in terms of people infected and in terms of deaths so of course he needs a narrative now and so I guess does the United U.S. media to admit that they no longer are the global's leading power being able to control everything including themselves thank you very much for being with us and hope that we can continue discussions in this vein again or the COVID-19 which doesn't seem to be going away and next time we shall discuss Indian issue that you have raised because that I think is also something we need to take stock of now this is all the time we have for news click today do keep watching news click and do visit our website