Welcome to Toffy TV, it is the start and the levings show for Everton against Crystal Palace at Goddison on Sunday. Let's get into it, Jordan Pickford in goal, no brainer. Right back, John Joe Kenny, obviously Seamus Coleman. There's no word from Marko Silver in his press conference regarding Seamus Coleman and his fitness, so we're going to assume that he's going to be out for another couple of weeks. John Joe Kenny, who's done well of late, he's actually got better and better, so he's a right back. Luca Dean, who's been on duty with the international French side for the last week or so, him at left back, he's been fantastic for us so far this season in the games that he's played. At the heart of the defence, K2 Met and Michael Keane, I know yet he mean it, looks as though we may actually be in the squad for Sunday, but it's not the right time to break up Keane and Zuma just yet. Let me in again, get himself in the squad, get him watching again from pitch side, get him involved before we try to think about breaking that up. Not the moment he don't deserve to be dropped either of them, so there's a partnership for the weekend. Into midfield, I'm going to assume Adrissa Gay passes a fitness test. He is doubtful at the moment, so I will go with, I'm hoping that he's going to be fit, so my midfield would be Garnett alongside Tom Davis, again the same thing that Andre Gomez, hopefully he'll be on the bench, he's getting closer to playing, but Garnett and Davis were excellent at Leicester as a pair, so those two in the midfield. Guilffy ahead of them, he's really come into his own of late Guilffy Sigarton, absolutely brilliant the last few weeks and obviously that match winner at Leicester the other week was incredible. He's got four goals in his last four Premier League games, so Guilffy the tip of the midfield. The left hand side, Bernard, outstanding performance at Leicester City last time out, really getting up to speed, getting up to the fitness levels of the Premier League, it's such his ability to go past people, his vision is just everything that we need to open up a team like Crystal Palace. On the right hand side Theo Walcott hasn't been great this season but he's always a threat, he's a goal threat and his pace worries teams, I actually fancy him to score at the weekend. Theo on the right and up front Richard Ellison, we caused less the real problems last time out. We need that pacey direct frontman, at the moment Jank isn't at the top of his game and I just feel as though that four at the minute are Eddins best option, so that's who I would go with this weekend. I'm hoping to see Gary Mina, hoping to see Andre Gomez in the 18 for the weekend. James McCarthy, I reckon it'll be another couple of weeks for these in the squad, but that may be changed by what happens with Garner, if Garner's out then Snidel and they'll probably come in and then maybe McCarthy will be considered, I don't know. But that is the start on 11 that I would go for against Crystal Palace on Sunday, and let's hope Evan can give their third win on the row. And it'll be about time that we won a game on a Sunday because our record isn't great of late, so let's get rid of that one on Sunday as well. If you haven't subscribed please do so, only takes a minute and if you want more videos get over and join us on Patreon.


Hi what's up you guys, this is La Modeles and welcome back again to my YouTube channel. For this tutorial I will teach you guys on how to recreate the cocoon shaped sleeve which is popularized by Cristobal Balenciaga, Jesus Telpozo and reimagined by Sara Burton of Alexander McQueen. This design is so avant-garde and it is one of my favorite sleeve styles. So honestly it is not so easy to make but I have managed to recreate my own version of the pattern and I told myself why not share the creative process to the world. So prepare your tools and materials and let's recreate our own version of the cocoon sleeves.  And do not forget to include the important notches such as the center line notch and so on. And establish the lines for center line, elbow line, and bicep line. From bicep line at underarm side seam, mark down 4 eighths of an inch or 1.2 cm. And mark out 2 eighths of an inch or 0.6 cm from underarm side seam. From 2 eighths of an inch or 0.6 cm marks, redraw the lines for the new side seam. From the 4 eighths of an inch or 1.2 cm marks, redraw the armhole. This is for the armhole enlargement. And label for reference. Next cut the patterns at the center line making 2 pieces. And as you can see I will work on the back pattern first. And from underarm side seam, mark in 2 fourth eighths inches or 6.3 cm. And from side seam at wrist line, mark in 1 fourth eighths inches or 3.7 cm. And square a diagonal line connecting both marks together. And let's do the same thing for the front pattern of the sleeve. And I am going to cut these new lines making new panels. So now I have 4 panels for the sleeves, 2 panels for the center line and 2 panels for the sides. In here from the center line, I attach a pattern paper for the enlargement. Next extend the elbow line. From elbow line at center line, mark out 5 fourth eighths inches or 13.7 cm. From extended elbow line, mark out 1 inch both sides. And square a line. At the upper part of the sleeve, from the cap at center line, mark down 6 eighths of an inch or 1.8 cm. And from this mark, mark out 3 eighths of an inch or 1 cm. From the 3 eighths of an inch mark, square a diagonal line towards the 1 inch mark at elbow line. Next get the halfway measurement of this line and mark. From the halfway mark, mark out 3 eighths of an inch or 1 cm. And draw a curve line on the first half. And a slight curve line on the second half using a straight ruler. Make it sure to hit the 3 eighths inch mark at the cap of the sleeve. At the lower part of the sleeve, from the 1 inch mark, square a diagonal line going towards the wrist at center line. Next get the halfway measurement of this line and mark. From the halfway mark, mark out 3 eighths of an inch or 1 cm. And draw a curve line on the first half. And an inverted curve line for the second half. And for the back pattern, I'll do the same procedure. And now we have enlarged the patterns by making a cocoon shape at the center line. For this pattern, we have two sections, the upper section and the lower section. And from the seam line and new center line, we are going to establish lines for depleting. From the elbow line at seam line, mark up 7 slash lines with a measurement of 6 eighths of an inch or 1.8 cm in between. Next from elbow line at center line, mark up 7 slash lines with a measurement of 1 6 eighths inches or 4.3 cm in between. Next, connect and match these marks creating multiple slash lines for the pleats. For the lower section from elbow line at seam line, mark down 5 slash lines with a measurement of 5 eighths of an inch or 1.5 cm in between. Next from elbow line at center line, mark down 5 slash lines with a measurement of 1 2 eighths inches or 3.1 cm in between. Next, connect and match these marks creating multiple slash lines for the pleats. The elbow line will also be a slash line for the pleat. And do the same procedure for the front pattern of the sleeve. From the seam line, cut out the slash lines but not fully or beyond. Next, get another piece of pattern paper for spreading. For each slash line, spread it open by 1 6 eighths inches or 4.3 cm and use a sticky tape and tape it in place. Next, from the sleeve cap, at the upper section, match the lines and fold downwards. From the wrist line at the lower section, match the lines and fold upwards. Once you have folded the pleats or slash lines, establish your desired sewing allowance and cut out from the paper. For me, I have used 4 eighths of an inch all over my patterns. And these are my patterns for the cocoon shape of the sleeve. I also drew the lines for the notches to avoid confusion. For the cocoon sleeve, we are going to connect it to the side panels. For the back and front side panels, I am going to connect them both at the side seam, making a whole new pattern. Also, don't forget to put your desired sewing allowance.  And snip out the notches for my sewing reference. And FYI, I have placed this pattern on the green line of my fabric. Next, connect both back and front sleeve at the new center line. And on the curvy parts, snip it out to ease the tension. Next, press the seams open for a clean finish. Starting at the upper part, fold the pleat lines and pin in place. After folding the pleat lines, sew the pleats in place to hold the folds. And prepare the side panel for sewing. Next, sew the cocoon shape of the sleeve onto the side panel to complete the whole sleeve. So, here is the end result of the cocoon sleeve. Et voila! And here's how the sleeves look like attached on a basic bodice. So if you can see here, I have achieved the cocoon shape for the sleeve by enlarging and creating multiple pleats to give it a voluptuous volume. Anyway guys, comment down below if you have any questions and I'll make it short to answer as quickly as possible. And I hope this tutorial gave you enough tips on how to create a cocoon-shaped sleeve. And don't forget to give this video a huge thumbs up and subscribe to my YouTube channel Lamo the Least and I will see you guys again on the next tutorial. A piento!


Good day. In this session, we will be discussing existing and emerging technology in teaching and learning. For our discussion, we will be touching on existing and emerging technologies and then on a framework on how to pick the tool for a specific activity. For the existing and emerging technologies, I will be, I have divided them into several categories. There are activity tools, video tools, assessment tools, gamification tools, social media tools, authoring tools, collaboration tools, and virtual worlds. The criteria I have used for picking these tools are that they are web-based, no need to download and no need to install and that they are free. For the activity tools, I have divided them into several categories too. There is discussion, whiteboards, infographic tools, presentation tools, and timeline makers. For the discussion tools, I have picked a collaboration classroom where you can see you can manage discussion forums and create discussion forums. And I have also been using Google Hangouts, the chat feature of Google Hangouts for discussion boards, because for learners who are quite used to messaging, Google Hangouts has that feature where they receive their messages or discussion messages, like a messaging feature, like a texting message. Next is for the, for other discussion tools, if you have a learning management system, there are usually discussion board tools included. The, for whiteboard tools, whiteboards are usually used for collaboration, for brainstorming. So the tools I've picked for this is Tazit. As you can see, it's, they're all just blank pages where you can write on them, whether it's handwritten or typewritten. SketchLot is another tool. Twidla and Studol are other tools for whiteboards. The next is infographic. For infographics, you can have your students create a summary with graphics of what they've learned or a poster of what they've learned just to reflect and summarize their, the content. So for these, the tools I've picked are Canva, PictoChart and Venge. Venge is really good because it tracks, it has analytics, so it can track your, the people that have viewed your infographic. For presentation, we have PowerPoint, of course, and PhotoPeach. PhotoPeach is basically a slide maker for photos and same for Kizowa, but with Kizowa, you can use videos too in your presentation. For timeline makers, for, usually use timeline makers to have students maybe summarize the history of a topic or the history of a theory. So the tools I've used for this is History, Capsules and Timed Lider where you can see that there are dates at the bottom for you to mark the the year or the date for the event. The next category are videos and we use videos because they are more engaging, demonstration-friendly and because of the visual cues, it facilitates thinking and problem-solving. So for video tools, I've picked ones where you can edit your video and the first one is YouTube Editor and Pautune. Pautune can help you make animated videos and an emerging technology in video is interactive videos where you can add questions or add a discussion board within the video. So the tools that you can use to make interactive videos are Viologs, Ed Puzzle, and Play Posit. And usually if you're doing videos you need to, sometimes you need to edit audio too, so there's cheer-bit and audacity for audio editing. The next category for technology tools are is programming and this is becoming very popular with learners right now because this is a skill that's quite important and I've picked some websites where you can take courses on programming languages. So the first one is Code Academy. The next one is Scratch where they say from a nine-year-old to a ninety-nine-year-old can use it and it teaches you the logic of programming and also, Code Academy has a lot of programming courses that you can sign up for. The next technology tool is assessment tools and for this, I've picked Class Tools.net. It's a website where you can create your own assessment tools from crossword puzzles to multiple choice quizzes or you can use existing ones from the website. There's also Quiz Revolution and Yakapaka which also has existing quizzes that you can just use or you can build your own. For games, I've picked Kahoot to create or to play games for your students and also, you can do badges that you can give out to your students for every achievement that they've attained. So there's OnlineBadgeMaker.com and for websites where you can have your students access games, there's Education.com, FunBrain.com, ScienceBob.com, Brainiost.com and the Utah Education Network website. With social media, this is becoming very popular too since this is something that the learners are using every day. So you can have them do a blog and have the tools for that is WordPress, Blogger and Wix where they can write a journal for their learning or just post their answers on their blogs. You can also use chat or messaging tools to keep in contact with your learners. So there's Google Hangouts, Line, Messenger and Vibeur. Facebook groups are good to use too for collaborating or just keeping in touch with your students. Google Plus can be used the same way. For authoring tools where if you want to make your own modules, a self-contained module, these are the tools to use. There's EC Generator, Smart Builder and ScreenCast-O-Matic. For ScreenCast-O-Matic, this is one tool that you'll have to download and install and this doesn't really create a self-contained module, but it captures your screen so that if you want to do a demo of a software, you can use ScreenCast-O-Matic. For collaboration tools, you have video conferencing and you can use Google Hangouts for that and for project collaboration, you have Yammer which looks a lot like Facebook so you can add your students here and they can communicate and keep their files here. Basecamp operates the same way and then there's Google Apps for Education where you can use Google Docs or Google Sheets to collaborate on a document. Same with Wiki Spaces where you just add your students and you can collaborate on a topic. For virtual worlds, I only have one tool in that second life and for this tool too, you'll have to download and install. So with all those tools that I've mentioned, how do you know which tools to use? Little Janet Begler designed a matrix based on Laurie Lard's conversational model based on the type of activities and these type of activities are assimilative, adaptive, communicative, productive and experiential. So for the first one, assimilative, this is just processing narrative media, managing and structuring information. So for this type of activity, you can do lectures or videos or just reading texts. So the technology you can use here is word processors where they can do concept mapping and brainstorming or presentation software and or crossword puzzles. The next activity is adaptive and this is where an environment that changes according to learner input. So the technologies for this are virtual worlds where they can do simulation and games and interactive videos. The next type of activity is communicative where your students can discuss, whether it's asynchronous or synchronous discussions and here you can use electronic whiteboards or discussion boards, instant messaging and video conferencing. The next type of activity is productive where learners produce something. So they can create a book or a report, an essay or journal, a literature review. They can compose or synthesize. So for the technologies, you can use image editing technologies, infographic tools, the timeline maker and other project collaboration tools. The last type of activity is experiential and these are interactive activities that focus on problem solving. So with this, your learners will be practicing and applying what they have learned. So you can do case studies or experiments and laboratory experiments in a virtual lab or interactive videos. And this ends our discussion for existing and emerging technologies and I hope that it will help you pick the tools that you will need for your teaching.


Everybody for a steer ripping 23 24 prism draft basketball hobby eight bucks number 10 random teams We're gonna randomize now, and then we'll get started. Good luck everybody and two go five times here Go names first One two three four and five Alex L down to James s And the teams one two three four and five Excuse me spurs down to Raptors Alex L spurs Charles F Rockets L two pelicans Jonathan L sixers Kenneth W. Cavs Manuel V Mavericks from Mars Hawks Michael S Kings might Manuel V with the Clippers Nate S. Lakers Gregory M Thunder Barton L Suns Joseph C warriors Brett scene all non-NBA Joshua B Celtics Charles F Nuggets Jeff M Blazers Jonathan L Nets Tom B Bucks Wolves Eugen with the magic Gregory M. Nick Jeff M Bulls Kenneth W Hornets Manuel V Grizzlies Kyle Z Jazz Joseph K Pacers Wang S. Heat Kenneth W. Wizards Gregory M. Piston James S Raptors These posted right now There's your link for the results case you check them out anytime late in sports cards calm results quick link bottom of the website So it's like we'll have to push them more guys Let's go ahead and get black football in the mixer and NT filled up. Let's see a Big card out of here got Matt Bradley rookie purple ice number to 149 a Grant sure field rookie Otto to 75 sure field But he was Phoenix. He was Suns and summer leagues only affiliation. He has silver Adam Flagler hyper Mojave King Rookie Venom nice price sense about going to Utah Venom or snakes in whichever one you want to call it and a Kobe buffkin Kobe buffkin Kobe steakhouse We go to the giant liquor bowls they make I'm getting that Edwards the 99 on the autograph Justin Edwards. I think he might still be I think he's not NBA. I think he's in college now. I just give it whatever doesn't matter my drink so much That's not gonna make a difference Noodles rice protein don't matter Yep, that is gonna be non NBA. He is at Kentucky currently as a freshman silver Brandon Miller I think it's always kind of like that in prison draft illegal. I think hypermatheran Red Hakeem it's like a handful of case like that red Hakeem obviously goes Rockets to 99 and a skewed brilliance Maybe not quite this common though Say David Thompson auto to 75 David Thompson, where's his longest tenure? David Thompson Denver, right? Yeah, okay Denver Nuggets on the David Thompson Silver Dylan Mitchell hyper Trey young and a purple ice of the Marta Rosen for the bulls Bulls the 149 is silver feel it's Brandon Miller Charlotte a couple Brandon Miller so far. Let's do it. Let's do it rated prospects silver of my Taz Busellis for non NBA James Najee rookie gold autograph number six of ten James Najee. He is Where you at Najee where you at? Hmm gonna be Charlotte, right? Or no Pistons or wait Hornets then right because he's still in he was drafted, but he's still So we go draft rights, which would be the Hornets, right? Yeah, okay, so the Hornets have his rights. They're just gonna go Hornets Solid one there. It's getting confused there for a second. I Didn't know he was drafted and then like traded. I didn't know that or like the rights. You know what I mean? That's why I was getting confused there. I thought it was just Charlotte, but I saw Detroit. I'm like, whoa, so it is Charlotte in a Charlotte Silver Isaiah Thomas, but we want to hang on to there.  Thankfully. I didn't yeah Taylor and Taylor enters rookie blue to one ninety nine for the jazzy sco nights I know Jake will appreciate that as a fellow night. There's been a Cambridge rookie auto out of 149 Desmond Cambridge is gonna be a That's not the right desmond Cambridge different desmond Cambridge here. Where's this guy? Yeah, Desmond Cambridge, Jr Raptors, right? Yeah, Raptors Raptors Yeah, web and yama definitely the big chase in this Short prints numbered cards silver a star Thompson Hyper Evan Mobley red at John Morant number 299 Jordan Hawkins Like all women yamas are selling pretty well right now Nice. Yeah, I didn't see it Jake did not see it Here at whatever Derrick Whitehead on the autograph rookie You can never remember anything nowadays three whiteheads Brooklyn that's on the whitehead Don't want whiteheads though. I want those Silver Levine put a 51 last night hyper rookie case and Wallace and a blue wave of Nick Smith, Jr. It's 249 Wemby fireworks or to tattoo if I was ordered a tattoo ink. I probably wouldn't have an arm right now Scoot the 99 is a Gabe Kelshaw rookie auto Are you sure it's a Gabe Kelshaw? That's Jake. That's my impression. That's my impression of Jake He goes to the wizards silver Kelshaw Nick Smith, Jr. Hyper and a Kendrick Davis rookie blue ice That I'm 99 silver widescreen is Dylan Mitchell. I didn't Jake. I didn't hear are you gonna say what it is or no? I'm gonna time out he hasn't said what it is yet So 99 is a Chris Livingston purple ice rookie auto Chris Livingston. Yeah, bucks on the Livingston Silver Palo Hyper shack Purple Trace Jackson Davis That one's number to 75 I'm in Thompson. Yeah, Paul. That's the worst game in the NFL history. Is that the Jets Giants game earlier? Blue ice is a Palo nice Duke color match and magic color match Orlando It's 199 you got a Daniel Gibson auto to 75 for the Cavaliers Oh silver Damien Lillard hyper rookie Colby Jones and a blue ice so Han for the spurs It's 99 and a Steph Curry fireworks 25 Jalen Wilson rookie autograph on the mojo. It's like Nets Jalen Wilson, right? Nets silver rookie Jalen Pickett hyper Tatum red sassar rookie Out of $2.99 and a widescreen Jimmy Butler Her we're getting the ball for the first time David Singleton rookie autograph here Yeah Hawks It does it makes like almost no sense hyper rookie Derrick Whitehead Got a blue wave Grady Dick It's 249 for the Raptors and a silver Chris Murray So that game is set the NFL back 50 years Jake just said chat chat back 50 years life Wemby base That is a to 125 blue auto of christian brown for the nuggets Solver Keontae George hyper Jalen brown Tristan Vukovic to 199 rookie. Yeah, man. That's that's a tough one That's like the worst one though Redemption is bob macadoo. Wow bob macadoo. I believe is gonna go to the clippers Legacy signatures prism blue Bob macadoo Yeah clippers clippers bob macadoo It was Buffalo who became the clippers.  No Leaky black is hornets So 149 silver jaden ivy hyper rookie keontae george and a red a blue wave trey young for the Hawks It's 249. Oh boy orange pulsar is a dillon mitchell autograph for all other Nice mitchell to 49 texas color match. That's all other So rookie keontae george hyper rookie adam flagler and a blue magic johnson The lakers the 199 cd sasoko blue ice is a rookie auto joey hauser. I think he It's 75 joey hauser jazz I was afraid.  Gotta be denver. It could be the mavericks, can it? It is denver. It is denver Fat lever auto for denver to 149 What's up mic? That's silver londi hyper rookie sensaba and a red could be buffkin for the hawks 299 and a week three whitehead again Mojo here auto is max well lewis max well lewis For the lakers 25 silver is brice sensaba hyper paul george and a blue wave of amen thompson Going to the rockets to 249 Blue is a stef curry Out of 199 for the dubs a peat nance Not that kind of nance Not with the z Okay, uh, gonna be cleveland Cleveland on that one silver scotty barns hyper keegan murray and a blue castleton for the lakers It's 199 Give my boy Howdy Echler? Oh, dillon's going down Jacoby walter blue ice auto to 75 goes to all other Silver keegan murray hyper zion and a blue ice and bead For these sixers there to 99 orange postal rookie otter's uh traquavion smith Jim's illegitimate son Traquavion right sixers on the traquavion smith rookie otter to 49 silver is iverson hyper rookie singleton and a red d wade We're at 299 silver taylor hendrick's prison break. Let's see an sp Eagle stink dude. Got john marant purple. Yep out of 75. That's facts You got a dama sanogo auto to 149 sanogo Sanogo bulls Seth londi silver hyper donovan mitchell and a red kj evans at 299 julian strawther to 75 for kibalu ice auto Nuggets on the strawther silver jaylon williams hyper rookie is adama sanogo blue is maxon's prosper rookie At 199 and his zion There he is that's a no go on sanogo. Oh boy Magic rookie otter to 149 tiger campbell Nothing huge yet.  All right Silver rookie brice sensabaugh. That is a redemption. It is erin bradshaw college penmanship He's a freshman right now, right? Yeah, so that is all other all other on the bradshaw Silver rookie kendrick davis Hyper jaden ivy red jaylon brunson one of the nicks got black gold here It's 299 on the brunson and a gold vuketjevich prism break one of 10 Vuketjevich go see the one with the draft right somewhere else wizards on the vuketjevich wizards scoot henderson base Blue ice keegan murray number to 99. That is a turquavian smith rookie auto smith is sixers silver magic johnson hyper rookie is leaky black and a Venom rookie is bilal kula bali Appreciate it aurora 23 looks better Got a jacobi walter. That is I believe non or non nba as well There you go bears on the jacobi walter silver rookie leaky black hyper is damien lillard and a um jarris walker purple ice to 149 That's jarris walker silver ricky council the fourth rookie auto Council i'll check that in a second here silver malone hyper picket and a purple alan iverson iverson is 75 for philly and the star thompson silver rookie council the fourth Is sixers All right autos here.


All right, so there's some room at the front for those just coming in and You are in room two as you know, we're going to talk about x rat So a deeper dive into x rat monitoring China's interests Abroad with surveillance and with mobile surveillance where so our two speakers are a poover Kumar She's a security researcher at look out spends most of her time uncovering and exposing threats as he emerged in and around the mobile space And we also have a Rizu Osainzad Amirizi To security researcher and reverse engineer with experience working in different domains of security and I'll stop their bios there because I want to give them the floor and the time to speak to you guys Thank you very much. Thank you very much for coming. I know it's been a long conference. This is the second day This is a Friday afternoon. Everybody has enjoyed themselves last night at the party and our understandably quite tired, so I'd like to thank you for coming along and Melting your brains with some Android reversing So this talk is kind of linked to the previous talk and I see a couple of people that were there in the previous talk So I hope you enjoy that they're sort of attached to each other and you saw the big picture you saw all of the details of the context of some of our investigations last time and Right now. We're here to tell you about really just a particular mobile family mobile malware family and go really deep Into the Android reversing and into it all its technical capabilities And hopefully this is a good exercise for all our security researchers here So just to give you a quick overview of who we are my name is a purva This is our isu and we are security researchers at lookout Our focus is mobile malware, whether it be iOS or Android malware And we spend all of our time Just as Kristen showed in the last slide or in her last presentation that we spend all of our time looking at the malware Looking at its context understanding how it's being used But then also just immersing ourselves in each family and trying to understand why these malware Developers are doing what they do and why they do it how they do it So Today we're gonna talk to you about two different ones Kristen already mentioned Excessor em rats, so I hope you guys are taking notes. They will be a test And then we will start to deep dive into x-fat and we'll talk about its technical evolution How hard it was to actually see that evolution and categorize it talk about its Communication how it talks to its c2 infrastructure what the c2 infrastructure says to it As well as some of the context around its investigation and what that tells us really about the malware So this focus of this talk is really about what it can tell us about the malware How we can use that context to sort of flesh out more of the malware capabilities and details so Excessor em rat if anybody could stand up and just tell me what they remember about the previous slide, but Excessor em rat was discovered in 2014. It was widely reported. It had two components Android and iOS Kristen already went into a lot of detail as to why it was Built the way it was But I'll tell you a little bit about it again for the new people in the room So it had an iOS application, which we're not going to talk about at this point But it needed a jailbroken device. It was it was installed through a city a package But what we're going to focus on today is really the Android component And that was a two-stage application It had a sort of benign front and it posed as a code for HK application code for HK is a non-profit organization in Hong Kong and it advocates for transparency within Hong Kong, so it was off-interest to a particular set of people within Hong Kong as you can imagine It was discovered in 2014 as I said during the pro-democracy protests within that space And during the umbrella movement, so it was a two-stage Android application It contacted a C2 server called accessor comm which is exactly where it got its name Excessor em rat em rat is obviously mobile rat Rat for any beginners in the room is a remote access Trojan So it looked like this It was sort of when it was running it disguised itself and as soon as it got installed it asked to install a second application called system thread Basically posing as a system application on Android And then it would disappear into the background So as I said before it was widely Reported and this is an example of a message that was received by one of the pro-democracy protesters the people Part of the Occupy central movement And they received a link something like this which downloaded a sample of accessor em rat so there was a lot of Reporting around it. There was a lot of chatter around it at the time and this particular article goes into how the code for HK Organization claimed that it had nothing to do with this particular application So it it said we don't have an Android application and we know nothing about this particular application Which is how we know perhaps it was They didn't source it they didn't develop the application themselves So while this reporting was going on me and our zoo were looking at this rat And we were trying to understand it and break it apart and while we were doing that We came across a different variant now depending on who you speak to and how they classify malware. It's not Too much of a science. It's more of an art people see different similarities and different code structures and realize totally different things X rat is Can be considered a variant of accessor em rat, but we classify it as a different family Regardless of those very very specific details We're gonna go into why we think x rat is different how it's exactly different and explain to you You know, perhaps some of the motivations behind the actor and how they've changed throughout the years So we're talking about an application that started in 2014 We've also written a blog about this because I know all of you read our blog very very carefully and Have already caught up on this particular one in 2017 In the middle of 2017 and we've blogged about it Extensively, it's not a new family, but it's still worth talking about and I'll go through why the blog basically talked about really the high levels of this initial version of x rat that we saw and Some of its capabilities some of the interesting things were exactly what you expect a surveillance where family to be so surveillance where Kristen again went through that in her talk previously, but it is an application that sort of targets a particular group of people and Exfoliates as much information off a mobile device as they can Within the context of mobile malware, obviously Some people call it spyware, but don't get the two options confused It has to be I have to explain that distinction just because some people will call it spyware But look out and we we call it surveillance where The interesting thing that wasn't surveillance where like About x rat is that the last sort of set that you see over there Which says it repeatedly downloads and deletes large files trying to exhaust mobile data supposedly That's runs counter to a surveillance where you don't want the person to know that you're on their device But that seems to be quite a nuisance that it starts to raise red flags for the user So that's an interesting point to point out about x rat So let's take a look at one of the more recent versions and then we'll talk about the evolution as a whole x rat in the context of a sample that we received in May of 2019 Has sort of two main aspects of its Structure and functionality it has a class called a protocol class Which is basically an enumeration and it has two things in it. It has a set of things that That have a suffix c to s which we suspect is client to server and another set that is s to c Which is server to client so we call the c to s ones actions these are things that the client can execute actions that it can perform on an infected device and s to c which is Commands that it can receive from its server So the c to server or the command and control infrastructure can come back with 45 different commands And tell the client or the rat to do whatever it needs to do so some of these things overlap But they're not necessarily the same What's interesting on this slide is the icons that it uses so again just like its older cousin Excessor em rat X rat uses sort of the generic Android Android Application to try and blend in obviously that's the image for the operating system. So it can't be anything bad But there's two interesting samples that have a slightly different picture And the fact that they're so rare and have a different icon as well as separate titles May tell us something about where else we can find this Surveillance where and perhaps what it was used for The graph that you see is look out data for when samples were acquired by look out And you can see the different spikes In 2017 when our blog came out Again in 2018 and now we're seeing a much more consistent use of some malware So it's still being used is still being handled and and and that's interesting to take note of It is a surveillance where it is a spyware So it's going to take everything it can possibly take from your device And as we've already established as Eva has established in her keynote If you take control of a person's phone you take a control of their of their lives So it's got everything for you It's got exactly what websites you visited who you called what meetings you had what applications you have on your device What files you've downloaded all your passwords all the files and then passwords to unlock those files All the pictures that you've taken of your dog and your cat and your family and your co-workers Or your recordings of wherever you take your device These are not difficult to do that. We see these every day in every single surveillance where So this is just a wide range of things that x-rat can do and what generally applications can Surveillance where applications can do the interesting thing to look at the slide is the we chat databases in the QQ data So x-rat is particularly targeted to people who have those things on those devices So it could be people that are Inclined more inclined to use Applications such as we chat and QQ You can probably tell that there's a particular area of the world where these are more popular than others so Let's get to the the evolution of it and how we decide to categorize it again. It was very hard it's running for a long time and A lot of these categorizations was actually very hard to categorize Based on code structure for all the researchers in the room You know most of the time you look at the changes in code to try and classify and Categorize malware so but this was very hard to do with x-rat The code looks largely the same throughout all versions There are small minor differences in one or two samples and those are the ones that we want to focus on But it was easier actually to categorize them into three separate categories, which we call versions And it's based on the configuration files found in the malware so We're gonna look at dates of the configuration files that the date in which they were last modified Version one was a little more like a baby Its configuration files were very simple. They were plain text. They had no obfuscation They were found from they were last modified from sort of December 2014 To June 2018 so even you know fairly recently They were about three percent of the samples that we observed It had some interesting and human analysis mechanisms, which I'll go through and it had a second stage So version two which comes along next is more like a toddler I would say It was about 92 percent of observed samples. So this is the one that's really favored by The x-rat developers Its configuration files were DES encrypted If there was some sort of minor obfuscation and emulator detection within it, which again will go through It had some persistent mechanisms and it had some new commands and it we see this version up until today. It's Quite a detailed one and quite a change from version one now The thing that you have to realize about version one and version two you can see it some of the things have been have disappeared Version two doesn't have any anti-analysis mechanism. So this is interesting. Why did they move away from that? Then let's look out version three and version three is more like an angry teenager It's about five percent of the samples that we saw and the last modified dates of the configuration The configuration files were from October 2017 to April 2019. They were a in cut AES encrypted And they used multiple encryption keys not only one But you can see that actually some of the things were taken out and some of the things were put in It's not necessarily that it was just increasing its level of obfuscation every single time So with that let's deep dive into some of the technicalities And I'll start with sort of the quick ones, which are the anti-analysis and anti-detection mechanisms So the most interesting one was the self-destruct functionality of xFAT This I believe was also seen in Emirates and what it did was it clean cleaned up certain files and directories Depending on the sample it could basically wipe your phone if it wanted But depending on the sample that you looked at it cleaned up different files and directories And that's an interesting a point to make why was it different from it it almost appears like it wasn't mass produced, right? It was each sample was kind of Created that way for a reason It had antivirus checking So it had an antivirus check and if it found any of those Antiviruses on the infected device it would disable all of its rat functionality. It didn't want to be found It had some Emulated checks so blue stacks is a popular Android emulator. It looked for that it looked for particular IMEI numbers if if you're not into Mobile devices, that's the sort of unique identifier for mobile devices So it looked for particular IMEI numbers that are linked to particular emulators now while this isn't a complicated check and some Emulators probably can get around it This is pretty good for I don't know 90% of the dynamic analysis engines that are out there It also did the usual when I say usual. It's because we see it every day. It hides its icon. It hides activity There's nothing really on the screen that will let a lay user figure out that there's something running on their device The last thing is that it Put all of its exfiltrated data the updates Of its itself as well as its debugging logs all in hidden folders in the SD card probably due to size The last thing I want to talk about is the anti-analysis mechanism So this was really interesting the initial versions as well as accessor emrat crashed the popular tool dex to jar if you've never reversed an Android Application before dex to jar is a very popular tool used to convert a dex file Which is how an Android application code exists in an APK to a jar file, which can be easily reversed So what it did was it had a zero width instruction at the beginning which kind of threw off the tool and crashed it This was moved away from I It's interesting because maybe it it signaled that they didn't really care whether people were looking at it There are better tools out there as well. Perhaps the people who were trying to reverse them didn't use dex to jar It's just interesting to see And to get into the mind of the person developing this tool. Why did they get rid of that? I? Guess I'll we'll talk about the configuration files and sort of how they change now Hello everyone, so I'm going to just jump into the configuration file. I've probably mentioned them a couple of times now Let's see what do what what what are they? What do they include so basically configuration file as a file in the asset folder of the package? It will include information about the server or the c2 or the command of control It will include an IP and if I include Port I'm not going to talk about vision one of this family because as a prova said it was a baby and It was in plain text. So there's no reason to bother you with that It's readable. So everybody can just let go and look at it version two. However It starts encrypting these information in the in the asset file the asset file in this case is called string.xml The string that is used to generate the decryption key is a double base 64 encoded string It's hard coded in the function that does that Decryption and encryption. It's called this utl And the decryption algorithm that is used is DES encryption These are some of the samples of the double base 64 encoded DS keys that we observe through these families Gonna go move on to version three now so version three Takes it one level higher In terms of complications so In this case the file is called consata and I it's still located in the asset folder of The package it still includes the C2 information. However This time the decryption key is also included in the configuration file It's the first line of the file and second line is the IP address and the third line is the port of the C2 server Another thing to note about version three is some of the code is hidden in another file in the same asset folder This file is usually called base base that IPK base that BTC, but well the name can't change anytime and This asset file is XOR encoded. It can easily be Decoded using a key which varies across different samples These are the two a yes encryption key sets that we have observed through the samples that look at acquired Okay, so now let's talk about the more interesting stuff commands commands are what the server instructs the infected device to do and These are the common commands across this family We have reported these in details in the blog that we published in 2017 these are a typical surveillance work commands. You've seen them Approval talked about them Chris Kristen talked about them. So I'm not gonna repeat the information But just take a note that these are all surveillance for actions requested from the device So now let's move to more interesting stuff So I'm going to mention three sets of commands that approval and I thought we recently have seen them and We thought that they're interesting So my purpose of the talk is to walk you through them and hopefully at the end of my talk You will agree with me why they are interesting and then we are going to make a conclusion of how they can be used exactly Starting with the first command. It's called do intruder So do intruder the purpose of the command is to direct the infected device to make multiple HTTP or HTTPS request to an arbitrary host and port by changing arbitrary sequences in that request It also logs the request and response for certain keywords and if it founds them it would report to the server and Also logs the response from that request Syntax of the command is like that a Separator is used to separate the fields. I have memorized the name of this many times and I now forgot it So it just looks like that Section mark, okay so The first field so it has the command that comes from the server obviously it has certain fields The targeted host the targeted port that the request has to be sent to a Store path which is a string to a file system to which a string which is a path to a file system on the device keywords don't be misleaded with the S it's just one single Keyword There's a couple of flags in here is SSL is ran header and is safe response. They are all willy-n type and there are two fields in this request that in this command that Also include multiple fields. Those are request and var and they are both basic 60 basic 64 encoded So now let's deep dive in the function and Try to parse this command. We are the client. We have received this now. Let's take it step by step so first thing we want to separate the fields so we can take a look at them and Secondly, we want to start with the more complicated ones the ones that have multiple fields in them. So we're going to start with War variable is also separated by semicolons. So we are going to split it in the same way that we did for the command Then we are going to generate several dictionary lists zero to four dictionary lists basically from this war variable Dictionary list also is separated each field is separated by each dictionary separated by a column And it has two fields field zero and field one field zero is the string to be replaced and Field one is a string to replace that first field so field one if it starts with a File pass indicator, which is a slash that means that this is a file path This is not a string. Don't do not use this to replace the string. Just go search the device for this path obtained a file that is located there grab this and Just try every single string that is in that file and they're obviously delimited by new line Slash or slash in Okay, so now we have a dictionary list We know what strings to substitute what strings to use to do the substitution But where is this going to be applied? So we're going to now parse the second field of the request, which is called request It is a standard HTTP request. It is separated by Sierra of Two of them to separate URI and headers from the body If the body doesn't exist, that's fine, then the request just has one line So we are going to refer this to the original request or or I request as a malware calls it so now We are going to check how many dictionaries or substitution strings did we get If there is zero, we're just going to go move to the next function. It Interestingly is called Craig HTTP Then if it's not zero then we need to parse those fields replace the request with All the combinations of the dictionaries. This is going to be done in nested loop and the matter is going to make sure that All this all the strings are going to be replaced. So basically think of dictionaries as placeholders for the Strings to be replaced. So if there's four dictionary, that means there are four places in the original request that we can replace With any string that the server commands the device to do it So next a step We are going to call Craig HTTP. We're going to pass this modified request to it as a first parameter And then we're going to use Everything that we used to generate the current request as a second parameter for information So now let's dive into the Craig HTTP and see what happens after Remember there was a is rant header So this basically is going to be checked if the server wants to add random headers to the request we're going to do so by Generating an x4 the for and client IP and then populating it with random IP address the purpose of x4 the for and client IP usually an HTTP request is to signal the receiver of the request where this request is coming from is usually used for the devices that are coming from behind a proxy and So in this case, we are replacing it with random IP addresses. So obviously we want to hide where we're coming from If there's no random header generation required, then we're just going to dive into the next part which is Using that request that we generated and we will send it to the targeted host and a targeted port construct instructed by the server Now next part we had one string. It was called keywords and We are going to use that To search the response that we are receiving from that specific host and port Whether we find this keyword or not. We are going to Tell the command and control server about it. I did find it or I didn't find it and we're going to log it with the response and Then we're going to check is save response set or not if it is set We're going we're going to log this and store it on the path construct instructed by the server If it is not true, then we're going to move to see to To to log in everything for the C2 and this happens every a hundred times This whole function that I explained to you is called HTTP fuzz by Malware So we are going to call it a fuzzing attempt Okay, next command do port map this one The purpose of it is to direct the infected device to act as a proxy between two arbitrary hosts on port It's way simpler than the previous function It only has four parameters two IP addresses two ports What it's gonna do is to get the first IP and port generate socket socket listen at that port and Do the same thing with the other IP address and now all it needs to do is to transfer data between the two Okay, I was supposed to highlight it before explaining it but Next command and the last one that I'm going to speak about is do repeat this one directs the infected device to perform an HTTP or HTTP s request Optionally with a slightly randomized header and deliver the response back to the server in a form that is displayable in a web browser Do repeat is simple targeted host targeted port two flags is SSL and is random header and a request again Multi-fuel fields in a request and base 64 encoded So let's parse this command First thing what does request include and let's break it into a stand standard HTTP request We're gonna also do some trimming on it on it basically means that if the HTTP body does not exist We're just gonna treat it as one string or one line Then we're gonna check if is random header is set and we're gonna do exactly what we did for the first function that I explained adding x4 or the 4 or client IP and Populating both a firm with a random IP So the replace function here in the code that has user agent user agent random IP basically does nothing but generate the random IP So user agent is just a mislead so now We are going to send this request to the instructed host on instructed port if is SSL is set we're gonna do so in a HTTPS format and then we are gonna wrap all of the data that we sent and Processed in HD at HTML tags, and we are gonna call it final red valve And the next step we are going to report to the server that This was being processed and we're going to basically report that final red valve back to it So now I talked about these three commands and you already have Heard me saying HTTP HTTP request arbitrary fuzzing and these are the commands that we previously showed to you And these are all surveillance work commands. So one would think What does This set of command has anything to do with surveillance work commands. We're gonna wrap this up as my conclusion So new commands new purpose That's what we were a program I we were brainstorming about because so one thing that did not we could not get was Was receiving a response from server? So basically we don't we didn't have the server the C2s that we obtained from the malvers We tried to communicate with them But they did not reply back to us for any reason it could have been certain Conditions that we didn't meet it could have been our geolocation But for any reason we didn't get any data so because of that because I have not seen any data actual data or actual Strings coming from the server or in commands Coming from the server. I cannot be certain about what exactly is intended by these three commands. However Reverse engineers always say the code is there just go read it and we did read it So the next step for us is to conclude something. There are some potentially potential There's some potentials for these three commands the first important the first Theory that we have is that at an adversary can use these commands to gain access behind the firewall Now imagine you're an enterprise company You have all the securities and then one of your employees is just gonna Download one of these rats on their jailbroken Android device and not follow the policies of the company now That device is inside your firewalls Is able to tunnel every information outside your firewall and nobody's gonna know about it So this actually will be some will introduce introduces some enterprise risk Secondly with HTTP request multiple sending fuzzing everything that can be used to scan internal networks again You have a device inside the network You can just like try scanning sending arbitrary quiz the multiple hosts and ports around you Observe the response and try to get some information about what's around your device and basically just like gather information about okay So if in case of an enterprise what other devices are there who else can I get into or what else can I do with this information and After reconnaissance always comes Is there any wonder ability is there anything that I can exploit here What version of the IIS server or Apache server these hosts and ports are sent are using How can I engineer my requests to exploit them and the malware can't just like go and try it's luck for Theory which is not impossible is to send Multiple HTTP requests to single a single host and port to the extent to exhaust resources on that device So basically denial of service or dosing that device now. Let's take it one step further Let's assume that the malware has infected multiple device and now it's going to use all of these devices to send a request to one single host basically Distributing this denial of service attack and created DDoS attack So the questions are We think there are two scenarios possible here So number one, which is a stronger is that the authors are now changing their scope Authors of extract they're changing their scope Surveillance for is not sufficient enough anymore and they are adding new functionalities now They want to go beyond surveillance where and do other stuff as well theory number two Happens all the time especially when the malware has simple code Other threat actors steal the code and add their own functionalities to it so this could be totally a different actor and It's it's it has potential for more investigation and research basically Okay, so we process the commands now, let's look at the communication protocol what happens between client and server I'm going to take one of the client actions and Talk about connect, which is basically the send The first connection that happens between a client and server which is basically the malware is installed on the device Now the voice wants to check in with the C2 and say hey, I am here and this is the information that I have for example This is my IP. I'm in this network if you want to use this IP to tunnel to other hosts Do so so the connect sends gathers bunch of information about the device and constructs packet that has One opcode which is basically telling the server. Hey this heads up this type of information is coming your way Next field is zero It's referred to target form. Honestly. I'm not sure what it is for Third field is the length of the packet again this type of information is coming your way heads up this is the length of it be prepared and Information is going to be followed So be it final packet Shows the size of those fields opcode two bytes length target form two bytes Length four bytes and the rest of packet depends on how many what whatever bytes that is specified by the length This is the snapshot of the p-caps in version one and version two Those are the fields that I just talked about So in version one and version two the opcode of the connect server has changed The target form is the same the links varies. So they may not be Sending the same amount of information to the server in the connect function and the rest of it is just a packet This is version three the angry teenager so This one follows the same protocol has a command Target form length and final data, but for final data it takes takes it one step further and It is encrypted and then G zips that information and then sends it to the server Okay large amount of information and technical analysis so what we wanted to do what now was to Switch gears and talk about sort of a little bit of the context of this malware And when I mean context there's one apps aspect which we've spoken about before and which Kristen spoke about in the previous talk Which is attribution But what we also want to talk about is what all of this information and all those small little details Tell us about this the malware itself and also about what more you can find using this information So I wanted to give you an idea of what the C2 infrastructure looks like it's still live today And this is the one of the more recent ones that's still online Now the picture makes it look way more hectic than it really is it's not this Fantastic it looks like there's actually something hiding there And there's a picture and there's some restricted access and some target located and from translating very generally the Information at the top of the page and in the rest of the page if you keep scrolling down which isn't pictured here It seems to be just a blog site. It's it's a website that holds certain conversations between developers of different things Which doesn't really make sense, but it's it's live and it's working But and this is just the front if you take a look at some of the subdomains It's hiding some APKs and APKs obviously an application Android application And this was modified on the 4th of April of this year So even if we don't know much about what this malware is doing and how it's doing it We know it's still being handled. It's still being worked on it's still being Perhaps manipulated by the actors or by the developers whether it's the same ones or not and web config web.config didn't really come back to me with anything and This is a hallmark of XS or em rat and x rat The servers are very locked down. We don't hear much from them We can you can and this is like built into the code structure. You can send a lot of data that the Server will accept anything you give it all it all your data It'll take it, but it will never come back with something or it'll come back very rarely And and this is sort of consistent with most of the way that this The actor operates Or the actors The other thing that we can tell with the limited information that we have is a geolocation of some of those servers Of course, that doesn't tell you too much about Actually where the actors are they can easily use VPNs and connect through different areas But what we did notice is they were about 43 servers that we'd seen in total some were online and some were offline But 11 of those the vast majority of those were actually Located within Hong Kong and they were sort of a smattering around in the US now You might think well, this doesn't really tell me much the actors could be anywhere But the truth is that this is actually consistent with XS or em rat So for years since 2014 we're seeing the same pattern It could be that somebody's sort of trying to hide and things like that and these might be false flags But it is interesting that certain things remain the same There's some consistency there which may suggest that it's still the same actor employing and deploying these tools Then there's other smaller little things that I wanted to draw your attention to and I'm interested to see what you guys think And what your theories might be about these things But what's interesting is the titles of the applications when I say titles. I mean application names It's when you download something and install it on your Android device the sort of words that come below the icon These titles were particularly interesting and I'm gonna take a quick look at what XS or em rat titles said about The family and as you can see the titles are very like generic things system thread and System IM and system ADB, which isn't so weird, which is a little weird, but the others seem to be quite normal Right, they look like things that may perhaps be required by the operating system if you're not familiar with Android But the one that stood out especially to the researchers multiple researchers that were looking at XS or em rat Was the second one on the list there that says code for HK Those were about 11 samples out of the 11 one thought 114 samples that we saw and and that's the one that stood out everything else looks generic and looks Android II and then there's code for HK which is Probably particularly targeted at a certain set of people that are interested in that particular organization Which may lead you to believe how it was being used. So let's do the same thing With X rat and these are the titles that we saw we saw a lot more samples 328 And all of them are again. These are legitimate processes system UI is the thing that runs on Android So if even if you're quite a tech savvy person Maybe it might not raise that many red flags, but we'll go into that later The one that is really interesting are the last two at the bottom there and the rendering isn't perfect on the last one there, but It's difficult to say what those mean without the context of the people that are being targeted So code for HK was really popular, right? It the umbrella movement was going on in 2014 There was a lot of reporting around it There was so much context that you could see as an external observer But x rat had only two samples that were whose titles were in Mandarin or Taiwanese or Chinese some Chinese language And so what we did was we took one of those Let's say we took the last one and we threw it into lookouts data set And we saw what came back and we found four samples with that title alone and three of them were the legitimate application This is a legitimate application for a website called lion travel It's a company that specializes in travel tours around Taiwan and and What you have to realize is if you're not within the situation and if you're not within the context of where this malware is being used It probably doesn't ring too many bells but maybe you're the person who uses lion travel for your tours and travels and buys your parents a family trip to Taiwan and perhaps the people at the employees at lion travel use a particular airline or Have a certain set of people that they know quirks and ideas. Perhaps they Book travels for somebody important It would be interesting to go down these little small threads and pull them and see what comes out at the other end and that forces you to think a lot more and immerse yourself in where these Malware are being used So that's just like an interesting tidbit of information which I'm sure if you pull on that thread if you go home tonight and pull on That thread you might find something interesting Definitely reach out to us and let us know what you think So I'm gonna summarize our little talk today. I hope you really enjoyed it Exvessor em rat we talked a lot about it. It's been reported quite Quite a lot. It was a multi-platform tool and it masquerades code for HK. It was a multi-platform tool X rat isn't too different. It appears to be used by the same people Could there be an iOS component that we haven't seen yet? Maybe I haven't poked the servers long enough There's obviously code similarities. They're so similar. In fact, you can't you almost can't separate the samples looking at the code structure The infrastructure is still live and it has very recently uploaded an APK still being handled. It's still being used Let's find the links that link back to that. Perhaps there is a Twitter handle that's sending DMs to interesting people about. Hey, why don't you book your tours to the through this website or this app? So I guess the larger picture that I wanted to get Everybody to start thinking about is that the mobile field? We know changes a lot changes a lot more than any other field that we've seen in technology and Turns out that mobile authors may need to keep changing their tool set just as fast and the interesting thing looking at X rat, so there are many different mobile families that keep changing, right? But why we focused on X rat was that they didn't only just keep changing as an increase in complexity They kept moving laterally as well. They dropped some things that perhaps weren't interesting or weren't worth maintaining They added other things some of their particular applications had some commands some of them didn't so were they really Tailoring their applications to suit the people they were targeting But these lateral shifts turns out can be just as effective and the way that we know that is because it's still being used It's still being handled. It's still being worked on. It's not a dead malware family. We keep seeing new samples every single day We've seen six in the last 10 days So Thank you very much for sticking out with us. It was a lot to handle. So your prizes little puppies Thank you


OK. I'm Stephen Carsey. I work with Pivotal as does David here, based in London. Today's session. How many of you have used Spring Boot before? Excellent. Session over. So the session, as you said, is going to be a two-hour walkthrough of building a fairly complex application composed of many microservices. Dyna sy'n gwasanaeth, mynd i'n ddweud y ddweud yn y ddweud yn y ddweud a'n ddweud hynny fel hynny'n gwybod yw'r cyfrifio lluniau i'r ffurdd hynny yn ei ddweud. Dw i'n gweithio'r gweithwch o'r Ffryd Mwy. Ychyn ni'n gweithio i Labs now, dwi'n gofyn, rwy'n ei gweithio'r url yn ystod o bwysig ysgol yma, dwi'n gweithio'r Labs Ffryd Mwy. Mae'n gweithio i ffryd mewn y ddweud, yn y cynfiguretio o'r apl wedi bod yn gynnwys ar gyfer maen nhw. Yn gyffredinol gyda ar gyfer eich hwant yw Cloud Foundry, ymweld yw'r eich hyn sy'n gwneud, mae'n ffordd yn gwneud, yn ymweld yw'r ysgol. Felly, rydych chi'n gweithio i ymddangos am y gyrdd y mae'n gwneud y lab ar y llan. Mae'r rhai oedd â'r cyfrif yn gwneud y website i ymddangos, mae'r cyfrif yn ymddangos, mae'n hyn mewn i'w rhaid i'r URL, mae'n hyn yn unrhyw ymddiol. Dyna cae bydd David ychydig. Rydyn ni fydd gweld yn digwydd. Rwy'n meddwl addysg. Felly, rydych chi'n meddwl hynny yw Y Sprig Ynwyshgyddor i'wlluminat Tawn gael yw Josh? Mae'n meddwl, rwyf yn dechrau. Rwyf yn dechrau, hi. Mae rwyf yn dechrau a eu gwirionedd, byddai dynean. Mae'r tîm pan fyddwch chi'n ei wneud cyflyt yw yn i ddifael peon, felly mae'n meddwl hon yn ychwaneg mi o'r ddechrau. I'm going to just accept the defaults for my package, my application name, and I want to use a certain dependency so I can just type in a dependency here and say I want to use, I want to create a spring web app, I want to create a very basic web app which exposes a restful end point, I click on web, I click generate project, and that little fancy animation means I've got a zip somewhere. Firefox sticks it in downloads, I think, okay. Oh, okay, even better. Now I've just got to find STS, okay. So I'm going to import that into SpringTool Suite. I chose Gradle, so where are we? Over here. Yes, so, yeah. Deepinto downloads demo 2. And with a bit of luck, this should work. So, for those of you who have done Spring Boot, it does get a bit more advanced than this, don't worry. I'm just going to watch my application downloads and loads of libraries. So just out of curiosity, people who are using Spring Boot, you're using Spring Web, Spring Data, how many people are using very complicated Spring apps? I've got people staring at me. Who's using Spring Cloud? How many people are using deploying Spring apps to Cloud Foundry? Okay, cool. We didn't really need to be here at all. Okay, so it's obviously, here we go, it's kicking off. This is just downloading a bunch of libraries which is needed, I'm just going to say, hey, except I would like to import this project. It gives me an empty application over here in a minute, I guess it will. It's just downloading stuff. Hasn't appeared, does it? It's in other projects. That's not the one. Demo 2, I guess. There we go. So, here's my amazingly complicated application. I know it's a Spring Boot app because it's got an annotation in the beginning saying, hey, I'm a Spring Boot app. I'd like to make this a simple app which exposes a restaurant endpoint. I'm just going to create a new class here just to make life a bit easier for me. I'm going to call it my controller if I could spell. And Spring Boot makes life easy for me. I used to work for a company. They've got three letters in their name. Some people say it stands for I've been married. And in those days, we never had Spring or any kind of clever stuff. We used to do a lot of big, heavy monoliths. So the idea that I could come along and just say, hey, I'd like to create an app and just write an annotation at the beginning was really revolutionary for me. It's not completing because I guess it hasn't got its libraries and we're live. There we go. Best controller. Zoom it in. Okay. Sorry, I forget that you guys want us. Right. Yeah. Right. So all of it is created a new class and I've added a simple annotation at the beginning. And this is going to be a little hint for Spring Boot when it's running my app to say this is a class which is going to expose to restaurant endpoints. And I'm going to create the best method in the world, something that just says hello world. That's about the sort of level of my knowledge that I can get to. And I'm going to say return hello. And I like to execute this method every time someone hits my web app with a specific URL. Let's make that string. I'm just checking how many people are awake. So again, Spring Boot makes it really easy for me. I can just say map this to the path. Hello. Okay. Now, in the old days, when I used to work for that big company, this would have taken me about half a day of configuring and kind of playing around with XML files and opening up the web.xml and putting port mappings and stuff. But now, in theory, I should just be able to run as Spring Boot app. That's going to run the last configuration, I believe. Which is this one. And it's running another application. Right click on the demo too. Yeah, sorry. Let's close that. That one, I guess. Spring Boot application. So, for those of you who've never used Spring Boot before, Spring Boot has looked at the configuration of my application. It's realized that it's got a Spring web dependency. So it's automatically enabled Tomcat for me as a container that was run time for my application. It started it up on a default port of 8080. If I now just went to localhost 8080. I don't think you've got enough windows open. Could you open a few more, David? I'll try next time. I didn't map anything to that specific URL. What I did was I mapped it to hello. I should say hello. Cool. Awesome. Thank you very much. I'm available all three days for the summit. Now, let's get back to something more important. Which was our... Some more. There we go. Now, the labs that are in this URL are far more sophisticated. They walk through things like actuator. They walk through changing to use jetty instead of Tomcat. They walk through putting your own error handlers, putting metrics. Fairly comprehensive bunch of stuff. If you don't think that's enough, you could go to spring.io. There's loads more guides and doing consuming data from Facebook, Twitter, et cetera. Really useful. These slide decks will be made available so you can grab the URL after that. Now, we chose Spring Boot because we just think it makes life really easy. The speed of building an application is just really quick. It's great for building microservices. As you use Spring Boot to build several other microservices, you're going to reach some of the problems that people have had when they go down this route where, hey, now there's loads of complexity where one microservice talks to another microservice, I need some way of mitigating if one microservice was down, discovering other microservices. I need patterns to help us overcome some of these issues, specifically storing configuration, load balancing, monitoring, et cetera. The purpose of today's talk, Greenie, was, if we were doing a hands-on session, was to get you guys to build some of this. We're going to just rush through and show you a pre-built application and give you some links to where you can find out more about this. So, what am I talking about? Consider this application made up of three microservices. You've got a web front-end, you've got two sort of back-ends in two different domains. One for customer data, one for stores data. There's clearly some sort of dependencies that are loosely coupled to each other, but they need to know about each other's service to provide the functionality that they exhibit. How does customers know where stores is running? How does the web front end know where customers and stores is running? What happens if stores goes down? Does the whole application die? It's not a good practice. Now, if we could have some other supporting technology, like some sort of service discovery component alongside this, they could say, hey, every time a microservice comes up, register with me and I'll make a note of where you're running and what your URL is. Then other clients could then consume that at runtime. We could have a configuration server that's separate to this that stores vital information needed at runtime, that isn't hard-coded in the application, makes life a lot simpler. What we're going to talk about today is how some of these components, which if you follow Netflix, OSS and some of these other things, you might be familiar with this, how some of these technologies packed in to pivotal implementation of Cloud Foundry. So, we have a component called Spring Cloud Services Suite, that we've had on for our enterprise version of Cloud Foundry. It gives you a lot of these features out of the box and makes it really easy for you to build your applications using those capabilities. To show this, we've got an application called Springbit Trader, written by my colleague David Pinto, and he's going to walk you through some of the architecture and show you some of the benefits and show you how he's implemented and may take advantage of these features. Thank you. So, the good news is I'm not going to write any code, because I've did that before, and I'm just going to show you how easy or hard or difficult it is to implement some of these patterns that help you live in a Cloud-native world. So, the first one is configuration server, or configuration management. When you've got tens, hundreds, thousands of microservices, you might want to share some properties for the instance running that are running in Cloud Foundry. There could be multiple instances with different properties for different purposes. So, what is the best way, or what is one way of dealing with configuration? You want those properties to be auditable. So, when someone changes that, you know that that change was made, and you want to propagate that change to all of your instances. Within Python Cloud Foundry, we've got a Spring Cloud config server that connects to a Git repository to grab all of the properties that you need for your applications. And then each application goes to this configuration server to pick the properties that it needs in order to run. How do we set this up? Well, it's really complicated. If I find the right window, there we go. Let me just pick one of my services, like the user service, aptly name because it deals with users. And I go to my build.gradle file, or my POM file, and I just select one dependency, which is... There we go. So, by adding this dependency, it tells Spring Boot to go and grab the properties from this configuration server. By default, it will go to a specific local host and port number, but if you're running Pythclaw Foundry, you will pick up where this service is running automatically for you. So, that's it. No more to do to get the configuration management apart from setting your own properties. Next one is service discovery. If you call tens, hundreds, thousands of microservices running in the cloud, they can move about. They can be in one place today, and they can move to another place tomorrow. How do you figure out where they're running at runtime? Well, one technique to do this, and that's what Netflix uses, is for each application to register itself and say, this is my name, and this is where I live, so that other applications can go to these yellow pages and ask for particular services. It's like a directory. Again, this is very difficult to implement in Spring Boot, and I'm sure I've got one open here. Soph showed you how to build a Spring Boot application with this annotation. To add the service discovery capability, all you need is this other annotation. This means that the application will register itself and gives you the capability to look for other services that you've got access to. Again, no other configuration needed. In Python Cloud Foundry, where the registry is living is plumbed into your application automatically. The next one is, if you're dependent on other microservices, when you call them, you don't want to fail if those microservices aren't there. There is one rule in the cloud world, which is bad things do happen. Things fail. Hardware goes away, memory goes away, applications go away. How from your application can you ensure that you stay alive, even though other applications that you depend on fail? The circuit breaker pattern is how to sustain failure, how to be tolerant to failures. You've got a primary path where that's your dependent service that you're calling all the time. If that dependent service goes down, this circuit will open and it will stop contacting that primary service and it will go to a fallback service, or a method. Or you can just deal with that problem right there and then. Overtime, the circuit will try to close again and go to that primary service. And it will try it to see if it's come back to life. And if it is, it will open up the floodgates and will start contacting it again. How do we do this in the codes? Well, it's extremely difficult, as you can imagine. All we need to do is annotate a method with Histrix commands and you give it the fallback method. You can have as many fallback methods as you want and you can cascade down. So you don't just have to have a primary and a secondary service. You can have a third, fourth and fifth service if you're that paranoid. Pyptocall Foundry gives you visibility on what is happening with your circuit breakers. You can have as many as you want in your application and they'll show up in a nice little dashboard on how many calls you're getting a second, whether the circuit is open or closed and what the platform is doing for you. So the next thing that is really important in microservices world, in the cloud-native world, is how to trace a user request throughout your microservices. This is good to find out where the latency is within that call and also to figure out where the problem may exist. Spring Cloud gives you this flexibility. It gives you this ability with Spring Cloud Sleuth and it injects traceability through all of those requests and it gives you an ID that follows that request across all of your microservices. Again, as you can imagine, this is super complicated to do and if I show you the build.gradle again, this is another dependency, which is this one, Spring Cloud Sleuth. Spring Boot will take care of everything that it needs to do to give you that traceability across multiple applications that are developed by different teams and you get that traceability in a nice little UI which I don't have running here to show you, but you can trace your calls, your user requests from application to application. How are we doing for time? So Zipkin is the UI that shows you that traceability going from one microservice to the other of your user request. It gives you a nice little traceability how long that request is spending in each application as well which is very important when you're trying to performance test your overall system. So to summarize, what have we shown you over here? Well, A, you need a platform to run your microservices and to link them all together. You need a framework that allows you the velocity of development to spin up these microservices, test them, give them to your users and get the feedback. Spring Cloud gives you the framework to fix some of the challenges you see in the cloud world, whether that's configuration management or service discovery. And then you need Pyftal Cloud Foundry to run all of these applications of microservices for you and it will benefit from the data operations and self-feeling and so on. So your application, David, is it in GitHub? It is in GitHub. There was a link over there. These slides will be made available so you can just click on the link and it will take you to this page where you can find out more about the Spring Boot Trader application which is a set of four microservices. Very soon it will be five and it uses all of these cloud capabilities to register themselves, discover themselves. All the configuration is shared amongst all of the microservices so they all have the same properties. OK. Jonah. We have to obligratory mention dimensions and we are hiring at Pyftal when it was interested in working at us. There's a guy in our office called Harry Kang. He will be very pleased to see this slide. Any questions? Yes. Don't worry, it's fine. Yes, I do. That's a good question. How do you protect your sensitive data in the Git repository? There's a couple of different levels that you can go to. One is protect your Git repository itself so it's not public, especially in github.com. The other one is you can encrypt properties. So when you put into your Git repository that password is already encrypted and only the config server will be able to decrypt it. Does that answer your question? Good. What if I want to make changes to my properties while the application is running? Make the changes. It's absolutely fine. You can make the changes in your github repository and you can tell your applications to refresh their properties. So the question is, do you need to have different repositories for production, development, testing, the different environments? There's different ways of dealing with that. Git provides you with a lot of capabilities in terms of branches, different commits, different so on, and you can make use of that from the configuration server. So you can point your configuration server to the production branch or to the development branch. You can also use different repositories if you want. It's really done to the structure of your organization on the best way to deal with that. So the question is, if you want to use other registry services like console, is there a way to do that? Spring Cloud gives you that capability, but you need to deploy your own console cluster in order to provide that infrastructure. As part of Pivotal Cloud Foundry, currently we're using Eureka as that service implementation. The questions are getting trickier by the time. No, we're running out of time, don't worry. Time's over. I do have an answer for that. So the question is, it's great if you're using Spring to use all of these patterns. What about if you're using other languages like Go or Python or these funky languages? There are libraries for these languages to work with the Spring Cloud patterns. They are emerging, so there's already one for Go, one for Python, I believe, and there'll be more coming along the lines. I'm sure that .NET, if you're that way inclined, they've got a project called Steeltoe, which is to kind of capture the Spring Boot and Spring Cloud functionality within the .NET environments. I think we've got time for one more question. As long as there's an easy one. Oh, it's not an easy one. So the question is, does sleuth that traceability capability have any performance impact on the running application? That's a tricky one. It will have some impact, obviously, but it's minimal because it's done asynchronously on the calls. Most of it is done asynchronously on the calls. If you're just logging the correlation ID to the logs, the performance penalty is minimal. If you're actually streaming those calls for the traces into Zipkin, for example, that's done asynchronously either through a bus or through HTTP requests. So it shouldn't have much of an impact on the latency of the application. On that note, ladies and gentlemen, thank you very much. We are going to be at a pivotal booth if you've got any more questions. I think we're there for half one today. But if you don't find us to other pivotal colleagues around, you can answer your questions. Thank you very much.


What's going on guys, it's your boy DPJ here today with another Destiny video and in today's Destiny video we have top 5 trials of a series, Sniper plays of the week, don't forget guys if you have anything bad that's to send in, send it into the email just linked in the top of the video description, hope you guys enjoyed the video and the end if you do if you could leave a like I would appreciate the support and I will catch you guys on the next one. Enemy team eliminated. Last gun in the fight, enemies have been eliminated.


Silver nanoparticles, AGNPs, have been recently recognized for their use in agriculture and medicine as antibacterial, antifungal, and antioxidant agents. They arrest the growth and multiplication of many bacteria and fungi by binding with biomolecules present in microbial cells, producing reactive oxygen species and free radicals that cause apoptosis leading to cell death, and diffusing into cells to rupture their walls. Smaller nanoparticles are more toxic than bigger ones, and their toxicity is dependent on size, concentration, pH of the medium, and exposure time to pathogens. AGNPs are also used in packaging to prevent damage of food products by pathogens. This article was authored by Khwaja Salahuddin Siddiqui, Azimul Huzan, and Rifikat AKRAO.