Everybody forced here ripping at 22 23. It's like basketball hobby six bucks for a six box number four picker team style Ali a with the Raptors Anthony C warriors Brad B sons Kato H nuggets Chen M Pacers Cheng Q with the Rockets Ching Long C with the Pistons crispy Celtics Chun Wei has the Mavericks and the Wolves Edgar B. Nicks Gavin K Kings Jason a bulls Jeremy D Clippers Jesus T magic Justin C wizards Justin P calves Kevin B Who has the Lakers Mark D Thunder Marvin and Spurs Robert P with the Blazers Rory C Jazz Scott T Pelicans Bucks Shane W Nets Spencer D with the Grizzlies Wendy J with the Hawks Hornets and Sixers and us has the heat good luck everybody Let's get started He's had them so far Robert P's been blind buying the Blazers and like every product this year Maybe he's a Kentucky fan Like sharp a lot of laser spots and a lot of a lot of breaks a lot of products show me so on concourse Unstoppable Yannis silver concourse Jalen Brown Celtics AJ Griffin rookie signatures red prison redemption going to the Hawks Silver Yannis for the Bucks and Ivy Yeah, I know Peter some people just by whatever Or they can yeah Blazers went for 129 129 for the Blazers There's a Branham. God you barry Smith and Warriors Patrick Baldwin jr. Premier level rookie orange number 265 Bo champ Trey young the 75 on the jersey card game use for the Hawks Try color shade on sharp concourse for the Blazers on the rookie Jalen Williams, there's a snapshots of Luca in a scope of Brogdon going to the Celtics Bradley Beale courtside Jaden Ivy concourse Got light blue rookie concourse Malachi brand of spurs out of 299 Tie tie you got silver concourse rookie. Oh, Jack Bajie jazz. Who's Mon Jang? Which a Bajie and Jaden Ivy pistons on the rookie jersey He has Matt is live on channel 2 with Chronicles PYT breaks today silver hearted for the Sixers As well as a random divisions case All breaks are full on this channel today tonight Sam has your spots for sure, but Make sure you're grabbing your Chronicles teams a lot of them are on sale or cheap Chet Holmgren rookie future Purple premier level Siakum Raptors. That's out of 99 The Collins sexton Yeah, random styles of selector tonight along with the soccer breaks and more Chronicles Random solid Chronicles that time to concourse tricolor is Brogdon Celtics shade on sharp base tricolor clay Thompson premier level Warriors He'll Houston courtside rookie magic red concourse Donovan Mitchell Cavaliers Since to 199 I'll do it for box one Snapshots Iverson silver concourse rookie is Malachi brand of spurs What's going on now? I doubt there's bad news Benedict Matheran. You got a Coloco Raptors rookie auto 1099 red color match Travis Deener. Oh boy magic legend silver Zion Williamson Pelicans What'd you sell it for Sam? Who's buying Travis Deener cards on either? That's the real question First of all who's selling you obviously and who's by what is going on here? I'm doing ready concourse jazz Colin Sexton out of 199 Lebron James and the game-worn Jersey card Lakers $3 Concourse scope is John Moran for the Grizzlies guys you guys watching on sick talk the link is in the bio for late in sports cards Com plenty of group breaks today Namely lots of chronicles left in Fuego KD sons Tricolor concourse and next Julius Randall And a shade on sharp court side rookie concourse blue Steph Curry. That's the 249 Warriors color match 200 to 249 concourse Hardy rookie for the Mavericks Blue premier level shake Yildus Alexander thunder that's a color match 2 to 249 Lots of slack lots of chronicles concourse silver Jamal Murray nugs It's high-tie premier level rookie Yeah, we do need to see a zebra. I said they're a lot. They're a lot rarer in basketball than they are in football Jay Nivey rookie Jersey Pistons silver premier level rookie Hardy Mavericks Nice hardy sorry Sensations Mather and he got a Jalen Brunson lime green or neon green Nick's to 75 All right. All right, Nick Tricolor premier level the mellow ball going to the Hornets He can marry concourse rookie Kings tricolor concourse SGA for the thunder Courtside Van Lee. That was my perfect Sup Fred yeah, I remember Frederick How you doing man? Been a while. Hope you're well. He can Murray. There's a tricolor concourse Dyson Daniels Pelicans rookie scope premier level down of a Mitchell Cavaliers Courtside Colin Sexton Heels Mark Williams light blue concourse to 299 Celtics Marcus smart Christian Brown premier level and seriously Fred. That's awesome. You know silver concourse rookie Jalen Williams That's J. Dove for the thunder. Yeah doing well Congrats on that Yeah, he's they're gonna be good. He might he might end up being like their piece moving forward Silver concourse anger and pelicans They have a nice core though, man if Okay, come back him. He got Thompson now Duran yep to 199 so hawn spurs rookie Jersey audio don't mess with a so hawn Adam Sandler masterclass silver premier level rookie Andrew Nemard Pacers Jared Jackson jr. Jersey card Grizzlies to 99 get vets are game-worn in select basketball Silver Tatum premier level Celtics it definitely seems like the court sides are rare and it's like basketball as well to 49 magic when Del Carter jr. In-flight signatures probably grade and Sell at the right time I would say try color rookie concourse Trevor Kiehl's nicks I know if you're in Germany, it's a little hard. It's a little hard to grade But I probably still find a way to grade it Christian Brown Davis Keegan Murray and a tricolor Diabatae Clippers rookie premier level Court side Roddy Grizzlies You're watching on tick-tock links in the bio for latest sports cards calm Who breaks on two channels today on YouTube? on Twitch to Concourse read LeBron James To 199 Lakers. Yeah, usually if it's a big card like that you pretty much grade it almost no matter what Just to get it in case like authenticating all that so on Don't have a Mitchell unstoppable for the cabs Unless it's gonna grade like a six or something maroon poor zinc is the 175 for the wizards Or like anything under an eight for something like that you probably wouldn't But it's also weird because you'd hope it's a good condition because if it's gonna go to like a larger auction house It's gonna end up getting graded no matter what so people kind of want to see that east in there purple This is sick color match card. This card is awesome Larry marketing to 99 jazz Marksman felt good that card looks there's a like bodgy We do um this is a six six box break pick your team style We don't sell solo packs, but a box is worth 399 99 Yeah, we have my 399 99 It's free shipping and if you have a rift all yours all your good stuff to stop out of the force Caster poor zingus maroon premiere level wizards to 175 Yeah, I would try to do that too. Usually you get a little bit little bit more priority if it's a big card from them Or I've heard that before I haven't actually dealt with that premier level blue deer and fox kings number two two 49 I haven't had a penny card that was like If it did have something with it, it wasn't like worth it to get it because I guess it's over something I don't whatever And if we go step curry warriors silver concourse garland calves Heal and Terry we got jazz Walker Kessler rookie order to 49 Kessler Haven't seen him lie. Yeah at all silver Deontay Murray Hawks Lot of NHL trades going down before the draft here color Ben caro Concourse white Mavericks Kyra Irving Jersey match there to 149 in a hearty premier level rookie base You usually send it to them and they like Usually replace it if they can whether that means like reprinting it and all that stuff Not 100% sure to one that I know a con a congo a con who on the Jersey auto. I Want to see a con quo because he's a Titans rookie a Kong who Jersey auto. Yeah, yeah for the for the Hawks here try color is Simon's blazers concourse So usually I'll print like some replacements like bigger stuff and keep them if they need to they need to like replace it Coloco rookie try color premiere level for the Raptors Shade on sharp scope concourse Michael never swing the Rock Porter Jr. The nugs There he is You see they got the the repeater rifles back with the explosive rounds. Yeah, they got those back in the game Try color hero for the heat Zion what else they added something else Augments changed to where like they have the heavy ammo augment and the heavy shot augment. Oh, yeah. Yeah, I was doing some you can do some damage with that rifle I like that Concourse blue rookie tarry eason at a 249 Rockets nice Rockets card there. This I on card Whichever one it was probably not a whole lot We didn't had a big Zion yet J. Dev rookie concourse for the Thunder silver concourse rookie Yovitch for the heat But his rookie still hold decent value of how talented he is Like a Zion you have to hit something pretty big to you know, turn like make me like have a really really big hit in like Was this fourth year now? To 99 tight-tie rookie Jersey going to the Rockets. I don't even know anymore Yeah, yeah, it's worth here Walker Castle rookie silver premiere level for the jazz It is crazy. All right a couple more here By basketball cards. Well, we get ours from distributors. We're a shop hobby shop You got some distributors Sometimes we go set like secondary market just kind of like anyone else Buy cards might blow out of it if we need to but at first we'll get him from distributors Sec we need chasling for some Chronicles brakes here You guys Matt's live over on channel two with Chronicles. He's just got two teams left On the break he's trying to fill now There's Lincoln chat for a YouTube and switch you guys are watching on tiktok. I think it's in the bio if you're interested Bate Here's a tri-color Michael Porter Jr. How else I'll skip all the words that time Michael Porter Jr. Nugs U.s. Men's actually goalie Matt Turner hit four home runs and BP with the Cardinals He didn't start playing soccer until he's in high school And he's like that he's good too summer comfort rookie tight-tie watching a junior for the Rockets He's a keeper to bar I spent a junior He's like the mookie bets of soccer, I guess just go do anything Nick's RJ Barrett Jersey card game used Nice blue color match on the Luca dodge. It's here concourse to 249. I'm not sure what you mean Oliver I'm not sure what you mean Maybe I'm just reading it wrong There we go. There we go Keegan concourse random insert a Booker concourse scope sons Rookie premier level scope is J. Dub Thunder Jalen Williams Tri-color van Vleet premier level Raptors van Vleet tie-tie field or field level court side Castellanos Castellanos Concourse red and bead going to the Sixers Number to 199 over red Max Christie Any good piece so far. What do you mean Joe? Fuego is I on silver concourse Halliburton Pacers like good cars or specific cards But a color wheel of Yolk itch earlier. We've hit some nice IVs. We hit a so Han tie-dye We hit a Christian Brown tie-dye Dyson Daniels at 25 speaking of tie-dye. There it is rookie auto pelicans That kid's got some upside to Dyson Daniels Nice card pelicans to 25 and who knows what they're gonna do. He might get more time depending on what trades happen with that team Try color rookie Wendell more junior T Wolves Seems an interesting spot Watson silver Bradley Beale wizards Jimmy Butler T Wolves gold patch card dude.  So cool. Yeah, I love runs in this Blue rookie Agbaji to 249 on the premiere level for the jazz jazz having a good break as well Kessler auto Baji Blue rookie such a cool card. That's going in a mag for sure Jane Hardy gold concourse book Suns Look at that five and ten Suns Teal uni. I do like that a lot Do that or had to be the Valley Unis For the gold has to be Wow, both those cards are gonna get magged. That's sweet. Let's see what we're saying chat It's just a throwback card You have Yeah, throwback Jersey have been a thing in slight basketball for a few years So we've seen like Al Horford as a hawk. What else so we've seen today. We've seen some weird stuff It is a pelican that's not as crazy, but the Horford is a hawk. I was like, whoa Oh, we saw Wiggins is the T-whip to And living and living.   Yes with the horse. Oh My god. Yeah hit of the day so far right there That is a monster scope rookie premier level AJ Griffin Hawks and Nicola Jovic All right, silver premier level Palo. That's the first non-base Palo that we've seen Magic It's taken a while. Some of these rookies are scarce, which is weird because they have the same amount of cards in the checklist as the others Especially the big ones. There's a Watson tricolor concourse for the nugs The cool thing about select is the different levels will have like different uniforms and stuff Especially with the NBA where every team has like 15 uniforms Forzing is Nick's Jersey. Whoa That's been a minute Forzing is Nick's Jersey Light blue staff concourse of 299 for the dubs. It's a chat premiere level Can't believe that Ivy That thing is something I think it's something sick scope on the concourse Bane Grizzlies And watch on trick-talk links in the bio. We got chronicles football break in today We more select tonight Benedict Matherin live on YouTube and Twitch literally all day and a Jaden Hardy tie-dye Premier level for Dallas What is happening here? I can't get that sleep over not now. There's the there's the sleep we need there. It is We're full-fledged on fire now.  Yeah, Chun Wei has the wolves, too That's nasty 5 of 25 on the hearty tie-dye. Holy crack This is by far the best break so far today It's like basketball little little fewer numbered cards, but when it hits it does hit on play go Trey young silver Concourse Chris Paul Sons Hardy concourse with a tricolor SGA okc J Griffin court side on Wendell Moore tricolor Brunson for the Knicks Zion court side Not popping like they used to I'm pretty good to me They're a little they're not quite as bright on some of the the parallels I'll say that but I don't think it diminishes value in Any in any way at all silver concourse is a yokich which has like a there's a durin base It's like a dimple up on the top left corner So I'm gonna send a box shapper with the yokich silver The silver concourse, but if you wanted it, we'll send it Send it He sent it with great man Pain Watson with the nugs here on the rookie jersey back. We're rockin rock on the nugget streak here We've got a maroon yokich To 175 I'm a I'm a nugget mag. I'm gonna have to have chicken nuggets for dinner It's all nuggets. It's all nuggets It's uses like a do you know it uses like a filler so that the packs are like easier to open because if there's just a few cards You could risk like having to like pull too hard to like and it might like bend a corner or something like that So it's used to like keep packs firm and and things like that also for like weighing boxes I think matherines so like all boxes about the same silver Donovan Mitchell calves and a hero But mostly it's I think to protect the cards in there We'll have it every few upper deck uses them like Like they're going out of style Open in some upper deck hockey products. So just they're like every pack all right Fund recap coming here all of the relics for paint Watson Porzingis with the nicks rj barrett jaden ivy LeBron James jaden ivy again jaren jackson jr. Tai Tai washington trey young keep in mind all the veterans are game used Got redemption hawks aj griffin red prism rookie auto Walker kessler. There's a wendell carter jr. christian kaloko sohan jersey auto spurs Kongwu jersey auto rockets And everything else in a mag pretty good stuff here gold boker for the sons in the concourse Gold patch card t-wolves jimmy butler So that's so fun. It's a cool hit existence of 10 game used gold patch Himmy on the wolves tie-dye rookie premier level jaden hardy mavericks. I always remember the story of him Taking the third stringers and beating the starters in minnesota and they all got all in their feelings about it Awesome hardy tie-dye for the mavs a tie-dye rookie auto dyson daniels pelicans to 25 too And the hit of the day so far rookie auto gold seven of ten jaden ivy for detroit That'll do it for six box number four number five is coming up next. Thank you very much everybody


Well, don't clap yet. You might not like it. We're here basically to want to talk about Lotus Notes and Domino Security. My name's Chris Goggins. I'm with Security Design International. And we have with us Kevin McPeak, Patrick Goonther, and Valter Acima from Trust Factory. Yeah. Yeah, that's the one from the sub that you saw in that movie recently. So basically, before we go into this, I just wanted to touch on something. I understand there was a little talk a few days ago where someone didn't particularly like the idea of disclosure. But you know what? There's a whole difference between reckless disclosure and responsible disclosure. Reckless disclosure is someone who doesn't give anybody's customers, vendors, or what have you, any heads up, and just blast the thing with exploit code so that everybody in the world can suddenly break into things and catches everybody off guard. The idea of responsible disclosure, which we've tried to do with the series of vulnerabilities that we're going to talk about here, we've been working with Lotus, made them aware of things, been working with very large notes deployments throughout the world, trying to make people aware. And just so I don't disappoint anybody, some of the tools you're going to see demonstrated in here, we're not giving out. But once we tell you how it's done, those of you who are clever in the audience will probably turn right around and do so. And what you do with them at that point is strictly up to your conscience. So, sorry, Marcus, here we go. Basically, some time ago, Trust Factory contacted us and said, listen, we found a couple of things that look a little weird. Can you help us? We want to take a look and validate that these things are real and then work with us to try to make sure that we can get the maximum exposure. That's what's bringing us here to DEFCON. With all the media and everything that DEFCON's turned into, I would imagine we'll probably get a little bit of exposure to this. And in working with Lotus, Lotus, when we told them we were going to do a presentation on note security at DEFCON, they said, go for it. So we're here with their blessing, although I really don't think they knew what DEFCON was when they said that.  But just for your benefit, so you can at least follow the bouncing ball, Lotus Notes is basically a secure group wear platform. It gives people the ability to have email, various applications, web and database connectivity. It's basically a little secure sharing service, right? Lotus Notes is also really powerful in that it has several different ways in which you can write applications that run data to the notes environment. It's got its own little formula language. It's got its own macro language called Lotus Script, which is really powerful and you can use it to basically manipulate anything within the notes environment. On top of that, it'll support things in JavaScript and in Java, and there's a C plus API that you can actually code external applications to talk directly into notes. And through that, there's also a way to talk to notes through OLA-enabled applications by using a notes.notes session OLA object. So you can actually do things with word macros and talk to things. But I'm getting ahead of myself. Now, to give you an idea about how big this is, Lotus says at this point they have approximately 60 million corporate users worldwide. That's kind of a lot. Now, the majority of these are running on version 4.6. It's probably the most user-friendly, and it doesn't take up nearly as much space as the later versions. The remainder is running on 5.0, the various versions and releases of that. To give you an idea about the kind of places where notes is, you'll be hard pressed to find anything in the global 1,000 that doesn't have some sort of notes installation within their corporate environment. Just in terms of customers that we've worked with, large power companies, telephone companies, big manufacturing concerns like a lot of major big computer manufacturers, pharmaceutical companies, petrochemical companies, most of the major defense contractors, those of you who some of you are in the audience know. Government installations, state legislatures and federal legislatures, military systems, intelligence agencies. Again, everybody who's been spotted from CIA and NSA, you know exactly what's going on here.  The CIA is probably one of the largest users of Lotus Notes out there. They pretty much store everything they do within Lotus Notes databases. Going into financial services, big accounting firms, especially those, you know, any of the major big five accounting firms are all using Lotus Notes in order to keep track of merger and acquisition data, corporate tax information and any professional services project that they need to schedule. Banks, insurance companies and the list goes on and on. Now, why on earth would all these people use this product? Well, Notes is known as a secure platform, has a lot of security features, specifically in the way it implements its own little PKI implementation. It has a strong mechanism for authentication and it gives you a facility using your Notes ID file as a key to actually encrypt different databases. It provides access control on a bunch of different levels, including the server, database, document levels, even within particular fields in a document view. You can set an access control and for our friends in the government, it meets the DMS requirements, so that's probably why a lot of you use it. Now, in the coming hour, we're gonna demonstrate a lot of stuff and it's gonna go by really fast, so I'll preface this now by saying the slideshow will be available on our websites after we're done, but we're gonna go through several vulnerabilities, including two new kind of major security vulnerabilities that exist with Notes. The first one has to do with bypassing the Notes execution control list feature and the second one is probably the most serious vulnerability I've ever seen. Basically, allows you to use a Lotus Notes password hash and a stolen ID file to authenticate to the server without knowing anything about the password embedded in that ID file. So these attacks, as you might imagine, can allow users to gain complete control of the Lotus Notes network in a matter of seconds and will give you the facility to completely hide your tracks. Now, I'm gonna turn it over to Kevin McPeak to continue on with some intro vulnerabilities. Hi, I'm Kevin McPeak.   Being someone from Texas who's now started his own security company in the Netherlands, it looks a little funky, so I don't need anybody and I would ask. I don't need anyone pegging me or raising any red flags. Please don't kill, Kevin. Yeah, please don't kill me. I'm still loyal to this country and all that good stuff. We're out here just to make better software. All right, some of these vulnerabilities here, which we're going to be detailing, actually fall into the following categories in which a particular user could commit acts of vandalism, theft, fraud, and all those combined together enable an attacker to conduct informational warfare. And this is quite a serious issue because there's a lot of government agencies, as Chris outlined, and as well as commercial organizations that are just trying to go about their business and do it securely. Now, some of the things, I'm actually gonna set this down. Try to go on the ones that are here. Several of the major one security problem that we have that we commonly find as security consultants auditing notes installations are problems where users have misconfigured settings because they don't know what they're actually doing or using the default installation settings of Domino. Now, this may seem really simple and everything else, everyone should know better, but nobody does. I would say over 80% of the installations we've audited have this problem inherent in their infrastructure that they've rolled out. These problems consist of access control list, the ACLs, improper settings in the names and address book, server ID passwords, execution control list, stored forms. And there's been several of these security advisories which have already been released by various other organizations, including Loft and various other ones that have addressed this. Unfortunately, it seems nobody's really listening because we're still finding the same problems. Now, in the access control list, if I can get Voucher to log me in here, I'm going to just give you a quick example of what an access control list looks like under Domino. All right, sorry. There we go. Now, for those of you who have never seen one or don't use Domino that much, this is your access control list here. You actually have entries for Domino servers, internal to the organization, Domino servers. These are groups which are created in the names and address book. This here is usually used for external organizations which are accessing your server. This is for the server itself, and this is for either a user or you could create a group of users. And you can see over here that right now this person is a person, not a server, and although he might think he is, and he's a manager to this database. Default is anything which does not fall into what is listed below. So any other user inside this organization will typically fall under the default category. Now, it seems to be a well-known fact, but a very poorly implemented is the anonymous entry. The anonymous entry is anything that is not signed inside Lotus Notes. There's no signature on that database or from that user identity. So anyone accessing this database over the web will have total access, because as you can see, he's actually got manager access. The default installation of Domino comes with several of these databases, including configuration and setup databases that are configured either with anonymous access as a manager or there's no entry for anonymous period. This allows somebody else or somebody remotely to conduct, guess you'd call them pseudo attacks as I'll demonstrate here. This is actually a result of the misconfiguration of the names and address book in which they're allowing browsing of all the databases within Notes. Now they can just, the nice thing about this is you can just click on any one of these, such as the address book, and you're now in the address book. If you don't mind, do you mind if we hold questions till the end? Okay, we will get to you though. So typically within many organizations, during the configuration, either they will accept the default installations or they will enable total access, so just to ease the installation process and let's always forgot them to go back and tighten these security settings. Now, as a problem of this, these are various examples of URLs which could be entered into a browser or some other application which could go off and retrieve the entries using HTTP commands. And these will all grant access to those types of databases if your access control list are not configured. And that is what I was showing back over here. If we actually take a view of the database here, I'm sorry, oh, sorry. One more, one more. All right, that's back what I was doing here. This is the same command that you saw on the other screen in the URL entry. You'll actually see the same command or very similar command which is demonstrated here. The only difference with this, if somebody has actually gone into a database and implemented their own customized navigator, this will take you back, this particular command and this is actually a function of Domino. This will bypass any customized navigators and take you back to the default views. This type of information, I'm sorry we're having to switch back and forth, we thought we'd have a few more screens, enables me to go in and select a particular user. I'll select myself and as you can see I was secure and remove my ID file. We'll take a look at the sum user and you'll see later in the demonstration where this is a valuable little attachment here because now I have access to this, I can read it, I can attach this to my hard drive and you'll see where that comes into play later on. And you've got to protect that type, you gotta keep attackers from having that type of access to your names and address book as well as these other databases. Commonly misconfigured databases, these are examples, there's many more. You have the names in SF, that's your Domino directory or before release five, it used to be called the names and address book. That's what I just poked around in and opened up the person document for. The catalog database is actually a database in which it's an inventory of all the other databases on that server. So I can find just by simply opening this database from a web browser, find all the other databases, the mail files for that particular server. The Domino configuration database is one that's used in release four six to actually set up virtual host and virtual servers on the web. So you could actually, an attacker could actually manipulate this and this one, I believe there was an advisory, I'll have to go back and check, but I believe Loft had actually made an advisory about this because what you could do is you could actually modify and give special URL commands and create a new virtual server remotely. The log NSF, this is where everything in Domino is actually logged on the server. Everything from SMTP emails, serial replication, TCPIP replication, all that is logged in one central database and that's this one right here. If you've got read, write access to this, you can erase your tracks for anything you've done on that server. This is, the web admin is one that's used often to, especially in release five, since there's no more client on Unix host and AS 400 as well as the mainframe versions of Domino. This is commonly used to configure and install, I'm sorry, just configure and maintain the Domino server remotely from a web browser. And these databases are used for the setup, configuration and installation of a Domino server. And this one is typically left on a server with management access for the whole world. And there seems to be a really bad user education that you need to either delete that database or tighten the ACLs. Within the names in SF, these are some of the valuable points of information that you can retrieve. Patrick's going to show you later how we can actually retrieve the HTTP password hash. And we can use that in a particular type of attack to gain access to the Domino server. Quite often ID files when the user is created, administrators have a tendency to think, well, we'll just leave the ID file on the Domino server in the person document. And that when they set up their notes client, they can actually just pull their ID file when they set up their notes client. They forget to detach it. This is really bad because if I can open up that names and address book, I've got their ID file. And I can build a little program to sit there and brute force the password. Or as you see, we've actually done even one better. The database does not contain usually an anonymous entry in the ACL in names.nsf. And there's a tendency amongst administrators to actually go out and set up manager access just for everybody while they're configuring a server. And they forget to go back and change that when they roll out Domino as a web server or an email platform for an internal server which is running their entire organization. All the names.nsf helps really give a remote attack or a blueprint of the organization how Domino has been deployed in that organization. The catalog.nsf, I think one of my colleagues is prompting me to talk a little bit faster so I'll try to race through here. The catalog.nsf, that's one of the ones I was mentioning earlier, which databases all the other notes databases. So it's actually got entries. Where are they located on the file system? Which server are they actually located on? The Domino config database. This is the one where you've actually got, configures the virtual host and virtual web servers which I mentioned earlier. And I'm gonna skip through these since I mentioned them earlier. In all of these, usually the ACL, the default ACL is actually misconfigured or people have not really gone back and checked their settings on all of these. And one of the last most important things there is a tendency among Domino administrators when they're setting up a server, they wanna utilize things like the auto restart feature of a Domino server.  But there's usually a ton of other things running on that server that they haven't thought about. And if there's some sort of form of host-based security on that server, we can usually violate that to gain access to the file system. Once we have that, and if the operating system allows us to just read the file of the server ID, we can retrieve that and we can actually create a new server on our system and we can use that to replicate with another server, not the same one, but another server inside that organization and retrieve databases from it to our local machine and compromise the company's data. Now, I'm going to hand this over to my next colleague, Walter Alkoma, who's going to demonstrate some other attacks, which cover some of the securities that I've talked about and some new ones. And here he is. Thanks a lot. Okay. Basically, what I want to discuss is two things. Two methods of attack. One is dealing with stored form vulnerability and the other one deals with the OLA interface to the LoadsNotes client. I'm going to start with the stored forms, but before that, I think it's good if I explain a little bit about LoadsNotes databases, so you'll know what a stored form actually is. A Notes database consists of data in the form of structured data, rich text or HTML. Next into a database, you also have design elements defined and one of them is forms. A forms is used to rendering that data and it also contains programmable events. A stored form is as follows. Suppose you're going to have a document, a piece of data that you want to transport to another database, but the form definition for rendering that data is not available. Then LoadsNotes allows you to, has a very powerful feature, allows you to accompany that data with a stored form. Another additional feature within that stored forms is that the LoadsNotes SMTP agent can use that so you can actually transfer email messages, LoadsNotes email messages with stored forms over the internet towards another nodes environment. The stored form vulnerability was actually dating from 1996, so this is not something new I'm telling you here. At least it should not be. The first occasion that I could find was the guy, Oliver Berger from Germany and he reported this to Loaders and the Spiegel, which is a German magazine, spent an article on it and somehow I don't think it got the attention it should have gotten. Anyway, Loaders responded with the execution control list as a method to defend the user against potential hostile contents. However, and this is what we see in practice with our clients, we are now four years later and what we see is that very few people or very few organizations have the execution control list set up properly. In addition, very few people disabled stored forms on their mail file. So in fact, still very many people are vulnerable to this attack, which is dating back from 1996. How would you perform a stored form attack? It's basically very simple. You take your mail file, take a copy of your memo form in the mail file, eliminate the code that Loaders notes put into the programmable events and replace it by your own. So what you can do is either make it launch an executable automatically or program something in the query open or post open event and as a result, you can launch any type of code or executable without user interaction. And again, this is back in 96, okay? Because I don't know Chris, maybe you can comment on that but there was some virus going on lately and they claimed that this was the first virus that did it without user interaction. That thing comes back on. Yeah, do you remember, I guess it was last year or so when Bubble Boy made the rounds because the view properties within, I guess it was Outlook Express, it would actually execute native VB script. Well, notes can do that too. Just by looking at a mail message, which founder's about to do? Exactly. Okay, I need to switch to my, can I use this microphone? Is that on video? There you go. Okay, first of all, I'm gonna explain a little bit about the setup that we have created. On this laptop here is gonna act as the victim. Okay, and we're gonna perform an attack from this attacker. We have several users set up. The first user that we're gonna attack is named R46 user.  Okay, and the laptop I hold over here is the attacker. I'm logged in as Voudra Okama. I'm now gonna attack this client. I've prepared stuff a little bit, so instead of creating a stored form, I've already created it and sent it over to R46 user. And I have to log in now. I have to provide a password. Okay, I'm gonna log in. And what you see is the user has received an email.  But I'm opening that email, I'm gonna launch notepad.exe, which is an executable. This should not be able, because I could launch notepad, but I can also launch backorefis or any kind of other hostile code that you wish. Take a look. I'm gonna press enter now. User's opening his email, and without anything, the notepad has started. And actually, as a kind of joke, I put in the advisory that Lotus wanted us to make here, so we'll get back to that later. Okay. What are the observations that we can make? Well, again, no user interaction was required. Secondly, there was no warning presented either by the operating system or by Lotus nodes prior to execution. And why? Because ECL was not configured properly. Within, as yeah, and that's number one, and number two is the stored forms were enabled. Lotus came up with the execution controllers. What is the execution controllers? Basically, what it does is it allows you to specify signatures that you trust. And per signature that you trust, you can specify what type of functionality you allow that signature to perform. Apart from the list of trusted signatures, you have two more entries. One is a default entry, that is for all other signatures that you have not specified, and one is the no signature, which is for code that has no signature. What are the common ECL problems? Well, again, as stated before, there's very few people out there that understand the ECL concepts. Number two, ECL settings are stored in a very obscure location. I don't know if anybody, if you know about administrative ECLs, they're stored in some hidden location, somewhere in the nodes directory. You can find them and you can manipulate them. Within the user's desktop DSK, there are also ECLs. There are also ECLs specified. But most important of all, prior to release 502 of Lotus nodes, the default ECL allows all functionality to any type of code. And that is very important. So when you are then installing a new node client, it's gonna allow for any type of hostile code to execute. Lotus has recognized this, and as of 502, they've reversed it. It's now as tight as tight can be. Which also presents a lot of warnings to people. But, well, there's two undocumented ways to reset an ECL. One is the formula that's called alpha refresh ECL. And if you specify either a non-existing administrative ECL or anti-parameters would do fine, you will reset the ECL at the client. Now mind again, that prior to 502, this is gonna end up in a situation where the client will all allow all functionality. The second method to reset the ECL, actually the title of my slide is a bit wrong, it's not removing, you're actually resetting it. The second method to reset the ECL is to remove the ECL setup equals three line from the nodes.ini file, which is a settings file for Lotus nodes. If you do that, the next time the node client starts up, ECL has been reset. What is the ECL attack about? Well, we have discovered with our research that the ECL is not capable of intercepting API calls into the nodes client. So that only interface of Lotus nodes is using the nodes API. So it's also not being intercepted by the execution controllers. I'm gonna show a little demonstration again, going back to my screen. Again, this is the victim, this is the attacker. In order to reflect a release 502 user with a very tightened ECL, I'm gonna have to switch to another user, which I have defined, which is Mr. Somm user. So I have to switch the location document here and I have to provide a password. Okay, I have a very slow laptop, I'm sorry about that. Okay, I'm gonna open an email. Again, from the attacker, I've prepared this demonstration a little. And what I've done is the following. I have sent this victim an email. And that email contains an attachment, which is an HTML file. The HTML file consists VB script. Okay, so that's why I'm gonna use Exploder to launch it. The VB script is making all the calls into the node's client. And I'm gonna have this victim perform all kinds of functions that should not be allowed. Let's first take a brief peek in the ECL itself. If you go to File, Preferences, User Preferences, Security Options. As you can see here, this is an ECL that Lotus is recommending. Default, there is nothing allowed. So as soon as any type of code tries to perform an action, it will pop up with an execution security alert. The same goes for the node signature. And Lotus Nodes template development is allowed all functionality. Reason for that is they shape the templates. So if you wanna be able to use your mail, this needs to be on. I'm gonna launch this file. And this is also gonna take some time because I have a very slow laptop. We rented it, by the way. What I'm gonna, what the code is going to do is very interesting. First of all, it's gonna modify the access control list on this victim's mail file. It's gonna change the entry anonymous into manager access. So the result is that you end up with a world access situation on your mail file. Secondly, this piece of code is going to send an email back to the attacker. Now all of you know that if Internet Explorer tries to launch ActiveX, and it's gonna come up with a warning, I bet there's guys out here that know plenty enough to go around those warnings as Loft did with their advisory a couple of weeks ago. I didn't put any energy in that. So I'm just gonna press yes. Yes. There you go. Nothing happened. Yeah, it's a regular HTML file. And the user didn't notice a thing. Let's go to the attacker, and let's take a look at the end result of this. Which, one down, okay, thanks. This is the attacker. There's about the alchemist's email, and I'm gonna open my email. And it worked. I received an email from Mr. Samuser with a subject ACL updated for the mail file of Samuser. I'm gonna open that email, and what I have here is a URL pointing towards that user's mail file. So let's click on that. Pop up Nascar and see what happens. There you go. I'm manager. Sure. In order to show you the ACL, I'm gonna switch back to the victim. Laptop here, which is on the screen. So pity we don't have two screens, but. We're back on the victim's mail file. Now, the third thing that the email did, that the piece of Phoebe script did in my HTML file, is I deleted the document. So all traces are gone. What's what happens if I try to open that email? Oh, it's already gone. You see that? Sorry. You wanted to look at the ACL. File, database, access control. And as you will see, default has no access. Anonymous has manager access. If you take a look at the log, you will actually see that this happened just now. Well, another interesting piece is that the user performed activity himself. Not me, but the user himself. Okay? With a little bit of imagination, there's a lot of things you can do with that Phoebe script. And I want to point out just a couple of things that we came across doing in our research. One of the things is that, hold on. One of the things that we discovered is that design elements in nodes databases, such as the mail file and those kind of things, they seem to be having a fixed node ID for databases that share the same template version. What does that mean? Well, if you look at the mail file, there's for instance the memo form, it has a node ID. And that node ID is going to be same for all the same versions of Lotus nodes. If you access that particular design element, not as a design element, but as a regular nodes document, there's a function for that, get document by ID, then you will find out that you can manipulate that design very easily. And again, with that Phoebe script, that'd be relatively easy. So, back to my first demo where I talked about stored forms. Well, we saw that the stored form is actually an attribute that is set in the icon document of a database. And if you go access that icon document, that's a regular nodes document, you will see that in the dollar flags field, there's a small F character, which indicates stored forms are not allowed. So if you remove that small F, you're back to the zero basically because you can send stored forms again. Well, the same goes for DB scripts, all those kind of things. What can we learn? What can we see from this type of attacks? Well, first of all, again, ECL does not intercept API calls. Secondly, payloads execute on full behalf of the nodes user. And also, not unimportant, the nodes client is not being used. The application is running external to nodes. Recommendations, how can we cope with this vulnerability? Since all of them calls will make use of the registry, we advise you to take away the following settings, that's the nodes.nodes session and nodes.nodes.UE workspace, take it away from the registry because that's your way to disable all the hooks into Lotus nodes. Now, a little side note, there is many external applications that are interfacing with Lotus nodes. They will no longer function. So there's a judgment you gotta make yourself. Do I want security or do I want functionality? Secondly, very important, prior to launching attachments, make sure you clear your user preferences. That way, if some hostile code tries to hook into the nodes client, it won't get anywhere because you'll be immediately prompted with a nodes password prompt and you will know something is going on. I thought, kind of obvious, the internal nodes viewer is not capable of running any hostile code. So use the internal viewer where possible for Word documents, HTML documents, any type of active content that you might come across. Okay, I'm gonna hand over this one to Chris and to Patrick Gunther, who's gonna do some more heavy stuff. Patrick's gonna be picking up the keyboard stuff and I'll go ahead and babble because he's happier on the keyboard and I'm happily babbling. Now, we've talked a lot about using F5 to clear out the user credentials. Like if you're walking away from your desktop for some particular reason, Lotus says, hit F5 because that's gonna force you to reauthenticate or at least reenter your passwords in order to unlock your nodes ID file. Well, there's some stuff about that. First thing, what Patrick's gonna do is pop up a external application that's gonna try to make a call into a nodes document in a situation where F5 has been entered on from the desktop, okay? He's hitting F5. We should supposedly be locked out now. So he's gonna launch this external application. Yeah, we're out. All right, so he's gonna launch this external application that's gonna attempt to connect in there and because we've hit F5, you still have your thing shared. We ran through this before, bear with us, he's gonna go in and unshare. So at least you see that going. Right now, the user ID is actually shared but we'll fix that. All right, so we're not gonna share that anymore. So external applications can't do a direct call into that by talking to the stored credentials in memory. Okay, so he's tried to connect and it's prompting him for a password. Now, what's going on in the background is when you hit F5, what you think is happening is that your credentials are being completely flushed from your workspace but what's really happening is the client's being instructed that it's dirty by basically flipping a bit somewhere in memory and if you wanted to take a look, you could flip that bit back because your credentials are still stored in memory. Your credentials have to be in memory because Notes has a remote replicator service that constantly talks between client and server so it can update your databases. Well, how could your client talk to the server if it didn't have some way of authenticating the server? It uses that stored credentials in memory to perform this function. So what we've got here is a little tool that's basically going, well, it's a little multifunction tool. The first function we'll do of it is basically turning back on that shared attribute for those credentials in memory so the external application can talk to it just fine. And there we go. So now we're back into that one. Now, just as we said before, once you've got access to that cache memory location, it's gonna remain cache so we'll be able to access that for as long as we have the session open. And basically it's just one little register that's being set. Now, the vulnerability, obviously, a little external program. I mean, we're doing it here locally on somebody's desktop but there's ways to do it using Phoebe script or anything else that we've talked about through some of these other attacks to perform the same function. Now, one of the things, of course, that makes sense, you're not gonna be able to access any databases other than the ones that that user has access to. This isn't granting us any sort of super database browsing capability. We're just able to sort of unlock that guy's workstation. But we're moving on to other stuff. Now, this is a basic recommendation. F5, don't use it. If you need to leave, if you gotta go to the bathroom and you're that worried about it, shut down notes, turn your machine off, whatever. But don't think F5 is really gonna buy you something because if someone can walk by your desk, they can just unlock everything and get your credentials back. Now, just talking a little bit about a thing called the HTTP password hash. Lotus in the names and address book keeps track of a thing for web-based access into notes. And basically they're using a modified RC4 implementation where a passphrase is then hashed using RC4 but rather than using a dynamic table they've got a static set of plain text that's constantly used as the reference to generate the hash. So essentially, Lotus isn't using a salted hash. Where people using Unix figured out a million years ago that if you're gonna use Desu, you need to salt it with something. Apparently, Lotus decided that wasn't a good idea so they're using this static thing to generate hashes. So what you end up with, if you actually look in the names and address book, any time you see, oh, well, we're in the names and address book now. Yeah, it should, you're up. If you go over to a field, you'll see HTTP passwords in the names and address book. Yeah, there are some hashes. So anytime you see a hash beginning, three, five, five, E, nine, 80, seven, B, five, nine, et cetera, et cetera, that's password. Anytime you see zero, six, E, zero, eight, blah, blah, that's secret. If we go back over here. I'm not gonna read it, you read it. Anyway, anytime you see that, and it becomes very obvious when you start looking through people's names and address book, all of this guy's using a password or password. And because of this, once you figure out the way the hashes are generated, you can make a very, very easy, dictionary-based hacking program to go against the hashes in the names and address book. So that's fun, but wait, there's more. Now, inside the notes user ID file, notes was set up in such a way that the ID file's providing a lot of different layers of security. It's providing strong authentication and access control because of the digital signatures used. You have real good file system integrity and non-repudiation and because it's used as an encryption key, you've got confidentiality. Sounds great, right? Well, taking even more. The ID has basically the private and public key, information about the user, an expiration date for the ID file, basic ID integrity control so that no one can go in there and muck around with the user ID file because it'll fail check sums. The ID file's necessary in order to unlock your client so you can do local databases. It's used in authenticating to a server so you can actually do client-to-server communications and it's referenced through notes programs that are using the native notes API call. Now, one of the things about the client with respect to the ID is there's sort of a an arbitrary delay that's built into the client to keep you from trying brute force attacks and logging in, you know, one, let's take a second and then two seconds and then 10 seconds and then 30 seconds and it can even lock you out from attempting again. Now, the digest of that user ID file is actually stored in the names and address book and it's sort of referenced with HTTP hash. And, you know, another feature that the client has is it has auto lock off features and F5 features but we know those don't work anymore, right guys? And it has the ability to share user IDs like we just did so external applications can happily talk to your existing credentials. Well, here comes the fun stuff. Basically, there's a mechanism by which you can use someone's HCE password hash and an ID file, both of which will explain a couple of reasons on how you might be able to get that information so that either on your local area network, since you're gonna have access to your names and address book or any service you have access to, or outside from the internet by getting this information, either by directing a user towards some hostile webpage or by sending them a mail message with stored forms or what have you, you can obtain this information and use it to authenticate to a remote note servers as that user. Now, how does this basically work? We're gonna walk through a demo here. The first thing we do, since we've got this names and address book up, we're gonna go ahead and steal an HTTP password hash. So we got that highlighted, just toggling that over. And now we're gonna pull up that user document for that person, and we're gonna detach that guy's user ID, make a copy of it, put it on our local desktop. Okay, so we've got that over there. Now from the notes client, what we wanna do is switch to that user ID we just stole. And it's gonna prompt us happily for a password, just like normal. We don't know the password, this is something we just stole. So the password could be anything, but it doesn't matter because we have the hash. So, basically, using that same little nasty tool, we're gonna go in there and we're gonna replace in that memory register where the existing credentials are, that hash we just stole. That's what the same as the note test? Yes, it does. And doesn't the notes documentation recommend not doing that because they've already said the HTTP hash is not as secure as the notes. Yeah, they did say that, but in most installations you'll notice that most people are still synchronizing HTTP and notes IDs and people have gone to extreme difficulty in trying to do that synchronization. It goes completely against reality, but. Not at all. Well, it's actually, if I can say this real quick, it's actually when you register a user, you got a little checkbox that says make the register as a web user, and it will actually set that HTTP password to be the same as his ID file. You also have a checkbox that says save the ID file to a disk as opposed to the ID. You do, but it doesn't default to it. No, it doesn't.  So, we're not saying that every major deployment of notes people don't have their act together because some do. Some of the customers we've talked to weren't gonna be affected by this, but they're still affected to other, some of the other things we've talked about. But, unfortunately, you're the exception of the rule, guy. And, you know, we've got customers out there with 80,000 different notes clients in one organization or another one that has 115,000 and another one that has 175,000. I mean, this is a big deal and anyway, we'll continue on. You can go home and sleep well tonight. Most of your colleagues at the audience won't. So, basically, what we did is we replaced in memory that hash with the hash we stole from the names in the address book. We've now authenticated as the head user. We're gonna pull open his mailbox and lo and behold, we're now that user. Now, as you said, there's a couple of things. Yeah, F5 doesn't clear your path through your private information so you can get hashes locally. You can get hashes by browsing something from remote. We've also implemented the same functionality for that particular tool into ActiveX so you can have someone browse a web page. You'll take their hash credentials from their memory location and steal a copy of their ID file. You know, and with that particular implementation, you're not using the HDB password hash. You're using the actual hash that's generated for your existing session. So, even if your HDB password's different, if I can convince you to go to my ugly web page, I'm taking your user ID and the hash for your actual logged in session. Not, so it's a little bit different because it involves a little bit more user interaction but it's still just as nasty. Did you wanna do that one? Yeah. Okay. Yeah. This one's just, this one isn't the full nasty example but it will, it's gonna mail back the hash information back from RoPlay. So, we're connecting up, there you go. There's the hash information that's pulled from memory. So, and that doesn't necessarily have to be the HDB password. That's the, you know, it's unfortunate and what they're using to generate HDB password hash is the same mechanism they're using to generate the credentials to unlock your private key. That's what unlocks your private key. Your passphrase doesn't, your passphrase generates that hash that's in memory. That's used to unlock your key. Oh well. So, as a basic summary here, password hash, you get it in the notes, notes, names and address book, which you can look at with a notes client. You can look at it with a web browser or you can get it from native memory in an active notes session. And for the ID files, well, most people unfortunately don't practice good host-level security.   People have NFS mounts with things with their notes ID. People storm in a central directory on the notes server that's accessible by everybody. So when Doofus's hard drive gets reformatted and the system administrator doesn't wanna build them a new notes ID, they have a copy of it somewhere. Or they just leave it by default and the name's in the address book. So, that's not good. So this information is out there and it's fairly easy to get. Chris, I was asking you a question. Can I go back to the web browser and hear what? Yeah, the active exit pulls the hash out? Yeah. Okay. You know, and on a lot of these, like we were saying before, you're gonna see, anytime you send in these things out there, since it's VB script running in an HTML, you're gonna get those Explorer messages. Because, you know, different security zones and whatnot. But how many of you use Explorer and how many times a day do you see that message and how many times do you ignore it? If you're like anybody else in corporate America, you'd probably go, well, gee, I'd rather have my porn than worry about that. So I'm clicking yes. So just in summary, I'll hand this back over to Kevin and we'll finish up the summary. Excuse me, Patrick. All right, so how many of you found that interesting? Yeah? Very. All right. Well, good, because I sure as heck did.  And the whole purpose of this is so that... And we found you. We found you. The whole purpose is so everyone thinks like this guy here. That is really the whole purpose of this presentation. Our recommendations for this is to restrict access from the web. So this could have various meanings. If you don't have a purpose for running a domino server on the web, HTTP service, disable it, kill it, get rid of it. If you do have a purpose for running it, then make sure all your ACLs are tightened up.  I know, I wish Lotus had better tools. It got a little better in version five. Yeah? Did you say ACLs or ECLs? ACLs right now. ACL reporter is a very good tool for that. Okay. I live right somewhere. Well, I think it should come just with the default install of domino. So not everybody, a lot of people have gone out and spent thousands on this and they can't, yeah. We all know that feeling. Don't forget to remove, don't, okay, sorry. Don't forget to remove the user IDs from the NAB. Get rid of those things, you know. Put on a floppy, stick the floppy in the safe. But don't keep that in your network address, but name an address, but. And like this gentleman out here, choose different passwords for your ID files and HTTP passwords. There was something on here and I want to, okay, no, we do get to it. And I mentioned this. This is something, now this is something when we reported this to Lotus, this is important that Lotus asked us to mention this. The strong password hash, there is in release five, there is a strong password hash that you can actually set in the domino server profile document. Four six on. I'm sorry, well four six on, you actually have to set an I&I file. But in release five, you can set in the server document. But one of the things which when we first reported this problem to Lotus, they actually went back and they did their homework and they came back to us and they said, you know what, using this is actually broken. So when you register a user, you need to go back and manually upgrade him to a stronger internet hash. Because they had not even realized it was broken until we started talking to him about this. So you need to go back into the person views, select all the users and there's actually a pull down menu under actions and you can actually select to upgrade to a stronger hash. And you'll notice a different format for that hash. And when you notice that different format, then you've upgraded and it should be somewhat more secure. Does that mean it's completely secure? Your guess as good as mine. We're gonna check that next. When you're leaving your desk, close the whole thing down as Chris said, you know? I walk by so many places when I go into auto to place and the screens are up, people fit F5 if they've done that. But close it down, especially if you're the secretary to one of the directors.  Never click on any email attachments, never run anything. If it's a Word document as Valter mentioned, if you've gotta open it, you know, don't accept them for one, you know, try to get something like PDFs, but if you've gotta open it in the viewer and notes, we're not completely sure that that's even secure, but we're not sure about anything. Enforce the ACLs on all the databases, make sure that you've gotten through, as I said earlier, check, make sure that you've gotten really tying down. Restrict the anonymous browsing for default databases. If you're running an older version of Domino, this is gonna be turned on by default. The newer versions, this is actually turned off. If you've enabled it for some sort of system administration or internal development, before you deploy that as a web server, go back and check that. Now, this one is very controversial. Disabled store forms on mail databases. We are aware that there are a ton of applications built for Domino, third-party applications, sometimes internally developed applications, that take advantage of this functionality. And when we were discussing this with Lotus, when we had our conference calls with Charlie Kaufman and Kevin Lynch and discussing this, they pointed out to us, you know, that there's a lot of applications that use this. Our next question was, do you guys have it enabled? Take a guess what the answer was. Enforce strong ACLs on all unsigned and untrusted documents. Especially if you're running 501 or earlier, you need to check this. This is kind of obscure setting if you're not familiar with it, go back and read the documentation, figure out where it is and set it correctly. Ensure strong host level security of all note servers. Chris can tell you lots of stories as we can where Domino server is only as strong as the platform it's actually running on. If that's not secure, your Domino server is not secure. If I can pull down your notes database and I can open it local, your data's not secure. If you've got more information, feel free to visit one of these web pages. This whole presentation, we hope to have PDF by tonight, tomorrow. The PowerPoint slides will be up tonight. Yeah. And we're gonna make sure to get the PowerPoint up tonight because I'm sure a lot of people wanna go back and review this for whatever reason you horrible people wanna look at these at times. But I assume there's some valid reasons for people wanting to see this. So we're gonna make sure it's available on the websites and we're gonna try to transcribe this and put a little bit more detail in a white paper that we'll be working on, which will happen sometime in the future. But as you might imagine, we've been a little busy lately with this. So the white paper will just have to wait a little bit. And finally, on there with Lotus, if you guys aren't, they don't need to see me. If you guys haven't been, for those of you who have major notes deployments and you're not constantly keeping abreast of what's going on with Lotus and updating and keeping patch levels, fixes come up for a lot of things all the time. And if you're not applying them, you're so far behind the curve that all of this is gonna take you forever to catch up on. So get on the hook, it's your responsibility. So I guess question and answers.


Good morning, everyone. And a warm welcome to all the esteemed panelists. And thank you for joining and agreeing to share your insights and learnings on this very important topic. And just to start, I was a few weeks back, I was in a B school. And I conducted a live quick online survey among the students and asked them to respond from the perspective of a consumer. And what I asked them, I asked them three questions, that how many of you are in favor of rising consumer privacy? Over 90% of the students voted in favor. The next question was, how many of you will be willing to share your data to a brand? And 74% said they won't. The third question was, how many of you would be willing or want brands to talk to you in a personalized manner? And 85% were in favor. So there you see, while consumers want privacy and personalization at the same time, they're not willing to share data. And that's the challenge that the marketeers today are facing at good phase, increasingly going forward. Happy to have a wide representation of various sectors here today and would like to see how they approach personalization and the challenges that face and what has been their winning strategies all the way. Vidya, thank you for joining. And may I start with you? When I came across, I was looking at monoliths and researching. I came across this statement, which says, we are a house of incredible brands providing people with the right snack or the right moment made the right way. So I see there is an element of personalization inherent in the statement itself. So can you please help us know, like, how do you approach personalization? Because the category that you are in, most of the buying happens offline. And if you can say this from the point of view from both existing as well as prospecting customers that you reach out to. Thanks for that question, Anil. And I think the reference that you made to the survey right at the beginning is pretty much my answer, right? So consumers today are looking at hyper-personalized experiences. They are always on. They're looking for content all the time when they're traveling. There is no prime time anymore. And there are multiple screens, multiple forums that are looking for information. And as a brand, if I am not relevant to the consumer at the moment where he's seeking out a proposition that I can offer best, then I'm not doing justice to either his needs or what I can offer to him. And that's where our personalization philosophy comes as well, right? So internally, we call it empathy at scale, which is to say that how do we identify moments in a consumer's life, which is contextual to him. So we're not starting from us. We're really starting from the point of view of what is he looking for? And how can I present myself to him in the most meaningful manner at that point? And therefore, personalization is not about only buying and what can drive sale. It automatically then becomes, how do I impact the entire consumer journey? Right from the time that I can impact awareness to, how do I make him consider or her consider my brand over a set of things that he's looking for in that moment? And that's really how we are looking at personalization and that's pretty much what we've demonstrated over the years as well. So would you have any case study of personalization which is very close to your heart for your brands? I think the work that we've done during Diwali over the last couple of years truly stands out as something that is university acknowledged as a great example of personalization. It's close to my heart as an employee of Mondleys because it makes me feel very proud that here is an occasion where you want to bring a happiness in everyone's lives that you are a part of because Diwali is a festival like that. And here's a brand Cadbury celebrations which is about invoking that moment of generosity. And given the COVID context, given that people are looking for that spark of inspiration or joy in their lives given how they've suffered, I think the fact that we were able to play the role of a catalyst by bringing a star like Shah Rukh Khan to a piece of comms that they can truly call their own. I don't think anything that we've done really surpassed that from the point of view of saying that how could we do really intimate personalization but do it at a scale which is not something that obviously we anticipated initially but then it took a life of its own. That was iconic, I must say. Sangeet, right? So housing.com when I read about it, of course it's one of the most innovative real estate portal, right? At the same time, you handle multiple stakeholders. You have builders, you have brokers, you have property owners, people talking to your site and apps for rent, buying a plot of land. Also, for a lot of allied services that you have on your site, how do you make sure that you keep the aspect of personalization alive and kicking with all these different kinds of stakeholders at your end? Got it, sure. Anil, I think that's definitely a challenge for us because there's just so many stakeholders. There's buyers, renters, on the other side, there's sellers, agents, homeowners, directly now interacting on the platform. So for us, and then again, another complexity that gets added is if you look at housing.com, real estate, you maybe buy a house once in your lifetime, right? Most of us rentals every two, three years on average. So it's a very short time period where we have to personalize within those three to six months for the user. Exactly. So this multi-stakeholder arrangement, we have started looking at this as an opportunity now because what's happened is instead of, in addition to I would say, one side browsing pattern, let's say, from the consumers, we also have started looking at the interactions now. So let's say if a buyer is connecting with a seller, we also have started taking feedback, learning what's going on, and then using that to improve the experience going forward. So having multiple stakeholders on the same platform is actually an opportunity because we know exactly what the user is thinking through the interaction that they had on the platform. Nice. So anything that, any case study or any personalization project that you are very fond of that you can speak about? Sure. So our approach to personalization, I mean, so we look at multiple touchpoints suddenly. So our idea is to keep making those incremental improvements across the journey, which eventually adds up to an overall delight factor for the user. So one of the recent things that our team worked on was around, so when you're looking for home, right, it's a complex journey. So you're looking at multiple neighborhoods, you're looking at multiple societies. So there are always multiple intents that's going on, right, in your mind. As a platform, a lot of personalization you would see is always based on the recent search. You always do, right? You start off from where you left off. For us, it's, as I mentioned, it's multiple intent. So one interesting experiment we did was using the explicit data that the user was sharing with us. In addition to the implicit data, right, as I mentioned through interactions and everything, we were able to classify multiple intents and then the user is coming back, right? We saw a lot of people dropping off because they, because what happens is what you were searching on Monday and by the time you come back to us on Thursday, a lot of things have happened offline. So what you were looking, it's not maybe what you're looking today, right? It evolves as you move forward. So what we started doing was we started showcasing multiple searches that you can do in parallel, right? So that fundamentally was able to change the way the person is looking rather than just one intent at a time. And in terms of results also, we saw about 15 to 17% uptick in our engagement numbers on the platforms. That would be a normal approach that you must be following even today, right? I mean, that's something nice. So Sachin, Pesha Bazaar, right? It's the number one consumer credit marketplace we're just discussing offstage, right? And it's also a category or a sector where data security and privacy, I mean, the restrictions are a lot more than what we have in other sectors, right? How do you make sure that you are able to look into the aspect of personalization, right? For all your existing customers as well as new customers who are talking to your site and app, right? Sure, so it's true that BFSI is imposed with a lot of restrictions, which are not there in other industries, right? Because money matters are very delicate. And these restrictions are critical to safeguard the interest of consumers, especially the naive ones. So I can't complain about that, but whatever data we have, we try to work with that. As far as personalization is concerned, they are obviously they are regular ones like personalizing communication, personalizing content, personalizing journeys. But one thing which I would like to comment on here, and I'm really proud of, people come to us when they are in need, right? People want a loan, nobody wants a loan. Some people need loans, right? Unfortunately, if 100 people apply for a loan, more than 60 got rejected because of one or the other factor, right? So when they come to us, they need that loan urgently. And if we can personalize that offering and improve their chances of approval, improve their chances of getting that product, that would be the biggest customer delight for us. And that's what we do. So we have various data points available to us. We, it are existing customers or the new customers. We have credit score data. We have their journeys on a website whatever products they have consumed, the channels, et cetera, et cetera. There are some third party data as well. Basis that data, we try to give him the best product while the best might not be with the lowest interest rate. Like I was mentioning, because people have, people tend to have this tendency when they come to a lending platform. They often choose the product where the interest rate is the lowest because they don't want to pay a higher EMI. But that might not be the right product for you because that bank may reject you. Basis is Sible score and all that. And if you get rejected once, your chances, suppose you had a better chance in Bank B of getting that product, but because Bank K rejected you, your chance will become bleaker even on the Bank B. So it's very crucial. It's, and we do it on the fly. When people come onto our platform, they give us some details and we publish those quotes, those options. We try to give him the best offer. That's a good insight for all of us, maybe. We shouldn't be checking our Sible scores or just going for the banks. It's very important. Lowest interest rate, right? Yeah, great. So, such in what kind of tools or platforms do you use currently or maybe from a future perspective, right? The way personalization is evolving. You have a focus on certain tools or platforms that you use. See, it's not how good your bat is. It's how well you have practiced your shot, right? Obviously, the bat will help, but you know, so similarly here, the tool is not important. There are multiple tools in the market and all, I would say most of them are equally competent. You would have plus and minuses everywhere, but it's within your own organization, right? How you treat the data. Before you're going for a tool, there is a lot of work needs to be done at your end. Before you even go out and start looking for a tool, there has to be a data unification exercise. Exactly. The moment of truth should be the same for every department, be it the product or marketing or service, right? If it's not happening, whether you take the best tool in the world or you take the worst one, the result would be the same. Having said that, so my advice is to first, you know, do your exercise back at home. Try to sanitize your data, get everything at one place, make it usable, and then go out and search for a tool. As long as tool is concerned, what we are using, we have been using an in-house tool for quite some time now for personalization, for automation, everything. Now, since our scale is bigger, we have recently signed up with Salesforce, Marketing Cloud and CDP, and we are in process of implementing that. So, great. I hope it's not the same situation. So, Ashish, coming to you, I think you represent the youngest organization on the stage now, right? It started in 2018, Bharat Pei, right? And you gave us our first UPI interoperable QR code. You have 80 lakh plus merchants on board, and you're processing 18 crores UPI transactions per month. Maybe that might have gone up from my last analysis, but you are in a different domain altogether where you are having to deal with merchants more, that is more on the B2B side, right? You have an element of consumers as well on the book now, yeah, postpaid. But how do you then look at the aspect of personalization? It's more from a B2B perspective, right? And then B2C perspective here. C-Personalization for FinTech or a BFSI kind of clients, right? Like Sachin rightly pointed out, there are rules and regulations around it, right? So, it becomes tricky for two reasons. One is obviously you are handling with money, right? Money is very dear to people, right? So, you can't be goofing around that. The second reason is basically, so if you think about any company, let's say a normal consumer company, right? The extent to which they will do personalization will depend upon how much capability they have or what is their internal thesis around personalization, right? But in case of a FinTech company, right? It's also governed with the rules and regulations of the regulator, right? So, just to give you an example, FinTech companies are not allowed to store their data with servers outside of India, right? So, that's an important critical piece when you select your partners, right? So, personalization becomes slightly difficult for us. One of the other reasons it becomes slightly tricky for a company like Bharatpe is because a lot of things don't happen actually inside your digital environment, right? So, once you, let's say, when you transact on any merchant using the Bharatpe QR, that transaction is actually happening offline, right? So, stitching that offline transaction to the online journey is something which needs to be done. So, we as a company use extensively what is called in technical parlance, server to server integrations, right? So, basically pulling your offline data in real time to your online world so that you can use that to, basically, cater experiences on the app, right? It's also true for experiences, it's also true for what communications you send to the merchants or consumers for that matter. Automation kind of businesses and emails. Yeah, okay. So, on that, so, is there any specific Martik tools that, what are the tools that you are using or proposed to use maybe? So, with respect to tools, again, I would say I agree with what Sachin was saying earlier. So, tool is just an implementation, right? The larger bind needs to come from your organization, right? So, whenever you, let's say, take up anything, let's say, personalization, right? You should not take it up just because you heard in an event, right? So, you'll have to think about it whether it's really important for your customers, right? And second, what kind of business impact are you able to create out of it, right? So, maybe you do a smaller experiment and try to see what kind of impact it has. If it has a real impact, let's say on the bottom line of the company or the top line of the company, then obviously it becomes a lot easier to get sponsorship inside, right? Because otherwise what happens is all these kind of projects, they fall apart. If you don't have internal sponsorship from your, let's say, top management. So, I think setting up requires use of, as in you should set up what's the real business impact you are trying to bring in once you do something, right? So, we, for example, use a tool called Clevert App which helps us personalize a lot of communications, a lot of app experiences for us. And website product as such, we don't have a website presence. It's an app-only product, both for Bharatpe as well as Postpe, yeah. So, I think one thing is coming out from both Sachin and you is that get your house in order with respect to your data before you start looking out for various tools and platforms, right? So, one more thing Ashish rightly mentioned. You know, most of the time what happens, these tools and these use cases are usually pushed by one department. So, either marketing who is pushing the management for an automation tool or a personalized tool, while service has no idea, product has no idea. And when they implemented, marketing implements one tool, you know, service comes up with a different tool that, okay, we have these use cases, these use cases can't be solved by this tool, we need another tool, that product comes up, okay, these tools do not have this capability. So, you know, before we go out in hunting of a tool, first we need to get every department on the same page, write down all use cases, why do we need it and what are the use cases we would be using that tool for. And just evaluate the importance and criticality of all those use cases, we do not have to go out and solve every use case another side. We just need to figure out what all cases are important for your organization, for your consumers, find those use cases are, if we are able to, you know, solve five or six use cases within the organization, that will be a good success. But it has to be at one group. So, a lot of these tools actually require as in taken product bandwidth, right? So, if you don't get that, it is a good, right? Yeah, yeah. So, on that use case, it's fine segue coming to you Vidya, right? Professor Byron in his book, How Brands Grow, he is little against, say, using hyper-targeting, especially with respect to CPG use case or CPG category. How do you, do you think personalization is only a lower funnel metric and needs to be looked differently? I think fundamentally, all of us are, you know, all of us in the CPG industry are still trying to drive penetration because most of the categories that we operate in, India would be, you know, vastly under penetrated and there's headroom to grow and stuff. So, our objective continues to be penetration and to that extent, I think most of us are aligned to the laws of growth philosophy that Byron Sharpe speaks about. And I think personalization is not about, at least in our case, which is very different from some of my fellow panelists here, is that we are still going to go to a very large audience and a lot of them are going to be light users or in some cases, you know, non-users. What we're trying to do through personalization is to really, you know, personalize the communication in a way that still speaks to our brand idea and our proposition. But in a manner that's fit to the platform, so, you know, if I'm looking at content on Google versus YouTube versus Facebook, the sheer diversity of the platforms means that I can't be speaking the same language. And the way we segment our cohorts is very different now, right? I mean, let's say 15 years back, we would have done simple demographics and you probably air the same ad at prime time on your favorite serial or program. That's changing now. So, that's what personalization means to us. We still are going to the largest cohort, I mean, largest universe of audience that's possible. So, we're not doing repeated targeting to one guy or going after one person because in our case, you know, while it's different in the sense that our consumers probably buy us far more frequently than let's say a housing consumer or an automobile, but the lifetime value, et cetera, is very small. I mean, it's a five rupees or a 10 rupees or a 20 rupee product at the end of the day. But we still want to be relevant to that moment. So, if it's four o'clock and if a consumer is looking for a snack, I want to be present among the plethora of options that he or she is searching for. And which means I have to communicate in a manner that's relevant to that moment purely because that opportunity is available right now. Technology is enabling that. And I'm going to use it. So, technology is not ahead of the fundamental philosophy of wanting to drive category penetration. It's an enabler to that extent and that's how we are looking at personalization. As long as you are able to do mass customization and take it at scale, I think it makes sense. Sangeet, so going to you, do you also think that personalization and scale are like antithetical to each other and you cannot have personalization at scale, I mean. Antithetical, not sure. I would rather put it in a different fashion. I think it's a big synergy between both of them. Personalization, scale, and this topic has been, I mean, discussed enough in the market. But the way we look at it is there's a circular relationship between both of them. For example, personalization through scale. I can do predictive analytics to personalize, which I cannot do if there's no scale. So just to give an idea, more than one corona people visit us every month, right? And that scale enables us, and especially predictive analytics plays a big role when it's the first visit for the user, right? Because then at that point, you actually don't know much about them. And it's the other way around as well. Through, by doing such, as I mentioned, delightful personalized experiences on the personalized side, you also start getting more scale, right? The user comes back and sort of the virality kicks in. So I don't think antithesis, I think both of them are pretty linked to each other. Got it. So Ashish, like in the B2B space that you operate since you've already touched a little bit, but do you think personalization in a B2B space should be looked at a little differently? Or what are the guardrails that one should be be cognizant of while doing this in a B2B environment? So when we really design our marketing, we don't really think about it like a B2B landscape, right? So B2B for me is something, when you are, let's say, your targetable market is say 5,000, 10,000, right? Then I think it's more like a B2B, right? So even in case of Bharatpe, right, which is a merchant platform, we have more than 8 million active merchants, right? So 8 million as a number, you can actually work on all the consumer-oriented stuff, right? So you can actually personalize. So 8 million is a fairly big number, right? So we don't really think ourselves as a B2B offering, although it is a B2B offering, right? But all our marketing, all the tools which we use to personalize, all the other things, so everything we do in marketing slash product, right, is not geared towards B2B mindset, right? Right. And post-pay anyways is a consumer product. Yes, yes, yes. Right, so if I just come to all of you and like to, if I want you to define, say, personalization in two, three words, or rather, personalization leads to what? Sangeet, if you can... I would put it delightful experiences. That's the focus for us. Okay. Ashish, personalization leads to what if you want to...? So personalization will lead to better business outcomes, but I would say you should not take it as it is. You should test it yourself. Great. Sachin? So there's only one reason why we should do personalization is giving our consumer better experience, right? Just as an example, if you walk into any showroom, right? So in early days, when we used to go to small shops and the guy there, he used to greet us with a name, or if I used to go with my father, he used to greet my father, you know, Haji Jaal Hushna, et cetera, et cetera, and then used to go about regular business. That was a good experience. That was a delight. Just a small example. So the only genesis of personalization is customer experience. Very nice. I think that's the... Vidya? I think for me, it enables to build sustainable, long-term consumer relationships. I mean, the relationship that a brand like ours where... I mean, we are not even... We're a discrete category. We don't... A lot of people won't find the need to consume us. For us to be able to build a sustainable, long-term relationship, personalization is a great tool. It's not the only tool that somebody mentioned. But I think it's a great tool. No, I think as Sachin rightly said, so we have transitioned from a, say, a broadcasting era to a Web 2.0 to Web 3.0, right? But if one thing which has remained constant is the need for personalization. While you were giving an example of some... Yes, two years, but I think the tone, the nature, the manner in which you do personalization, that has undergone a change and it's still evolving. But I think the challenge that we, or all of us, marketers face is, of course, bridging that gap between personalization and privacy. I think if the day we are able to solve that we'll be able to, in fact, enter into a new era for responsible marketing. And I think all of us are gearing towards that. I think we have some time, we can have some questions from the audience if someone would like to ask to our panelists. Yeah, please. Hi, my name is Mridhu, and my question kind of relates to the survey insights you were talking about in the beginning. And so there are two entities here. One is the consumer, one is the marketeers or the brands, right? At one point you're right, like customers want it. But how are you dealing with the trade-offs? Not to be over-personalized for lack of a better word, like not to be over-personalized or over-embarking in their personal territory, specifically in terms of those DNDs that customers have the right to on the messages or the calls. So what is a trade-off, or what is a thin line that marketeers should keep in mind to not cross that line, you know? Can I give you an answer? You have this question specific to somebody or anybody in the panel. It's generally a question because we're talking about that topic. So any of the panelists... So she's asking, so what is the line which differentiates between privacy and personalization? How much do you want to enter into that zone of personalization? And primarily, do you keep that in? How do you keep that in mind if you can give some examples, if you intentionally keep that in mind? Yeah, yeah, please. In our case, you know, unlike some of the other industries where data is naturally volunteered by the consumer because they want to make use of the service. In our case, a lot of times, it's through promotions and activations where consumers would have volunteered to give that information. And a lot of times, they don't quite realize that they've actually consented to receiving communication from us. I think there is a constant tussle between saying that are we just being privacy compliant or are we building consumer trust? And we believe that brands which deliver on consumer trust are likely to succeed as far as the data journey is concerned. The idea is to not spook people. So I don't think there is a definite SOP around how many times should you communicate? What should you communicate on? But I think you get a fair sense of, you know, relevance and communication coming together. So for example, if there is a festive period that's coming in and I know that there are people who are making last minute gifting purchases, et cetera, a gifting comms or a gifting offer at that point of time makes sense if I'm reaching out to them directly through an email or a WhatsApp or whatever. But I think fundamentally, I don't think there is one way of doing it. We all need to be cognizant of the fact that we can't spook them. And that, you know, ultimately, if you want to be intimately engaged with your consumer, you've got to think of it as a relationship where he feels happy about placing his trust in versus just complying with the laws of the land which require you to do a certain set of actions. She's right. I just want to add one thing, give you an example. I am not sure how many of you have experienced it, but sometimes we are talking about something or we receive an SMS from an organization and suddenly we see a Google ad talking about the thing which was mentioned in that SMS or the thing which we were talking about. That is bad personalization, even though one of the largest organizations in this world is doing it, but that is something which will spook you because then you'll be worried suddenly that who is listening and why am I seeing this ad? I got an SMS about, let's say, something delivered to my house from Amazon, but someone is reading that SMS and the market here or the product guy decided that okay, let's use the intelligence from these SMSes which are not sent by us, which are not meant to be read by us. It is between two third parties. Let's try and personalize the ad experience for this consumer. So this is bad personalization. So I think we are all waiting for the India data protection law. I think a lot of these will be taken care of and will fall in place once that is out and enforced. Any other question that anybody has? I see a hand there. Thank you so much, everyone. Really insightful session. Before posing the question, my learning here is that personalization is always welcome, but the question is that does personalization have something to do with the industry that we are operating in? For instance, Mondeleys can do really well, but will people be more cynical about it when they are dealing with personalization coming from Bharat Piaw or Pasa Bazaar or housing.com because the nature is like, I come from a BFSI sector and in BFSI, the moment we want to do personalization at scale, things like regulatory, things like legal, things like finance, compliance all come up, and then when we want to do personalization at scale, internally the scale means that you get all the teams on board before actually making a mark to the consumer and we lose the bus. Like the topical marketing, the moment marketing, the personalized factor of it just doesn't come through. So is it more industry specific and how can we actually enable that, be it in BFSI or be it in sectors, which are slightly more, where people are very, very privacy centric or safety centric or how they're handling their data, where how can we do personalization there? Sachin or Ashish, if you want to take that. See, you are right. Up to an extent, personalization is industry specific. I'll give you an example. Nobody minds sharing their anniversary date or their birth date, right? And if a gifting companies or Mondays or FNP or anyone else, if they're personalizing their communication, their journey, the experience around these occasions, right? Around festivals, around your birthdays, nobody would mind that. But when it comes to the financial information, which I have shared with you, like my salary or my credit score for that matter, and if you're using that, I'll be, as a consumer, I'll just it'll just force me to think, have I shared my information to the right guys? Are they using it? Are they protecting it, et cetera, et cetera? So, right? It depends on what information the consumer is sharing with you and how are you using that information? Thank you. Thanks, Sachin. And thanks a lot. Thanks, audience for the questions. And thanks once again to all the esteemed panelists here for sharing their insights and learnings on this. Thank you so much.


The Navy released an updated Arctic Roadmap Monday. The Navy's Task Force Climate Change Office plan ensures the Navy is ready and capable to provide security in the Arctic region. You can expect to see more participation in cold weather exercises, more Coast Guard interaction and cross-decking with Arctic nation navies. For more information on the Navy's Arctic plan, visit the Navy Live blog. This week is Military Saves Week and the Navy wants you to take advantage of what's available. This campaign promotes your financial readiness and highlights the Defense Department's initiative dedicated to keeping you fiscally fit. Now is the time to take advantage of the tools and resources and think about paying off debt, saving for retirement and your future. For more information or tips on how you can be fiscally fit, visit the Military Saves website. Read more about these stories at Navy.mil. From all hands update, thanks for watching.