Hey traders T Bradley 90 here for those who do not know Alex took on the challenge recently of seeing how much he can grow a $30,000 account in 30 trading days and the results are in and he made $84,000 in less than 30 trading days, which turned his $30,000 account into a hundred and thirteen thousand dollars Alex recently put together a free mentorship course with his mentor bow explaining exactly how he did this the link is available at My investing club dot co slash Alex There's limited seating every single week. So be sure to reserve your spot as a very special gift to our YouTube viewers I want to announce something very special This is my personal phone number my personal number that I am putting out to you guys if you have any questions about joining M.I.C. Or on the fence about joining our wonderful club You can contact me now directly and personally and I will get back to you just wanted to put on a Short here as it's breaking down of this big 340 level potentially break 332 You know, it's about the right time we got an hour and a half left of the market. It's pretty much reversal time and It's you know, it's not that much risk right to risk like 10 cents up here So I feel like it's pretty good. It's pretty great risk reward in the short You know if we go and break 320 we could see three maybe well depends on if emotions want to step up But if emotions don't step up, I'll probably just bail just giving it like I mean I'm closer discovering this Like, you know, I wanted to kind of show some emotion on the downside, but It is uh, you know, this this perk back this it's trying to hold, you know like it's trying to make the attempt to hold and I don't really want to be there for this decision Like oh, is it gonna hold is it not gonna hold like if it wants to break down Handily I want to be there and if it doesn't I can you know, I'll just take this, you know less than 5 cent You know loss from a starter I can I mean whatever That's you know, I'm putting myself in position And if it wants to prove that it's not a good position to have to keep then I won't keep it Right. I'm giving it a chance to pull under 340 one more time But right now it's pretty slow and emotion time. It's not, you know, you don't expect emotions to be very slow You know the fact that it's not fast or jittery It means that there's not a whole lot of emotion going on right now And that's not the trade that I want. I want an emotional trade. I want, you know, it longs to be bailing, right? So it's not being impatient Right, it's not necessarily being that impatient that if I decided to cover here Hey traders T Bradley 90 here Tosh Bradley from my investing club chat Just wanted to reach out to you personally and show you how to contact Myself personally if you have any questions about joining M. I see about M. I see in general or are on the fence and need a Little bit of guidance before you join for the first time ever I have put out my personal number for you to reach me directly Among my email at Tosh at my investing club calm and our Twitter and IG handles reach out today and get any Information you need on what makes M. I see so great and why you should join us today


There was an earlier, this is going back maybe a decade, there was a fear of, you know, I started out watching puppy videos and then 15 minutes later I've signed up for ISIS. Right. And most studies that looked into that did not actually bear out the idea that there's a quick or even long-term radicalization algorithm that is being widely applied or used or people are falling into. It's people seek out the stuff they wanna seek out and the algorithm just helps them seek it out more. Yeah, it is fascinating to me the moment that the algorithm kind of became this villain that kind of divorced from the people, mostly end users who are demanding or wanting certain kinds of content. Yeah, and it's math. Algorithms are math. When you're mad at it, you're mad at math and it's silly. Well, then I'm anti-algorithm now. Yeah, I mean I don't like math either. Yeah, I cashed out I think Algebra II in trigonometry like the Reagan era. So you write also that regimes that run age verification through the government would allow prosecutors to make children federal criminals if they lie about their age. Oh, this was fun. So I forgot about this one just because it was only in one bill and that was the Shats bill that protecting kids online. And I do respect Shats a lot. I think he's trying to do the right thing. And I think he's, I don't think he's doing it right but I think he's trying. And a lot of what I've seen that he's saying, I kind of respect more than I do from other elected officials, but it's really bad.  So I looked into this and it's whether- So if you say I am not a robot and you are a robot when you're checking- I wonder, I wonder if you can prosecute a robot. The robots, you know? Somebody's gotta take care of them, they're a problem. He thought maybe as a better way to protect data that it would be better for the government to handle age verification. But that means if kids lie to that entity, whether it's to run through a government contractor or an agency, you can be a federal criminal because you're lying to the government. And sure, we don't prosecute kids a lot, but like government sometimes starts enforcing stuff that it didn't use to enforce. And you don't wanna add a new law to the books that makes it possible for kids to become federal criminals for trying to log into YouTube. That's not wise policy. Right. At the same time, services should be free to kind of demand whatever they want. Sure, yeah. Yeah, no, I agree with it. I don't like when they want a lot of my information, but if that's what they want, they can suffer the business concept. I was, you know, for people watching this on video, they may have seen I was drinking out of a 7-Eleven cup and I went to 7-Eleven to get coffee this morning and they asked for my phone number. And I was like, no, I don't wanna give you phone number. And I was going to walk away like if they were like, you can't buy coffee unless you give your phone number. And they were like, okay. So yeah, it was, it's interesting though, like what, you know, and I understand why they're doing that. And I also understand the power of getting more personal information, you know, it does allow the internet. I mean, one of the things that sites can do more than regular businesses, it's tailor more stuff directly to you, but you know, that's a negotiation. Totally, yeah. And you have some say there and it's not mandatory. And some companies realize that users don't want that so they try to step away. With age verification systems, and you mentioned Neopets, my younger son, I guess was really big into Club Penguin, which was. Oh, that's fun. Yeah. And it no longer exists. I believe it was, it ultimately was owned by Disney or something like that, but it was kind of a social media, you know, a walled garden, you know, a very walled garden for kids to just to do stuff and interact and have, you know, online adventures. Were there services that did, or do a really good job, you know, that are directed towards kids that protect that? And, you know, are there examples to be learned there from how we might change the way kids interact with the internet? Yeah, I like Neopets a lot. I actually made a few internet friends and my friends were into it. And like, I forget the names of them and they're dead now. They're all dead. I like haven't fed them in so long. They're like, I have, I haven't even dug their grave. You better hope they're dead. Yeah, oh my gosh. They're gonna be really angry. But I liked the way Neopets operated. I always felt pretty safe on there. I'm sure they could have actually done some more nudges like, hey, remember not to give up personal information to strangers or whatever, but overall they did good in Club Penguin was a really good example because I remember the big trend of trying to get banned from Club Penguin, but like they did a good job of banning people being inappropriate and then it became a meme. So it was a bit of a barbarous try sand effect. I know Instagram wanted to do Instagram kids and then everyone flipped out over it. So they couldn't, but I actually think that's a good idea. Some like safer areas where you still warn kids about stuff, but maybe there's a little bit less risk for them. I think that's like- And I guess Amazon has, you know, on Kindle Fires and stuff like they have certain kinds of, you know, again, they're kind of like playgrounds, right? And playgrounds are good because kids are safe in them, but then they also can draw creeps, right? Because hey, there's only kids there. But why is it, what's the role of the companies here? You know, broadly, people who are offering goods and services, have they fallen down on their job to kind of proactively preempt this type of legislation? You know, or what do they need to be doing better? Yeah, I think the big thing is that they should be coordinating to make parental controls easier. Genuinely, I think that's the big lesson here. I'm not sure it would have stopped the legislation even, but I know parents are sometimes overwhelmed by all the choices, but it would be nice if parents had like one set of controls that made it a little bit easier because you can't have device-level filters, platform-level filters, app store filters, but it would be nice to give something to parents that's a little bit easier here just to manage, just to show them how stuff works because just like with any technology, it gets complex. Like I'm online way too much, so I know how all this stuff works, but make it easier for parents. I'm not sure that companies have exactly failed, but they really could be doing better. And part of this is a kind of a public relations war because I know in the, again, going back to the 90s, when cable TV didn't really become a fully national phenomenon until the late 80s and the early 90s, and then under Bill Clinton, Janet Reno, the attorney general went on a jihad against cable TV because it was showing too much sex and violence. And it's like, it obviously wasn't, but out of these sets of concerns came things like the V-chip, which was a technology mandated into every new TV. And then the idea was that we're gonna write TV programs and then parents will set their TVs to certain levels so the kids can't plug it. Nobody used it. And I guess my point is that there's nothing industry could have done. That was a tidal wave coming because, it seems like companies now could do a better job of combating the negativity. But they seem, they're part of the problem, aren't they? Excuse me, both in terms of not seeming to care, maybe, maybe not, but also colluding with the government. I mean, one of the things that is very different now than the 90s is in the wake of revelations about Twitter and Facebook and other companies, really not just relying on the government or rolling over for the government, but asking the government to say, hey, will you moderate our content? Yeah.  I mean, it's regulatory capture and they know what they're doing violates the First Amendment, but it benefits their business. I do understand on a level like you're a business, like your job isn't always to fight for freedom, but at the very least, you shouldn't be proactively fighting against freedom. I get if government pressures you too much, you might have to roll over a bit, but rolling over is different than what a lot of these companies are doing. I was very grossed out by like how Snapchat and Facebook were just like, oh, please regulate us and put it sort of on other people, not exactly us. And it's just silly. Snapchat, I also personally have never had a lot of respect for. They used to tell politicians to go on Snapchat and that's where the kids are. They knew that's not where you're gonna reach people for politics. That was just not ethical business.


The next talk is going to be beyond your cable modem How not to do docks his networks? Sorry, I'm not a hardware guy but Alexander Graf is gonna hold a talk and he's done a lot on virtualization and stuff other people think is too complicated and now he's gonna talk about The outside of your apartment give him a warm welcome Hi and welcome to my talk beyond your cable modem This is gonna look at what's beyond the stuff you usually see at home where you just plug in a network cable and well You happen to have internet available So who am I? I'm Alexander Graf. I'm usually more of a virtualization developer. I have nothing to do with hacking in my day work I don't usually go around and hack embedded devices usually at least But during the last year I had a lot of spare time at night because the baby was crying So I figured could as well spend that time and do something useful So what happened? We moved to a new home. So I was living in a home where I had DSL available I had a real phone line. Everything was great Things were just awesome, but then we moved into this new home where Where there was no DSL available. Well, there was these elevable. There were different circumstances Why couldn't use it so? Instead I figured you know what try this cool new technology Internet over your cable TV cable TV cable So I got myself a cable modem from the provider got myself registered and now had internet over cable TV Also on the same time or along the same lines I figured why not go and also do your phone line over that cable provider with your old phone numbers So that people still can contact you when they want to Now the thing is the when I finally received the whole package. I realized whoa wait some things some things wrong here That's an analog phone line. Are we like in 2015 or is it 1994? So instead of the usual digital stuff that I'm used to I just got myself a analog phone line So I had to put myself another box in there that would convert the analog phone line back to a digital phone line So I could route it in my house to another line to another machine that would then go and router to my phone You see the problem in there? Yeah, that that whole stuff over there just doesn't look right right you why would you go and convert something? It's obviously digital. I mean the stuff that goes into your cable is obviously digital right kind of obvious And and convert it back to analog and then back to digital just to be able to do a phone call So I called up the technicians support and said hey guys, you know what? Isn't there a way I can like directly access whatever you have there and go and use Digital throughout and the guy said well, you know what actually behind the scenes. We're all just running SIP It's just a normal SIP server. There's not just normal voice of IP. That's something special about it. So If you know what you're doing just go ahead and connect to it challenge accepted So what we learned from Felix earlier in this Car talk was what do you do when you don't want to break your own system? Of course you buy a new one on eBay. They're really cheap. Just go and get a cable modem and then you can go away and well Treated with a kind of laugh that you want the device to be treated with Turns out my modem is actually just running Linux. Oh nice. It fits me pretty well And it's just a normal arm system. Well, the only special thing is this big Indian But then again, I'm kind of used to arm by now Why not just go away and like go around and just look at how this thing works? And well, we really just want to get this voice of IP stuff working So take a look at how this voice IP stuff works on the on the device turns out There's actually a normal SIP SIP works on port 50 50 60 usually Normal SIP client running on there But this IP looks weird So my external IP looks different and my internal IPs all look different and so so what where does this IP come from? So I looked at the IP list of my device and figured well, wait some things some things weird I have a lot of IPs in there and connections that I really don't know anything about hmm So down here is obviously my phone line and Up here is something else that I have no idea. Oh, sorry something else that I have no idea Well, this is about so I figured, you know, let's go and dig a bit deeper and see what's actually happening there So how does docsis work? Just this is just a like small introduction and like high-level introduction and how are they rooting ones? So basically you have your cable modem that is connected using your TV cable line to a cmts just a translation service that then Takes all of the docsis specific stuff and just basically gives you an IP routing over into something something something behind it However, it doesn't just give you one line. It actually gives you three gives you one line for your internet Make sense, right? You want to get online? That's the one you actually see when you plug into the device It also gives you another line for voice of IP and it gives you one more line that I would call the admin line It's the provisioning line Now let's start with the admin line that that sounds the most interesting, right? But what does the admin line do well? In the end the modem in the docsis network is just a normal client like in your ethernet network So the first thing it does when it gets online is what does it DHCP request and DHCP request it goes and gets an IP address and gets all the information it needs and it also Well, it's kind of same. It's just a normal DHCP request it also However, gets something similar to pixie booting where it gets usually in pixie booting you would get an executable that you would run Here you get something different here. You also get a file that you need to download using TFTP just like with pixie However, in this case, it's a configuration file configuration file that you just received using pixie to your cable modem and then the cable modem is configured Now what is inside this provisioning file? That's what they call it. Well, that's interesting information like What is your firmware update file name called if you want to update your firmware or if the provider wants to have you update your firmware? How much bandwidth do I have I? Hear people have been playing with that one and Well, since it's just a normal TFTP request you can just do it yourself, too This is my configuration. You just go get it and you have your configuration file Now the interesting thing that I realized when I first started doing this was well Sure, this is my configuration file, but what about configuration files from other people? Well, you go and get the MAC address if you have the MAC address you just go and get it and there you go You have the other people's configuration file Easiest that right that's that's the way it's supposed to work The actual effects of that we're gonna come to that later So let's just declare TFTP the whole access to that as slightly insecure for now But now now if you're if you're an ISP you want to monitor what your people do, right? So imagine you're the admin there you just imagine you're one of the good guys, right? And you want to see what are those people on your modem doing? Are they like downloading too much contents because you obviously cannot filter or find that out from the other side Um, so what do you do? Well, you obviously send the industry standard for that an SNMP request Using a password that only you know Send it over to the cable modem and the cable modem then goes in and replies with the respective reply saying oh, yeah Sure, I'm I got this piece of information. There you go. You have it. Um, oh that was too quick So, um, but how does? How does your modem actually verify that password? Yeah, you guessed right using the provisioning file obviously so Once you don't know the provisioning file from any random modem in there including yours You end up getting an interesting password All right However, what one they actually did at least one thing they are limited the address range you allow to access those devices on Yeah As a hint for those who did not clap This means everybody who's in that network, but but how big is this network? So I figured you know why not just give it a try and ask some people in Hanover whether I could just get their Mac addresses and See you, you know how far I could get just send an SNMP request over I had the password now, right? and ask that modem Please tell me everything you know and Did reply There's a lot of interesting information as MP. You wouldn't believe it. So this is obviously just General stuff like oh, yeah, and this and that modem, but there's more in there That's for example, and this is my public IP address in case you're searching for someone specific or These are my internal Mac addresses IP addresses in case you're searching for some specific notebook then someone stole from you also or This is my provisioning file in case you just happen to port scan all of the machines out there and ask them using the same password that they all share on What their provisioning files could be called? Hmm, of course, I never did that, right? So well, I would say the whole SNMP story isn't really all that secure either Yeah But at a certain point in time like when the modem actually doesn't work Like the way you would envision it to be or if you just need to do more administrative stuff The admin wants to have more access and just SNMP, right? It's just kind of isolated to a few specific pieces of information Yeah, you want some more hardcore access like we'll go down into a real shell How do you do shells in 2015? Tell me exactly We'll actually get to the point where talent was a good idea later, but um, that's 30 slides down or so So well, we already managed to get an SNMP connection working to a different modem Let's let's just try the same with talent and see you know where how far we can get well we can go in and Just turn it in and it replies and says please give me a login Hmm now where where do I get this login from? Turns out the administrator needs to provide that password just the same to the modem which needs to verify it Based on configuration, which it gets from the provisioning file that I think you see the point So in the same provisioning file that you can obviously again download for every single user in the network You also have the password in plaintext That's the part that actually took me the longest in this whole thing I spent weeks trying to figure out what hash this is So if we try to log into the server using those credentials we got Yeah, we get greeted with a nice commander interface for poor mr. Admin at our provider site, but I don't really like those Like boiled down interfaces. I want a real shell. I don't want to load kernel modules I want to filter all my network traffic. I want to reroute everything that modem does to indifferent machine. I want to Rewrite the voice of IP client here instead do either way So I want to do something real right, so let's do the help command and it tells us that there's a cool command called shell Oh, yeah, there we go. Good a shell So by now at that point I can actually go and do anything I want with that modem.  It's a good idea, right? So I now got shell access so I can do anything I want I can reroute all your traffic I can well, I don't obviously but this is this was basically where we were at half a year ago Another thing to note is that since it's so annoying to generate different passwords for different devices Yeah, yeah, I know You just use one password for all right.  We do the firmware and they just don't like to enable talent Apparently there are people in there in that company that actually know what they're doing so Well, I would say the whole tenant access thing isn't exactly I wouldn't market secure either But we didn't really come here for the admin network, right? It was just it's happened to be around. I just looked at it and We wanted to go and do voice of IP Yeah, so how does voice of IP look like well? It's kind of similar. It also does a DHCP request in the beginning DHCP is usually fine. I Mark it with a green tick here. It's Yeah, I'll leave it to others to further dig down into that part It does the same TFTP bit so if you just go and instead of downloading your provisioning file from your own modem into like From from a modem from from the run from the admin network You just go and get it from the other part from the other Mac address and they go you have it Nicely enough all those cable providers Registered consecutive Mac addresses. So if you have one you also have the others Yeah You basically just ask a friend give me your Mac address that's written on the box and you basically have everything you need SNMP is the same thing you can access it using SNMP the really nice thing about SNMP here is that the box also tells you the other Excesses it has so if you only have one IP address or They also have a nice DNS service internally that tells you what the whole IP address is to a certain Mac address So you just ask the DNS for the Mac address of the modem of the voice of IP access then you go and SNMP access the Go SNMP if ask it for the IP address of the admin network and they go you in the box However the really interesting bit on the voice of IP network is SIP since we're doing voice of IP, right? That's that's what the whole thing is about So voice of IP basically works your the way that your modem wants to go and do a phone call So how do you do a phone call with SIP? You know you need to provide data like credentials like tell the modem tell the other side the server How you authenticate yourself which obviously is written in your provisioning file So you use those you tell the server. I want to do a phone call and they go you do a phone call now if we look at this provisioning file you can see that it contains your server and your user name and your phone number and your basically everything you would need to Lock in and tune SIP server now since I can read anybody else's provisioning files Hmm so So imagine I'm this user up there, right and I'm just doing a normal call as this phone number up there. Well Maybe there's this other guy in the network who just goes in and downloads your provisioning file and Oh, it gets all the credentials he would need so he gets the same phone number and then he can just go and do a call Hmm Yeah, maybe I should have registered a few zero nine hundred numbers Now the really interesting part there is what it also works the other way you register for it And if you're the fastest one registering it The other modem Well, it doesn't get the chance to receive calls Which means now you receive the calls and then you can just tell the other modem that there was a call Just that by now you actually route all the traffic through your modem and you can listen to all the voice data that there is on the line Hey Yeah Not sure it would be a good idea to talk to your lawyer around either the way Using this line for secure stuff is probably not the best. I wouldn't mark SIP as secure on this thing either But at this point so so on the on the Talonet access and on all the other parts. I was like sure I can I can fix it for myself I'm an egoist right I can fix it for myself. I don't care about the rest of mankind. I do but I can claim that So I can just as well ignore all the others and say I fix it for myself But for voice of IP I can't because I'm completely out of the loop this this other guy He could just go and steal my credentials because he can And there's nothing I can do about it. So at that point I was kind of scared that someone would be able to hack me So I started to think about how to fix this thing Now the first thing that comes to mind is obviously you go and you as a user go and pick up the phone and call the Service line from your provider Yeah, I don't think that's a good idea No, no, I didn't didn't want to go down that road. Nah, so instead I figured I'm gonna call someone else I'm gonna call a couple friends I'm gonna call a couple friends from from hyzer. Thanks to my Linux work. I knew a few of those and They also tend to do security which kind of falls into this whole thing and use them as a proxy. So that Nobody could actually go and sue me until things were public Hmm. So imagine what what the provider would do when he hears that I hacked into that telnet account Sure, you do the obvious thing you replace telnet with SSH, right? It's it's what everybody would do. It's the first thing you look at this and think like oh my god This is 2015. Why would you be doing telnet? Well, the answer is pretty simple um Take a look again. It's it's not as as simple as you think it's take a look at again This is provisioning file SSH actually gets different credentials So the SSH credentials are actually down here and the password is different from the one on the top I don't know what the password is, but I can tell you that the password hash is really cool So the password hash is something that comes from VX works So I'm pretty sure that there are more devices out there that might be interesting to look at The VX works hash basically works in a really simple way it creates a checksum of your input That lies somewhere between those two numbers and then creates a fancy string out of them based on some heuristics, but essentially the whole password down there boils down to just a single number that's Basically in a realistic case the upper limit is 40 characters. So you're not going to see a password that long Realistically, you basically check around 100 passwords and any any hash out there any password that's available. You're already corrected Which means there are so many collisions in this hash, which I wouldn't even call a hash That I don't know what the original password is like. I don't know, but this one works pretty well So go ahead and we lock into this machine and we type in our collision and yeah, yeah, there you go You got the same thing as before So we told them again guys look, it's not as easy as that you should probably take a bit deeper breath and take a look at How things actually are broken Which turns out they did so what happened next we had this whole Huge mess with lots of services that are all available all attackable and everything's just horribly broken That was two months ago Yeah, there were some circumstances why we just couldn't tell them earlier And in that we basically told them guys, you know in two months time We're gonna do a talk here and everything's gonna be public. So you might want to fix your network until then So the first thing that it is I ended added a check to their TFTP server to verify whether you actually eligible to download this provisioning file So now you can only download your own provisioning files, which is great finally I mean, this is the obvious thing to do. So that one's fixed Then they got went ahead and said well, there's no real reason why one modem should do SNMP traffic with another So they just added a firewall saying we're blocking SNMP traffic between different machines Problem solved the same for this age. They went ahead and said there's no reason why you should be teaching Why you should be doing TCP between one modem and another? problem solved and because the Voice of IP access credentials are actually part of your provisioning file Which you can now no longer download from somebody else That one's fixed to awesome so Go ahead. Go ahead clap. It's awesome Thank you ISP. So after two months actually managed to Limit me into the borders that I was supposed to be in the beginning. It's cool. So what do you have? Please God, your networks even if you believe that somebody couldn't go in they probably will because as soon as a customer can Access your device physically, which well kind of happens to be the case with a modem that's sitting in your department in your apartment That guy can access your network. There's no way you can you can prevent it. So Don't believe that the border of your network is the home The border of your network is the cable going into that home The same way goes the other way around if an ISP gets your device don't trust that thing Seriously, they can do anything. They're like and sometimes somebody else can do So in this case according to my provider, I was able to access three million devices Quite some number also the press is your friend if you are afraid of revealing something Tell someone who can do it for you and Usually things go out well Let's hope for the best and then this whole thing went online beginning of the week and There were a couple of questions on the phones that I read and I just wanted to take the time to reply to those So first thing that always comes up is is this a conspiracy like oh my god.  They have their own front doors. They don't need the back doors This this really is just a case of if we don't secure things. It's going to be easier for us Yeah, it was easier for everybody Including the ones who shouldn't have access So no, this is not a conspiracy. This is not some back door from some agency This is really just a matter of a company not doing their homework. The same thing goes for other providers My cable just wasn't long enough to connect to some other country So I don't know. I don't know where their other doxus networks are affected from the best of my knowledge Yes, they are. I'm not allowed to tell you to check But if you happen to have that idea on your own No animals were hurt during the production of this movie All the passwords were changed So if you happen to know the real passwords you probably had a good laugh during the presentation If you don't know the real passwords, they're different To the best of my knowledge all of that knowledge that I just gave you is completely useless to you because all the Issues are fixed Thank you So now we can go for questions if you like so please or you go ahead and announce it so if you have questions run towards a microphone and Stand behind it visibly The first one was on number four Yeah, you were talking about Taking a couple of weeks to get to know that it was the password wasn't hashed by plaintext So how long did this whole exchange In total go on How how how much face bombing and how many hours did it take for you? So I didn't spend full time on it. I really literally just whenever the baby was crying I just went up and figured I can do something It's not I Basically got cable access two years ago I first got into the modem about one year ago, I think that's when I started looking for real and Well, it's a I basically ended up digging deeper and deeper right it's it's not like voice of IP for example I only realized the whole voice of IP story in say August or so since I just didn't look before I was like so excited to see all the other bits Just didn't look Now number one, please Are you really sure that the TFTP? Professioning file fetching is secure now because do they do some Mac integrity tests or Mac spoofing and The problem is the law right I'm not allowed to tell you to try it yourself I'm not allowed to tell you that I don't think that anything on the physical layer is insecure I'm not allowed to tell you that I mean there's so many things. I'm not allowed to tell you about this whole network. I Haven't tried I Really just went in and said TFTP fetch and see whether I can get it Number seven up there on the balcony Hello, my question is in the beginning and your config files. I think there was something about Traffic priority or network priority as well. Did you play around with that one as well? Is that something about net neutrality? Maybe? That's an interesting. Okay, so it's not about net neutrality at all. It's about qs of different services so they basically say that voice of IP traffic gets Higher priority than the other bits since you want to have low latency on voice of IP traffic, obviously So there's nothing with net neutrality in this thing at all. I did play around with those settings just because Coincidentally right the day after the far plan got released my account got throttled to 80 kilobits. I Don't know why it could be related could maybe not but I figured I'm paying for a hundred megabits, so I should probably get a hundred megabits and Started to look at those things. I did not manage to actually convince my modem to get me more Did you change the bandwidth in the settings? Yeah, no dialogues, please. I did change the bandwidth It's not My guess is they're also qs'ing on the other side, but if you want to verify it. I'm not telling you not to Number two, please. Yes. So at first. Thank you for the nice insights. I am a capital user So I'm interested here and I want to again make a statement on the provisioning file You should have told them that a provisioning file Fetching in this way isn't the good idea anyway And I personally would believe if they do not scan transfer it via a completely different panel It will not get really secure They cannot do it differently because it's part of the part of the standard There's a doctor standard which all the modems have to adhere to and that's part of the standard They cannot do it differently if you want to have it done differently You have to tell the doctor's standardization committee, which is in India Now we'll have a question from the internet Could two modems be programmed to talk among themselves directly bypassing the ISP firewall Say it again Could two modems be programmed to talk among themselves directly bypassing the ISP firewall You mean with a new scheme over the old scheme with the old scheme It was just available. You could just go and route through it with a new scheme You not with the official modems Number eight on the balcony Did you find any traces of TR-69 in this thing? I did in On the AVM boxes that were secure. Yeah, so that was the only bit that actually ended up making a lot of sense TR-69 is a pretty nice standard. You basically have authenticated I think was even HTTPS traffic that basically goes and pokes the server to get you a firmware update It it's a perfectly nice way of provisioning such a system. It's definitely a lot different from the usual way So on those text boxes modems the usual way to tell it to get a new Filmware is either to tell it to reboot and get a new file from the provisioning server or to just poke directly to SNMP Tell it go to this TFDP server over there with this file name and flash it onto your flash No, I have not tried to spoof the privileged IP address range Now it's number four again The question I have is When you tried first contact them via hyzer Was there any Way, they might have tried to convince you to not to the talk and if so would there be an H on your head They did not try in any way whatsoever Zero do you think that was due to the credibility or do you think they thought of we screwed up? I don't know I Don't think they thought any other way would work at that point in time since the press is already involved They're not gonna pull back their story There's nothing else they can do Thank you again Forehand the microphone. Do you want to do the entire? 24 remaining minutes Q&A or do you want to put a limit to it? No, I think 24 minutes Q&A is fine We can always cap it later on right it's The internet again How much of this would be possible would have been possible if the modem had been in bridge mode my modem was in bridge mode and number six Do you have an idea how long this has been that way and do you have any specific reasons to believe? What? proportion of what group of people might have abused these these problems So I don't know since I did not see anybody else on the network But it's really hard to see somebody in a sea of the million devices. I Am not aware of anybody exploiting this So I can only stay state what voter phone said and they said that nobody else did exploit those problems According as far as time and I believe them on that one actually it's it's I don't think anybody did which is surprising since This whole stuff was kind of obvious But apparently nobody thought of digging into their modem before the one thing that About the timing is Apparently they already covered dutchland basically already does internet for 10 years by now and there's very little reason to believe It's been different in the beginning So it was probably vulnerable for about 10 years That said in the beginning they were not even using docsis 3 which did not really do real encryption So at the end of the day you could just do whatever any race on the network Back in the day right now. It's only halfway complicated Now in number one Yeah, thank you for the talk to So it's completely possible that They may have not found out that somebody else accesses before and Maybe already flashed a lot of devices with another firmware Which is still listening to his commands in the with the new setup because he changed the firmware They did the they did not okay They did update the firmware at that one point in time when I showed that they switched SSH They did not change the firmware ever since so all the service that I was talking about they are still running on your modem Okay But they can't be sure that there is another firmware by somebody else on Routes running now if somebody else may be for sort of making a botnet Before all this came up in the last five years or ten years And and already controlled some devices and they can't be sure that their current firm is now running on those devices There can be still devices somewhere Controlled by somebody else sure I mean you have to obviously fake all the information They receive from the modem pretty well. Otherwise, they get you onto the security block that I'm on but If you do that correctly you can probably just replace all the firm pieces of filmware Just ignore all the updates and try to behave the same way as they would expect and hope that nobody finds out It's entirely possible. I don't think it's very likely, but it's definitely entirely possible. Let's hope there are no more networks like this one Usually there are no second questions. So We still got comfortable time, but try to limit yourself to one question Now it's number two Have you tried to change your Mac address on the doxus level also for the DHCP request or how do they do? Authentication of the modem in the network. So the authentication works using certificates I'm actually not sure I haven't read the standard on that side whether the Mac address is part of the certificate. I don't know If it's not you can easily just change it. I haven't tried But then again the modems are what eight euros number seven What other what other? What other recommendations do you have if someone were to have a suspicion about a vulnerability? For the research part and for the disclosure part What do you have to do? Well, I can't give you any legal or any advice on that one. I can tell you that Getting somebody involved that has done this before is a really smart idea Because they've gone through a lot of pain points The press is even better because they have a really really big lever Nobody wants to be in the press for two months or whatever just on negative news that There was somebody who was legitimately trying to tell them to improve the network and they sued them So there's a really good chance that going via the press is going to keep problems away from you But there's no guarantee I cannot give you real. I mean legal or any coherent advice on that one I would I mean if I would find such a thing again, I would definitely go the same route I would just call up hyzer and tell them and It went pretty smoothly And I mean though the really cool thing is they actually listen to the press if I had gone to the service They would have just said sorry. I wrong number. I can't help you know the internet How did you obtain the original data do you use jpec or dump the device firmware and run virtualized? Not sure how much of that I should actually tell everybody Let's say I Replaced you can actually see this on this on the slide, right?  There it is Okay, so I got a picture of the modem here There you go. So What what you can see here down the right and the yellow cables those are the serial port And the ID cable up there. That's where the flash chip was you before I started Filling with a modem now the flash chip is actually in that socket up there Which means I could swap the flash chip between a device I own Beaglebomb black for example as a really nice spy interface that you could just use to write those And then plug it back into the modem so I could replace the firmware and get myself an initial shell As I mentioned earlier, I really do not like to lose internet access So this is not the modem that I was actually using of at home Instead I just used that modem to fetch a firmware image so I could then look at See whether there might be other bugs that you could use No number eight Earlier you've said that Who was it fritz box was more secure and they didn't have the same vulnerabilities You think they simply didn't use hard-coded passwords and stuff So do you think they would be Vulnerable to similar attacks and that someone probably like you wouldn't tell them But maybe they should look into it or do you think it isn't possible and someone should like prove you wrong From all I can tell but this is I mean just a gut feeling that I get from looking at the different firmware files the usual way at least the Linux based firmware works on the assistance is that there's Ti creating a BSP then they give it out to Motorola the Motorola gives it out to CBN then CBN gives it out to To Kabul, Deutschland and then each party of those adds a few pieces of stuff That's the usual way it works in those those devices Whereas in the AVM boxes things looked vastly different. There was one firmware image that even contained formation for some Austrian provider so instead of giving Like full control to the cable provider AVM kept control on their own and Actually audited the stuff they were doing That's the major difference One more question from the internet Do you know if they still use unencrypted zip? Oh, yeah Yeah, there's nothing Nothing in the protocols changed at all whatsoever. They really just added a few firewalls So once you're on the physical layer, you can read everything. You're like, yeah Well, and you break through the doc's encryption obviously Now then newly adjusted number two Thank you Mine is not so much a question as I'd like to add some insight and perspective to this I have myself worked for several ISPs and The week I've actually worked for an ISP that had not this particular issue, but a similar issue and The the way that it was fixed and you can look me up. I've worked for several ISPs You don't know which one had this problem, but what? What there was actually the actually the fix was a simple IP check So once you downloaded the tip from the tip to piece over It was just checked if you did it from the IP that was suspected. So This issue may actually be reproducible if you can somehow get hold of an IP you weren't supposed to have Like say spoof Mac address or something like that That being said I would like to attach a comment to the the whole zip thing You indicated that it would be possible to silently intercept Conversations which is not necessarily the issue because many sip servers can be configured to allow multiple endpoints. So as the The what you call the bad guy would be able to pick up your calls You would also hear your phone calling yourself, right? And if your phone picks up within 0.0 and one microseconds, then yeah, that's nothing you can do about it It just rings again That's that's the point about it also the other bit that you have on the on the sip server is that That particular server actually only allowed one endpoint to be registered at a time at least from what I could tell was some Huawei box Number three, please Yeah, I intended this talk today because I know that At the beginning when doxies was introduced the modem were asking for the configuration file all over the ethernet ports Which is great and My question is Is there way within the doxies standard so that the ISP can verify their hardware? I mean you you have seen I've seen the The type and the vendor name and the SNMP, but you cannot live obviously spoofed that Of course firmware binaries won't run on the wrong hardware but I'm not quite sure I'm getting what you the question is is the weight control for the ISP Which hardware there is they are using So so I come from a virtualization background and in my world. There's no such such thing. Okay exist If you if you can somehow abstract it you can abstract it Okay Eight, please Hi I wanted to add on the part with the max goofing because I had a modem like that like five years ago And I actually I never went inside the modem But I had some applications where I needed a new IP address in a short period of time And I remember that actually the thing if you you told the modem your IP You're a MAC address a different MAC address. You've got different external IP addresses back then I don't know if things have changed because it was five years ago, but Yeah, after what I've heard from you. I'm kind of unsure that things changed No, I'm fairly sure this is actually accurate from what I understand. I never did that myself But I heard from people who did The MAC address check and the certificate check are actually separate So that if you own a valid certificate from some random dude who happens to actually pay for the service Then and you get that certificate and you're not on the same CMTS as that guy then you can actually go and Well, basically say that you are him even if you have a different MAC address Which then again implies that if you change a MAC address, you can just be somebody else Which then again implies that maybe you can actually go and get somebody else for visioning thoughts. Yeah Yeah, well Not up to you. Not gonna try it out Number two, please. Yeah You have this one with one particular provider I happen to know that there's a second provider using the same technology in Germany Where they somehow involved in this loop? I mean it took Cabel Deutschland two months to fix this No, they better hurry up Quite frankly, I do not believe that this is limited to Germany at all whatsoever So, let's see who's faster All right end of questions right or is there looks like we're at the end of questions the internet maybe No internet doesn't have any questions. They're eight empty microphones. So Thank you very much for your talk and thank you very much for


I'm Salvatore Babonis and today's lecture is the emergence of world society. Background. Most macro sociologists tend to interpret the social world and theorize social problems either in realist terms or phenomenological terms. Realists emphasize the importance of material forces in shaping social change. Karl Marx said that all history is the history of class struggle. Friedrich Engels in the very first book on the sociology of the family said that the types of family in a society depends on the type of property ownership in that society and that capitalism lent itself to the nuclear family. Phenomenologists, on the other hand, emphasize the importance of norms and institutions in shaping social change. People like Emile Durkheim who said that social facts are real and real in their consequences Max Weber who studied different types of legitimacy as the bases of power. Most sociologists, most social scientists probably don't realize that they're either realists or phenomenologists but these meta-theoretical traditions of realism and phenomenology are embedded in the ways we approach the world whether we know it or not. World systems analysis is a macro realist approach to understanding and interpreting the social world. Macro realist meaning that it's a realist approach but at the macro level studying countries and global forces rather than micro level individual interactions. World systems analysts think that macro level material forces determine outcomes even at the micro level. So individuals, people's lives are shaped by their position in macro level social structures. There's a focus on systems for the allocation of material resources throughout the world and global social problems are understood as being driven by fundamentally coercive forces that reward bad behavior and penalize good behavior in the world. The focus of today's lecture however is the world society approach. World society theory is a macro phenomenological approach to interpreting the social world and theorizing social problems. Macro phenomenological meaning that like world systems analysis, world society theory is construed at the macro level of countries and global forces but it takes a phenomenological approach to understanding norms and institutions as the determinants of outcomes in the world. World society theorists tend to focus on international organizations nongovernmental organizations, NGOs, intergovernmental organizations, IGOs and multinational corporations, MNCs that shape, that are institutions that shape our social world and either cause or in many cases fight the social problems that we observe around us. In a world society view, global social problems are driven by institutional shortcomings that arise when institutions are not sufficiently robust to deal with the global challenges they face. World systems and world society approaches to macro sociology are best used in combination. They're really complementary instead of competing accounts of the world. Both realist and phenomenological forces are always at work and so we should always have an eye towards both. The appropriate question to ask in thinking about them is not which theory is right, it's which theory is most useful for understanding any particular social problem. For example, Europe is experiencing a massive influx of Syrian refugees. A world systems account might attribute Syrian refugees to regional conflicts over access to oil and other resources that have led to regional wars involving Iran, Russia, the US and Turkey in Syria's civil war. That's a realist approach that focuses on the material factors that have driven refugees out of Syria. A world society approach from a macro phenomenological standpoint would argue that the United Nations and other conflict resolution institutions have failed in their missions to provide safe homes for refugees within the region. There are institutional failures both on the part of the Syrian state in the first place and now on the part of the United Nations and the European Union that have led to uncontrolled refugee flows from Syria into Western Europe. World Society Theory World society approaches are most associated with the sociologist John Meyer whose original focus was actually comparative educational sociology. He identified the emergence of world society starting in the 1990s with the spread of internationalist norms and institutions, the importance of technical efficiency sometimes summed up in the term McDonaldization, individualism coupled with standardization, but most of all in the establishment of a world culture that is embraced worldwide or is at least embraced by elites worldwide of human rights, democracy and rule of law. Now John Meyer is an educational sociologist and so of course he saw educational institutions as being central to the spread of world society. People, university students in universities around the world learned to embrace norms of human rights, democracy and rule of law in their very coursework studying for university degrees. But he also saw an important role for professional associations. Organizations of accountants, lawyers, doctors of all kinds of professionals that have established codes of ethics and codes of conduct and tried to spread world society or world culture norms through professional practice to all parts of the world. He also saw mimesis as a major force shaping international norms, ideas and behaviors. Mimesis essentially just means copying. People mimic what they see in other countries. So if people in a developing country see successful models of economic development in the United States and Europe, they adopt institutions that are similar to those that exist in the United States and Europe hoping that by copying institutions they will also reap the benefits of economic development. World culture is not just an invention of sociologists. You might even say it was first invented by marketing people and only later spread to academia. It's certainly been embraced by media and the corporate sector. Cultural globalization is perhaps nowhere more obvious than in the famous Coca-Cola ad from the 1970s I'd like to teach the world to sing translated into I'd like to buy the world a Coke. Taking all of the kind of good feelings of helping the world and pouring them into Coca-Cola friendly consumerism. Not coincidentally, Coca-Cola was the first western product made available for sale in China after China's opening to the world in December 1978. It was very much viewed by Deng Xiaoping in the Chinese leadership as an emblem of world culture that they were accepting into China as they brought China into the rest of the world. Cultural globalization is a tendency towards a single universal world culture and that world culture, as I said, is a combination of universal norms of human rights, democracy and rule of law but also a celebration of diversity, localness and authenticity. Again, if you watch the Coke ad, I won't play it in this video because I'm not sure about the copyright propriety of doing so but I encourage you to watch the Coca-Cola ad referenced in this video and you will see a celebration of diversity in the faces of the people chosen to sing in the ad a celebration of localness in the Italian countryside in which the ad is filmed and certainly a celebration of authenticity. You will hear in the background the rising voice Coke, it's the real thing. So there is an attempt to leverage these emerging world society norms by a consumer products company as early as the 1970s, long before they became well understood and well accepted in academia. Of course, the dark side of cultural globalization is, ironically, the evisceration of diverse local authentic cultures as this world culture spreads to cover the entire world, it smothers pre-existing cultures. That's maybe nowhere more apparent than in today's Middle East and in the Muslim majority countries of the Middle East in particular where protests against the United States can be seen perhaps just as much as protests against world culture. There's nothing that ISIS, Islamic State in Iraq and Syria, dislikes more than human rights, democracy or the rule of law. The emerging world culture of the last 25 years embraces these three universal norms, human rights, democracy and rule of law. Global human rights norms are particularly strong and have come to be enshrined in a developing body of international law. This international law started with the foundation of the Red Cross in the 19th century and has really expanded in the late 20th and early 21st century to include a regular body of law in which you can now receive law training at the world's major law schools. Again, a form itself of education playing the role of spreading world culture. In recent years, these generic declarations of the 20th century have been turned into actual hard power projects in the end of the 20th and early 21st century, in particular the International Criminal Court where evil dictators and mass murderers can be brought to account in a special court in The Hague in the Netherlands for the crimes they commit against international law, usually against human rights. And the responsibility to protect doctrine, R2P, which was officially adopted unanimously by the United Nations in 2005, and the R2P has been understood as a, well, some say a responsibility to protect against genocide. The immediate cause of R2P was embarrassment over the genocide in Rwanda in the mid-1990s, which the international community did little to prevent or address. But the responsibility to protect has also been criticized as being a right to intervene. So on the one hand, R2P has been used as, has been considered a major accomplishment of international law by some. On the other hand, other people view it as a major transgression of international law because it gives countries an excuse to intervene in the internal affairs of other countries. Indices from the World Justice Project, an NGO, show the greatest protections for fundamental human rights in Europe, Canada, Australia, New Zealand, and Japan. On this map, the darkest countries have the highest respect for human rights. What you see in the United States is not listed in the top rank of countries. That's because of U.S. military action around the world and its associated spying operations and drone strikes. Similarly, most of the world's democracies have a European heritage. And here again, when we look at democracy ratings, this from the Politi4 project, we see North America, Western Europe, Australia, New Zealand, and Japan, and Mongolia having the highest ratings for democracy. And then when we look at rule of law, again we see the same usual candidates, North America, Western Europe, Australia, New Zealand, and Japan having the highest ratings for rule of law, again from the World Justice Project. From a world society perspective, these three world culture elements of human rights, democracy, and rule of law are being spread by voluntary, institutional, and normative diffusion, but it's impossible not to notice on those three maps that the countries that get the highest ratings are the western countries that have invented cultural globalization and that promote it most. So is it really a world culture of human rights, democracy, and rule of law that is being spread through voluntary diffusion? Or is it a western culture of human rights, democracy, and rule of law that is being imposed on other countries in the world through mechanisms like the International Criminal Court and the responsibility to protect? Answers to that question will vary enormously depending on who you ask. If you were to ask most socially conscious people in developed countries, are human rights, democracy, and rule of law good things that the West offers to the rest of the world, I think most people would say absolutely yes. Most people want these things and believe in spreading these ideals. However, the governments, and as far as we can tell, large majorities of the population in countries like China and Russia and Iran feel that these are western imperialist projects intended to change their internal structures against their will. And this reaction against western world society norms is especially strong in the Muslim majority countries of the Middle East, North Africa, and South Asia. Nonetheless, as education levels increase around the world, more and more people come to be aware of the unity of humankind, and values have been shifting. The most educated people, even in places like Russia, China, and the Muslim Middle East, are much more likely to embrace secular values and self-fulfillment values rather than traditional religious values and survival values. So the kinds of values associated with world society and with world society and world culture are the kinds of values that are being embraced by the most educated members of society in developing countries. And this is, of course, one reason why many people in developing countries are unhappy about education and westernization. It should be remembered that the Nigerian terrorist group Boko Haram chose a name that literally means western education should be or must be forbidden. So, you know, it's not surprising that many people in developing countries, especially many traditional people who embrace very foundational, survival values like the importance of the family and the importance of agriculture in the economy, that those sort of people might reject cultural globalization and world society. People all over the world, certainly educated people all over the world, want to mimic the perceived success of North America and the countries of European heritage. So even if they may not value democracy as such, they often see democracy as the only legitimate way for countries to make decisions. Thus the Communist Party of China is at pains to emphasize that China is a democratic country. Now, they have a different conception of democracy than most people in the West do, but nonetheless they insist on that value, on the idea that democracy is an important aspect of Chinese governments. The Chinese Communist Party also issues an annual human rights report on America in which the Chinese government evaluates American human rights deficits and claims that China respects human rights much more than the United States does. So rather than completely fighting world culture values like respect for human rights, democracy and rule of law, many countries, many developing country governance and elites actually take the more nuanced approach of embracing those norms but redefining them or attempting to redefine them according to their own ways of thinking. Now as John Mayer has consistently maintained, education plays an important role in the spread of world culture and world society and universities are at the peak level of this effort. The global spread of education over the last 50 years has been truly amazing. This is a map of average years of schooling in 1960 from our world in data. As you can see, most developed countries had levels of schooling where people went to school for maybe eight or nine years. In the rest of the world there were large swaths where people had virtually no schooling at all all across India, South Asia, the Middle East and Africa.  In North America, Western Europe, Australia, New Zealand, people have 10, 11, 12 years of education all across Latin America. People are more educated today than Westerners. People from North America and Western Europe typically were 50 years ago. The only places that remain with very low levels of education are conflict-ridden countries like Afghanistan and Niger. Still, education levels today are much lower than you might think. Fewer than 7% of the people in the world actually have university degrees. Developed countries today are about 40 years ahead of where developing countries are. If we look at this chart we can see almost a continuous line. If you were to look at today's developing countries and their levels of education in 1960 versus today, it's been rising rapidly over the last 40 years. In the same way, levels of education in developed countries have been rising rapidly. But the levels that developing countries have just reached in the 2000s are levels that prevailed in today's developed countries in the 1950s and 1960s. As you can see, the developing countries, even though they have made massive gains in education over the last 40 or 50 years, are still 40 or 50 years behind the advanced countries. Relative levels of education between developed and developing countries haven't budged. Everybody has simply become more educated. Ultimately, developing countries will catch up unless developed countries continue to expand in schooling. In fact, you might argue that developed countries are expanding not by having more and more years of education, but by improving education so that a person who graduates from high school or university in the future will know much more and have much greater skills than a person who graduates today. We don't know if that will happen, but past trends suggest that it very well might.  People get fundamentally the same education, whether they're in Europe, Australia, Russia, Japan, North America, or even in the elite universities of the Middle East, China and Africa. The quality differential is certainly there. But the type of education, the way education is done, is near identical. And a big reason for that is that the people teaching at universities in Africa, the Middle East, Russia, typically themselves got their own PhDs and their own advanced degrees in the United States or Western Europe. So there is a continuous flow of norms as people themselves flow from getting their education in the West to teaching in the East and the South of the world. Of course, English is increasingly the medium of instruction. All around the world, universities are switching from native language education to English language education. Students study the same majors. The typical academic menu that's available in the United States, Western Europe, or Australia is the same menu that has come to be available in the rest of the world. Even individual courses, individual units of study are highly standardized and becoming more so with the Bologna model, which is standardizing education across Europe and the Bologna model for higher education is being adopted by countries outside Europe to ensure their interoperability or transferability of credit with European universities. Students study abroad at very large rates. But I think the number one reason why education is becoming standardized globally is just that university lecturers are recruited globally. So there's a single population of Western educated lecturers who do the teaching at universities everywhere in the world. This is a major agent for the spread of world culture as elite university professors go back to their home countries with a frame of mind and a frame of reference that was gained in Europe or the United States or Australia. They then train the next generation of students coming up in their home countries in those Western norms. You've probably heard of Francis Fukuyama's famous claim in 1989 that it was the end of history, and this is actually very closely connected to education because the end of history did not mean the end of historical events. It meant the end of intellectual change in the world, that there would only be one ideology in the world going forward from 1989. Fukuyama made this argument at the time that the Soviet Union was collapsing and communism was coming to an end all around the world as an organized, ideological resistance to the West. What Fukuyama recognized was that the important fact of 1989 was not a military victory or a change in the balance of power. The important fact in 1989 was a restructuring of the world's ideological bases. Before 1990, many of the professors who went out to teach at universities in Africa and the Middle East and in Asia were not trained in Europe or America. Many of them were trained in the Soviet Union. In fact, in Moscow they still have several large institutions dedicated to training students from developing countries where students from developing countries can get scholarships to go visit in Moscow. They also have similar programs, although less popular, in China for students from developing countries. Before 1990, many countries in the world looked to Soviet and to a lesser extent to Chinese expertise for knowledge about how to run their economies and how to run their societies. That organized alternative, the Soviet model contrasting with the Anglo-American Western model, is no longer available. Today Russia still trains students from poor developing countries, but for the most part they're trained in a Western curriculum by Russian professors who themselves have PhDs from Western universities. The Soviet Union is gone, Russia is still there, and Russia is still there as a geopolitical power, but the ideological challenge posed by the Soviet Union is gone. Russia poses a physical challenge to other countries as shown in its interventions in Ukraine, in Georgia, in Moldova, in Syria, but Russia no longer poses an ideological challenge to the Western system. Not only does nobody want to be Russian or study Russian, it's much deeper than that. Russians themselves are not promoting an alternative ideological universe in contrast to world culture. They are demanding independence and sovereignty and they resist American aggression in the world, or at least claim to, but they make no claim to having a different knowledge system the way the Soviet Union did. And that's crucial because that's what's led to the victory of world culture, or you might think of it as Western culture, over all other cultures, because even though there are many local resistances, ISIS in Syria, Boko Haram in Nigeria, the Zapatista movement in central Mexico, these resistances are all disjointed in local. None of them represent a systematic global alternative to a Western world culture value system. Fuku Yama interpreted this end of history as what he called the emergence of a universal, homogeneous state consisting of liberal democracy combined with economic freedom. Liberal government, electoral democracy, a market economy, pretty much means, put together, human rights, democracy, and rule of law, at least in economic matters. He saw this as something that was becoming universal and homogeneous, meaning that it was spread throughout the world with no systematic differences between people of different races, different classes, different genders, that these are universal norms that would be applied universally to everybody. It may make a big difference in society whether you're black or white, female or male, but whether you're black or white, female or male, you get one vote in an election, you have the same legal human rights, and crucially for Fuku Yama, you're equal in the market. One person's dollar is as good as another's. It doesn't matter what color or gender you are. At least that was the theory that came from Fuku Yama with the universal, homogeneous state. Well, many people say it's not the end of history, and they point to China, Russia, and Islamic State as counter-examples, but those people, I think, misunderstand the main point. Fuku Yama did not say that events would cease to happen. He said that there would be only one ideology, and that in that ideology every person would be at least in principle equal. From a social problem standpoint, ideas of world culture may be homogeneous in principle, but are they universal in practice? That is, there is a, you know, homogeneous, there are homogeneous human rights. There's, you know, homogeneous democracies. There's certainly a homogeneous market in which anyone can participate who happens to have the money, no matter what their race, religion, or gender. But are these benefits universally available to everybody in practice? Well, you know, liberal government, you know, people's individual human rights are at risk even in the United States and other Anglo-Saxon countries. They're certainly non-operative in most countries of the world. Places like China and large parts of Latin America, ordinary people simply don't have the human rights that we take for granted in liberal countries of the West and Western Europe and North America. Electoral democracy is at risk from the increasing role of money in politics. Again, even in the most developed countries, like the United States and Western Europe, right now there are a series of nightly protests in Paris and all across France against the operation of France's democracy. And even though France is one of the most democratic countries in the world, nonetheless, people are unhappy with the conduct of their democracies. The rise of Donald Trump in the United States is evidence that people are unhappy with the quality of their democracies. If this is true in the United States and in France, imagine how compromised the quality of democracy is. Again, in countries like China and countries like Brazil where the current and previous presidents are both likely to be indicted for corruption, electoral democracy is hardly safe in most countries in the world. And finally, even the market economy is increasingly at risk from government intervention to protect corporations and investors. If you think about the things you buy in your daily life, the purchases you make, most of them are probably only available from monopolies or oligopolies, and those monopolies and oligopolies have very strong levels of government protection. Now, if you don't think that companies have strong government protections, just think about every single web service you sign up for or every airplane ticket you buy that has a long 10-page document that you have to click that you have read and understood the terms and conditions of those policies. Of course, you haven't read or understood the terms and conditions, but government will enforce corporations' rights over yours. And this puts the market economy ultimately at risk. Is it a free market or is it a market that is managed and manipulated by those who have much stronger political power than ordinary consumers?  The corporations that run the economy certainly have much more power in that economy than the consumers who buy from them. Global governance. An important aspect of world society theory is the centrality placed on global governance institutions. Institutions are increasingly governing the world without sovereign authority, meaning that without a mandate from the people, institutions are increasingly governing relationships that transcend national frontiers. Now this definition of global governance, institutions are increasingly governing without sovereign authority relationships that transcend national frontiers, is attributed to the US diplomat Lawrence Finkelstein who put it in his account of a United Nations meeting. And this is not actually published in a book, but it's become a very well-known definition. Institutions that do this, that govern trans-nationally, are known as global governance institutions. And we usually recognize three basic types of global governance institutions. IGOs, INGOs, and MNCs, intergovernmental organizations in which governments are the member, international non-government organizations, organizations like Amnesty International or World Wildlife Fund, and multinational corporations that, well, of course, you know dozens of those. IGOs are organizations that have governments as members. The best known is the United Nations. Others include the World Bank, the International Monetary Fund, the World Trade Organization. These are global IGOs in which almost all countries of the world are members. But there are also some smaller IGOs that are nonetheless influential. For example, the OECD, Organization for Economic Cooperation and Development, is a club of mostly western richer countries that has enormous influence on school curricula, on how education is measured, and on how the economy is measured. The Shanghai Cooperation Organization is an organization of Asian countries led by Russia and China that is very focused on security and anti-terrorism. Council of Europe, African Union, ASEAN, APEC, OAS, Arab League, et cetera, et cetera. There are dozens, well, hundreds of IGOs that have countries as members. The second, the most important IGOs are centered around the developed democracies of North America and Western Europe. So NATO, the European Union, the G7 are all leading intergovernmental organizations. Ingos or international NGOs are civil society organizations that have people or businesses as members. Most human rights organizations are INGOs, Amnesty Human Rights Wash, Red Cross Democracy Promotion Organizations, also tend to be NGOs, so the Carnegie Endowment, the Open Society Foundations, and many pro-business organizations or organizations of businesses like Chambers of Commerce, Transparency International, World Economic Forum are also Ingos. Most major global governance institutions, whether we're talking about IGOs, international non-government organizations, or multinational corporations, are based in and controlled by Euro-American people in countries. One view of these Ingos and other global governance institutions is that they're dedicated to doing good in the world. I mean, who doesn't like the World Wildlife Fund or who doesn't like the UN Refugee Agency or UNICEF? You know, they're doing great work and most people respect these organizations. But another view is that IGOs and Ingos are really front organizations that promote the agendas of the rich and powerful people and countries of the world. Do these NGOs and IGOs really have the interests of their clients at heart, that is of the poor and needy people of the world, or are they really driven by the desire to promote the views of their funders? In reality, Ingos and IGOs certainly are neocolonial, both for good and for bad. Most of us think it's a good thing to promote human rights in the world, but that's a neocolonial project. Most of us think neocolonialism is bad. Well, that's something that we have to reconcile for ourselves. Global governance institutions do great work that reduces human suffering, especially in countries that are failing their own people. It's fantastic that there are IGOs and NGOs that are willing to work with Syrian refugees to help them escape from the violence plaguing Syria today. On the other hand, IGOs and NGOs are undemocratic and unaccountable, and they impose Western values on their involuntary clients in poor countries. Think of NATO's involvement in Afghanistan, where NATO imposed a constitution that expanded rights for women and gave women seats in the Afghan parliament. Most of us in the West embrace women's rights and think that's wonderful, that Afghan women are no longer as severely discriminated against as they were under the Taliban. On the other hand, no one even asked Afghan women if what they wanted was emancipation. That's a value that Western organizations imposed on Afghanistan. Many of us believe, for good, I'm not condemning that imposition of Western values. I'm merely pointing out that for good or for bad, it's certainly a neocolonial imposition on countries whether they want it or not. From the standpoint of poor, vulnerable countries, even multinational corporations are in effect global governance infrastructures. In most of Africa and large parts of Latin America, governments don't have the capacity to build roads, to build telecommunications networks, to dig their own natural resources out of the ground. They depend on multinational corporations to do all the heavy lifting of providing infrastructure and exploiting resources. As a result, multinational corporations become de facto government agencies in these countries. In fact, many of them are much larger than the countries in which they operate, at least much larger in terms of revenues than the countries in which they operate. Put it all together, and global governance is more a web than a hierarchy, but it is a very hierarchical web. This web has thickened substantially since 1990, so the fall of the Soviet Union was definitely a watershed moment in history when Western-centered global governance institutions suddenly had a free field to run amok over the entire world, not just over the Western world. More and more organizations of many kinds are engaging in global governance that is governing without sovereign authority relationships that transcend national frontiers. But who controls global governance and who should control it? For what purposes should it be used? These are major challenges for us to grapple with when we think about the spread of world society. Key takeaways. First, the emergence of world society starting in the 1990s was driven by the spread of internationalist norms and institutions. Second, the three major elements of world culture are democracy, human rights, and the rule of law. And third, Francis Fukuyama saw the end of history as a universal, homogeneous state combining liberal democracy with economic freedoms. Thank you for listening. You can find out more about me at salvaturbabonus.com where you can also sign up for my monthly newsletter on international affairs.


Hello, my name is Joy Blomwini, founder of the Algorithmic Justice League, where we focus on creating a world with more inclusive and ethical AI systems. The way we do this is by running algorithmic audits to hold companies accountable. Also a point of code telling stories that make daughters of diasporas dream and sons of privilege pause. So today it's my pleasure to share with you a spoken word poem that's also an algorithmic audit called AI Ain't I a Woman. And it's a play on Sir Jernert Ruse's 19th century speech where she was advocating for women's rights asking for her humanity to be recognized. So we're going to ask AI if it recognizes the humanity of some of the most iconic women of color. You ready? My heart smiles as I bask in their legacies, knowing their lies have altered many destinies. In her eyes I see my mother's poise. In her face I glimpse my auntie's grace. In this case of deja vu, a 19th century question comes into view. In a time when Sir Jernert Ruse asked, ain't I a woman? Today we pose this question to new powers making bets on artificial intelligence hope towers. The Amazonians peek through windows blocking deep blues as faces increment scars. Old burns, new urns, collecting data, chronicling our past, often forgetting to deal with gender, race, and class. Again I ask, ain't I a woman? Face by face the answers seem uncertain. Young and old proud icons are dismissed. Can machines ever see my queens as I view them? Can machines ever see our grandmothers as we view them? Ida B. Wells, data science pioneer, hanging facts, stacking stats on the lynching of humanity, teaching truths hidden in data, each entry and omission, a person worthy of respect. Shirley Chisholm unbought and embossed the first black congresswoman, but not the first to be misunderstood by machines well versed in data driven mistakes. Michelle Obama unabashed and unafraid to wear her crown of history, yet her crown seems a mystery to systems unsure of her hair, a wig, a buffon, a toupee, maybe not. Are there no words for our braids and our locks? The sunny skin and relaxed hair make Oprah the first lady.  We laugh celebrating the successes of our sisters with Serena's smiles. No label is worthy of our beauty. So there you are. And so what you see in the poem I just shared which is also an algorithmic audit is a reflection of something I call the coded gaze. Now you might have heard of the white gaze, the male gaze, the post-colonial gaze, well to this lexicon. We add the coded gaze and it is a reflection of the priorities, the preferences, and also sometimes the prejudices of those who have the power to shape technology. So this is my term for algorithmic bias that can lead to exclusionary experiences or discriminatory practices. So let me show you how I first encountered the coded gaze. I was working on a project that used computer vision, didn't work on my face until I did something. I pulled out a white mask and then I was detected. So I wanted to know what was going on and I shared this story with a large audience using the TED platform over a million views and I thought somebody might check my claims. So let me check myself. And I took my TED profile image and ran it on the computer vision systems from many leading companies and I found some companies didn't detect my face at all. But the companies that did detect my face labeled me male. I'm not male. I'm a woman phenomenally. And so I wanted to know what was going on. Then I read a report coming from Georgetown law showing that one in two adults, over 130 million people, has their face in a face recognition network that can be searched unwarranted using algorithms that haven't even been audited for accuracy. And across the pond in the UK where they actually have been checking how these systems work, the numbers don't look so good. You have false match rates over 90% more than 2,400 innocent people being mismatched. And you even had a case where two innocent women were falsely matched with men. So some of the examples that I show in AI, anti-woman or the TED profile image, they have real world consequences. And because of the real world consequences, this is why I focused my MIT research on analyzing how accurate systems were when it came to detecting the gender of a particular face. And so with the research we're doing, it's been actually covered in more than 30 countries, more than 240 articles, talking about some of the issues with facial analysis technology. So in order to assess how well these systems actually work, I ran into a problem.  And so in machine learning, which are the techniques being used for computer vision, hence finding the pattern of a face, data is destiny. And right now, if we look at many of the training sets or even the benchmarks by which we judge progress, we find that there's an overrepresentation of men, 75% male, or this national benchmark from the US government, 80% lighter skin individuals.  So the first step was making a more inclusive data set, which we did called the pilot parliament's benchmark, which was better balanced by gender and skin type. The way we achieved better balance was by going to the UN women's website, and we got a list of the top ten nations in the world by their representation of women. Rwanda leading the way, progressive Nordic countries in there, and a few other African countries as well. We decided to focus on European countries and African countries to have a spread of skin types. So finally, with this more balanced data set, we could actually ask the question, how accurate are systems from companies like IBM, Microsoft, face plus plus leading billion dollar tech company in China used by the government when it comes to guessing the gender of a face? So what do we see? The numbers seem okay. 88 maybe get a B with IBM, 94%, Microsoft is the best case overall, and face plus plus is in the middle. Where it gets interesting is when we start to split it down. So when we evaluate the accuracy by gender, we see that all systems work better on male faces than female faces across the board. And then when we split it by skin type, again we're seeing these systems work better on lighter faces than darker faces. Then we did something that hadn't been done in the field before, which was doing an intersectional analysis barring from some of Kimberly Crenshaw's work on anti-discrimination law, which showed that if you only did single axis analysis, right, so if we only look at skin type, if we only look at gender, we're going to miss important trends. So taking inspiration from that work, we did this intersectional analysis. And this is what we found. For Microsoft, you might notice that for one group, there is flawless performance. Which group is this? The pale males for the win. And then you have not so flawless performance for other groups. So in this case, you're seeing that the darker skin females are around 80%. These were the good results. Let's look at the other companies. So now let's look at face plus plus. China has the data advantage, right? But the type of data matters. And so in this case, we're actually seeing that the better performance is on darker males marginally. Again, you have darker females with the worst performance. And now let's look at IBM. For IBM, lighter males take the lead again. Here you see that for lighter females, there's a disparity, right, between lighter males and lighter females. But lighter females actually have a better performance than darker males.  So this is why the intersectional analysis is important, because you're not going to get the full spectrum of what's going on if you only do single axis analysis. Now we took it even further and we disaggregated the results of the darker female, since that was the worst performing group. And this is what we got. We got air rates as high as 47% on a task that has been reduced to a binary. Gender's more complex than this. But the systems we tested used male and female labels, which means they would have a 50-50 shot of getting it right by just guessing. So for these systems, we're paying to do an audit that actually shows is marginally better than chance. So I thought the companies might want to know what was going on with their systems and I shared the research. IBM was by far the most responsive company, got back to us the day we shared the research and in fact released a new system when we shared the research publicly. So first, we gave the research privately to all of the companies and gave them some time to respond. So here you can see that there's a marked improvement from 2017 to 2018. So for everybody who watched my TED talk and said, isn't the reason you weren't detected because of physics, your skin reflectance, contrast, et cetera. The laws of physics did not change between December 2017 when I did the study and 2018 when they launched the new results. What did change was they made it a priority and we have to ask why. So this past summer, you actually had an investigative piece that showed that IBM reportedly secretly supplied the New York police department with surveillance tools that could analyze video footage by skin type, skin color in this case and also the kind of facial hair somebody had or the clothing that they were wearing. So enabling tools for racial profiling. And then for the New York Times, I wrote an op-ed talking about other dangers, use of facial analysis technology. So you have a company called HireView, for example, that says we can use verbal and nonverbal cues according to their marketing materials and infer somebody's going to be a good employee for you. And how we do this is we train on the current top performers. Now, if the current top performers are largely homogeneous, we could have some problems. So it's not just the question of having accurate systems, right? How these systems are used is also important. And this is why we've launched something called the Safe Face Pledge. And the Safe Face Pledge is meant to prevent the lethal use of facial analysis technology, don't kill people with face recognition, very basic. And then also thinking through things like secret mass surveillance or also the use by law enforcement. So so far we have three companies that have come on board to say we're committed to the ethical and responsible development of facial analysis technology. And we also have others who are saying we'll only purchase from these companies. So if this is something that you're interested in supporting, please consider going to the Safe Face Pledge site. And if you wanna learn more about the Algorithmic Justice League, visit us at AJLUnited.org. Thank you.


Hi everyone, Joe for Jaspy's case brakes calm coming at you at 2019 2020 Panini gold standard soccer One box random number block break number 19 No, no, I'm I was just kidding. It's all good Gretchen Ryan Luis Robert. Thanks for getting in there The numbers right there. Let's roll it. Let's randomize it five and a four nine times for names and numbers one two three four Seven eight and nine and final time after nine we've got Gretchen down to Luis Luis what are what are you? What are you looking for in this? I've seen you get into these soccer breaks number of times there anything specific you're going for you just like collecting soccer Nine times with numbers I've down to a lot of great value in the soccer ladies gentlemen Don't don't underrate this soccer stuff Gretchen with five and you just like collecting soccer Luis nice. This is a good one to collect too Robert with one Gretchen nine eight six Robert with seven Ryan with three Luis with zero four and two So Luis you get any and all redemptions in this box They were about to open if any including one-of-one redemptions, right? But Robert you'll still get your live one-of-ones just FYI So it's sort by column B by number Let's center it up Luis is there a Soccer team that you support I'm a Liverpool supporter Liverpool football club, and I guess in the United States LA Galaxy all right, there's the final prayer right there, and I think we're We're going Mexican soccer league. I think we're we're I think we're a Chivas family here UVA for Mr. Flyer. Oh, nice I think ESPN got that Syria contracts. They've been playing a lot of Italian soccer there. Ah Chivas we were we support Chivas here to Luis We're a Chivas family. There's me a ham. Nice 121 out of 149 nice me a ham 140 or 121 out of 149 Robert uncle Me a ham and no more still live in this area close to here There's Philippe Anderson 108 out of 149 That'll be for Gretchen in number eight I thought there's gonna be base cards on the bottom. There's Tony Cruz 65 out of 129 for Gretchen in number five Me a ham. Oh, it was really cool legend me a ham 138 out of 149 Julie Fowdy another legend. I want to say that she's got a Fairly entertaining podcast for ESPN just commentates a lot of games, too All right, we've got a Renato Sanchez for Byron Munich 28 out of 79 that'll go to Gretchen and Last but not least we've got Andrea Ranocchia 28 out of 39 two-color patch for the Inter Milan player It's all good. It's all good. There you go. And then we've got Terry Mina 23 out of 79 for Colombia that goes to Ryan Cassone In case and with the Colombian right there and there you go pretty quick break right here But started off with with a really nice hit marks of gold Me a ham don't see a lot of me a ham autographs and there you go. There you have it ladies and gentlemen I'm Joe for Jasper's case breaks.com. I'll see you next time for the next break


We are all neighbors here. We can help each other along. Building bonds that are strong. So everyone knows that they belong. We are all neighbors here. What is a community?  Come along and you'll see. All are neighbors here.