zero accounting software 2023 bank rules same vendor to accounts filtered by amount get ready to become an accountant hero with zero 2023 here we are in our custom zero home page going into the company file we set up in a prior presentation the bank feed file let's duplicate those tabs to put the reports in like we do every time right clicking on that tab up top so we can duplicate it and then we will right click again and duplicate again let's go back to the tab to the middle accounting drop down open up the balance sheet report tab into the right accounting drop down this time of course the income statement sometimes called the profit and the loss I just call it profit because I have no losses man losses aren't a thing I don't I manifest my destiny by not thinking about losses I only manifest profits anyways 2022 by going to the end tab date 2022 the 31st and update it so there we have it let's go on to the first tab now and go to our bank feed information accounting drop down we've got the bank accounts that's where our bank feed stuff is we're going into the checking account we've updated information to our checking account we're in the reconcile tab we're doing our best to try to construct everything we can from the bank feed so the stuff comes in from the bank feeds and we're creating the transactions from the bank feeds we're looking at some more complex rules most of the time the rules are pretty straightforward we paid the telephone bill so we've we assigned Verizon to the telephone expense straightforward but sometimes they could be a little bit more confusing this time we want to look at a little bit more nuanced rule around whether or not we've record something as say supplies or whether we're going to record it as an asset a fixed asset so office depot for example any kind of any kind of home depot type of store this could be the case because we might be purchasing a whole bunch of stuff mainly supplies from it but sometimes we might be purchasing equipment from it and we want to be able to set up a rule that can distinguish or at least give us an indication as to whether we might have to record something a little bit differently so here's like like office depot here and then we've got some other office depots and some more expensive stuff that we purchase from office depot on the second page so let's think about this in the general conceptual format if I go to my balance sheet here note there obviously the checking accounts going down most of the time we're going to go to the income statement and just record it as an expense of supplies because that's what we normally purchase from let's say office depot but sometimes we might purchase something that we have to categorize as an asset now this is one of those areas where even if you're a small company you often have to deviate from a cash-based system you might say well I don't want to I don't want to deviate from a cash-based system I don't care if I bought like a you know $10,000 piece of equipment I want to purchase I paid cash for it I want to just reduce the or record it as an expense but if you're in the United States at least you might have to deal with taxes and the tax code even for small businesses is going to force you to put it on the books as an asset and then to depreciate it so you want to make sure you're in compliance at least for that reason and obviously just from a conceptual framework it makes sense to put something on the books as an asset if it's a large purchase even if paid cash because if for example you purchased a $50,000 piece of equipment for cash and you expensed it in January and then you tried to compare your January and February income statements you would have this $50,000 supplies expense in January and very little supplies expense in February and it would make it look like you had a bad January which isn't the purpose of the income statement in general the purpose of the income statement is to try to measure performance over time and what really happened is you purchased a $50,000 thing that you're going to be using multiple periods into the future so that's why we want to put it on the books as an asset and then allocate the cost over the timeframe that we're going to use it that's that a cruel kind of concept so as we do this also just realize that on the balance sheet if you put things into the equipment account you want to make sure that you're kind of lined up with whatever your sub ledger will be used to track the equipment for the depreciation and accumulated depreciation often done in the United States by external software such as tax software due to the fact that even small businesses are going to have to do their taxes and you're going to have to put this into the tax software anyways and depreciated on a tax basis so you might as well use that same tax software to calculate your book basis as well whether or not your book basis is simply going to be on a tax basis or whether you're going to have two different basis in the United States of tax basis and a book basis so you want to talk to your accountant or tax professional or whatever software that you're going to be using to see what account categories they have in their depreciation sub ledgers so you can line up your accounts here for things that you're purchasing to the sub ledgers also just realize that when you purchase equipment you might sometimes be having a loan related to the equipment so now you might put a down payment on the equipment you might finance the rest of the equipment and then you have a loan now there's three accounts affected now that could be a little bit confusing when you're putting a loan on the books as you purchase equipment and using the bank feeds just from a bookkeeping perspective so a couple different ways you could deal with that you could see the loan come through from the bookkeeping perspective and put it on the books track the loan with an amortization schedule and so on or possibly you could try to keep everything as much as possible on a cash based system or at least a system that you can automate with zero keeping all the documentation for loans as well as the equipment purchases to then have adjusting entries possibly at the end of the year done by your tax professional or CPA firm or accountant at that point in time in that case you could just say I'm just going to record that money that I paid in the equipment asset I'm going to save all the documentation so at the end of the year the accountant can shore up the loan the loan balance and all that kind of stuff all the payments I make on the loan I'm just going to record to a loan account instead of breaking out the interest so that I can automate my system with the bank feeds and then give all this documentation to my accountant at the end of the year that can shore up the information entering the proper transaction for the equipment taking into consideration the loan breaking out the interest portion of the loan and breaking out short-term and long-term loan account if necessary okay so let's go back to the first account we're really just kind of focused on the bank rule we're going to come up with an arbitrary rule here saying hey if it's below a thousand dollars just expense it now that thousand dollar limit is kind of arbitrary because we're just picking a number in theory if you're using something for more than a year you should put on the books as an asset but in practice of course it's kind of in material under a certain dollar amount so you can pick whatever dollar amount you think is appropriate I'm going to choose a thousand dollars right so I'm going to say all right let's create a rule and this is the office so it's going to be any conditions match I'm going to say that all conditions have to match now and I'm going to say that it has to have a description that contains or let's do let's do the bank the any text so the normal thing is if it contains office depot that's just like normal and you also have to have this rule met that the amount is below is less than the amount has to be less than a thousand dollars if it's less than a thousand dollars we're just going to write it off to an expense if it's more than a thousand dollars and it's office depot don't apply this rule because we might have to put it on the books


Welcome to this course on data structures and algorithms. In all the sessions in this week we shall be looking at graphs and their implementation using STL of C plus plus. Today we look at graphs to understand what they are and how they are used. Graphs are useful to represent many real life situations. For example, if we want to represent family relationships or if we want to represent a road network or a rail network, graphs are commonly used. Please note that we have already studied tree structures, but graph is something different from a tree because there could be interconnections between various nodes unlike a tree which we shall see later. The graphs are useful in solving many optimization problems. For example, given a road or rail network we want to find out what is the path which will give me minimum transportation cost or minimum transportation time. To solve such problems I need to represent the transportation network and I need to represent cost associated with travel between any two nodes. Such problems are solved by the graph model. You might have heard of shortest path problem. You want to find out the shortest path between two cities. Again graphs are very useful in depicting the situation as well as solving such problems. Let us look at representational graphs. The graph, any graph consists of a set of vertices and a set of edges. A vertex is merely an element or a node in the graph. For example, in this illustration A, B, C, D, E are all vertices of the graph. An edge is the connection between two vertices. So, you will note in this particular illustration there is an edge between A and B. There is an edge between A and C. There is an edge between B and D, but there is no edge from vertex E. So, these are examples of edges and these are examples of vertices. So, vertices and edges together constitute a graph. There are two types of graph. One is called the undirected graph which is the most general graph in which the edges have no direction. What it implies is that if there is an edge between A and C, we will say that there is an edge from A to C and also from C to A. We will say there is an edge from A to B and also from B to A. This is what is illustrated here. So, this is the property of undirected edges that every such edge represents an edge between the two nodes and they indicate either from two or from two in either direction. Undirected graphs on the other hand have edges which have directions. So, these are called directed edges and they specifically indicate the source and destination in terms of the vertices which are connected by such edges. For example, there is an edge from A to B, but there is no edge from B to A. So, this is a directed edge connecting from A to B. On the other hand, if you see this edge, this edge actually indicates a directed edge from A to C and a directed edge from C to A as well. There is similarly an edge between C to D, but there is no edge from D to C. So, these are called directed graphs. In case of directed graphs, we have the notion of outgoing edge and outgoing degree and a corresponding notion of incoming edge and an incoming degree. Let us look at the notion of outgoing edge first. An outgoing edge is defined as a directed edge from a source vertex. For example, there is an edge from A to C, there is an edge from C to D, but not from D to C. An outgoing degree of a vertex is the number of edges which emanate out of a source vertex. For example, A has outgoing degree 2. Why? Because it has 2 edges going out from A to C and A to B. B has outgoing degree 0 because there is no edge which goes out of B. C on the other hand has an outgoing degree of 3 because from C, I have an edge to A, I have an edge to B and I have an edge to D. E of course has a 0 outgoing degree. So, a simple concept, outgoing edge is a directed edge from a source vertex and outgoing degree is the number of edges going out from a source vertex. As I mentioned, exactly similar concept exists for incoming edges and in degree.  For example, if you look at B, there is an edge from A to B, there is an edge from C to B, there is an edge from D to B. So, B is the destination vertex and we define correspondingly a notion of indegree. These are number of edges pointing to the destination vertex. For example, if you consider A as a destination vertex, it has only one edge coming to it from C. So, its degree, indegree is 1. B on the other hand has an indegree of 3 because there are edges coming to it from A, C and D. E again has 0 indegree because it has no edge coming into it. So, in today's session, we looked at graphs and their basic properties. We saw that graphs have vertices and edges. Depending upon the whether the edges are undirected or directed, we classify the graph as directed graph or undirected graph. In case of directed graph, we also saw the notion of indegree and outdegree. We shall later on see how graphs are implemented in our programs. Thank you.


my name is Danny and welcome to esoteric moment today I have another book review fitting for October I am reviewing the pagan book of living and dying by Starhawk this is a book that I think every pagan needs on their bookshelf this is a book that I would recommend to everyone pagan or not to read well before they are ever in the midst of confronting death be that their own or someone that's close to them now life presents itself in many bizarre and unplanned ways so it's not like you can time when you might be confronted with death but I really think this is a great read that allows people to focus on an issue in a really beautiful way that our society just fears and doesn't want to confront and that is of course death for me my sister read this book when she was in high school or early college and she had a disease that didn't have a cure where death confronted her in a different way than I think most people did so when she began as a weekend and as a pagan I think this book really appealed to her I didn't read it though until my sister was later in hospice I kind of wish I had read it before I was in the midst of that experience but it was still really really powerful and wonderful and helped me so much and helped my family follow my sister's wishes when she passed this book is written by Starhawk but it actually has lots of it has a few other authors from the reclaiming collective which adds a beautiful totality to the picture and I think you really pick up on the fact that there are many different experiences and people a part of this writing process and I really appreciate that so the book starts by talking about what is death it talks about what is death in the context of a pagan viewpoint so there's a lot about reincarnation and some other viewpoints it also talks about the dying process which is really useful every death is not the same some deaths are fast and immediate and unexpected other deaths are long known about and there's lots of preparation almost too much you know after about very specific situations like AIDS children deaths violence things like that and also talks about suicide and where people have a choice in their death process and that transition and then it also talks a great deal about grief and what it means for the people who are dealing with it I love about this book is it is not just from the standpoint of those who have not died who are left behind it also talks about death from the point of view of people who were experiencing that process so you get you get the whole picture it is not meant for just one person it is meant for all of us there are two parts of this book that I think are probably the most useful things one would be all of the ritual ideas and resources there are songs with actual music there are prayers there are ritual ideas and processes kind of ideas about burial and resources on where to have a green burial or something that is more akin to a pagans perspective on death that is an invaluable resource also this book talks a great deal about the legal aspects of dying which for some reason we also don't want to talk about in a society as someone who works at a law library I can tell you that not enough people are writing wills and everyone should have a will people aren't thinking about how they want their funeral or memorial services or burial to be handled and everyone should have a plan and everyone should talk about this with their family because the state has a lot of really intense legal definitions and expectations when a person died that can come from the time limit you have from a home death you call the police or to call 911 it can come from where you can actually bury someone so for instance in Wisconsin you can't just bury your loved one in your yard or on your farm but you can spread ashes on a farm so farm has a legal definition and you know ashes has a specific definition but really we regulate where people can be buried and how they're buried in that place a lot of us have kind of vague ideas about what we think we would like for us or for our family when they die and legally there might be some roadblocks to that so reading this book will help you confront some of those issues and have resources to look up how you would overcome those obstacles this is an invaluable resource for those people who are working with midwifing death and for everyone who will confront death at some point it's written extraordinarily well and you get the viewpoints of lots of people from many different circumstances so it feels like you're getting a very large picture but heartfelt details of those situations we haven't read this book you should at any point you should read this book I think it's one that if you're investing in a few books to keep as resources I think this is one that is worth purchasing sight unseen because I think it's extraordinarily useful to reread when you're confronting death or grief I think it's extraordinarily useful to have for those situations that you don't expect and you need to help someone else through the grieving process or through ritual after death so I cannot recommend highly enough the pagan book of living and dying by Starhawk and if you haven't read it I hope you do in the comments below I would love to hear your thoughts about how we can better help our culture confront death in a healthy way I think pagans are unique position where we understand the cycles of life and death in a more holistic way and we have a lot of really interesting ways of valuing the dying process and the dead and our ancestors and I think those methods could be brought to the rest of our culture and hopefully bring a little bit more balance and I'd love to hear if you agree with me don't agree or kind of your thoughts on the whole top thanks for watching and as always may you find peace in the sacred grove once your notebook has fully dried on both the front and the back we'll start cutting the elastic cord so I measure by just loosely holding the string up over the notebook you're going to want to do it twice the length of where your holes are plus a little extra to tie


Here we are zooming into the southern ring planetary nebula, 2,000 light-years away. A planetary nebula is the remains of a star like our sun after it has run out of hydrogen fuel for fusion. This side-by-side comparison shows Webb's observations in near-infrared light on the left and mid-infrared light on the right. The southern ring has a binary star system at its center. One is a white dwarf. The brighter star in both images has not yet run out of fuel. It closely orbits the dimmer white dwarf, impacting the distribution of the ejected material. Over thousands of years on its path to becoming a white dwarf, the dim star periodically ejected mass that now forms the visible shells of material. In cyclic fashion, it contracted, heated up, and pulsed, spewing stellar material in all directions, creating this beautiful landscape. This is not only a crisp image of a planetary nebula, it also shows us objects in the vast distance of space behind it. The transparent red sections of the planetary nebula and all the areas outside are filled with distant galaxies. Inspirals of many shapes and colors also dot the scene. Those that are furthest away or those that are dusty are small and red. Note the bright angled line at the upper left. It's a far away galaxy seen edge on.


It is my pleasure to introduce you to Pedro Fortuna. Thank you all. Welcome. Thank you for being here. Today I'll be talking about protecting crypto exchanges from a new wave of man in the browser attacks, starting with a little bit about me. So I've worked in security for the last 15 years. The last seven or eight have been mostly focused in JavaScript code protection. But before I started working in the network security side of things, then I started building things like bot detection, device fingerprinting. And in the last few years, I've also paid a lot of attention to man in the browser attacks and malicious extensions. So today's talk will be mostly about man in the browser and crypto exchanges. But I'll start off by a brief overview of the man in the browser history. Then followed by, I'll cover the most common security, application security features that we have found in crypto exchanges. Then we'll get deep into the attacks that we have seen in last March. And at the end, I will talk about application real time monitoring, which is kind of a new approach that we have been working on that can help in this type of attacks. So for those who are not familiar with man in the browser, it all starts with a device getting affected, usually through email phishing. It's the most common way of doing it. And then the trojan gains control of the browser and just waves off for the user to go to a certain targeted website. And then it makes malicious injections into the page and tempers with the page. And this happens regardless of other authentication factors that may be in use. So man in the browser can be subtle. So they can be patient. They will just wait for you to access the website. And then they may wait for the very last minutes to change a transaction or just to collect your credentials. So they do the very minimum to accomplish what they want to do in the website. And they can be very subtle.  So it's very hard. So in this example that you see what's happening is the web inject is modifying the transfer amount in destination account. But apart from that, that's not, through the perspective of the server, that you have nothing else to look and that can tell you that this is happening. So it's really an attack focused on the client side and it's hard to spot. So it all started with Zeus. Not the slot machine, but the trojan. It first appeared in 2007. And he was able to do web injects and also to form grabbing. And at the bottom, you can see how a web inject looks like. So it has three sections. The target URL reference, where to inject and the injection itself. So in this example, the web inject is adding a field to a form that's requesting an ATM pin from the user. So the source code for Zeus was released or leaked back in 2011. And this really opened the door for the number of attacks growing. We have seen a lot of different forks and variants of Zeus and they are still out there. In this table, you can see the most common features that you can find in the man in the browser trojan. So most of them have form grabbing and web injection. Of course, those are practically mandatory, but they can do other things like key logging, remote access, and a few of them are even able to remove HTTP headers which can be really dangerous. So back in 2016, according to a study by IBM, the most prevalent man in the browser trojans were still Zeus, which is surprising. After 10 years, it's the most prevalent one and followed by a couple of variants, Neverquest and Gozi. But you can see here that the attacks have been going on in the last 10 or 12 years. And really, we are just scratching the surface. So there's so many attacks that go unnoticed, but we don't have time to cover all of this today. So I'll just mention one. Back in 2015, a drydex train was able to steal around $50 million. And what was worse is that it took two whole months for anyone. I mean, and we're talking about hundreds of different financial institutions for anyone to notice that this was happening. So this is a real problem. The question is, how secure are crypto exchanges? Are they up to the task? What kind of features they have that can mitigate or prevent this? This is the question that we had. So we went for a few exchanges to find out what they were doing. But there's too many changes. I think the numbers I've saw was roughly over 200 crypto exchanges right now. And so it's too many to make a survey. So we had to start somewhere and we decided to choose a representative set. And the rule of thumb was let's select exchanges that are likely to be selected by users. So we went for the most popular, but not only the most popular, but the ones that have also interesting features that we know about. So trading volume is interesting, ranking on Google search, links and relevant sites in social media, and also known user base. So in the end, we selected the six Binance, Bitfinex, Bitrex, Coinbase, Wobby, and Kraken. So other exchanges could have been selected, of course, but I believe the main conclusions wouldn't be different. So getting into the features, by now everyone knows what two factor authentication is. It can be used to frustrate attacks that only compromise a single channel. So you have a second one. You can use SMS, you can use mobile applications like Google Authenticator, or even physical hardware like Fido. All exchanges that we saw use two factor authentication, but they differ when they force the use of two factor authentication. So in general, they can use this to confirm logins, withdrawals, password changes, API key creation, changing security settings, or changing other sensitive settings. Captchas are also very common. They are used to determine if the navigation is being done by a human or by a bot. And you have many different types of captchas. The early day captchas were all based in text, as you can see in the right, the top image. Then the image based captchas came along and become very prevalent. And in the last few years, we are seeing more risk based and hybrid or dynamic based captchas that basically collect behavior information of the navigation and decide whether they should allow you in or just serve you an image based captcha if there are suspicious that you may be a bot. So typically they are used in authentication and registration. And most of the exchanges that we analyze are already using reCaptcha, which is the latter type of captcha, risk based. But what you have to keep in mind is that there's a high threat, which is the use of sweat chops to solve captchas. So especially if you are using image based captchas or even text, with text based captchas you don't even need sweat chops. But if you're using image based captchas, there's a whole set of services that you can easily integrate with your automation tools to attack that can get you solved any captcha in just a few seconds. And you can scale that up and you can abuse many websites that are only protected by image based captchas. So you have to watch out for those. Exchanges also lay out a number of different account takeover defenses, starting with two factor authentication, of course, but they are only forced by a couple. So only Binance and Bitfinex really force you to use two factor authentication. So in the other cases, you can disable this option. So it becomes a viable road for an attacker to disable those options and try to attack. So another thing is they send an email on every successful login. So this is useful because if you received an email and you haven't logged in, maybe it should take measures, right? If you reset your password or two factor authentication, some of those will require you to confirm that action through an email they sent you. And in a few cases, that will also cause your accounts to be frozen for a certain amount of time. So you cannot deal with roles if you just reset your password or two factor authentication. And this is good. You can also have a white list of IP addresses and devices. So you always have to confirm your devices. So not all exchanges offer this. And in some situations, you have to approve as well through email. Some, in some cases, there's also the possibility of freezing your accounts directly using the emails that you received, which is good because if you receive an email telling you about some action, you can quickly disable your account and hopefully in time for stopping the funds from being exfiltrated from your account. And all exchanges in general, they collect, they lock the actions that you do and they make this information available to you so you can spot if weird things have been done with your account. Withdrawal protections are probably the category that I found more interesting because some of the features can really be helpful to protecting exchanges. For instance, if you reset your passwords or two factor authentication, like I said, your account can be frozen for a certain amount of time and that amount of time can go from 24 hours to 15 days, which is really aggressive but gives enough time for people to understand if someone is messing with your password or with your two factor authentication. And this amount of time in certain situations depends on the exchange and the amount of funds that you wish to transfer. You can also lock or disable withdrawals for crypto coins that you are not using and you don't wish to trade at all and you also have a withdrawal address whitelist. So you need to specify the crypto wallet addresses that you intend to do transfers to and if you need to add a new address that can cause your account to be frozen during, for instance, five days.  So this is a weak spot for sure. Also, the IP device whitelist lets you withdraw for new IPs and new devices, but only if they were previously approved and you have a minimum of 24 hours commonly that you need to wait before they are really approved and cleared out to use. Also, as you can see in the screen at the right, the image, some exchanges also present this image with the transaction details, but also with the secret phrase that you can set and this is done to prevent things like phishing attacks or tampering attacks that are forging transactions or tricking you and diverting the funds to other accounts. So if you don't find your secret phrase there, maybe it's an automated tampering attack and you need to watch out for those. There's also some anti phishing, more anti phishing techniques. You can set a secret phrase that's sent in every email that you received to prevent email phishing and you can also configure, I think in a couple of exchanges, PGP keys to be able to receive the encrypted emails. So this is useful as well. Pretty much all of them use HTTPS by now and I think only Binance, no, a couple of them, they show you warnings or requests for you to check and double check if you are running in the HTTPS and if you get the green lock and everything to make sure that you pay attention to those things. Last but not least, content security policy. So after going through all the six exchanges, I'm kind of disappointed because what I saw is most of the exchanges are either not using CSP at all or they are using it very wrongly. So as a couple of friends of mine, Michele and Lucas from Google said and they speak about CSP a lot. Over 94% of all CSPs based in wireless are bypassable so we shouldn't use them at all. Oh, oops. And what I saw is that at least more than half of these exchanges, they are using white listed domains in CSP which they shouldn't do at all and plus they use unsafe eval, they use unsafe inline and they don't use base URI none and like I said, some don't even use CSP at all. So they practically do all the mistakes that you can do with CSP. I don't know the reasons but I think they should fix this. CSP should be used but should be used right and I really can recommend enough the use of CSP evaluator which is a tool from Google that can warn you off if you are doing like obvious mistakes in your CSP configuration. So in this table you can see a summary of most of what we already talked about. Also I include the X-Frame options that we have found in these exchanges and the general overview is that most of them are allowing iframing of their website from their own domain and as we are going to see this is a problem. So only kind of moment is denying iframing from within their website. Other things that you can see the two factor authentication in the case of Binance and Bitfinex they are being forced in a lot of the actions that you can do in the remaining four. You can disable two factor authentication and this is bad because many of the browser can exploit this by disabling the requesting two factor authentication and so it becomes a useless security feature. And this is the same table with the positive things and negative things and I believe this table should be way greener than actually it is. And there's no single exchange that can get away because let's say Bitfinex is way greener than the others but at the same time they are not using CSP so they should be blocking all sorts of cross-site scripting, disabling framing from within their websites so no one gets out easily from this. So the main takeaways is that improvements can be made. CSP is not being used properly. In one case I didn't point out that Bitfinex is using text-based catchers which are very used to overcome if using OCR or whatever. You should ban framing of the website from within which is also useful to mitigate attacks like click-checking so you get that as a bonus. So there's no reason why you shouldn't use CSP and every important actions should trigger two factor authentication and that can't be disabled so you can't let the user decide whether two factor authentication should be used or not. So all sorts of whitelist can help. They should be used but they should be forcefully used with freeze time, like freeze time. And the anti-fishing, tamper proof images are also good to fight bots. But some of the stuff were nailed down by the exchanges so they all use HGF. They all factor one, two, okay. So factor authentication, they all log history. Wait a second, but if you look at what's being done we are using a lot of two factor authentication, captures, countries, whitelists, this and that. And the overall usability is being hurt. So what we want to know is whether we are getting more security in return by doing all of this. So now I will show you, I will talk about the attacks. So roughly five months ago I heard in the news that Coinbase and blockchain.info were being targeted by many of the browser attacks. And it all started by the work of a couple of malware researchers, Deweyna Kosovan and Kathleen Valerio-Lita from Security Scorecard. So they did a white paper on this and basically what they found is this was an attack caused by Zeus Panda, which is a variant of Zeus. And they were targeting, so what stood out from this is that among 50 targets, we found two crypto exchanges. And this really caught my attention. So I've read the white paper carefully and this is what you can see there. So this is the first stage web inject. I don't know, maybe you cannot read this, but it has a div element in the top and then you have an inline script. Hello, use of CSP, please. And here you can see the obfuscated version of the same script. It's not really complete, but you can see the different parts. But basically what it's doing is just waiting out for the page to complete loading and then afterwards it's just dumping an inline script that will load a second stage JavaScript payload from the website. So this means that the attacker can change the attack at any given point. So the only thing that's static is the web inject. So you put the main browser out there is injecting when people visit the websites, but then at that moment they will dynamically load a second stage JavaScript payload and that can evolve. They can do different things through time. So in this case it's only doing that and we didn't have all the details. So with the white paper it didn't have access to all the second stage payload. So, and we wanted more details on this. So we reached out to DeWina and Kathleen and we were able to discuss the attack with them and they were kind enough to share the stage two payload with us and based on that we implemented for Coinbase.com a C2 capable of interacting with the JavaScript payload and we are doing the injections in the browser using Burr proxy. So this is what we know. So initially the user visits Coinbase. At any given page the web inject is always injected no matter what inner URL you are visiting. And when you access the login form they overlay, they put a button over the real button and they disable the enter key so that you cannot use that because that will trigger the bottom real button and they force you to click their own button. So it's kind of an easy trick they can do. So when you log in they will extract your credentials but they will also put forward the normal login. So after you log in at the dashboard they will present you with this model window that says that they detected an usual sign-in activity. You're probably trying to log from a new location or device and so it seems pretty generic so it could potentially warn you off but at the same time who knows when the crypto exchanges are requesting two-factor authentication. It's really complex and it's dynamic too so we never know what's their strategy for serving and requesting two-factor authentication. So at the same time this can easily trick people into entering the two-factor authentication credentials. So let's imagine that you enter it and when you do that they will basically use that credential that two-factor authentication to load the security settings page in an iFrame so that's why we shouldn't allow your website from being iFrame from your own websites. So they load the security settings and they set the requesting two-factor authentications to none, to never. So basically you are just downgrading security in the website. So one thing that was weird is that this iFrame was not invisible which is one of the indications that we have that the attack wasn't complete so they were probably still working on the attack they were debugging and seeing how it goes. So after this, if you try to go to the security settings page you are presented with a one line error saying you that something went wrong, please try again later. And this is presently what it does. What it could do, it could initiate a transaction for a wallet controlled by the attacker and it would be easy because after disabling two-factor authentication there was nothing there to stop the attacker from doing this and the account wasn't frozen so it could be done immediately. All your funds are lost and this is far too appealing because you cannot undo this and the money is untraceable. So why shouldn't many of the browser torsions target crypto exchanges? They should. It's easier than targeting a conventional bank in my opinion. So this is how we implemented the attack. So we deployed a Burp proxy and the Burp proxy is applying the web injects but it's also stripping the CSP and the X-Frame options headers. And why we are doing this? Because we believe that after the attack Coinbase disabled the framing within their website and this attack in particular is using the iframe as I told you. So in order to replicate how it worked we are stripping the headers. And by the way Coinbase, like I said is the only exchange that is presently doing this. All the others are still vulnerable to this type of iframing. So obviously we configured a browser to use the proxy and the JavaScript payloads is communicating with a situ that we have implemented. So now it's time for the demo. So here in Burp you can see that we are removing the removing, replace with nothing the X-Frame options headers and contract security policy and we are also adding the web injects. So let me try to show you that. So before you can see very well but this is the same as I've shown you before. It's obfuscated but it's obfuscation is really simple. So in five minutes or so you can reverse this. Not really a good barrier. Okay so we are already running our C2. So let's add to, so the window is not very big so I'll try to do this the best I can. Okay. So let's go to Coinbase. This is not, it thinks it's in the mobile device because it's a really short login. So right now it's already tampering with the webpage. So this sign in button will exfiltrate the credentials. So I need to use a two factor authentication running in my mobile device and verify it. So here is the model that's injecting into the webpage. You're probably trying to log in from a new location and if we go to the security settings, so sorry, something went wrong. Let me just try again. Okay. So it's now requesting my two factor authentication tokens again so this is fake, of course. Let me just use my mobile device 215. In the original attack it would show the iframe. So in this case we have disabled it because it wouldn't be like, it's hard to understand what's going on if you're seeing an iframe. And now if you go to the settings, you see this error. So something went wrong, please try again later. So this is the attack and what they aren't doing is transferring the funds out but they could easily do that. If we go, if we log in using another browser which is not using the burp proxy, we can confirm. Okay, so we can confirm that right now the security settings, the two factor authentication is disabled. So we can see this because we are not using the infected browser but if we try to use Firefox in this case, we are not allowed to see the settings or even change them. Let's, because we are at DEF CON, we should fix this immediately. All right, okay. Okay, so what have we learned by doing this? So first, the first conclusion is that this attack is very noisy. So it basically injects the web inject in every endpoint of the website. So if they were trying to be quiet, they shouldn't do that. They should target like two or three very specific URLs and only drop the web inject in those endpoints. But we can speculate because the attack was still being designed. Maybe the guy doesn't know yet which endpoints that he will use. So he doesn't want to lose an opportunity to tamper in other pages and maybe Coinbase can change the endpoints as well. So he wants to retain the ability of just tamper with any inner URL. It also uses a state machine to control how it works. But it seems very experimental, very poorly written JavaScript. I believe it's uncompleted work and we have different signs that this is true, like the visible eye frame. Also there's a part in the payload where they are doing the transferring out the funds, but you have a return statement just at the top of that function. So it's an unconditional return statement. So it means that they are disabling that part and we also saw that some automata states are missing from the code, seem to be missing. So two factor authentication or SMS confirmation, it's not a real barrier for this attack vector and I believe that even security professionals can be tricked because it's so confusing when and when not two factor authentication is used or should be used or why it's used. So you can easily be tricked with this and we assume that in this case, Coinbase has since disabled the eye framing from within the website. So obviously you can follow the usual many of the browser recommendations like using a live distro to go to your favorite banking website or crypto exchanges, but I mean that's hurting the usability even more. So the question is what if we could be able to detect the injections and do something about it? And this is the question that we have been trying to, we have been working on lately. So this, one, two. Okay, so this is what we came with application real time monitoring and this is more or less how it works. So it has two components, a client and a server and the client components, the real time monitoring agents is continuously monitoring the page and the DOM and it checks for DOM injections, for JavaScript, script injections and for modified Heaven Tundlers. And it does that by leveraging mutation of servers to receive a stream of things that are being changed in the DOM in real time. It also combines that with the checksums for certain parts of the DOM and it does poisoning injection. So when the injections are detected, we send that out to the real time monitoring backend which validates if this is a real threat and then it sends out to the backend application using a special web hook. So this web hook is receiving a stream of events of things that are being injected into the application and this is done in real time and you can set policies on your application backend on how to react to this. So you can blacklist the user, so automatically freeze the account, you can do a lot of things and it can be done in timely fashion in order to stop funds from being exfiltrated from the account. So you can send more, you can ship more things to the clients as a feedback loop and this can be really helpful. So it follows a widely seen approach means that it detects any unseen injections. It has different levels of sensitivity according to what's being injected and where and it uses machine learning to tackle the false positives. Also support signatures for known injections in which case it can launch counter measures. So it can remove injections that we already knew about but it can also redirect the page to a certain URL, delete cookies or execute a custom callback in the client side. So this is very flexible. Of course all of this is done by using code protection because the client side components is JavaScript can also be tampered with so it needs to be resilient to any kind of manipulation from the web inject. So it uses polymorphic JavaScript obfuscation. It is tamper resistant and can optionally be mixed with the code of the application making it very hard to distinguish which part is the agent and which part is the regular code of the application. So let's redo the demo but this time using the application real-time monitoring. So I'll struggle a little bit with the size of the windows but I'll try to do my best. In order to add the agent I'm also using burp proxy so this part is adding the agent to every web page dynamically because we couldn't get Coinbase to install it in time for this talk. Sorry. And let's go here again and let me open the dashboard here. Okay so I want you to be able to at least see a portion of this graphic in the back so I will try to position things so that you can see a little bit to see what happens. Okay? So I have to restart C2. Okay, we're done. Let's go. So we are already seeing things in the back. Just a second. Already seeing things. So we have four new threats so things are getting, are landing in the, so we can see the button here and you can see the overlaid button code here. So you could already be doing something about this. Let's proceed. This is the regular two factor authentication that's Coinbase requests. So here you can see the iframe. So sometimes the code isn't really reliable so as I said it's a work in progress and may take a long time to just move over. Okay, and we have new stuff. All the time they are adding the web inject to the page and deciding whether they should do something or just quit. When they decide to do nothing they also remove the injection from the web page. So if you do a dump at the later stage of the dump you won't find the injection there. Okay, so this seems to be stuck. Let me try again. Bear with me please. Of course. Sure. So yeah, good question. So Burp is replacing me having my device infected. So if I had my device infected my browser would be in control of the web injects and as you go to Coinbase it's automatically injects the. Yes, I know we have shown you before. I can show you in the end if that's all right. Okay, I can show you again. So let me try this again. All right. Seems to only work at the second time. Shit. Okay, so you've seen this before. Let's see what we have here. We have quite a few injections in the page. Let me try to show you a couple that might be interesting for you to see and to understand what kind of information we can supply. So here you can see this is a form and it's actually the two factor authentication thingy where it's requested like the model, complete model having the form to request the two factor authentication and let's see another. Okay, so this one is in the dashboard and it presents an image. Let me see what kind of image this is it. So this is the icon that shows just next to the two factor authentication. I don't know if you remember but this is the kind of thing that you can collect as well. All right. So let us go to the security settings. Oh, I'm in the wrong browser. Okay, load the security settings. Something went wrong, please try again later. Okay, so four knee threats. This is all live and we can see that a bunch of DOM has just been removed from the security settings page and this is the actual security controls that you usually see in the page. They have been removed and the attacker has placed the error message. So in conclusion, if there's anything I like you to take away from this talk is that crypto exchanges are being targeted by many of the browser and they should be aware of this attack vector. Of course, every other vector should be in their horizontal as well. But I believe we are seeing more of this because it's far too appealing for an attacker because it's anonymous, it's untraceable and if they get out, it's really difficult to find out who stole the money. So I think this attacks against Coinbase and Blockchain Info can be seen as warnings because the work after all was incomplete. We don't know if there were consequences. We know that the credentials could have been stolen during this period, so we don't know if someone is using them in any way. But we know that at least this version of the Trojan is not yet stealing money. And other conclusion is that two factor authentication is not enough for this attack vector. So definitely exchanges can improve their defenses, things like temporary freezing the account when you change anything about the security of your account and I don't mind paying with usability but at least do it right and don't provide workarounds for people to just go and disable two factor authentication because this can also be a tool for web injects and for Trojans to be able to perform their attack. So I think attacks will most likely get more creative and they can be executed by anyone because you can acquire a Trojan kit in the black market. You don't need to really understand how it works. You just need to write some JavaScript that goes into a webpage and adds stuff to the DOM, removes others and implement a state machine to control how you are doing that. So it's not really sophisticated, it's really simple and due to the potential returns, I think we are definitely seeing more stuff. I think for this attack vector application real time monitoring is really can be effective. We just assume that injections will occur, we cannot prevent that and try to detect them in real time when they do. You can set custom policies, you can adapt what you're doing in real time and you can mitigate the attacks before they are successful. And as you know, if attacks keep failing, probably the attackers will move to the next side because they always look for the least amount of effort and the maximum profits they can have. So I cannot tell you exactly how to earn money using this talk like Ming said, because I shouldn't unless you pay me a beer afterwards. Then I can consider that. So this is all I have, thank you.


Father, we thank You, Lord, for how You have been pouring out Your rear blessing on this weekend, Lord. Father, I thank You that we can talk about subjects we can think, we can reflect, that we can be challenged, we can be convicted, Father, that we can be inspired to press on. Father, my prayer is that this weekend would not be an end, but just a means, Lord, in the journey of growing in Your likeness, of pursuing You, of knowing You in deeper or fuller ways, of being able to say that Jesus is Lord in new places in our hearts that You have not been Lord before. Father, I pray You'll bless Brother Steve. Lord, you know the challenge He had in the last day or two here of sickness. Thank You that He pressed through, did not give up. Father, I pray You give Him health, give Him strength, Lord, give Him a clear mind and bless Him with anointing of Your Spirit. And we ask this in Jesus' name. Amen. Amen. Okay, thank you, Brother. Good afternoon, brothers. I'm really glad to be here today, and especially challenged to be able to face a group of young men. And I guess to burden on my heart as a man and with the experience I've had in my own life and what I see happening in the lives of many others, I have a burden. I have a burden for you. I have a desire to see that you will be able to do well in your lives, that you will become productive men in the kingdom of God and that God will do great things in your lives. So what I'm planning to share on here is, somewhat from my own testimony, I'm going to share some with that. And then out of that, I'm going to share in Scripture various things that I have learned, some challenges that I have had, and the work that God has done in my life and the work that God wants to do in your life as well. Just a little bit about who I am, so we sort of know each other somewhat. I'm a real estate agent. I'm an investor in real estate. I've been doing that for about 10 years. Before that, I was in the computer software industry for about 15 years. I had one year in Kenya, Africa. When I was a young man, I was at a rescue mission for a year out in Illinois. So I've been around a little bit. I'm married to my wife, Mary Lou, and we have three daughters. We live in Martinsburg, Pennsylvania, which is up toward Altoona if you don't know where that's at, so we're not very far from here.  The question I want to begin with is this. Here you are this day. What are you going to do with your life? What are you actually going to do with your life? You have one life. Here you are. What are you going to do? It's a question you need to answer, and it's not necessarily something to answer quickly, but it's a question you should be exploring, you should be thinking about, and you should be coming to a very firm conclusion. Many boys, many young men in our day are like ships without a sail. There's no direction. They're out there bobbing around. They don't know where they're going. They don't know where they're at, and they generally don't get very far. The theme of the weekend is the Heroes of the Faith, and it's an inspiring theme from my perspective. Now we can look at that. We can look at the people in Scripture and we can say that these people were so great and they did such great things and I could never possibly do the things that these people did. You could become intimidated a little bit and you could become discouraged, but I guess the way I look at it is I am inspired when I see another person, whether it be in Scripture or whether it be a person today who is doing the will of God, who is actually responding properly to the challenges that they are facing. A person that is out on the front line, so to speak, in spiritual battles that are happening in the kingdom and you may think to yourself that you could never be a hero of the faith, but I will say this, you can be a hero of the faith, especially to people whose lives you touch. If you get married at some point to your wife, to your children, to your grandchildren, to others that you influence. A person that you influence and win to Christ, that person is going to view you as a hero. So I want to encourage you in that. I grew up in Holidaysburg, Pennsylvania, which is just outside of Altoona, it's on the south side. I was part of the church of the brethren growing up, I don't know how many of you are familiar with the church of the brethren, but I was sort of in the middle of the road church of the brethren. Church of the brethren is, it runs the whole spectrum. We were sort of in the middle. We had some truth. There was something there if you were interested. I'm very thankful for that. I'm very glad that I was raised with the influence of a Christian church. Not the best church. Certainly a lot of things lacking there. The way I describe it is we didn't have a full understanding. A lot of things we did not understand. But the things that we had I'm thankful for because that helped to lay some foundation in my own life. I was, I am one of, I'm the fifth born of eight children. So we had a big family and my parents are both deceased at this point. When I was young I would have thought that we were just the normal American family. I would have thought that this is what a family is like. This is the way things are supposed to be. I didn't realize some of the problems that we were actually facing and they later came to a head. I want to say this as I share some things. I have to be careful in that the Scripture does instruct us to honor our parents. And I want to do that. On the same, on the other hand we got to tell the truth of the situation. And so anything I say about my parents please don't view it as a negative. I love both my parents. And I will say this. I especially appreciate the good things that they have done for me. And there are many, many good things that they have done. Not the least of which is exposing me to the Word of God. And that I'm thankful for. But I don't know that either of my parents really were converted. We always went to church. That was number one priority with my dad. But I think that was a big part of what being a Christian was for my dad was just being connected to church, going to church. As far as life there was a disconnect. And my dad had some different problems. I still remember the time when I was I guess probably around 15, 16 years old when my dad came and told me that he was going to jail. And I was in shock. I mean I didn't even realize what was going on. And he did go to jail. And my mother left my dad and ended up connecting with another man. And so our family situation was in a turmoil. It was a mess. And where I was at in my life God was already working in my life.  And I was responding to at least some degree. But the crisis in the family really made me search for answers. It made me look for something that had some kind of stability. Something that I could latch a hold of that was a value and that I could count on. And I really began to seek and to search and to look into the Word of God. And I was a typical young guy I would say I was not a rebel.   But I had different challenges, different problems with sin. That was the reality in my life. As I began to study Scripture, as I began to ask God different questions and to search for answers, I was just spending tremendous time searching the Word of God and seeking the face of God. And God was doing something. God was doing something great in my life. It was during this time that I really began to understand the teaching of Jesus. This is in Luke chapter 14. If you have your Bible, I'd encourage you to open it to that. Luke chapter 14, we're going to talk here about the concept of being a Christian. And I just... What I grew up with was more the concept of you responded in invitation. You say you want Christ as your Savior. You want to have your sins forgiven. You're baptized. You join the church. And that is you have become a Christian. And I'm not... Don't misunderstand me here. I'm not saying anything bad about any of those things. But I do want to say this. There's more to it than that. There is something that has to happen in your heart if you are going to be a Christian. There is a change that must take place in your heart at the very core of your being. And it is that change which is actually more of the essence of being born again. And this has a lot to do with it in Luke 14. Verse 25, the Bible says, and there went great multitudes with Him. He's talking about Jesus, and He turned and said unto them, If any man come to me and hate not his father and mother and wife and children and brethren and sisters, yea, and his own life also, he cannot be my disciple. And whosoever doth not bear his cross and come after me cannot be my disciple. For which of you intending to build a tower siteth not down first and counteth the cost, whether he have sufficient to finish it. Lest haply after he hath laid the foundation and is not able to finish it, all that behold it begin to mock him, saying this man began to build and was not able to finish. Or what king going to make war against another king siteth not down first and consulteth whether he be able, with ten thousand, to meet him that cometh against him with twenty thousand. Or else while the other is yet a great way off, he sendeth an embassage and desireth conditions of peace. So likewise whosoever he be of you, that forsake if not all that he hath, he cannot be my disciple. Salt is good, but if the salt have lost his savor, wherewith shall it be seasoned? It is neither fit for the land, nor yet for the dung hill, but men cast it out. He that hath ears to hear, let him hear. Another scripture that I want to bring out that ties in with us, and it's in Matthew chapter 10. Trying to locate the exact verse here. I might just have to turn to it to find it. It's around 39, I think. Matthew 10. Okay, it is verse 39. He that findeth his life. He who is speaking to you. He that findeth his life shall lose it. And he that loseeth his life for my sake shall find it. I ask you the question, what are you going to do with your life? And Jesus is saying to you, if you find your life, you will lose it. But if you lose your life for my sake, you will find it. The concept here is the giving of your life. The surrender of your life. Giving your life to Christ so that you can serve Him and do His will. Salvation requires you to give your life. And I remember as a young man reading these scriptures and wrestling in my heart. Am I actually willing to give everything to Christ? I don't know if you've come to that place yet in your life. I imagine some of you have. I imagine many of you have not. But I want to share that with you today.  Not just parts, not just pieces. Not just some. But it requires all. There is no greater privilege that you have. There is no greater cause. There is no greater mission that you could be a part of. There is nothing of greater value that is offered to you than to follow Jesus Christ and to do His will. If you want to have Christ the Savior and still be in charge of your life, if you want God's best and the best that the world has to offer, if you are willing to give much, but you're not willing to give all, you cannot be Christ's disciple. That's what Jesus is saying here in Luke 14. What does it actually require to be a disciple of Jesus Christ? It requires complete surrender. Total surrender. Giving up. Giving your life. It requires hating your own life.  You're going to do what Christ says, not what you say. So where there's a conflict, you're going to follow Christ. That's the idea of hating your life. It requires the death of self. Now you're no longer in charge of your life. But Christ is in charge of your life. And you're going to obey Him. You have to die.  You're dead, the Bible says. And your life is hid with Christ and God.  And you will find new life in Christ. It requires forsaking all that you have. Verse 33, you have to give everything that you have. And that's material possessions. But it's more than material possessions. It's all the relationships. It's all the desires of your heart. It's all the things that you hold dear to yourself. You must forsake them. It requires total commitment. It requires 100% obedience. If you do not obey Christ in all things, everything, you're not His disciple. And many of things are easy. Many of things are challenging. Some of the things are very difficult. You think about the heroes of the faith. You think about some of the people that are being shared about this weekend. Think about people who have actually died for their faith in Christ. And I remember, I was just a young guy. I was just trying to say, I want to follow Christ, but I'm not sure if I'm going to be able to... I'm not sure I'm going to be able to do that. I'm not sure that I'm going to be able to go to the stake and be killed for Christ. God gives grace for those situations when we face them. It's hard to know ahead how am I going to respond in this situation or that situation. But I have confidence in this. I have given my life to Christ. It is my heart's desire to follow Him and to be true and faithful to Him, even to the point of death. And I believe that should I ever face that situation, that God will provide the strength and the grace in that moment where I will be true and faithful. And I trust the same for you. But you need to be willing to give even your actual physical life, that you give to Christ. Obedience, Luke 6, 46, Jesus said, And why call you me Lord, Lord, and do not the things which I say as perplexing. People who call Jesus Lord, but they don't obey what He says. Okay? It doesn't make sense. It's not right. It's not as it should be. We need obedience. It requires to be a disciple hating others. Verse 26, you have to hate father and mother. You have to hate brother and sister.  And this is kind of a strong language. We think of hatred as being a sin, generally. But it's not in this case. The hatred that he's talking about is, who are you going to be loyal to? Okay? What is most important to you?  Your relationship with your parents or Christ? I've actually experienced this in my life where one of my siblings, and this is when I was young and I didn't really have a great support system, but one of my siblings was going to get married. He was going to marry a divorced woman and I knew that that's wrong. And I'm not going to be able to support that. And I shared that with him and he was not pleased. And it changed our relationship. And that relationship remains changed to this very day. But I knew where my loyalty was. And while I still love my brother, my love for Christ is greater. And I don't regret remaining true to Christ and following him and honoring him. It's loving Christ above all others. Being Christ's disciple means taking up your cross and following him. To take up the cross, the cross is a picture there of suffering where you're actually going to be ridiculed for being a Christian. You're going to be mistreated. You're going to be viewed as a bad person and it can get a lot worse than that. And you've got to be willing to suffer whatever it takes if you're going to follow Christ. Discipleship means Jesus is first. Jesus is king. Jesus is Lord. Discipleship is a life of faith and obedience. If you're looking for a good foundation in your life, remember what Jesus said there in Matthew chapter 7, at the end of the Sermon on the Mount. Remember that? He talked about two men building a house. One man was a foolish man, right? He built his house on the sand, right? The other was a wise man who built his house on a rock. But what did he say that actually represented those two things? Sand and the rock. Do you remember that passage? Jesus said what? The man who hears my sayings and does them is the wise man who builds on the rock. His house lasts.  The house is your life. And you want to build on a solid foundation. So this concept of discipleship, if you do not settle this question, it is very likely that you will flounder all of your life. And the reason is to actually experience the power of God in its fullness, it requires a full commitment. It requires being willing to obey even when it hurts, even when it is a major sacrifice. It is in those experiences that our faith is purified and our faith shines forth like gold and you actually experience the benefits of such faith. So I want to lay that challenge before you today, young men. Settle the question. Give it very serious thought. And it may take you time to wrestle through it and that is fine. I don't push people to make any decisions at any time because this is your life we are talking about. And God is expecting you to stand true to what you say. So that is the issue of discipleship. Disciplining your life after the Lord Jesus Christ, following Him, having Him as your Lord and Savior. I had an experience I want to share with you and I really wish I could not share this and I am going to share it because it needs to come out. Several years ago I was speaking to a young man and he was facing some real challenges in his life. He had been raised in a Christian home and I am not sure what went wrong with him but he was beginning to turn from what he had been given. And that is one of the lessons I want you to take with you today. Take advantage of what you have been given, whatever it is. Some have been given a lot more than others but whatever good you have been given, take advantage of it. Use it. Don't throw it away. And this young man was struggling. I remember him sharing with me and I was trying to figure out because I had known him off and on for years and he was in a spiritual battle for his very soul. And it seemed like at that point he was rejecting some of the temptations that he was experiencing and he was wanting to do what was right and I don't know where he was actually at at that moment but you know that it wasn't that long after that that he basically turned his back on the church. He turned his back on his parents. He wanted to go out and live the life of sin. I don't know how else to say it. He was drawn to that life.  And he was in that for a time and he got himself into some problems. He ended up in jail and I thought, now he's in jail. Hopefully God is going to speak to his heart and help him to realize that he got to change your ways. But he went, served his time. He came back out. See, he made his decision of what he wanted to do with his life. He found his own life. And things went for a period of time until one day I got a call from his brother and I still remember right where I was at at this moment and he said this young man was dead. And I said, what happened? And he said he shot up with some kind of drug. I don't know if the drug was tainted or if he overdosed what the problem was but that was it. And I remember sitting at his funeral just my heart aching beyond belief. Why? He gave his life. He gave his life for the wrong thing. You have an opportunity to give your life for something that really matters. Something of value. And for the glory of God. Not for shame. I talked about discipleship. What we look at is escaping Satan's traps. I'm going to share a number of traps that young men especially are facing and falling into. And you may be in some of these. I don't know. Hopefully not. But whether you are or whether you are not you need to be aware of these traps and you need to avoid these traps. And if you are in these traps you need to get out. Because some of these things can cost your very life. God's will for every Christian for every believer is that we would have victory in Jesus Christ. It's a part of salvation is not just the forgiveness of sins but it's actually where God teaches us how to live. Where we actually have the power of God the resurrection power of God in our lives on a daily basis where we are no longer in bondage to sin. It's not just a dream. It is God's desire for it to be reality in your life. John 8, 31 and 32 then said Jesus to those Jews which believed on Him if you continue in my word then are ye my disciples indeed and ye shall know the truth and the truth shall make you free. Hallelujah. It is Christ's ministry. It is His work for you to experience the truth which Jesus Himself is the truth and to find freedom from the bondage of sin. You need to understand that. If you are beaten down now in your life if you are defeated I've been there. Don't give up. But understand that it is God's desire for you to be free. It is God's desire for you to have victory. That is His intention and that is what He provides. Satan wants to keep us in bondage because when we are in bondage we are in trouble but we are also very ineffective in any work that we could do to impact anyone else in a positive way. First trap I want to look at is pride. Arrogance. Proverbs 8, 13, the fear of the Lord is to hate evil, pride and arrogance and the evil way and the fro-word mouth do I hate. I don't know if this is something you deal with or not. This has actually been a problem in my life the issue of pride. It is to view oneself as great. It is to think more of yourself than what you should. That is the idea of pride that we are talking about. The thing that God hates. Pride is irrational. It is self-promoting. It is self-deluding. It is self-glorifying. And a person that is proud has a skewed view of reality. They don't have the correct picture of themselves and their relationship with God and others.  You can't be taught. You can't be shown anything. You can't be helped because you already know it. You already have all the answers and you're bent on going your own way. Pride is something that God hates. It is something that God will not allow to stand. It is something that he has said he will deal with. He will bring the proud low. He will bring his own discipline. He will bring his own correction. And I know from personal experience it can be very painful where God will humble you until you realize that, yeah, I guess I'm not that I was. Beware of pride in your life and don't let it take root in your heart. Now to clarify there's a difference between confidence and arrogance. There's a difference between boldness and haughtiness. They're not the same thing. Proud people can be very confident and they can be very bold just because a person is confident and bold does not mean that person is proud. Confidence and boldness are actually things that come out of walking in the truth, walking in the spirit in your life and gaining victory over sin to where God is at work in your life and you're experiencing the power of God. So just want to make that clear sometimes people think a person that has some confidence not so much confidence in themselves but confidence in God. Confidence in the Word of God. Confidence in what God wants. That's not a bad thing. It's not really an indicator of pride. Humble yourself under the mighty hand of God the Bible says and God will exalt you in due time. Watch out for pride. Second trap, drugs and alcohol. Why is it that people use drugs and alcohol? I'm curious. Any ideas? Why would people use drugs and alcohol? Somebody said pleasure makes you feel good, right? It's to feel good. That's the primary reason that people use drugs and alcohol. I worked for a year at the Wayside Cross Rescue Mission in Illinois and it was when I was a young man 20, 21, 22 years old and I was... I couldn't believe what I was seeing. How people's lives had been totally destroyed through drunkenness and through drug addiction and these things to understand the danger. We need to watch out for these things. Proverbs 20 verse 1 says, wine is a mocker, strong drink is raging and whosoever is deceived thereby is not wise. Are you deceived by that? Is there an attraction there for you? Beware of drugs and alcohol. I think for a lot of us growing up in a family without these things it really helps a lot and maybe you don't have any desire there, I don't know but the pressure for some of these things and the lure of them is actually very strong in the world and many, many people get themselves pulled into this and become addicts and face all kinds of challenges as a result. The next trap is... I have a couple different things here linked together but they're kind of tied together. It would be the love of money, wasteful spending and the use of debt. Let's kind of put these together in one package and the thing that's happening here as far as I can tell with money is it's the belief that money is going to make you happy. If you had more money you're going to be happy. If you had the things money can buy you're going to be happy and this is a challenge that we face. Your happiness will not come from having more money. There are situations where having more money is a real blessing and money is something we need for expenses and get by. So it's not... we understand that. But having a lot of money doesn't make people happy often the opposite is the case. If you think that spending and buying and getting and having is going to satisfy you it will not meet the needs of the heart. It will not give you a lot of thinking. This is where a lot of people and young people especially get themselves into some different types of debt problems. Think about your life being useful in the kingdom of God being free to go where God may send you which could be many places. If you are in debt you may not be able to go because you have obligations that you need to pay. And so borrowing makes you a servant. Proverbs 22 verse 7 the borrower is servant to the lender. I think we know that verse. Borrowing puts you in a servant position. You become obligated to pay that back and you have to continue to do that over time. The reason that people borrow why do people borrow? Ask that question. Why would you borrow for something to buy it? Why? Can't wait. That's exactly right. The thing that borrowing does is it allows you to buy something today that you would either have to wait for or completely do without.  You're thinking that you have to have whatever this is if it's not a need you don't need it. You don't have to have it and it's something that you should at least put off and maybe do without. The way that you handle money and the way that you handle finances it tells a lot about you. It tells a lot about the discipline that you have in your life or the lack of discipline. And the skill there in saying no to desires and the discipline of that will be an asset to you as you work in the Kingdom of God. I know a young man right now he's doing remarkable. I mean he graduated from college top of the class he got a good job he's making good money and additional certifications I would say from the world's perspective he is on target to be a millionaire probably I would think within 10 years. The problem is he doesn't follow Christ. He turns back on Christ. It's a sad situation. But he has the love of money and he's seeking after that. The next trap sexual immorality and pornography. The desire of a man for an intimate relationship with a woman is a normal natural desire. It is not bad. It is not evil. It's not something that is of the devil. That's a normal thing. That's part of being a man. God made us. The question is what do you do with the desire? That's the real issue. What do you do with it?   And so as a young man this is an area that in our society has become just a major, major source of temptation in a battleground that is wreaking havoc in many lives. I would like to know but I'm not going to ask but I would love to know in the group that is present right here how many in this group have looked at pornography this month. I would love to have an answer to that. In most circles the numbers are staggering. It's just hard to imagine. In the old days when I was young and I actually fell into this trap and I was not seeking after it I actually found pornography without looking for it and I got sucked in and I was in bondage for a period of time. But in the old days my case was an exception you kind of had to look for this. You kind of had to take the initiative if you were going to be getting involved in pornography. Those days are over. Now it's looking for you. It's coming after you before it was stay away from it. Now it is defend yourself. You have to take steps. You have to guard your heart.  They're in your hand. It's everywhere. So this is an issue that I want to warn you and when you are involved in this there is a corruption in your heart which is happening which is somewhat difficult to explain. I've experienced it. The guilt the guilt is terrible and the fact that here I am trapped in this and yet I keep going back. I keep doing this over and over again. It's just destructive to the very human make up. Sexual immorality can cost you your life. Read Proverbs chapter 7 and you'll find out it has landed many men in spiritual ruin and it is a trap that the devil continues to lay and continues to lead in bringing people down. The last one that I want to look at is media internet and entertainment and it kind of ties into the pornography somewhat but this is sort of a different subject. I was raised on television. We had television. I spent hundreds and hundreds of possibly thousands of hours in my life on television and when I was converted one of the real battles that I had in my life was to break free from the television. It was a fight. Praise God I got the victory but I'll tell you it was easy compared to what we're dealing with today. With media all around us and always with us the the draw there the temptation things have really changed. I was at Pitt University this week on campus students were there. I was in the Cathedral of Learning fascinating building on the Pitt campus very large building like a cathedral. I was inside I just happened to look around and there were I don't know maybe 30 people around in there look what prompted me is I went over to a table and here are about 10 or 12 students every single student was looking at their phone not one of those people was in conversation with anybody else around that table. I looked at this this is strange and then I looked at the whole room and it was I think around 80% of the people had their phone okay I have a phone okay I use my phone the phone itself isn't the problem but it becomes a problem when the phone becomes a toy okay phones phones a tool not a toy. Tools are for adults toys for children so that was the problem with TV for me is it was a toy and it was also an instrument that Satan uses to bring images and to bring ideas and to bring temptations and I'll tell you what there is no way that I could watch TV and work through all that to keep the temptations away I couldn't do it I couldn't get victory when I was watching TV okay but I was able to get victory after the phone the computer is a good tool I use a number of things in real estate I'm an agent we have electronic signature now we have our listings on there showing requests I mean it's tremendous the time that is saved it's good but as a toy all the media and all of the glitz and all of the things that go along with that it's actually capturing the hearts of people I don't know if you've seen this or maybe you've experienced it your life is about your phone that's your whole life it's what's happening on the phone it's who you're connected with there it's what you're watching it's what you're pursuing if you remember back in the Old Testament if you remember this with Absalom he stole the hearts of the men of Israel and by doing that he was able to overthrow the kingdom Satan is using the same kind of strategy where through all of these things people's hearts are being drawn in and they're coming into bondage 1 Corinthians 6 verse 12 all things are lawful unto me but all things are not expedient all things are lawful for me but I will not be brought under the power of any is the phone is it a sin no, it's not a sin but if you're in bondage if you're addicted to your phone that's a problem you're under the power of it if you constantly watch things on your phone which you know go against what the Bible teaches and draw you into temptation that's wrong you're not to be doing that, you're filling your mind with garbage 1 Corinthians 10, 23 all things are lawful for me but all things edify not we want to focus our time and energy on the things that edify these are the things I have to share here the traps I've been in a number of these traps I know what it feels like if you're in these traps any of them I want to say this to you you can get out God can help you get out of that trap God can deliver you but it goes along with what we talked about at the beginning you have to be a disciple you have to surrender all you have to follow what God says you have to please Him God wants to set you free if you're not able to get free in your life if you are defeated if you are in bondage let me say this to you you've probably done that obviously reach out to God but if that still you're still floundering reach out to other godly men that you have confidence in I've become part of something that's been a real blessing to me and that is first time in my life here in the past few years I started meeting with a group of men and we just share we share what's happening in our lives we share the struggles we might be having we share prayer requests that we might have or seek advice problems or situations that we have I've seen in this in this group in just a short time I have seen God do tremendous things in that that was something I did not have as a young man I was kind of out there on my own but I encourage you reach out and find help because God wants to use you God wants to use you in the work of His kingdom God wants you to be someone who can actually be a blessing to others a person that can bring deliverance to others a person who can bring wisdom to others who can bring other people to Christ that's what God wants to use you for but to really be in a position to be used you need the experience yourself you need deliverance yourself you need victory yourself 1 John 2, 14 I'm going to close with this verse it's beautiful I have written unto you young men because ye are strong and the Word of God abideth in you and ye have overcome the wicked one hallelujah, is it true in your life what John writes God wants it to be true for every one of us so I encourage you I challenge you we want to be there for you as young men to help you become grounded and established in the faith and become useful as soldiers in the kingdom of God


The final city pass versus Novak Djokovic is the second semi-final for the men's event in Paris for 2022. And both guys have had different roads to get to this stage. The final city pass ended the tournament as the number five seed, and we'll get a buy in the first round. In the second round, you take on Dan Evans, who had just beaten Nakashima in a close three-setter. But this pose no problem for City Pass, winning through in straight sets, 6-3-6-4. In the third round, you take on the qualifier Mouté, who had just beaten Chorich and Nori back-to-back in very long matches. But the City Pass match seemed too much for Mouté with Steph getting through in straights, 6-3-7-6, to get to the quarter-finals. In the quarter-finals, City Pass would take on the unseeded Paul, who had beaten Rafa Nadal along the way. But unfortunately for Paul, this was where the dream run ended, with City Pass winning in straight sets, 6-2-6-4. Novak Djokovic ended the tournament as the number six seed, and got a buy in the first round. In the second round, he take on the serve volley player Kressi, and after a very close first set, where Kressi pushed Djokovic and pressured him, Noley eventually prevailed in straight sets, 7-6-6-4. In the third round, he take on Karin Hashinov, a man that he had played already three times in 2022, and after a frustrating first set, Djokovic got it together in the second, beating Hashinov again in straight sets, 6-4-6-1, to advance to the quarter-final stage. In the quarter-finals, Novak Djokovic would take on Lorenzo Mussetti, who had just come off beating Kasparud in a three-setter. And unfortunately, Mussetti couldn't replicate that against the best, losing pretty convincingly to Djokovic, 6-1-6-3, getting Novak into another semi-final in Paris. This year played ten times before, with Djokovic leading the head-to-head, eight wins, two losses. City Pass hasn't won a match against Djokovic for a long time. In fact, Djokovic has won their last seven that they've played, including one a few weeks ago in the final of Astana. If City Pass is going to win, he's going to have to learn from that loss that he had a couple of weeks ago in Astana.  He's going to have to be aggressive, maybe a little bit too risky as well, going for the backhand down the line, coming to the net, being aggressive, making it a little bit harder for Djokovic, keeping it unpredictable, is how he's going to try and maybe taking all that out. If Djokovic is going to win, he's going to have to just play again, the same way he's been playing all week, just keep his head, because he has got a little frustrated in the last couple of matches, despite them being pretty straightforward on the scorelines. He hasn't been as cool, calm, and collected as we've seen, and I think City Pass might get a little bit more crowd support, because he is the underdog, so he's going to have to block that out as well, no way, if he's going to get to another final. This is a very fun matchup, and we did see it a few weeks ago, and it wasn't that exciting, I guess, in the end, if you look at the score, because City Pass didn't really have a chance in that one. But I think City Pass might make a better match of this one, but I don't think he's going to win it. I think Djokovic is going to win this one in three sets, make another Paris final, and maybe set up the match against Oge Ali Asim, if Oge Ali Asim wins his, but let me know down in the comments below. Who do you think's winning this semi-final?


Good morning, everyone. Welcome to the third meeting of session 6 of the Delegated Powers and Law Reform Committee. Before we move on to the first item of the agenda, I would like to remind everyone present to switch the mobile phones to silent. The first item of business is to decide whether to take items 6 and 7 in private, as the committee can tell to take items 6 and 7 in private. The next item of business is consideration of an instrument subject to the made affirmative procedure. No points have been raised on SSI 2021-290. It is the committee content with this instrument. Under agenda item number three, we are considering instruments subject to the affirmative procedure. No points have been raised on the following draft instruments. Scotland Regulations 2021 and Social Security Advocacy Service Standards Scotland Amendment Regulations 2021. It is the committee content with these instruments. Under the next agenda item, we are considering instruments subject to the negative procedure. No points have been raised on SSIs 2021-280, 282, 288, 289, 292, 293. Thanks, convener. I'll just come in on regulation 292 if that's okay. And this is the town and country planning miscellaneous temporary modifications coronavirus Scotland regulations. And there's a particular aspect to this that I just want to query. As you'll be aware, under the coronavirus legislation, the requirement to hold public consultation events on potential building developments was suspended. So, in other words, you didn't need to hold them anymore. And this regulation continues that suspension until 31 March next year. Given that we are now allowed to attend all sorts of events, concerts, football matches, et cetera, weddings, I would simply query why anyone should be allowed not to hold a public consultation event. I don't think that we've had any explanation for that. So I think that as a committee we should write to the Government asking for an explanation. We could also write to the lead committee, which I think in this case would be the local government committee. I think that there's a related regulation, which comes up later 291, so we could perhaps include that in the letter. Thank you, Mr Simpson. In addition to that point, my experience of dealing with planning applications locally has been that online consultations have become more of a feature. In many cases, the online facility has increased participation in consultations in relation to planning, just because of the physical logistics of attending are much more straightforward. It might be another opportunity to request that whether there's been a study done about the effectiveness of that procedure, perhaps having online facilities as well as physical facilities might be a good thing to look at as well, whether they've reviewed the effectiveness of how those provisions have been undertaken so far. Thank you. Any other points? I think that certainly the point that you raised, Mr Simpson, regarding 292 and subsequently 291, I think that it's worthwhile for us as a committee to write to the relevant committees. I think that certainly the point that Mr Sweeney raised regarding the effectiveness of what's happened thus far is a worthwhile point, too. I think that it's worthwhile to write to the Scottish Government just to ask for further clarification and further explanation on those points. So, notwithstanding, there's a committee content with these instruments. The committee may never less wish to highlight that no policy note was included with SSI 221 280. It is accepted practice that, in order to assist Parliament's consideration of an SSI, a policy note should normally be prepared for every SSI. Also on SSI 221 293, the committee may wish to highlight that the Scottish Government has rectified four minor formatting and typographical points raised by the session 5 committee when it considered the principle order SSI 221 98 in March of this year. Is the committee content to highlight those points in its report on today's instruments? Under agenda item 5, we are considering instruments not subject to any parliamentary procedure. No points have been raised on SSIs 221 291 295, notwithstanding the points 291 that we just discussed. Is the committee content with those instruments? Thank you. I will close the meeting and move the committee into private. Oh, sorry. Sorry, Mr Simpson. Yeah, so we're not quite in private, convener. I apologise for that. I just want to raise an issue. We know as MSPs that we're going to be having a debate around vaccine passports. I don't actually know what we're debating yet because we've not seen any details. All I've got to go on is, frankly, what the First Minister announced last week and what I've read in the press. We'll have a debate, we'll have a vote, and at some point I would imagine that for something as significant as this, there would be regulations laid. My view is that there's a process issue here. A lot of the coronavirus legislation has been used, has gone through under the made affirmative procedure, so it comes into force, the law comes into force and then Parliament has a look at it. A lot of planning has clearly gone into this. The First Minister said last week that if MSPs prove it, she would like it to come in at the end of this month. I think that there is time to do what I would describe as proper scrutiny. I would argue that the regulations should be laid before they come into force, so we use a different process, not the made affirmative procedure. Given the lack of clarity around all this, the committee could be writing to the Government to ask what their plans are. Not the plans in detail, that's for a policy committee to scrutinise, but how they plan to proceed with this and what process they plan to use. I think that we could also flag that up to the Covid committee, which I think would be the main policy committee. Those are the points that I wanted to raise. Thank you, Mr Simpson. We would all agree that we live in different times as compared to normal political times that we have had pre-Covid. There will be a debate on Thursday, so policy matters will be highlighted in that debate. Your suggestion to write to the Government just to ask about the process is worth well suggesting. With the committee's approval, I'd be quite content for that to happen, for us to get that explanation as the DPLR committee. Your point about writing to the relevant committee, I think that that's a worthwhile suggestion, too, with the committee's approval. I move the committee into private.


What a play by Tannehill. He was dead to Wrights. He was being slung to the ground by Martin. He was on his back. He got away. Mahal with pressure. Landry, side! First right side, intercepted by 20, 10, 5, and zone. Kevin Byrd, the AMC defensive player of the month for October, starts November with a bang. Touchdown, Titans! Play fake, Tannehill looking. Firing right side, there's Brown. Brown at the 40, breaks the tackle, 30, 20, 10, 5. Touchdown, Titans! There! Is Arthur won? Play fake, Tannehill looking, throwing, catching, scoring. Tannehill get reelected after that. Titans needs one play. Allen tried to sneak. He got nothing for so in a quick. Lucas Oil Stadium. He was sad! Recognition! And then he hit the ignition to take it on into the end zone. How about these Titans? Situation possible. So Jacksonville, check. Buffalo, check. Kansas City, check. Indianapolis in overtime, check. Has the Titans on Monday night football hit front of a packed-