Hello, hello, hello, I'm Philip Magnus and I'm back with more of this on it. Yes, I'm still playing that, don't ask about it. Anyway, last time as far as I remember I could not find that Throon, perhaps I will have more success looking from the inside out rather than the inside in. We'll see, we'll see. It would be nice if I were to find it since, you know, collectibles and all, precious, darling and very important, let's not forget. Ah, someone is suspicious, not to worry. We shall end you soon enough. Too late, unfortunately. I do enjoy this game of murder-killing murderers. It's also a very chic experience. You both seem to have something. Unfortunately, you did not manage to move as in scene as it would have, well, suited you and forced me to mine my manners and not to kill you. Happens to the best of us though. You'll earn my boy. Actually, no you won't because you are very dead. Oh, and I believe there is a secret or a multiple pathway somewhere around. No, none of that. Probably should use my dark vision. Just to be safe, just to be safe, safety is best when you're at rest. Oh, I do not know why I hit him like that. I was just only meant to assassinate him in the normal stabby stabby neck neck way. Why am I calling you a dust? Anyway, let's move along. Remain on watch and kill him if you can. Maybe you'll surprise us both. Oh, actually managed to notice me. Funny. Well, it's not well enough. Our daughter did so much fun stalking you. Is this how you protected the Empress? No, not quite. You think you can hide from a hunter of men? Well, yes. Yes, I do. I'm pretty good at this war. I know your footsteps, Corval. Hiding business. You could put a sleeper out in your mouth. Shall I? Should I? Happen. Or perhaps close and personal? As he did with the Empress. Sweet dreams, little assassin. What?  Fine, we'll be messy then. Wonder if you can survive this. Oh. Oh, my. Whoa. Nice. One mate. I think it's mine. Are you fighting for the men poisoned you to die? This is wonderful fun. Calm out. Calm out. Greetings, boys. That was annoying. Thank you, whoever you were, to have helped me. But it is. Whoa. Ha. I did believe my bullet got you first. Ah, Daud. You never stood a chance.  But I preferred to do it while watching you in the face. Killed all your men as well. Empress Jasmine Coldwyn. Hmm. I have read this one. Oh, have I read this one? Let's see. Before Slugjaw ran the streets in the Distillery District, there was no boss more ruthless, violent, or dedicated to squeezing the average citizens for coined and black salae. Like so many from Morley, she was pale-skinned and green-eyed, with hairs black as the void. They say that she started young, and as a girl, she'd stun a man with her looks, coming upon him in an alle, and then smiled one-sided smile and suddenly run him through with a knife. She'd have his money be on her way before he breeded his final breath. As a boss, she was worse. Riding over the meanest street gang, Dunwall had seen up to that time. Her operation touched everything from shipping to prostitution. She then had a racket going with the Baikis Guild. A finger in every pie, indeed. One man, watch Captain Jules Robin, married his mission to stop her, and kept the case going for half a decade. Black salae met her end when Robin had his men light smoke fires in barrels near the warehouse where she hid out during the day, as she and her gang rushed into the street, terrified the building was burning. Captain Robin and his stop officers through nets over them, and round them all through with blade and pistol shot. Well, that is quite entertaining. Let's just see then. Anything else? No, I suppose not. Oh, Daud is... Hello, Daud. I have one more surprise for you. I asked for my life. When I killed your Empress and took her daughter, something broke inside me. Now I see the design on the back of your hand, the mark of the outsider himself. And I remember all I've done. The years of waiting for the right moment to step forward from an alley, and drive a night between the ribs of some noble. All the money exchanging hands from one rich bastard or another. Killing for one of them one year, then being paid to kill him in return the next. I remember bending at the shrines, listening as the outsider whispered that I was going to change things, that I was somehow important. Felt good. Made me believe I was powerful. But what have I accomplished more than you have or much less? Now I want nothing but to leave this city and fade from the memory of those who reside here. I've had enough killing, so my life is in your hands. Make your choice. All right. I'll let you live. And you choose mercy, extraordinary. Indeed. That was fascinating. I will be completely honest. I had no idea that I could speak with Daught. I actually, the first and only time I played through this, I just went behind him and I put him to sleep. So I never had this conversation, which is, I won't lie. Absolutely freaking awesome. I'm so happy. So, so happy to have witnessed this. I think I'm going to go search for that room now. Oh, I don't believe I'm close. Please tell me there's nothing awful and creepy around. It's just so nervous, of course there is. But hey, let's loot the coinage. Since I have almost nothing left to do. Okay.  Nothing. Nada. Nuh-uh. I can't find it. And honestly, I cannot be bothered. Sorry, Rune. Oh, damn it. I should have used the heart on Daught. I'm betting that she would have told me that she could recognize her murderer, or what not. Maybe if I use it on his, like, study. They bring the bodies here with rough hands, rough hands and cages. Huh, I like this. That's a lot of assassination targets. Is that Granny Rags? Who would hire him to assassinate Granny Rags? That lovely, nice old woman. Yeah. She's not. Let's enter the tunnels then, shall we? What? I don't even know where the bloody tunnels are, apparently. Perhaps if I exit this way, I shall find them soon enough. Did I complete his crew up just now? I probably did. Bloody hell, I'm so bad at following maps. If you have an assignment that requires that you travel to Russia or get see me, I hold the key. All right, you do? Oh, oh. Obvious much.  There it is. There it is.  Funny way to live my life, I agree. How many runes do I have? I have eight runes. Huh, that's a lot. Shall I stop time? Probably. Should I stop time? Probably not. The crew up the space time continuum, but hey, you know what? I don't care. All right. Do you believe I have missed no major runes as of this point? Let's see what awaits in the tunnel. Hey, what's up with the extra creepy music, mate? Yeah, of course, there's gonna be a rune there. Oh, lovely.  I'd call them brats, but really. No need for name calling. All right. So this is a ways off, isn't it? Honestly, I don't think there's anything living around here.  Oh. I honestly don't think there is anything I can do to help you lads. Sorry about that. Let's see, how can I get there? That did not work. Hey, that did. Great job, mate. Uh-oh. Let me guess. Filled with drowners and whatever their name is. I don't know if there's not going to be a proper good path this way, so I will have to find another way. Yay. All of this looks very apocalyptic. I was all interested in joining the sick and diseased fellows. This here painting will not bring me a pity penny. What a pity. Maybe this way? It seems to be my only option currently. Oh, there we go. Good, good. Excellent. That's how you do it. The outsider walks among us. That's a very astute observation, I will admit. Let's see, where was that pretty little ruin of mine? What's in this house anyway? Shall we explore? Dead men, probably. Plenty of them, if I had to guess. All right, all right. I got it. Might as well leave now, I think. I'm going to save the game, just in case the fog kills me, which it shouldn't because there's water below. I teleported right above the burial mound. My bad. See, that's why I saved. Let's see that. Gradual fall will do the trick for me. See, far easier and less dead. Let's see now what should I kill these two. They're basically hell hazards at this point. Oh, fine, I won't. Talk about my better angels, why don't you? Are you two guys going to try and fight me? Oh, mission clues. The plague wagon returns to the Fluted District every few minutes, as I have already seen. Oi! What the... I'm going to steal it from you. I'm going to steal it from you too. Okay, so I need to get somewhere and jump to the wagon. Or, you know, just pass the barrier in some other way. Yeah, I'm going to take the wagon. I actually probably could go back to that building and jump from there straight into the wagon. Or at least teleport, right? Seems intuitive enough, I suppose. I should probably not do that. I mean, there is electricity running along the tracks. And I could get to higher ground without getting back in that horrible, murdery building. Come on, wagon. So how have you guys been? Been good? Feel like leaving a comment? No? No. That's fair, that's fair. No, don't think we have. But, last for you to ask. Making conversations is great. A great skill that not many have nowadays.  Done got all day. Got people to kill. Daughters to save. Don't think I will be able to make it from here. Not as I had hoped. But hey, know what? I'm going to get back to my latest save. Fine, fine, fine. Unnecessary damage, I know. Let's get back to this here building and try and get the Orient Dead Express. That was such an awful attempt at making a joke. See? Easy. Should have done that in the first place. Now hopefully I will not die horribly. Although, I should probably save again, just in case. Woop-de-dee-dee-da, woop-de-dee-dee. And probably missing all kinds of goodies. Yeah, I thought that might have happened. But that's okay. I can still use it to a point. I must admit, I have forgotten most of this level.  Dammit. Dammit! I need to land to be a better shot. I suppose.


So hopefully everybody will be entertained. I know everybody thinks, you know what I really want to do at 5 p.m. is go to a talk that involves math. So yeah. So hopefully this will, excellent. Came from the math, stayed for the mustache. So that's me. I'm going to be dealing, I am Packer and so can you. I'm going to attempt to keep this to the 45-ish minute mark. So I can do some Q and A. Hopefully I'll get some hard questions. Hopefully I'll get some good questions. All right. Now we're on to the agenda. Do a little bit of an intro. Talk about the product, or not the product, the project. A little bit about me because why wouldn't I am up here? Give everybody a little bit of a refresher kind of techniques. Talking a little bit about the PE format, since that's mostly what we're going to be focused on today. Right, we're going to look at the data and pull out our magnifying glass and look at wins and zeros. Do a little bit of math. We're going to then look at the solution and then finally, we're going to look at the results. So the most important part, me. What do I do? Currently threat research at Bit9 Carbon Black. Right, those are my hobbies. Static analysis, machine learning. Anybody else from Texas? There we go. If you're in Austin, I will totally buy you a beer. I run a little project on a website called secrepo.com. If you guys are looking for various security data, I try to keep a somewhat updated and curated list. So everything from kind of bro logs and snort logs to other projects that have way more information than I could possibly host. Follow me on Twitter at sushi. And then finally, I may sometimes occasionally contributing member to the MSI project. Thanks, Alex. And feel free to tweet about this and use the hashtag secure because math? Because we are going to be talking about math. All right, so what's the main problem here? So I'm sure a lot of people are familiar with the idea of detecting compilers and packers and crypters and all sorts of other stuff, right? There's some good tools. Some of the tools are really old. So I'm going to pick on PID here. PID was written in 2005, right? So in essence, it's 10-year-old technology. Maybe there's a more interesting way or a better way to kind of manage this problem. So really the goal was set out is can we do something new and different? So we've got some goals. So we've got some great projects out there, right? Like PEID and some of the other ones. Yeah, they might be a little old, but there's probably still some validity. However, for this, we're going to try and adopt kind of a zero trust towards them. In other words, if somebody as an analyst says, oh yeah, this PID signature is verifiably correct, then great. We, being myself or anybody else in this room, can create a signature and kind of directly translate it into this new language. The other one is this easy to create signatures. So looking at PEID and some of the other associated tools, you've got to live in a hex editor, right? You've got to maybe open up IDA and find the exact pattern that you're looking for. It requires kind of a certain bar to entry. So the idea here is can this really be distilled down to something anybody can get value out of, right? So let's make it easy. And we're going to talk a little bit about the signatures as well. Cross platform. So running PEID on a Mac itself, right? It's a Windows program. That's not going to happen. There are a couple solutions to attempt to let you run PEID signatures on Linux, on Mac. They're really good. They're not as full features actually using PEID on Windows. So that's kind of a negative there. The other thing, once again, right? Simple to extend and understand. So in my opinion, what I'm going to start with here is kind of this base notion, this idea, present some data and say, look, I'm pretty sure this mostly works. And then hopefully somebody, multiple somebody's in this room or elsewhere will go, wow, that guy wasn't really dumb. He was only mildly dumb. And instead, here's a couple of enhancements, right? And the other thing that I really wanted to get out of this was this idea of fuzzy matching. So if you've got kind of something like PEID or another signature based language, generally it's the signature hit or it didn't. So instead I want to kind of introduce a notion of, well, part of the signature hit and this is about how much of the signature hit. So in other words, when I use this or when anybody else uses this for signature management, you can kind of figure out where your overlapping signatures lie and you can maybe be a little bit more effective kind of out of the gate. So this we're going to jump in, just an easy refresher, talk a little bit about the terms. When I say certain words, what I mean, it might be different from what other people said, so I want to make sure to do basic level setting, talk a little bit about the PE file structure. I'm sure all most of you in this room go home and dream about the PE headers. Probably not everybody does. All right. So this is a very simplified look of the PE file structure, right? You've got kind of this dust up at the beginning. You can get these other various headers, some of which are optional, some of which are only generated by certain compilers. You have this notion of sections, right? Some sections contain the code and some contain data and so forth and so on. This idea of resources, so if you ever look at, you know, a programmer executables icon, it's generally stored in the resource section. So there are many, many different parts. This is one of my favorite graphs and I apologize if you can't see it all that well. These are all the header values that you can have in a PE file. Now, keep in mind not all of them are required to exist. Not all of them are required to be filled out in an entirely accurate way, but this is what you can deal with. So there's a lot of things to mess with. They're color coded. So really as far as the PE format itself and the header structure, this is what we're going to care about today. This is the three basic things that I decided whether I'm correct or not. That's fine. But three basic features out of the PE header that I said these can be kind of interesting and these should generally vary enough from compiler to compiler or packer to packer, gripper to cryptor, that they should be useful features and kind of doing this type of analysis. The other one is number of sections. So things like UPX and a lot of other packers, right? Maybe they jam the entire executable and we'll get a little bit more into this in a second into one section and then just have their little tiny days section. So when I use the phrase tool chain, what I'm talking about is the set of tools used to develop software. So you have things like IDEs and linkers and compilers and all that kind of stuff. And each one of these actually leaves somewhat of a relatively unique fingerprint upon the binary that it creates. Now once again, you can manually go in and change these. Not a lot of people do. So for this, when I talk about tool chain, I'm actually going to go, we're going to talk about kind of the build environment. So GCC versus Visual C++. So packers, what are they? Packers are generally this program within a program. When I want to pack a binary, what I'll do is I can take the original executable, kind of smoosh it down and ram it somewhere inside this new pack executable. So I generally want to do that to evade AV, right? Make analysts lives harder because who loves or who doesn't love really stepping through our LED bug, trying to figure out how do I get the unpacked version of this in memory because this is just ridiculous. So at least if you know, you can identify what packer is similar to anything you've seen before, right? You know what steps you have to go through or maybe you know what tool to pull out of your tool box in order to do the unpacking. So there are really two parts to a packer. You get the packer executable that you run on the original file. This is the thing that actually does the compression or the obfuscation and creates this new executable. And then you get the unpacker. And the unpacker is generally this little stub that comes out in the new program that when this new executable is run, the stub is generally the first thing that is executed and it goes through and it kind of, you know, unpacks the original binary and goes, okay, now I'm going to run this. So really when I talk about packer detection in this context, I'm actually going to be referring to the unpacker or the stub, right? So unpackers, how do they work? So what you really want to do is you want to take control of the address of the entry point, right? So where when a Windows or P file is loaded, where should I go and begin executing code? So you want that to now point to your stub. And then once you unpack it, right, so maybe you decrypt it or maybe you obfuscated it or whatever it is, right? So you find the pack data, you kind of restore it, you get this little in-memory image. You've got to do a couple relocation fixes because it's not the Windows loader doing the actual loading for execution. You have to mimic some of that. And then you jump into the original program and keep going. Alright. So now on to the popular kids. So these are kind of the three, in my opinion, and there's probably several more tools that when people do compiler detection or do packer or cryptor detection, this is what they're talking about. So one before, it's nice, the signature language is pretty good. It's been around forever. It's my opinion, it's kind of the de facto standard. YARA has its own signature language, several projects that will allow you to take PEID rule sets, convert them to YARA rule so you can kind of update your analyst tools, but you're still kind of using this limited idea of what it is you're looking at or this harder way to describe data. And then this last one, this RDG packer detector, I actually really like their slogan. Alright. So now, now we're going to dig into data and who doesn't love data? And honestly, if you're going to talk about math and if you're going to talk about, you know, doing any type of analysis, if you don't use data and you don't understand your data, right, it's really, really hard to get good results. And a lot of times, data is really ugly, right? It's not this beautiful end result, it's this nasty thing you have to slog through and dissect and understand. So this is the data that I used in my testing setup. So I went and I found and I Googled and I threw together 3,977 unique PEID signatures. That's a lot of PEID signatures, right? So that alone kind of got me thinking, maybe we can address the signature management problem. We'll get some file sets, various sizes, right? Got smaller ones that I understood that I could pull apart and go, oh, okay, I get it. Yeah, these two are right and this technique seems to be working. And then we have this giant random sample at the bottom, right? So 411,000 files. Because everybody loves big data and this wouldn't be a math talk unless I use the phrase big data. So there you go. So that was kind of the end all after I felt comfortable with the technique and comfortable with the tool. What I ran it over to kind of verify and then did some spot checking with that giant data set. We'll talk about that as well. So let's get into some of the data analysis, right? So for this, there's a handful of slides. We'll go through them. We're going to talk about the basic exploration of the Zeus data set, right? So if I go back a slide, I think, yeah, there we go, right? So 6700 samples roughly is what these slides are based off of. There we go. Okay. So first thing I did was, all right, what happens if I run PID on these 6700 files? Well, turns out PID signatures don't match 4600 of them. Really disappointing. So you get some other ones, right? So this different UPX and another UPX version and, you know, Microsoft Visual Basic and Armadillo Packer, which I'm sure just by looking at the numbers you could probably make a relatively educated guess that maybe Microsoft Visual Basic 5.0 and 6.0 and Armadillo Packer are really, really closely related. So what is the, kind of those numbers, what do they look like in visual format? It's a bar chart. You don't have to worry about the numbers. That really tall line is the 4600. So it's kind of another way to visualize it, right? Just to kind of get into the idea that creating signatures is hard, right? It's not, it's not trivial. So having an easier way to do it would be great because then that really big giant, and I apologize for not using grayscale, blue box or bluish-purplish box, to make that smaller, right? To get more things that you can actually label and understand. Okay, cool. So this graph in my opinion is what science looks like, right? You show this to somebody and they're going to go, that dude up there totally did science. So this is simply a correlation matrix. And the idea being is you take all of these PID signatures and for files that had multiple PID signatures flag, you want to see which signatures flagged, right? With a high correlation or flagged, when one flagged the other one was very, very likely to flag. So the diagonal is basically the signature correlating with itself, which makes sense, right? Because every time a signature fires, it's going to be observed.  And while this one's kind of hard to view, we can zoom in on one little snippet of the graph. So this is kind of that upper left hand corner. And you can see that there are a couple signatures that are highly, highly correlated, right? So there's a lot of signature overlap. There could be signature overlap, right? In your environments, there's obviously signature overlap on the stuff I downloaded from the internet, right? So every time, you know, one of these ASPAC signatures flagged the other one did. And so with that, you kind of get a feel for, oh, this is, this is where I'm lacking or this is maybe where I have some duplication. So that's where we've got, we understand what PID looks like in a sample data set. So now looking at maybe some of the other features that we can use in addition to the header features that may allow us to definitively say or say with a very high probability that we're looking at, you know, a specific packer or a specific compiler. So we can use PDB strings. I love it when any type of malware author or any author in general includes a PDB string because sometimes it's like hitting gold. Sometimes they're awesome, right? And they're like, oh yeah, by the way, we're using the, this cryptor called Crypto Revolution, right? You know, it's our visual C++ project. Sometimes, you know, it's kind of random garbage. It doesn't really give you anything. It's important to keep in mind that these are just text, right? So there's no reason why you can't create your own. So for misinformation strategy, right? So now I kind of mention this linker version. So you've got these major and minor linkers. What do they look like in the sample set? So this is just kind of breaking down. So if you got the first one, right? Linker 2.5, 2,000 of them. So while you can group, you know, this new sample set or many other sample sets just by looking at the number of linker versions or those, sorry, looking at the linker versions of their count, it still really doesn't tell you the whole story. So we look at the number of sections and you can kind of see relatively similar distribution, right? You've got a big groups of files, right? That might indicate a specific campaign or something like that within the Zeus data set. And you can have this longer tail. So the thing we really wanted to look at, assembly mnemonics. So I think these are kind of cool. So the idea here is, right, when an executable runs, there's code. And that code, those bytes, can be translated into a mnemonic. And all the mnemonic is is simply instead of, right, the byte representation for add, it just prints out the word add. And it's easier for me and a lot of other people to understand. So the idea is maybe we can use assembly mnemonics to help understand exactly what it is they're looking at. Right? And Johnny 5 is live, but in order to get assembly mnemonics, you must disassemble. So, sorry, Johnny. So for this, Capstone Engine was used. I don't know if anybody's played with Capstone Engine, if you're looking for a free and a really awesome disassembler, it's great. I love it. Runs in multiple architectures. There's bindings from multiple languages. It's super easy to use. So the reason I call this out specifically is I'm sure a lot of you have noticed that every single time you run a different disassembler on an executable or some code, you will get different results. Right? So really you only get consistency within a disassembling engine. So if you were to write your own or use one of the other disassemble libraries, the technique itself would still work and that's totally cool, right? I'm not pimping completely Capstone Engine. I like it a lot. But the point is just to be consistent with this type of stuff. So then I had what I thought was a really bright idea. I was going to look at the correlation between assembly mnemonics, right? So every time an ad appears, how likely is it that a move or maybe a call or a jump also appears? Yeah, that was an awful idea. So we moved on. So let's get into some of the math, right? Because how do you not love math? Math is so fantastic. So going back to kind of the assembly mnemonics, right? These mnemonics describe the program behavior and that's kind of what we're looking to capture is what exactly is this unpacker doing or how exactly does the executable get set up, right? Because it's generally compiler specific or in the case of a packer or a cryptor, right? They have to know what to undo so they can then run whatever code they want. So we want to kind of capture this program behavior and that's what we're doing with these assembly mnemonics. So how can we look at these various assembly mnemonics? We looked at correlation. Correlation doesn't really take order into account. You saw the correlation matrix, it looked ridiculous, right? So imagine looking at that for 400,000 samples.  So there's this kind of notion of distance or similarity that fuzzy is if I have a signature I want to know how close what I'm looking at is how close is it to the signature, right? How similar are two things, this idea of similarity. So we'll talk a little bit about jacquard distance. Jacquard is awesome, it's cool, however it doesn't take order into account. The idea being that with assembly it executes an order. It doesn't jump around. I mean there's flow control and all that kind of stuff but generally if you see an add, a move and an XOR add is executed in that order and not move XOR add or vice versa. So while jacquard is great and it might be useful, the order I thought was pretty important to take into account. So there's this idea of leveraging distance, there's another cool distance metric, the number of edits determine the distance and position is important. So let's look at one of the examples of jacquard distance. So here we have two seemingly random sets of assembly mnemonics. So we can say the leftmost is the one at the edge of entry point so this is where the executable will start and then it moves from left to right. And you can see there's various ones. So the easy way to view of computing jacquard distance is to take the total number of shared elements divided by the total number of unique elements and that's your distance. So in this case it's move push which is two divided by the other set which is eight and this set membership is concerned these two things are have a distance of 0.25. And while okay and I just didn't quite feel right. So with Levinstein once again you have this idea of order. So how many things have to change to make one into the other? So this kind of fit the domain a little bit better. So once again kind of just doing a quick compare you know looking at if they're different so right there's one difference and then they're not different and so forth and so on. So basically seven changes are necessary to make one set into the other set therefore we get a distance of seven. So kind of what we were talking about before but code is executed in order there may be branches I really didn't want to build any type of flow graph or any of that kind of stuff I wanted to keep it simple and understandable and efficient. So in theory the assumption was what I worked with was on the left should be more than the assembly mnemonics on the right because it will execute starting on the left and it will finish somewhere off the right. And if there's a jump in there maybe I want to care about it but maybe I don't really want to care about this stuff after as much as the fact that there was the jump. So there were a bunch of testing and metrics where I tried to figure out where the cutoff was, how many assembly mnemonics were required so forth and so on and we'll get into that. We also have taken into account how big is the stub and if you don't know what you're looking at and some of these questions are really hard to answer. So we turned to taper levinstein and this I think is a really, really cool algorithm. So basically the idea is it's position dependent like regular levinchines except the ones on the left any edit to the left will have a higher weight than it adds to the right which kind of makes sense. So this is kind of a way to capture now we have, oh we care about more of the things that are executed first something like a branch or a jump right and now we have a language that's assembly mnemonics to kind of capture program behavior so we can put those two together and the way you basically calculate this for every single position is one minus the position of the thing you're looking at right divided by the length of the set so in this case there's ten things in the set so the first thing right requires one full edit the second thing requires zero edits and the third thing requires right .8 of an edit so you kind of go on and now you have a distance of 3.5 so to me this was great because it said yeah these things are separate and different but there might be some some sort of similarities the nice thing you can also do with levinchines is you can actually use it as a similarity calculation so if you want to use it as a similarity so it says basically those two sets are 65% similar so this is how the idea of saying oh we get this fuzzy hashing this kind of idea of similarity mixed into the algorithm alright so now that we've made it kind of through this great refresher everybody loves p files and their headers and all the various values and we have an idea of the features we're going to look at right where we're going to use we're going to use the major linker version these various assembly mnemonics number of sections we have some really fancy sounding algorithms that are actually really simple to understand which is great we have a way to do fuzzy matching awesome so what do we do well first step gather samples we already talked about the data sets so you know there are well over 411,000 samples that we dealt with so the second thing was let's get PED kind of this industry standard this thing that I'm very comfortable with I've used a lot in the past let's see what it looks like for everything then from there for every single one of the executables we're going to disassemble them because we need the assembly mnemonics and in this case we end up using the first 30 assembly mnemonics we'll get the header features we'll talk a little bit about clustering so you can kind of understand which PED files are similar based on these three features assembly mnemonics then when I ran this across all the data sets my threshold was this 90% similar so I felt that if an executable's signature and a signature that I was matching against were not at least 90% similar I felt that wasn't good enough to call it an actual match so one of the things that I started off using was banded minhash it's a similarity comparison optimization because I didn't feel like doing a lot of comparisons especially on 400,000 things however the implementation of banded minhash that I was using was broken so I wound up doing a lot of comparisons but luckily not by hand then we created signatures so we could test and verify so one of the things that I kind of want to talk about briefly is why signatures so everybody we live in this great age we're like oh my god security data science we have to do supervised machine learning and if we're not using random forest or run unsupervised if we're not using dbscan or k-means with k-means optimization you're just like no sometimes it's overkill right so one of the nice things about signatures in this case is we can use it to capture kind of this domain specific language but me or anybody else we don't have to worry about model drift so after you create this awesome machine learning model that might have great accuracy what happens when you get new data and you go to train it that accuracy begins to drift the model kind of gets out of wax so to speak you've got to keep going through this large process this is one of the issues with operationalizing machine learning but also the model will vary based on training source so if I trained it against only my apt one set well then it would be really good at probably finding things labeled apt one but it would be worse about trying to determine which packer or which cryptor is what right and likely everybody else will have different data than me so it really wasn't a good fit kind of that last bullet is really where I was going is simple right you want to play you want to do things you want to tinker sometimes machine learning is fun to tinker with sometimes you really just want to get something done so here's kind of what the signature language itself looks like so really really simple it's kind of highlighted to show you the signature and I'm going to go into a demo in a second but so the signature for Microsoft Visual Basic is the top line and then the parts where it matched on the file so you can kind of see those blue highlighted regions there's quite a few the ones on the left there's a really long run right so you get this similarity of .902 right because it required 2.9 through repeating edX and it accurately captured yeah the signature is relatively simple to the file and I feel pretty confident that this file matches my signature alright now let's move into a demo oh god I'm going to minimize that real quick I think we should be good I think I broke everything that's phenomenal yeah seriously alright this is what I get for doing trying to do like an honest I got demo huh maybe if I don't do it in full screen we can figure it out there we go it just hates full screen so I'm going to it's Asian guy showed up awesome it went from friendly math talk to clan rally kind of quickly I apologize so I scripted this out because I was kind of a chicken as well I didn't want to type commands really watching me type commands is boring so I'll direct your attention to the top kind of small box and walk through the demo oh god alright this really is I apologize you know what just sit there for like 2 minutes gotta want it that's alright if it doesn't work I have slides but I thought a demo would be way more entertaining for everybody third time's a charm third time was not a charm when in doubt try a different port oh maybe that's awesome if that was the case alright I really didn't want to like try and lean over you know what screw it I'm gonna unplug one more time we're just gonna go back to the presentation if anybody wants to actually see a demo I promise I literally promise it works I swear I don't promise it I didn't do I didn't do oh no no no I was trying to make sure that I think we're good alright screw you demo gods now you get completely unreadable slides so I'll try to describe what's going on there's two phases to this one there's the signature generation phase and that simply says run this one script on a binary that I can't even show on a computer that's what I get for trying to do a demo and generate the signature and all the signature is going to be is a simple list of assembly mnemonics and then give you this major minor linker version and then as well as the number of sections and then all you have to do if you're not giving a demo is run this other script that if you can see it that m m p e s dot pi on the signature and you can do all sorts of things you can give it a threshold so if your idea for similarity is different than mine right if you say I want to know everything that's 50% similar you can do that you can give it this crazy verbose so it says alright here's the signature that I have and here's what I'm matching against you can do that in case you really want to interrogate everything it also tells you when the major and minor linker versions match or when they don't match or when the number of sections don't match right it tells you how many edits you have and then the actual similarity so this is actually between two ABT1 samples and you can kind of see the signature generated on the two files on this directory the first one really didn't match all that well right it had this 0.844 required roughly four and a half edits but then this other file it matched exactly so all 30 assembly mnemonics were perfectly in order both the major and minor linker numbers matched as well as the number of sections and here's kind of a better description of the rule that you guys might be able to see alright apologies for the demo so let's look at some of the data sets we'll actually look at some of the bigger ones because again big data so we'll start with the ABT1 so for here this is kind of describing the clusters so in other words the like things grouped with other like things and it's two bar charts superimposed on one another with the color variations once again apologies for not doing it in grayscale so that very far one on the right the idea is PED found in that yellow thing and said this many things are similar and then kind of that green bar is the assembly mnemonic comparison of this many things were similar so kind of the cool thing even with having zero trust in the labels of using something like PED you get this anticipated view you expect a lot of things to kind of fall into a few buckets and then you get this really long tail that as an analyst is always a pain in the ass to deal with so one of the other ways you can represent this is kind of these neat looking bubble graphs it's not really science unless you have sweet graphs so this is just clustered on assembly mnemonics so once again kind of representing what you could see this one really large cluster and kind of these other ones the signature language and this work revolved around a couple other features so what do they look like alright so the darker blue is the actual is the group so in this case it's that big orange one is the big dark blue one and then within that one cluster right based only on assembly mnemonic similarity you know have kind of these three sub clusters based on number of sections and so this is kind of interesting right there's maybe a little bit of variation maybe somebody use this slightly different version of something so forth and so on likewise with linker versions I thought this was kind of neat there's you know very little in this sample set deviation for linker versions when uses a sub clustering and so then this is kind of a three dimensional or two dimensional view of three dimensional set of features so once again kind of that the dark blue is the assembly mnemonic circle and the dark blue is various sub circles kind of the one on the lower right hand corner you can see the cluster and then you can see one cluster that was actually based off of number of sections and you can kind of see two sub clusters in that and then everything else only had that one cluster so it's kind of cool so let's look at Zeus much bigger data set much bigger graphs much more science so this is what Zeus look like here with the little teaser you get this massive massive massive PID unknown label but the cluster one it actually it breaks it up so this one and the stacked one you can see the assembly amount of clustering on that yellow graph the yellow bar kind of in that blown up window is a little bit more manageable and you kind of get this slightly more gentle sloping curve but you get a lot of bubbles so either the end result is I shouldn't do anything in D3 or you should never D3 while you're high because both scenarios and badly so once again what does it look like if we sub cluster on a number of sections versus the cluster the initial cluster on assembly mnemonics you get more circles what if we do it on linker version you get these crazy sub spirals like things look so bizarre this was for me it was kind of enjoyable because it was a really neat exploration of Zeus and kind of a way to visualize this entire data set and then when you sub cluster on both you just kind of want to go home and cry it's never very good alright so I mentioned that I did something on 411,000 files which was awesome so let's talk about them alright this is this is just the assembly mnemonic graph so you can see there are tons of clusters based on similarity based on assembly mnemonics this is awful to read so one of the fun facts about this is roughly 5800 out of these 411,000 files are not 90% similar to any other file in this entire corpus I thought that was really cool and really surprising so this might be some polymorphic stuff it might be various crypters who knows but it was cool 5800 things is way too many for me to actually dig through right so we'll kind of skip through some of these everybody loves spirals and I really wanted to leave 15 minutes for questions so don't D3 or I shouldn't D3 I actually broke D3 on one of these my nest adjacent was too big it just wouldn't work so once again some cluster number sections and this is the one that I broke so this is where D3 just simply said I give up or you're doing it really wrong and it might very well be that I was doing it really wrong but it cried so there were a couple of really really cool things that popped out of this relatively large data set like Google Chrome there were 97 Google Chrome instances right hashes in this 411,000 and they all match the same signature right they all had this kind of same assembly mnemonic string and so they're very consistent with their builds at Google so if anybody's in the room from Google thanks I appreciate that they're very consistent with what linkers they have what linkers they use so out of the 97 kind of the take home is 94 of those 97 have matching linker versions matching number of sections and assembly mnemonics within 90% right this .9 distance so this is kind of cool and then it really wouldn't be a talk about Packers if they didn't talk about UPX because somebody was going to ask about it so this was kind of cool this was kind of telling I dug into UPX some in the past but this actually forced me to do a little bit more digging so I kind of cheated and I said all right what if I do this really really naively and just look for the string right UPX0, UPX1 or UPX bang in the file and said that's probably UPX right because once again I didn't want to test any prior solution and I wanted to really see how this kind of stuff stacked up so with the assembly mnemonics right out of just doing that simple thing through it it got 65 different groups and I thought shit now I'm going to be left off stage however there's some pretty cool results in here so you can kind of see in the table there's this group label and there's this count so that's group label the cluster label is just the arbitrary number that I assigned to it this group so you can kind of see once again you get this neat little slope and I was like all right so maybe there's some variations of UPX maybe I'm much smarter than I thought I was and I can do UPX version detection with this right maybe my head's going to explode or maybe I failed miserably and the answer is kind of somewhere in between so looking up against how it stacked up against PEID while I didn't trust the PEID results fully it was neat to say either you know me or and or every random person that I pulled signatures from on the internet were making the same mistakes or maybe we're totally onto something so kind of the cool thing was is here's the numbers it looks like you know maybe I was onto something after all there's also kind of that none I dug through that a little bit see what was going on and if this algorithm was completely failing it turns out there's a bunch of packers that basically wrap UPX which I really had much exposure to so I thought that was awesome so I learned a whole bunch there these kind of variations so right let's go through this recap the idea was easy to generate signatures had I had a working demo you would have literally seen me type one command and the signature would have appeared out of nowhere it would have been awesome but I can show you later I'm happy to it involves math right who doesn't love math it's cross-platform it's all written in Python because Python's the new old Ruby it's this capstone engine it's cross-platform it met that requirement it's mostly easy to understand it involves a little bit of math but hopefully not too bad even for 5 o'clock on a Friday and probably most important for me so even though the paper promised the demo it didn't work I'm going to release it online the guys at work were more than happy to say yeah you can totally release this tool and some sample signatures for people to play with and use that's the URL where it and these slides will live the updated slides because the old ones are on the CD so feel free to take a picture of it or you can ping me on Twitter however it's not up there yet because I'm a slacker so it'll probably get done next week and last but not least if anybody has any questions I'm more than happy to answer them so the answer is once you have all of this data what's the action and that's actually a really good question so aside from why did I do it because I love messing with things it's important in my opinion for any analysis to drive an action and the action is to understand what you're looking at as a malware or somebody looking for extra context right so if if I can kind of solve part of the signature management problem and you can get this idea of fuzzy matching out of signatures and what not and have fairly accurate signatures with very little low lift right when you're at your home organization and you've got man I've got this piece of malware that I've never seen and you go grab 3,900 signatures off the internet right you can go oh right here's a technique that uses these types of signatures that works that tells me how similar it is to some of these other things that other people have seen so it kind of helps give you a starting point for analysis and I'm going to go ahead and do some more okay there's your bullet what honestly I haven't looked at it much so I don't really know if I have a good opinion on it sorry anymore I mean it'd be awesome would you believe it oh if anyone's using it I haven't run into it so the question was have I run in anybody actually putting in the packer information into the packing the packed files my answer is no because I didn't run into it in any of my sample sets however even at 411,000 binaries given the number of executables that everybody talks about right that's still a relatively small sample set so it's nowhere near everything anymore question yep so does this apply to protectors as well or am I using packers on a broad side when I say packer I mean protectors, cryptors the whole gamut the whole idea that it's you want to obfuscate some intellectual property or something in a binary or someone to get the juicy bets anymore man was my math that much on point that not everybody fell asleep and nobody has questions on math alright cool so I'll be around if everybody has questions oh one more how do I make this mustache happen I think it is genetics it is math this is what happens when you do too much math you wear super classy this is I did yeah so I actually had a really long beard at one point in time and my wife hated my long beard because I told her I was going for wizard length so I said you know if I can have a long beard I'm going to have a long mustache now I sleep on the couch too much D3 exactly alright any more questions nobody alright cool thanks for coming I appreciate it


This study investigated the effects of omega-3 supplementation on uremic poritis in chronic hemodialysis patients. The results showed that the mean score of itching decreased significantly in both the intervention and the placebo group, with the difference being statistically significant between the two groups. Therefore, the authors concluded that omega-3 supplementation can be used as a therapeutic option for reducing uremic poritis in chronic hemodialysis patients.


Hello and welcome back to my channel. If you don't know who I am, my name is Claire Carmichael. I'm a third year adult nursing student. So today I want to talk to you all about what brought me into nursing, what made me realise I wanted to be a nurse. Some people, they were born into a profession, they knew from the very beginning from when they were like tiny, tiny, tiny. But for me, I had no clue. The first memory I have had of any career I wanted to do was when I was around, I think I was nine years old and I had a little post office set and I loved stamping things. So I wanted to be a post lady and I wanted to stamp things, either that or I wanted to be an official stamper for somebody. That was my main goals when I was nine years old. However, when I was seven years old, so let's rewind the time, take me back to my seven year old little self and I grew up with my nan and granddad and unfortunately my granddad, he passed away of cancer, but he hated hospitals, he refused to go into hospital so he wanted to be cared for at home and luckily he got those wishes respected. So I watched him sort of slowly decline at home. I remember not fully understanding what was going on but I knew something wasn't right and I remember seeing these amazing district nurses. This was the first time I had ever really remembered seeing a nurse and I remember them doing all these things with my granddad and I remember just looking up to them and thinking wow, these people are something special. These are wonder women to me. Who are these people? Why do I admire them so much? What is it about them that I love? I had no clue, but I knew I admired them and I knew that I just fell in love with nurses at that point. But even with that being said, I didn't realise I wanted to be a nurse. I knew I admired those people. I knew that they were doing an amazing job and how they were with my granddad and how compassionate and caring they were. I admired them about them but I didn't think that's the job I wanted to do. And then a little bit later on in life so I was 15 years old and my nan unfortunately got cancer and she passed away and I remember being 15 and I'm already going through my own hormones, my own emotions trying to find out where I fit into the world but to have to deal with my nan dying of cancer and not understanding anything. I didn't understand anything about how the body works, how it's affecting her, why she was losing weight, why suddenly her mobility's slowing down, why she needed a wheelchair, all of these things and I just watched her sort of deteriorate and deteriorate before my eyes and I didn't understand it and I didn't know how to help, I didn't know how to stop it, I didn't know how to prevent it. I didn't know how to care for my nan. This is someone that's always cared for me and it just, it was a really, really upsetting time and I think that was one of the other reasons why I wanted to go into nursing was to get that knowledge, to get that theory behind me so that I can help others and help care for others effectively with the knowledge behind me of what something's doing to somebody's body. I'll be able to care for somebody effectively if that makes sense so I couldn't stop it unfortunately and my nan did die, my grandad died and in this life there are going to be patients that die and you're going to have to deal with that but for me I, if I have the knowledge I can care for someone, I can give that person the best care possible during their last moments of their life and hopefully also prevent it, prevent it from getting to that stage, seeing the warning signs, seeing the symptoms, recognising all of those things as a nurse and saying to someone okay let's test you for this, test you for that, let's check you out, let's get you better treatment, let's slow this process down, give you a better quality of life, give you pain management, all of these things that I just didn't know back then and it frustrated me because I didn't know how to care for my nan, I didn't know what to do about it and it really upset me but this is why I wanted to do something about it, this is why I thought do you know what, no I need to do something about it but again like I've said I didn't know how to, I didn't know where to start, I didn't think I was intelligent enough, I didn't know how to do these things, I felt like a failure, had a lot of self-doubt, self-confidence issues, a lot of self-esteem issues, I didn't think I could be a nurse, I didn't think I was intelligent enough to be a nurse and alongside that I always saw nursing as a really high profession, I always thought you needed like this fancy education, I thought that you had to come from a family background of nursing to actually go into nursing and be a nurse if that makes sense, so I never thought myself as that sort of person at all, I literally, I came from a background of nobody went to university, all of my family lived in council houses, everybody had hospitality jobs, sales advisor jobs, working in vision gypsharps, things like that, so I never saw myself as being capable of being in a high profession such as nursing but I think my main point saying that was because with nursing and doctors, teachers, roles like that you need a degree to go into the profession, I didn't feel like I was smart enough to do a degree, I didn't think I had that intelligence to do a degree so being unable to do a degree, I couldn't do any roles such as nursing or doctoring because I just, I didn't feel like I had that level to go and do that so I did go and do other jobs that I could do without doing a degree, so then following that, when I, after I left school, I left school with literally nothing, I didn't have any GCSEs, I got a B for arts, a C for French, the rest were D's and E's, write them off because nobody wants D's and E's if you're going to apply to do your degree so this was another knock of my confidence, I literally had no confidence, I had no self-belief, I didn't know I could be a nurse so I did follow my mum's footsteps in the end and I actually went and worked as a housekeeper in a hotel which to be honest, I'm going to say this now, housekeeping was one of my top favourite jobs to do, it was one of the best experiences, I absolutely love it and do you know what if I wasn't doing my nursing now, I would probably still work as a housekeeper because it's such a great job, I had a great team around me, we used to put on the radio we'd make the beds, we'd have a dance, every day was a fun day doing housekeeping and some people might think what why do you want to do that but do you know what no, it's one of my favourite best jobs I've ever had, I worked in hospitality for five years, I make sure of housekeeping, waitressing, reception work, so then I was talking to someone and I was just saying I don't know what I want to do with my life, I don't really want to work in hospitality, I don't know where I should be in the world, I don't know what I want to do, I don't know where my career lies, it was actually someone's comment to me that said I can see you as a nurse, I can see you nursing and I was like what, I was like no I couldn't do that and then literally I think it was either that night or the very next morning I got onto the job search, I had to look at nursing and I found my very first residential care home position it came up and I was like okay care home what do I need to do to do this and then I had a look at the requirements I was like okay I don't need a degree to be a carer, they just want NVQ which you can do on the job it says I can do this so I applied for the position I explained about my GCSEs I said I've done really bad but I'll do whatever it takes to get them because I really want this position and luckily for me they said okay no problem we'll put you on the learn direct and get your level one and two IT enumeracy we will get you doing your NVQ two if that's the route you want to go into and we'll get you out there and we'll give you a job basically so I say yes this is amazing so in 2005 I got my very very first care assistant job which I absolutely adored it this home was one of my favorite homes it was just a little small home I think I had about 18 or 20 beds it was quite small really small team fantastic team fantastic manager we all got on so well we had a such a laugh every day at work it was amazing so in this care home was where I actually discovered my love for nursing I absolutely fell in love with caring of people I fell in love with looking after people I fell in love with the compassion the empathy the doing everything I can to make someone's life better I loved it and I would get the district nurses come and go because we were just a residential home we didn't have our own nurses so when we got the district nurses come and go I was constantly sitting with them I was really engrossed in what they were doing I was like this is amazing this is fantastic this is where I can see my career lie but again I didn't think I had the intelligence to do something like that so I never really questioned it and it wasn't until I worked alongside a really just I want to say this first she was amazing she was a great great carer the way she cared for patients was fantastic she was funny she was great but this one day patient wanted a boiled egg on toast and she come to me and she was like Claire don't know how to boil an egg and I was there like what do you mean you don't know how to boil an egg and like it really threw me baffled me because I'd always cooked for myself from the age of 16 17 so I never thought about how other people are and how other people can or can't cook or anything like that but to me I was like in my head it was so it's like a simple thing I was like but it's an egg everyone knows how to boil an egg and she was like I generally don't know how to boil an egg or you show me and I was like oh okay so I showed and she was like is that it I was like yeah so she was really surprised too so yeah so she just didn't know and she I just got an acceptance letter to go and do the nurse diploma back then our courses had nurse diplomas and nurse degrees and she got accepted onto the diploma and I was like how did you get accepted on the nurse diploma like don't you need a degree and all of this and she was like no no you just need your mvq2 and your mvq3 and you can get on your diploma and I was like I can do this I can do this definitely can do this and then I thought do you know what if she can't boil an egg and she can be a nurse I can definitely be a nurse I can definitely do this no offence to anyone that can't boil an egg but because of her inspiration that's what made me do my nursing so I knew what I had to do I had to get my mvq2s my mvq3s and then I could apply for the diploma however in my job within that residential home they didn't do mvq3s unless you were higher up in the rank so there was no positions going there was not really much room for progression I went to my manager and explained that I want to do my mvq3 but unfortunately because I was just a sort of band two care assistant and you had to be a band three to do the mvq3 there was no funding for me so oh it really it disheartened me that I had to leave but I had to do it for my own benefit and progress further and do the career that I wanted to do so I did unfortunately leave that position and then went to work for young adults with learning disabilities because they needed a team leader and then I could do my mvq level three so I applied for it I was I actually got the position of care assistant to start with and then I applied again for the team leader role because I didn't get it the first time round they said you just need to just push yourself a little bit more you need to come over with a bit more confidence in your interview sell yourself all of that something that's actually always been told in my interviews is I need to sell myself more so I am working on that but second time round I did get the position I became a team leader in charge of a team it was amazing really great experience and I got to do my mvq level three so I did it so I got on to my mvq level three and I finished it and completed it but by the time I went to apply for nursing which was in 2009 or was it 2010 sorry it was 2010 when I finally got round to actually applying for the nursing diploma and so I rang up the university I wanted to know how I went about it how I applied for it and then they told me really sorry don't do the nursing diplomas anymore they've been completely scrapped we we are a degree only now profession so I was just like what I was I was gutted if I just applied the year before or if life didn't happen I might have got in and oh I was gutted I was just like what I can't do this I can't do the degree again I had it in my head I wasn't smart enough and I'd heard about the 10,000 word dissertation in a degree so I was just like I can't do that I can't write 10,000 words of a dissertation that's not me I'm not confident enough I'm not smart enough I haven't got it in me to do something like that so that really really put me off applying for the degree just for my own self-worth and self-confidence was so low I didn't think I could do it however I did look into it despite all my fears all of my worries I did look into it and I thought okay so they need an access course to get on to the degree so I looked into that I looked at Walsall College where I actually went and I did my access course I finally plucked up the courage and it was a year long it was part time the class is full time but actually when you go I think it's only something like 17 hours so you can manage to work around the access course well I did anyway back then this was like 2010 so yeah so I did my access course and then after my access course I applied to go to uni and it has taken me a long time from then to here but um I knew that that's where I had to be where what I wanted to do and I went out and I did it all because of a girl that couldn't boil an egg and she inspired me to do that so hands up pool of eggs


Income tax 2022-2023. Child and dependent care expenses credit. Can you claim the credit? Part number two. Let's do some wealth preservation with some tax preparation. Most of this information comes from publication 503. Child and dependent care expenses tax year 2022. You can find it on the IRS website, irs.gov, irs.gov. Looking at support accounting instruction by clicking the link below, giving you a free month membership to all of the content on our website, broken out by category, further broken out by course. Each course then organized in a logical, reasonable fashion, making it much more easy to find what you need than can be done on a YouTube page. We also include added resources, such as Excel practice problems, PDF files, and more like QuickBooks backup files when applicable. So once again, click the link below for a free month membership to our website and all the content on it. The income tax formula, we're at the bottom in the credit area. Remember, in the first half of the income tax formula is an essence and income statement, although a strange one, the bottom line being the taxable income similar to the net income in a normal income statement. We then calculate the tax on that, not with one rate, not with a flat tax, but with a progressive tax system to get to the tax before credits and other taxes. Then we're gonna be dealing with those credits and other taxes, like the self-employment tax. Then we're gonna be dealing with the payments, which could be in the form of estimated tax payments and withholdings to get to the bottom line, the amount refund or amount due. Now remember, the credits are similar to deductions in that we like them both. However, if we could get a dollar credit versus a dollar deduction, then we would rather have the credits because we will typically get the full benefit of the credit in that case. Whereas if we got a dollar deduction, it would only decrease the taxable income and we'd only get a benefit that would be based on the tax rate. Also note, we're breaking the credits out into non-refundable and refundable credits, the non-refundable credits don't take the tax liability below zero because then it wouldn't be a tax system, but rather a benefit type of program, a welfare type of program, and the refundable credits are acting as a benefit or welfare tax type of program because they are extending possible benefit below a zero tax liability. Okay, that said, we are continuing on now with the child and dependent care expenses credit, noting that this is different than the child tax credit. The child tax credit is a fairly straightforward credit because you have a qualifying child to get the credit. These is going to be related to child independent care expenses. The major idea being that you are trying to be able to work, the taxpayers trying to be able to work and they have these expenses for childcare in order to do so. Okay, so now we're going to be continuing on. We have camp now. So the cost of sending your child to an overnight camp isn't considered a work-related expense. So the cost of sending your child to a day camp may be a work-related expense, even if the camp specializes in a particular activity such as computers or soccer. Let's take a look at an example. Example number one, you send your nine-year-old child to a summer day camp while you work. So you say, hey look, I sent the kid over to the camp so I can work over here. So you would think that the camp might be being used in that case as a means to be able to work. So the camp offers computer activities and recreational activities such as swimming and arts and craft. So the full cost of the summer day camp may be for care and the costs may be work-related expenses. So once again, the full cost of the summer day camp may be for care. So in that case, the idea being the cost is for care.  So you would think that if these other things are not the primary purpose, the primary purpose is care. You would think that you might be able to claim the credit, the rest is just a drop in the bucket, right? You have to, it's gonna be the other things that could be involved in it. All right, example number two. You send your 10-year-old child to a math tutoring program for 10 hours per day during the summer while you work. So the cost of the tutoring program isn't for care and the costs are not considered work-related expenses. So the idea here being that the primary purpose, this is my interpretation of the example, is for the tutoring and not so that you could basically work and therefore it wouldn't be something that would be constituting the credit which is designed for work-related credit. All right, transportation. If a K provider takes a qualifying person to or from a place where care is provided, that transportation is for the care of the qualified person. This includes transportation by bus, subway, taxi, or private car. However, transportation not provided by a care provider isn't for the care of a qualified person. Also, if you pay for transportation cost for the care provider to come to your home, that expense isn't for care of a qualified person. All right, fees and deposits. Fees you pay to an agency to get the services of a care provider, deposits you pay to an agency or preschool application fees and other indirect expenses are work-related expenses if you have to pay them to get care. So we're gonna say these are gonna be the other things that are kind of incidental but they're in the process of getting care, even though they aren't directly for care. So they're not, you could say, well, they're not actually for the care themselves but the end goal is for the care that you need in order to do the work. So however, a for-fitted deposit isn't for care of a qualified person if care isn't provided. Example one, you pay to fee to get an agency to get the services of the nanny who cares for your two-year-old daughter while you work. The fee you paid is a work-related expense because you paid it not directly to the nanny for the care but you've paid it to get the nanny for the care. So the end goal, the telos, the reason is for the care. So you would think it would qualify.  You later sent your child to a different preschool and for-fitted the deposit. So the for-fitted deposit isn't for care and therefore not a work-related expense. Household services, expenses you pay for household services meet the work-related expense test if they are at least partly for wellbeing and protection of a qualified person. So the house services gets a little bit shady in terms of the line of what it's for, right? But you would think that if it's for the qualified person, then those would qualify. Definition, definition. Household services are ordinary and necessary services done in around your home that are necessary to run your home. They include, for example, the services of a cook, maid, babysitter, housekeeper, and cleaning person. Well, how is my home working without all those things? And cleaning person, if the services were partly for the care of the qualified person. However, they don't include the services of a chauffeur, a bartender, or a gardener. Oh, just the bartender, that's the only one I have for crying, you excluded it. Just kidding, I don't have a bartender. Household, housekeeper. So in this publication, the term housekeeper refers to any household employee whose services include the care of a qualified person. So expenses partly work-related. So now they're partly work-related. So if part of an expenses work-related for either household services or the care of a qualified person and part is for other purposes you have to divide the expense. Here's where it gets a little messy. You gotta parse things out. You got a bit of it's going for one item, a bit of it's going for something else. You would think you would have to divide out the amount that might be qualified for the credit. So to figure your credit, count only the part that is work-related. However, you don't have to divide the expense if only a small part is for other purposes. So let's look at an example. You pay a housekeeper to care for your nine-year-old and 14-year-old children so you can work. The housekeeper spends most of the time during normal household work and spends 30 minutes a day driving you to and from work. So you don't have to divide the expenses. You can treat the entire expense of the housekeeper as work-related because the time spent driving is minimal. The time spent driving is just a drop in the bucket compared to the whole thing. So you don't need to parse that one out in that case. So nowhere do you have to divide the expenses between the two children, even though the expenses are partly for the 14-year-old child who isn't a qualified person because the expense is also partly for the care of nine-year-old child who is a qualified person. However, the dollar limit discussed later is based on one qualified person, not two. Okay, so now we've got meals and lodging provided for the housekeeper. So now you've got the housekeeper. You're paying the housekeeper, but they're also giving them meals and lodging. And normally, if you give someone something other than just money, it's still basically income. It's just in another format of income. And so then there's questions about that and what about these other items in terms of being able to take credit, for example. So if you have expenses, but then you could say that they might be in material and so forth. So we have the same kind of concerns come to play. So if you have expenses for meals that your housekeeper eats in your home because of his or her employment, count these as work-related expenses. If you have extra expenses for providing lodging in your home to the housekeeper, count these as work-related expenses also. Example, to provide lodging to the housekeeper, you move to an apartment with an extra bedroom. So you can count the extra rent and utility expenses for the housekeeper's bedroom as work-related. However, if your housekeeper moves into an existing bedroom in your home, you can count only the extra utility expenses as work-related. Okay, taxes paid on wages. The taxes you pay on wages for qualifying children and dependent care services are work-related expenses. For more information on household employers' tax responsibilities, you can see, do you have household employees later? So if you have like a household employee situation, then you gotta get into, well, do I have to withhold social security and Medicare and payroll taxes and all that kind of stuff too. All right, payments to relatives or dependents. You can count work-related payments you make to relatives who aren't your dependents even if they live in your home. However, don't count any amounts you pay to. One, a person from whom you or your spouse is, if filing jointly, can claim as a dependent. So you can't claim someone that you can claim as a dependent that you're paying for the care because that might be like a child or something like that that would be, you'd see weird things going on in that case. So two, your child, including stepchild or foster child who was under age 19 at the end of the year, even if he or she isn't your dependent. So again, you can think of people trying to falsify the structure of that pain, their own child and calling it an expense that you can take or a credit-related expense that you can take a credit for. So three, a person who was your spouse anytime during the year. So you can't like pay your spouse that was your spouse during the year and take an expense-related credit for. So four, the parent of your qualifying person if your qualifying person is your child and under age 13. So you can't pay the parent of the child because you think that would be kind of a related situation as well. So what's your filing status? Generally married couples must file a joint return to take their credit. So if you're married, you typically can only file married or married filing separately. But if you file married filing separately, you often lose out on these kind of credits oftentimes because the hours is skeptical. I was kind of skeptical. Of people taking advantage of the married filing separately to maximize credits, for example. However, if you are legally separated or living apart from your spouse, you may be able to file a separate return and still take the credit. So that gets into the state laws and stuff and say, are you really separated?  So legally separated, what is it? You aren't considered married if you are legally separated from your spouse under a decree or divorce or separate maintenance. So you may be eligible to take the credit on your return using head of household filing status in that case. So married and living apart, you aren't considered married and are eligible to take the credit if all the following apply. One, you file a joint return apart from your spouse. You file a return apart from your spouse, not a joint return. Two, your home is the home of a qualified person for more than half the year three. You pay more than half the cost of keeping up your home for the year and for your spouse doesn't live in your home for the last six months of the year. Example, Amy separated from her spouse in March. She isn't separated under a decree of divorce or separate maintenance agreement and uses the married filing separate filing status. Amy maintains a home for herself and Sam, her disabled brother. Sam is permanently and totally disabled and unable to care for himself. Because Sam earns $5,600 in interest income, Amy can't claim him as a dependent. His gross income is greater than 4,400. And because Amy isn't able to claim Sam as a dependent and she's still married as of the end of the year, she can't claim the head of household filing status. Amy's filing status is married filing separately and Sam qualifies as a qualified person for the child and dependent care credit. So because of the following facts, Amy is able to claim the credit for child and dependent care expenses even though Amy uses the married filing separately filing status. So that's kind of an exception to the general idea of if you're married filing separate that you may lose the credit sometimes in those cases. Okay, so Amy didn't live with her spouse for the last six months of the year. She has maintained a home for herself and Sam, a qualified person since she separated from her spouse in March. She maintains her own household and provides more than half of the cost of maintaining that home for her and Sam. Amy pays an adult daycare center to care for Sam to allow her to work. All right, example number two, Dean separated from his spouse in April. He isn't separated under a decree or divorce or separate maintenance agreement. He and his house haven't lived together since April and Dean maintains his own home and provides more than half the cost of maintaining that home for himself and his daughter Nicole who is permanently and totally disabled. All right, so these are sad examples. Because Nicole is married and files a joint return with her husband who is away in the military, Dean can't claim Nicole as a dependent and therefore can't use the head of household filing status. Dean's filing status is married filing separately and Nicole qualifies as a qualified person for the child and dependent care credit. So because of the following facts, Dean is able to claim the credit for child and dependent care expenses even though he uses the married filing separately filing status, Dean didn't live with his spouse for the last six months of the year. He has maintained a home for himself and Nicole a qualified person since he separated from his spouse in April. He maintains his own household and provides more than half of the cost of maintaining that home for him and Nicole. Dean pays a daycare provider to care for Nicole to allow him to work. All right, cost of keeping up a home. So the cost of keeping up a home normally includes property taxes, mortgage interest, rent, utility charges, home repairs, insurance and insurance on the home and food eaten at home. The cost of keeping up a home don't include payments for clothing, education, medical treatment, vacations, life insurance, transportation or mortgage principle. So they also don't include the purchase permanent improvement or replacement of property. For example, you can't include the cost of replacing a water heater. However, you can include the cost of repairing a water heater. All right, death of spouse. So if your spouse died during the year and you don't remarry before the end of the year, you must generally file a joint return to take the credit. So if you do remarry before the end of the year, the credit can be claimed on your deceased spouse's own return. Care provider identification test. You must identify all persons or organizations that provide care for your child or dependent use form 2441 part one to show the information. So now you gotta tell them who the expenses went to. So if you don't have any care providers and you are filing form 2441 only to report taxable income in part three, enter none in line one column A. Information needed. To identify the care provider, you must give the providers one their name, two address and three taxpayer identification number. So like with anything else, you paid someone for the care and the IRS wants to know who they are. The IRS sees people as numbers. So they wanna know how they can give get at those people, right? They want their name, where they're located and their identification number. So if the care provider is an individual, the taxpayer identification number is his or her social security number or individual taxpayer identification number. If the care provider is an organization, then it is the employer identification number, otherwise known as the EIN. You don't have to show the taxpayer identification number. If the care provider is a tax exempt organization, such as a church or a school, in this case, enter tax exempt and the space where form 2441 asks for the number. If you can't provide all the information or the information is incorrect, you must be able to show that you used due diligence, discuss later and trying to furnish the necessary information. All right, getting the information. You can use form W-10. You can find the IRS website to request the required information from the care provider. If you don't use form W-10, you can get the information from one of the other sources listed in the instructions for form W-10, including, number one, a copy of the providers a social security card. Number two, a copy of the providers completed form W-form W-4, employee withholding certificate. So if they're like a household employee or something like that, then you would have the W-4, so you can deal with the whole payroll situation as a payroll form typically. Employees withholding certificate. If he or she is your household employee, three, a copy of the statement furnished by your employer. If the provider is your employer's dependent care plan or four, a recently printed letterhead or invoice that shows the provider's name, address, and T-I-N, due diligence. What does it mean to do the due diligence to try to get this information if you couldn't get it for whatever reason? You gotta try, that's due diligence. So if the care provider information you gave is incorrect or incomplete, your credit may not be allowed. However, if you can show that you use due diligence and trying to supply the information, you can still claim the credit. So you can show due diligence by getting and keeping the provider's completed form W-10 or one of the other sources of information just listed. Care providers can be penalized if they don't provide this information to you or if they provide incorrect information. So obviously, if they're in the service of care providing, they should be able to provide this information if they're like a business of care providing, if they're an individual and whatnot, then you're gonna need to get the information in order to provide it, to take the credit. Provider refusal, what if they refuse? So if the provider refuses to give you the identification information, you should report on form 2441, whatever information you have, such as the name and address, enter quote, see attached statement, end quote, end the columns calling the information you don't have, then attach a statement explaining that you requested the information from the care provider, but the provider didn't give you the information. Be sure to write your name and SSN, social security number on this statement. The statement will show that you used due diligence in trying to furnish the necessary information. All right, US citizens and resident aliens living abroad. If you are living abroad, your care provider may not have and may not be required to get a US taxpayer identification number, an EIN, for example, an SSN social security number or EIN. So if so, enter LAFCP living abroad foreign care provider in the space that the care provider's taxpayer identification number.