All right. Hello. That's better. Let's try that again. Hello. Ah, there are people here. That's good. Okay, cool. Thank you. And hello to the people that are watching online. So today I've flown all the way from the UK to come and talk to you guys about remote team management. And this can be for anyone, right? So whether you're a leader in an organisation, a technical lead on a project, whatever role you feel where you are, helping lead or manage people. There is a Q&A at the end, but I don't like the sound of my invoice. So if you do want to stop me and ask questions throughout, we can also do that. And that applies to people in the chat as well. I have a very glamorous assistant that is moderating the chat. So a little bit about me. That's me. There's maybe less gray in my beard in the picture. But other than that, I've got the big belly that the podium is hiding. So in terms of a work sense, I've spent the last 15 years within STEM industries across four different companies. My background is non-tech. I am a people person. I come from a HR personnel people orientated learning development background. And CIPD is a Chartered Institute of Personnel and Development within the UK. I'm a qualified scrum master because I needed to speak the lingo when I was working with scrum teams. Insights discovery is a psychometric tool that helps me to connect with people. And Belbin is around another psychometric tool that helps people connect and work as teams.  I don't know why, because it is nervous and I reckon. I do coaching with people on a one-to-one basis to help them with their careers. But my main day job is as an engineering people lead manager at Collabra. So I'll talk a little bit about who Collabra are in a minute. But what that means is I have a team of people leads who are responsible for looking after the wellbeing and supporting a team of engineers. I have 100 engineers that are across 35 different countries. A little bit about me that's not work-related. I've been married for 10 plus years. I say 10 plus because then my wife doesn't challenge me when I get it wrong by a year or two. I have two boys from the UK if you can tell by this lovely English accent. I'm a gamer, I'm a geek or a nerd, whatever the word is nowadays. I say that because we're talking about managing teams remotely. One of the key things is about giving yourself and letting people know who you are behind the work persona. I did a talk yesterday. I shared this slide and someone approached me afterwards and picked up on the board game part and wanted to talk to me about that. So I think it's really important, especially when we're talking about remote or post pandemic, we take away the corridor conversations, all of those networking opportunities. We go now straight to task when we get on a call or in a meeting or if we're emailing. Where possible, I tried to promote the personal side of me. I would encourage you to do the same when we're talking about how do we connect with other people. Three key aims for today. The first one is to talk about what we mean when we talk about remote working. What is the flexibility of remote working? Looking at creating different opportunities to help people connect. We're talking about managing teams remotely. How do we do that? We're finally really, really emphasising the point that you cannot communicate enough. If you think you are doing a good job at communicating, you need to do more. Because in a remote environment, it's so easy to feel alone or get lost or not hear something or keep up today. I shared the picture of me with a big belly. That's because I like beer, I like food and I'm lazy. I said I don't like the sound of my own voice. I want to do a raise of hands for those that are watching online, just put in the chat. Who was working with people remotely before the pandemic? I love this. In the chat, if you were remote, put remote, if you were not remote, put not remote. Raise of hands in the room, working with people remotely. Nearly everyone, bit half and half. What is the chat saying? Anyone chatting? No one is chatting. That's fine. They don't have me looking at them like these guys do you say? We just did this. Let's talk about Collabra. Collabra have 150 people. We've been going for 15 years, we have 100 engineers out of those 150 people. Like I said, we cover 35 different countries. The little green icons are where we have office locations. We have an office in the UK, we have an office in Montreal in Canada. If you're based in one of those office locations, we would normally hire you as an employee. We hire engineers as open source consultants. Collabra is an open source consultancy company. Our engineers work in specific domains, if you will. We have kernel developers, we have multimedia developers, we have graphics developers that specialise within a certain area of the different FOS communities. You can imagine covering 35 different countries. That's super hard to connect with people. There are different challenges, different cultures, different backgrounds, different expectations. Different languages. I don't speak the best English for English people. When I'm talking to foreign people, that's tough. But we were remote long before the pandemic. Long before remote was like cool. Now one of the challenges is how do we look attractive to people when we're hiring the next bunch of open source developers? Spoiler alert, we're hiring. Talk to me after if you want to know more. Collabra sent me here for a reason, people. When we talk about how we manage those people, one of the things is the mindset of what remote working means. Work from home. That's a thing you've heard of work from home. We don't think about work from home anymore. We think work from anywhere. It doesn't matter when we talk about remote working. As long as you can get an internet signal, we're happy for you to work wherever. We have people that are dialing in to meetings with our customers on a train. Whether they're super productive is maybe a different thing. But we go by trust. We empower our engineers to have that flexibility. I told you I had two boys. A little bit about me. Before the pandemic, I was working for an organisation that was fully in office. The pandemic hit. I was forced to work from home. Suppose COVID went away and we all had to go back into the office. I was like that's not for me. I realised what was important, things changed. Collabra offers us that flexibility as employees, as people. If I want to help out with a school run, which my wife appreciates, then I can do that. If I need to go and pick up some dry cleaning, I don't know who's doing dry cleaning nowadays. But you know what I mean. If you want to take a longer lunch to do a run, which I used to do, then you can do that. One of the key things, when we talk about managing teams remotely, is instilling trust into people. Give them the freedom they want to work. We don't have nine till five mentality. It's difficult covering 35 countries, because for some people, nine till five might be mid-night till whenever. We allow people to work when it's right for them, as long as they do the hours that they're contracted to work for. When we recruit people, we don't test them. We will talk to them about their backgrounds, but we trust people have the skills that they say they have. We trust that they can deliver that work. We trust that if they don't or they need help, they can ask. One of my roles and one of the roles of a people lead within the organisation is to engage with our people so they feel that they can be supported and ask those types of questions. We also empower people to make their own decisions. I don't know if anyone's heard the phrase. It's better to ask for forgiveness than it is for permission. For the benefit of people online, people in the room are nodding. Maybe you're nodding at home. There's another collaborator here at the conference. He found a course. He worked within our machine learning domain. He found a course on AI that he wanted to do. It was a time-limited offer. He was in Poland and his people leaders in a different country. He bought the course. He broke process, but he felt empowered to be able to make that decision and then talk about it after. That's the thing that we're talking about with trust is making sure that these guys are making the right decision. We're talking about a business and understanding why they're doing what they're doing. We talk about the flexibility, the trust that we give to people when managing teams remotely. That's super important. They feel part of something so they feel infested and brought into it. The other thing that I want to talk about is, and I did it before, giving a piece of meat. This is my wife, they're my two boys. Super cute, they get it from their mum, not me. I've been a collaborator for eight months. The first thing I did when joining was creating an AMA. For those who don't know, that's asking me anything. I say that because I created this meeting. I asked the questions and someone said, what does AMA stand for? I thought, you're a techie, you should know this, but that's okay. The reason I did it is because I was coming into an organisation. These people had worked here and I needed to engage with them. I needed to get their buy-in. I needed to make sure they understood my purpose within the organisation and how I could help. I gave them information about me. I talked to them about my work background and gave them the credibility side and then talked about the human person. Within Collaborate we have what's called the engineering framework. An engineer will be assigned to a project and that project will have a technical lead. That's who the engineer will go to if they have questions of a technical nature. We have a business strategy lead that looks after a certain domain. I talked about them before. Kernel, multi-media, machine learning, graphics, XR, who they'll go to if the engineer has a problem relating to that domain. Then you have a people lead who the person will go to if they have any problems personally. The people lead is there to work with stakeholders across the business, work with those business strategy leads, work with those technical leads to get feedback and really help those engineers develop. Whether it's a personal development plan, whether it's training, what's needed, it's all about connecting with the person. I created a session. I said, hey, guys, come and meet your new people lead. You probably think you don't need it because you're technical and this is all fluffy stuff. You probably don't want that. I told you that there was that we covered 35 different countries. I had to hold multiple sessions. When we talk about remote team management, you can't have a one-size-fits-all approach. You can't just say, hey, guys, let's have a project meeting and expect everyone to turn up. You need to adjust and think about different time zones. You need to think about whether people are morning people, afternoon people. Again, we talked about culture. Are you booking into a lunchtime when someone's maybe having a siesta? I don't know, but you need to consider different time zones when we're talking about remote team management and probably doing things more than once. I held multiple sessions. One for the time zone, but also to create advocacy. The best way I was going to get people to come to these meetings is if their peers said, hey, actually, Dave, he's all right. He's maybe not always funny, but sometimes you should just go and have a chat with him. Think about that. Think about giving people time and space to make their decisions as well. You can't wall with an iron fist. You can't force people. That is management 101. The other thing you need to consider when we talk about remote team management is introverted people, right? How do they react when you're trying to engage with them through a screen? Probably used to it maybe in terms of typing. We use matamos as our instant messenger. Don't tend to use a lot of email, but again, some people don't want video calls, right? So what I did with the AMA was I created a structure, because if I had just said, hey, guys, come and ask me anything, it would have been radio silence, a bit like when I said hello this morning and I got like three hellos back. That's what it would have been like. So I created a structure to that session to engage with them, to start getting them to open up. The other thing that I did was what's called the balance wheel. Has anyone heard of the balance wheel? Okay, cool. So it's a coaching technique that I learned, and it really looks at two things. So the first one is it looks at the wheel of life, and it asks people to rate how they feel on a scale of 0 to 10 in each of these different sections. So this is an average of the scores that we got from our engineers Now, you know, some of those lower scores, right? When we look at fun and leisure at 6.1, this is October 2021, right? So, you know, COVID, okay? COVID is still a thing. You know, countries are sometimes still in lockdown. It depends. Boris Johnson in the UK is still eating cheese and pie. But like, but, but, but there's reasons why, right? And when I did this exercise, I also reported on the minimum and maximum. So it was very confidential data. I, you know, I got people to send me the wheel so I know whose responses are whose. But then when I shared it with my business, I kind of averaged it out and anonymized it. But it really allowed for a very quick way for me to come into the organization and see who needed help. Where were people feeling that they needed support? And the other balance wheel is the wheel of work. And that looks at, you know, some different sections. And actually I'm really, really proud that the work collaborate do because people were already super, super engaged and happy at collaborate. These scores are the highest scores I've seen within an organization when running this exercise before any intervention comes along. And so I want to drill down on that a bit, right?  But feel free to take those of the slides or of my glamorous face, I don't mind. And feel free to use it, right? And connect with me after and I can talk about how to get a better way of doing it. So this is October 21. And then six months later it goes like this. So you see the difference? Oi! So it gets bigger, a bit like my belly, right? So colleagues went up by 0.8 as an average, right? So 8.3, 9. Bad maths there, it says 0.8, it should be 0.7. If you saw it, I saw it. And the reason why is we started doing more engagement with people. We call them cluster calls and I'll talk a little bit about cluster calls in a minute and there's a couple of people in this room that saw me speak yesterday that heard me talk about cluster calls. But we started getting people more connected, right? Because we talk about managing teams remotely. How do we get people together? We have 100 engineers that are working on various different projects. So it's really easy to fall into the trap of feeling quite isolated on the project and then not knowing what's going on across the business or with other project teams. So cluster calls were a way of removing that. Leadership, right? They saw some active involvement. So we have had a huge period of growth, right? And we were hiring engineers ahead of hiring people to support those engineers. So now with this initiative, the Balance Wheel, they saw some real kind of engagement from leadership and support and so that resonated with them and that's why support also increased. I'm super proud that, you know, the average is 9.1. That is a huge, huge average number. Challenge and interest went up, right? Compensation went up. Unfortunately, not because of the Balance Wheel exercise, that's the annual pay review, right? I can't claim anything for that really. Personal growth and development went up. I talked about the aim of the people lead, gaining feedback, sharing that with these people. You know, I talked to you at the start about communication. Whether you were working remotely before the pandemic or after the pandemic, people are feeling alone when they're in a room by themselves. So if they get feedback, that's going to really resonate with them. They're going to feel that. Now, feedback is a gift, right? I'm going to say this, good feedback and bad feedback, right? Feedback to gift is however it's processed and taken. You know, good, constructive, whatever. But think about the last time you gave feedback to someone that you were managing or supporting and how that can then help them develop. So the reason why this segment probably didn't go as high as it should is because I was this, like, extroverted guy coming in from a non-technical background going, hey, let's chat. I needed to build a relationship with people, right? Before I started talking to them about their personal development. So about 20% of our engineers now currently have a personal development plan for the next one year, three year, five years. The reason why it's that low is because I'm not forcing it yet. We're still building relationships with people, right? It needs to feel natural and ready. By the end of the year, I'm hoping that's 100%, that's my aim. But I need to take it slow and steady. When we talk about managing people remotely, one thing you need to think about is everybody is different and you need to treat people like individuals. Matches with values, so this is a business matching with their own personal values and obviously we're open source consultancies so a lot of our culture manifesto matches that. And in a working environment and that's again creating kind of virtual ways of people working together. So a couple of other things we did. So virtual kitchen. So I didn't do this at clab, but I did this at my previous organisation. I told you that that was a fully office environment and we went into the pandemic. So what we did was we created a Zoom room half eight till half nine in the morning. It was a predominantly UK company. And we said, hey look, just come and chat, right? And the first meeting we did, which was two days after we'd got all sent home from the office, we had half the business on Zoom, which was a bit unruly and not great, but it was a great way of people staying connected and seeing each other. I told the business it was for the people and it was the business's benefit. It wasn't, I'm an extrovert, I just wanted to talk to people, right? I did it for me. But it was a great way of keeping people connected. And then we learned and adapt, right? So initially it was daily and people started tailoring off as they got used to working remotely. And then we changed it to Monday, Wednesday and Friday. Then, because we were British, we did an afternoon tea. We did one at two o'clock. Not everyone's a morning person, again, remember, adapt. And by the end, we were doing two a week after a year and we had 10 people coming on, right? A massive drop compared to the first time. But it showed you that there were 10 people within the organisation that still wanted some way to connect with other people. So again, when we talk about remote team management, how do we connect with people is finding different ways. And this was still a way of doing it. We also have a meet-up. So this was taken in 2019. Every two years, we get together for a party. It's like four days. There's like one business meeting. And then after that, it's just play, right? So we have a maker's room where people fiddle with hardware. We have Lego where people build loads of Lego that we've bought. We have a jamming space where people do a band. We have alcohol. Always the way. And it's a great chance to form relationships. So again, when I talk about remote team management, is there a way you can actually see people face-to-face? Not all the time, right? But is there a way that we can do this? I got asked by a collaborator, should I do this talk online or should I do it face-to-face? I think there's benefit to coming and looking people in the eye and seeing people smile and then I realise we're wearing masks and that's not happening, right? But I can hear laughter. So collaborator, every two years, tried to get the business together to connect, right? Because there's a difference in connecting face-to-face versus virtual. Our next one is next year in Europe. I can't wait because I didn't go to the 2019 one, but I've heard great things. So they don't want to talk about classicals. There's two people in this room that saw this yesterday, so they can't play along. Does anyone know either of these characters? It's not a trick question. Nope. Two fairy. That lady right there is a two fairy. So in the United Kingdom, and I imagine in the US, because the rock played it in a film, there is a two fairy. There is a little fairy that comes along and takes the teeth from the children and leaves money. In Argentina, it is not so. There is Raton Perez. There is a giant rat that comes into a child's bedroom and takes the teeth and leaves presents. I don't know how he carries the presents, but he is some super strong rat. He, in France, they also have a giant rat that comes into a child's bedroom, takes their teeth and leaves presents. And I give you this because I wouldn't have learnt that if we hadn't have had what are our classicals. So these are meetings that are run once a month by one of the people leads, and we get about five engineers together from across the company, so across different domains or projects, cultures, time zones, and we get them to just chat. Now again, when we talk about technical people, they might not want that. And actually we found when we did this originally that there was about 60, 55% participation rate of our engineers coming to these calls. We're not mandating them, it's just an opportunity for people to engage. And so what I did was I created a structure and I started with technical stuff. What are you working on? What have you been working on technically since we last met? Because people will feel confident, especially if English isn't their first language. I'm in the minority at Calabra that I can only speak one language, just about. Whereas a lot of people are either bilingual or trilingual within Calabra. But if you start off talking technically, people open up a little bit more and then we go into the discussion about, okay, what else is going on with you? Have you got anything else to share? And then you have some really interesting discussions. We've talked a little about Indian schooling. We've talked about different traditions around Christmas and holidays and this thing about that coming into the room which just terrifies me. So then the last thing I want to talk about when we talk about remote team management, please don't see this as screaming. You should not scream at people. But it's really interesting because I'm talking to people now around their performance. You want to try to over communicate. You want to make a conscious effort to let people know what you've been up to because they might not see it. You kind of got to get a bit better at blowing your own trumpet or celebrating the success of your team. Because if you don't promote the great work that the people you're doing are managing you, people might not see it. At Calabra, we are super good at communication. We have a very open and transparent culture within communications. So anytime we win a new customer or a new project, it goes out to the business. Whenever we have a weekly sales call, we talk about new customers, pipeline projects, anyone is allowed to come to that. We have quarterly videos that are recorded by our CEO that go out. We have monthly operational updates that go out from our CEO. So we are constantly trying to give people as much information as they want. The only time we won't share information is if it's legal or HRE type of stuff. But I think we do video, we do email, we do MatterMost, where we talk about new starters, new levers, projects, development. We encourage people to take ownership of channels if they want. We have something called guilds. I talked about cluster calls, which is like a people meeting. We also have guilds, which is a technical specific meeting. Anyone can create a guild within Calabra. They will become a guild lead, as long as there is interest from other people in Calabra. We have a kernel guild. They meet every two weeks. There's about 20 people in that guild. They'll do lightning talks about what things they've been working on in the kernel, or what project have they been doing that's specific to them and sharing their stories. We have a Rust guild. We have been investing heavily in Rust training because everyone at Calabra seems to love Rust. That was an interesting juxtaposition when listening to Linus yesterday. I hope it works. Guilds are another way. You've got the people side, and then you've got the very much technical side. Again, trying to adapt and communicate and share. Let's close off, because you've probably heard enough from me. Remember that start that I talked about? Work from anywhere, instead of work from home. Think about flexibility. You shouldn't expect people to be 9-0-5. If you allow them to work when it's best for them, you will get more from them. Understand that people are different, and there's different ways to engage with people, and trust and communicate as much as possible. Any questions? Thank you. Go on, shout and I'll repeat it. For the benefit of people listening, it was what is the format that I used for the AMA. The first thing was, this is an AMA, that means ask me anything. What do you guys want to know about me? It was literally a slide that said, what do you want to know? Tumbleweed, pretty much. I was like, they don't want to know about me. I feel unloved. Then I said, okay, work. This is who I am. This is my background. It led me to be in front of you at Collabora as a people lead. I said, this is about me as a human being. This is what you need to know. Again, I talked a little bit about my family, my background, my interests. I'm a Cub Scout leader. I talked a little bit about how I see that as a way of giving back to the community. Then trying to relate to them my understanding of community versus their understanding of community within a forced environment. Then I talked through how I wanted to help them and showed them the balance will. I showed them my personal balance will. Again, it's about being open. I shared my balance will and said, look, this is me. Can you do yours and send it to me? It will be anonymous, but it will help me understand you. Then I talked about what I will do next, my three month plan. I talked to them about setting expectations one to one. Understanding the projects they're working on, looking at their balance will in detail. Then I said, I'm here if you want support. That was the structure of that 45-minute meeting. It's a great question. For the benefit of those online, it was how do you communicate good news and bad news? I think it's about understanding the channel. There are multiple different channels for communication. That's a whole different subject and talk. You are not going to necessarily communicate bad news on that most with some emojis. That's just not the way to do it. I think it's about situation, urgency, and which channel is most appropriate. We'll do the room because people came to the room. We'll get to online in a minute. What's the time difference? Then I would say bribery. Incentifies. Joking aside, I think it's trying to show them the benefit. If they're not willing to do it, why aren't they willing? Do they understand what the aim is? Do they understand why it would be beneficial to them to collaborate? Joking aside, if someone ends their day later to accommodate for the other person, then they start the following day later. Talking about flexibility. I think that's probably the best thing. If not, and you have to go down, I'm a big believer of servant leadership and there's a whole difference between leadership and management. This is talking about managing teams remotely and I wish it said leading teams remotely. That's on me because I chose the name of the talk. I think if you can't influence them to show them the benefit, then I think it's okay trying to make it fair saying you guys you're going to do it this time and then the next time and then just sharing it out like that. Okay. Hey dude. It's so true because what we find with our developers is that they love what they do. So they're working and then they're continuing it for fun as a hobby and they're so committed so I have someone in Romania who is working for someone in the US, a company in the US. We found out he went on to a call at 2am his time. And I'm like, dude, don't do that. That's not okay. He was working, he was going on calls at 8pm because there in Silicon Valley and that's late for him so 8pm his time. But 2am is a totally different story and one of the things that we really focus on wellbeing and when I spoke yesterday I was talking a lot around we have a wellbeing committee. The people leads, what we do is we look at hours logged so because we're in open source consultancy we ask people to log their hours. And some of our engineers are working an extra 20 hours and then that allows us to have a conversation and ask why. Okay maybe if it's an isolated case then that's fine, we understand whatever but if it's a recurring thing then we need to talk about are we resourcing the project correctly. It's very much checking in with the people promoting wellbeing, promoting work life balance and trying to have that conversation and that's one of the roles of the people lead. I promise I'd come to you. Great question. Yeah. We have welcome lunches which I love. So we have like a virtual lunch in someone's first week where people get to meet and have lunch with people in their geography and we have most channels that are geography specific so obviously we have technical channels and off topic and other stuff but we also have somewhere for UK people to chat somewhere for French people to chat Indian people etc etc so on the first day what we normally do is if you're in a technical role you'll get your laptop and we'll ship your laptop and you can put whatever distro you want on it so our engineers can configure their machine to what they are comfortable using we don't mandate that again, we're talking about trust and flexibility we have a desktop support engineer that's on hand if they need to log in once they've gone through that process we'll ping in the collaborate chat and say hey welcome to this person our desktop support person will say hey welcome to the collaborate and then literally Malmo just gets flooded with hey hey hey like and that's been an interesting thing cos is that good or is that bad right but it's a way of making that person feel welcomed then they'll have a meeting with one of our we call them people operations not HR because there are human resources that's saying there are people so we want to have a people focused team so they don't have a meeting with them on their first day so they've got set up in a way they want that they're comfortable with they've been introduced to the business they've met our people team they've been given an onboarding ticket so we use fabricator as a way to manage tasks they work through the onboarding ticket and then they'll meet their people lead and then we have a buddy system and we go from there so like another engineer that's on hand that's been through that normally that's within their technical and then when they get on to a project their first project they'll have a kind of mentor on that project well loads of questions um yeah yeah um so pole EV is really good and I saw someone again using it yesterday so it's a bit like Mentimeter and you you can embed it into like powerpoint decks um and you know you just scan a QR code and you answer questions right um on zoom I use the pole functionality um if you are using Seam I think breakout reams are a great way because it can be quite daunting if you are in a call with 10 people right and you're asking people to participate so if you break that into groups of 3 or 4 and then and then come back and debrief that's a way of doing it um maybe like ice breaker stuff just to start with that's a bit of fun maybe checking with people and just a quick how are you or what did you do yesterday that's not work related right just something about them my favourite thing if we're in real life but you know it's remote right well and people take as many sheets of toilet paper as they want some people are going to take 1 some people are going to take 10 then they have to talk about one thing about themselves for each sheet of toilet paper um so yeah um is that enough okay yo ah yeah I didn't re-ask a question for the first audience so this one um the question was how do you promote discussion and bonding amongst a bunch of different Malamaze channels um that's a great question I think so one of the things that we allow our engineers to do is you know when we talk about time logging if people are spending a bit of time you know they can claim some of that time right like because if you spend 3 minutes in the chat here and 5 minutes in the chat here and 4 minutes in the chat there that time over a day adds up right so you know one of the things I do is I normally end up logging about 25 minutes a day on chat we don't want people to feel like the chat is a burden we want them to feel like they can they've got permission to go on there right like so again it's about when people on board and the people he's talking to them and we're looking at their time logs and you know one of the people lead responsibilities is how are these people spending their time um each month you know if they're using that and just promoting that and just encouraging them to use it as a discussion tool and then finding other ways right I've not in my entire time seen anyone say we need to stop this chat get back to work right like it's just not a thing you know and we have our CEO on the chat asking people for ideas you know what's next in remote working he wanted to one of his ideas was shipping out VR headsets to everyone and having meetings in VR right like but you know across all levels so it's about demonstrating that behaviour I think that's a key thing when we talk about remote team management and leadership it's about role modelling the behaviours and I think if staff are seeing you know our top level managers right and it's it's not very hierarchical at the collaborate you know it is very open um and transparent but if they're seeing people role modelers behaviours they feel empowered to do it at the back I don't know yeah you so for the benefit of people online the question was long that's alright so the question was no no I'm joking you know I'm joking so the the question was around people not engaging with with activities and does that indicate burnout or lack of engagement in culture and company and I think it goes back to what I was saying yesterday and also today right is everyone's different um I think that just because someone doesn't want to engage with an activity doesn't mean they're they're wrong right you know our culture promotes uniqueness one of our we have what's called a culture manifesto and one of the things there is be true be you right we're hiring people and we're kind of checking them at that stage we appreciate people for their differences we are stronger as a team and as a company if we have different voices around us right if we were all the same or we were all for the same way now I'd be boring and we couldn't move forward um so we appreciate uniqueness um I think sometimes if I'm honest it could indicate burnout right like and that's what mine and my team in terms of the people leads that's one of our things that we need to check right and that's why the business has realised there's a need for this this hybrid role that sits between our technical leadership and our people operations team you know that's where I fit or squeeze or however you want to call it right like because that's that's our responsibility to understand and make that judgment called is it burnout wherever the culture question is are we doing enough right as a company I think if we can try and offer different ways people will engage with one of those ways and if they're only engage with one then they're only engage with one if they engage with 10 then they engage with 10 right if they don't engage with any maybe we're not doing we're not doing it right as a company or maybe we need to have a conversation with that individual and understand why cool cool no worries one down here and then I'll take from the back but it is easier said than done so what do you think about that so for the benefit of the online people it's how do you how do you manage where life balance in a remote environment right and you know one of the tips I gave people early on when we went into to lockdown that struggled with this is walk walk out your front door walk around the block and walk back in create some kind of physical way of differentiating home and work right also try and create a proper set up so don't you know so many people especially when we went into to lockdown right it's about making sure you have the right environment to work so you're not in your living room or your bedroom or at the kitchen right try and find that space and that's easier said than done as well in terms of of money and where people are at and things like that but it's about trying to create a separate space how can you try and create a physical separate space to change that mindset I think that's one way again the people needs a layer to check to pulse check our people and understand what's going on with them I'm really bad for it I leave my laptop on right don't do that that's just because I mean I do it so I can escape my children but I have an I have an office so I'm a two story house I have an office which was our spare bedroom my wife hates it because I've now filled it with Lego and my work stuff and we'll go and bath them and she'll bath them and I'll go and work because I've left my computer on so stuff like that turning turning things off shutting stuff down because then you're turning work off I think it's still a I think it's it's really about self-discipline for the individual as much you know we can talk about managing people remotely but there needs to be an element of self-discipline as well do you want to take sure you do one question at the back I've got another question here oh thanks do you guys you guys can go if you want like don't feel okay all right we'll do yeah great question so how do you how do you encourage people to recognise as a group different working cultures right by talking about it by raising awareness so an example is we have some people based in India right and we have some people based in the US right and they are and then the European the customers in Europe so we had to change the way that we were running calls so that we could accommodate the people in India still started going on to the US schools which was like 9pm their time right and then I was getting asked why are the why are these people still going on the calls and it was a conversation around we've told them they don't need to but they want to and it's trying to educate people within the business and the company and people that you work with about those different working cultures I think it's an education piece okay let's try and do these virtual ones real quick yeah honestly I don't mind if you guys want to go get lunch you can go get lunch I won't find it rude okay let's go yes there is a so at Collabra we promote open source right so we use open source technologies as a tool but I can't think of it off the top of my head so I will try and update my slides that are on shared with some information ask Logan what he means by that okay great question but most of our conversations in a personal sense are done one to one right so on the cluster calls where people are opening up I think one of the big things that I try and do is kind of create a created contract and what I mean by that is a verbal contract where people agree what's discussed on this call stays on this call right that we are open and I ask them to add to that contract and then when we talk about what's said if it's anything that is specifically personal that's related to them we will probably take it offline so I was running a leadership development program workshop someone shared something very personal about their father rather than pursuing it within that group of eight engineers I then took it offline we had a separate meeting so I think it's about again understanding the channel and the sensitivity of the topic so that you don't have the issue of over hearing and break of trust cool yo great question and I've run out of water I think I don't have an answer to that I would need to think about that cool alright thank you for giving up some of your lunch cheers guys


Alright, I'm going to hand it over to your speakers, please give them a warm welcome. Uh, hello, uh, to the talk, all the 4G module could be hacked. And here is our team, and we are from the Baidu Security Lab. I'm Shupeng. I'm Huan Zheng. Uh, okay, uh, uh, let's introduce first, uh, his agenda of today's talk. First of all, we will introduce the fundamentals of the 4G module. Secondly, we will introduce the new attack surface of the 4G module. Thirdly, we will discuss what needs to be done in order to carry out a successful attack. For example, obtain the firmware, get a shell and so on. First, we will, uh, talk about various ways to discover the vulnerabilities. And last, we will provide some better defense practice based on our appearance. Okay, uh, this picture show, showing more than 50 various 4G module and the devices we have studied. Uh, the tools about, uh, some 4G routing device and some, we call 5G devices. Yes, uh, many vulnerabilities of the 4G module we mentioned today, uh, also is it on 5G. Uh, in the middle, there are some party boxes and some portable Wi-Fi devices. Uh, down the bottom, uh, there are all kinds of band or 4G modules, about 30 can. Uh, most of them are PCI interface and LCC packages. So, uh, what we have found, we have found several general vulnerabilities taste of different baseband chips and, uh, risk in several V2X 5G modules. And RCE, uh, RCE in more than 5 cards, T-box and, uh, vulnerabilities in all parts of the 4G modules. Uh, because vulnerabilities repair is a long process. Uh, so we just show, uh, just show you the vulnerabilities which will help be fixed, uh, in this slide. Okay, uh, why do we do this studies? First of all, we found that not many, uh, not many people have done relevant research in this direction before. And, uh, no one is aware of the security problem and the wide impact of the 4G module. So, we want to shed a light on more, uh, directions of security search. For example, uh, CAS now have, uh, networking traffic, uh, networking functions. But, uh, it seems that no one has attacked the T-box, uh, it's called, uh, sometimes it's called TCO. Uh, there are also security issues with the baseband. Uh, baseband security is really important. The researchers, uh, usually talk about the baseband security or COCOM and Samsung. In fact, there are many other baseband chips such as, uh, Intel, Huawei, ZT, MTK, uh, Marvel, UBLOX and so on. And compared with mobile phones, it's easier to analyze through the 4G module. Uh, we will also introduce some new and effective attack surface and methods. In short, the goal of the thread is not only to introduce some special, uh, one base or the 4G module, but also to provide you with some new ideas, methods for a successful attack. Okay, we can see the 4G module everywhere. LTDS could connect to the Internet through 4G modules. For example, we can control car remotely by the APP. It seems the communication system of the car is online all the time. Maybe some process establishes and maintains a long-running TCP connection. Uh, there are other devices such as like 4G Wi-Fi, 4G router, TK1 new machine, uh, our laptop and some industrial, uh, device, even the slot machine in Las Vegas. Uh, there are uh, there are many three interface, uh, interfaces. In fact, uh, uh, internal structure is the same, we will say later. Uh, on the left is the circuit board, the stress-order, winding machine. Uh, we can see a module with mini PCI interface, blood in, in on the red. Uh, there is actually a ARM processor motherboard, uh, running Linux or Android system. On the red, uh, is the TELUS mode 3 4G module. Uh, which implements, uh, navigation, mobile, remote, control system, upgrade and other functions. Uh, the module is attached directly to the motherboard. Uh, in this slide on the left is the industrial 4G route. Uh, we can see this, uh, mini PCI interface module on the motherboard. In fact, it's a common route as the slot to implement the function we in the last, uh, the DS on the red is a bit special. It's a powerful Wi-Fi device, but it doesn't have a separate 4G module. It uses the ZTE-ZX chip sign. In fact, it's also a 4G module. The chip in the module is attached to the PCB bulb. It should implement, uh, implements networking, driving Wi-Fi, running HTTP service and other functions. Uh, there are many other devices designed in this way, uh, such as some local 4G route. Uh, let's look at the structure of the 4G module. In fact, uh, the 4G module is a complete computer system. ARM, CPU and baseband system are integrated in, um, man control chip. They all use the NAD flash, which has a large shortages with and the locales. And, uh, they are on, uh, they are other chips such as power measurement, uh, radio from PCI chip and so on. Uh, let's look at the software. Most of the 4G modules are embedded linear system and a few RTOS systems. Uh, okay, this is a picture of the internal, uh, in that, in, in the structure of the Qualcomm EC2 zero module with, with the top shade removed. Uh, the memory chip is NAD flash plug, uh, DRM memory, which is integrated into a chip. Uh, by looking at the model, the flash is the BJ162 point. Uh, if we want to read or modify the data inside, we need to buy the corresponding chip socket. Uh, so how do the module work and how should they be used? We can see that the upper left corner is the LCC module, or founder technology. We build a minimal system for it, including power, uh, supply, uh, SIM card, uh, USB interface. Yes, uh, RDS communicates with the 4G module, use the USB cable. First, we need to install the corresponding drivers in the operating system. Uh, when the module is plugged in, uh, the operating system loads the corresponding driver, uh, according to VID, PID and the interface number. Uh, then the system generates a network card and gets, uh, the corresponding IP address. Then it sets the internet. Uh, the 4G module usually supports multiple connection mode and each mode has different kernel module or drivers. Uh, for example, uh, the upper part of the slide shows the PPP and ARM NT mode. Uh, when the dialing is successful, the device will get an IP address from the operator. Just like the IoT device directly gets a public IP address. Here, uh, the Venn Zero network statement is also considered a public network address. Another way, for example, in RDS, uh, or ECM mode, the 4G module usually has two network cards. Uh, when the dial is faster to get the public address from the operator and another network card is connected to the IoT device, using the 2 network statements. It looks like the 4G module becomes a router and the IoT device sets the internet through this router. The second part is the battery can or stands. Uh, here I marked the R-NDS and ECM mode because this, uh, these two modes don't require additional drivers, uh, particularly convenient to us. So now, most, uh, most of the 4G modules are using the modules, uh, using this mode. Uh, the T-Bus in the car is this way. So you'll see the security of the 4G module has turned into the security of the linear system, uh, is put out in the network. Uh, let's introduce some new test, uh, tackle surface. As we said earlier that, uh, muscle, the 4G module has, have a embedded linear system. So, whether they are operating system, uh, many reasons such as supporting 2, 3, 4G which requires a computing result. And, for example, automobile manufacturers often need to run their own program in T-Bus to achieve remote control and other functions which requires, uh, require modules with secondary development. Uh, now let's, uh, end as a text surface of the 4G module. As we said just now, all the current 4G modules have a complete linear state, uh, linear operating system. At the same time, we found that most of the modules now use the R-N-D-S or ECM networking modes. It, it means that the module will be assigned a separate IP address. This provides a chance or a talent. Linear to open your system often has some listening parts, or, uh, connect to the cloud for OTA after this, or remote management. Uh, now it has a separate IP. Uh, we can directly access the, this path, uh, intercept its IP link and do some MITM attack and so on. So, now the, the, the, the attack is essentially the task to address the hot system, the security. Uh, when the linux hot are exposed to the internet or internet, uh, but wait, it's the same that we kind of set the, the separate IP address in the same line, such a Wi-Fi hotspot. Uh, let's talk about some more attended text surface. Uh, the 4G module is a wireless cellular device connected to the operator's network, but some operators are due to, uh, configuration errors, don't have network isolation. So, clients can access, uh, IP or each, uh, or other devices. And, uh, all the 4G modules, about 2G GSM mode, because of the security problem or GSM, we can use a feedback station to monitor and modify traffic. Uh, also can obtain IP links and, uh, set paths. And there are also many third-parts, uh, service and added to the module, such as the car control service. Uh, now let's summarize the attack ideas. First of all, we need to collect enough information on the equal low, uh, vulnerabilities, uh, uh, under equal low, it's when, uh, vulnerabilities will get a shell, firmware, uh, network, uh, uh, uh, network of traffic on that and so on. Uh, there may be a lot of, uh, reverse engineer work here, uh, mainly analyzing the process of various listening paths. Then we need to consider how to run the, our attack code and, uh, we introduce the, uh, traditional method. Uh, mainly in that network such as Wi-Fi house both and, uh, uh, to assess the part of the 4G module to attack. And the new attack method, we can use the incorrect configuration of the operator network to transform the local line, uh, attacks into a very wide render of remote line attacks, which can generally increase the scope of the attacks. Uh, in addition, because of 4G, uh, because of 4G spells, uh, we can, we have a way or, a way to fully control the IP link of the nearby 4G module. We can directly, directly assess the spot and the, our attack to code. Uh, with these attacking ideas, it seems very easy to attack the 4G module. Uh, let's first talk about using free base station to attack. Uh, because clients can't identify whether the base station, uh, uh, is real or not in GSMO network, we can build a free base station system to attack and control traffic. Uh, interestingly this attack is effective for all, all 4G modules and the problem will proceed for a long time regardless of whether the operator shuts down the 2G base station or not. It's not too difficult to build a free base station, but the previous people, uh, have not solved the problem of auto attachment. If it doesn't attach automatically, uh, client need to select to the free base station manually. Uh, inspired by pseudo base station in China, we can improve the C2, uh, parameter in GSMO broadcasting channel and the client will automatically connect to our free base station. Uh, C2 is the cell reselection parameter, uh, the larger the value, the more client tends to connect to the base station. Uh, we can build our free base station via a sort of via radio such as the BLEED RF and the YET BCI system, but we need to change the value of C2. This parameter is not set in YET BTS, so let's hard code it in the south code. Uh, set it to maximum and uh, re-compare it. Here we need to remind you that it's illegal to build a free base station, although this attack is very effective. We can tie it in shade both and show in the finger on the right. In order to force the downgrade of the 4G module to 2G, you need to build a interfere with the software radio equipment such as sending some, uh, white nose interference in the current 3G and the 4G band. Uh, this also illegal. You just need to know that, uh, this method is effective. Finally, the 4G module automatically attach to our free base station, like the whirlpool. Uh, the lower red, uh, red finger shows that the C2 value is already very high, usually around the same time. So, we can now fully control the IP link, monitor the IP data transmission, access the point, run our impulse, and modify the date. The most commonly approach used is to assess the pulse, such as SSH and other service. Let's talk about, uh, uh, text through the operator's intranet. We, we have just implemented the IP links to assess the nearby devices, but it's zero way to attack remotely. Uh, most operators send, uh, send, uh, 1-0-1-7-2 network signal, to, uh, signal address, uh, to client. But many of them don't have, uh, network isolation. So, uh, such as China Unitom and China TechHome. At the same time, most 4G module don't have a favor enabled. This means that we can directly assess the pulse, uh, or other client through the pulse scan. The picture on the red is the result of scanning open pulse or ADB untimelnet service on the, uh, intranet of the operator. You can tell that many clients have those pulse open. Uh, more interestingly, we can measure wide range of text through private, uh, private, private APM. Private APM is the type, uh, technology that clients connect to their intranet server directly through operator's tunnel line. Just like, uh, VPN connection. Client and server communicate with each other so 1-0-1-7-1. Special SIM card and APM or set point are required. This kind of connection is widely adopted by most car companies and, uh, commonly seen among well-known IoT equipments, such as China's U-Ball vending machine. And, uh, all clients in this intranet are equipped with the same type are made by the same company. So, we can look forward to this in such device, then launch a massive attempt. As a result, we gain full control of all these devices. So, how, how can we get the configuration of the APM or set point? For example, so, from, from the analysis and log analysis and how to connect to the target operator APM network. Uh, we can detach the e-SIM chip on the motherboard and attach it back to our 4G module and use the AT command to configure, uh, the correct APM or set point. So, now we can connect to the manual features, private APM network and start the pulse scan and the hack. Uh, I just introduced some new attack surface. Let's implement the attack preparation work. To get ready for a successful attack, you need to complete at least one of the following. Get from where, get the shell or obtain network traffic. In general, getting the shell is a muscle inferential. After getting the shell, it's easy to get from where and network data. But sometimes it's not always possible to get the shell. Uh, let's take a closer look at how to achieve it. First, uh, I will introduce several methods for obtaining from where. It seems the method, uh, if this method don't work, there is a, uh, ultimate method, AAD flash dump. Uh, we can get the from where by downloading, uh, by downloading the from where update program from the official website and unpacking it. This finger shows the from where update program of, uh, well-known 4G, uh, Wi-Fi device. Uh, we easily get the new set of more part, partition, uh, instead of by unpacking the, it actually fell with the bin lock. Uh, the from where can be obtained through the manufacturers update upgrade tools. Uh, most manufacturers have provided the upgrade tools to the developers. For example, Qualcomm, Qualcomm module have a 908 recovery mode, which is a set by a short circuit, some solder points. We can get the update tools from when the test support, uh, which contains the initial realization fails for all, uh, partitions. We can see, uh, that the tool contains the initial image of all partitions. We need to focus, uh, focus on system.com. Mg. This file use the UBI FS file system. We can use the UBI reader tools to successfully extract the file format and get the final linear file system. If we can get the upgrade tools, we'll use the RT motor solution. A&D flash dump. A&D flash dump, uh, is more complex to read and modify the EMI flash. Uh, the lower red corner chip is a common BGA63 chip. It's very small and it's special A&D program to read and write. After dumping the, uh, after dumping the chip, we can use the bin lock to identify the file system. Uh, let's introduce how to get the shell. Uh, where do we get the shell? If we can get the shell, it may, it will be more convenient for us to view process, fields, networks, and debug a vulnerable, uh, programs. It's very interesting that many 4D models use a common password, OE Linux 1.2.3. And, uh, in some times the passwords may not be required. In addition to serial pulse, you can also use some remote management tools such as ADB, telnet, SSH, and so on. Uh, these services can be obtained by pulse scanning. Other methods such as getting a shell from AT command. After the module is connected, the USB interface will be virtualized with several serial pulse, such as DVT-VUB0. So, which AT command can be sent? According to the manual, we can send an AT command to open the ADB service. Uh, or some module could, uh, execute certain commands through sending an AT command. If none of this work, we still have an AT module to modify NAD flash, add, uh, telnet process to the start-up script and reattach the NAD flash back. Let's look at, uh, uh, let's look at how to get, uh, network traffic. We can build a 4JB station system. Uh, why is a 4JB station? Because it's used for the search. Uh, compared with the 2JB station, building 4JB will be more stable, convenient, and fast. As you can see in the figure on the right, our client automatically connect to the 4JB station and gets the IP address. We can use the virtual to monitor the traffic. We use the SRS LTE 4JB station system in this method, which is much more convenient, uh, uh, installation than OEI. Finally, we need to write a SIM card. We need to buy a red box SIM card and a reader. Uh, not, uh, that's, uh, uh, not that this SIM card are only used for security testing, not for other illegal things. We need to write the correct IMSI, KEI, OP to the SIM card to ensure that this program play are the same as those in the SRS LTE. Finally, we start our 4JB station and it works perfectly. In fact, no matter whether it's 2JB station or 4JB station, it contains a large number of configuration items. Uh, time, uh, time relations in this talk will only explain the most important to you. Now let's have a recap. Uh, what information can we get from this, uh, preparation? Uh, most likely, uh, the shell will be captured. Then the firmware system and the network of traffic will certainly be captured. These are essential for the following upper vulnerability menu. Okay. Okay. Supong just talked a lot about attack surface and preparation for attacking 4G modules. Now, let me show you the critical vulnerabilities we find in detail. Uh, let's focus on system management devices, uh, vulnerabilities first. Usually 4G modules, uh, runs Linux systems. Uh, Linux system probably, uh, start many remote management services, uh, such as SSH, uh, Telnet and the web server. Uh, we can use fast scan tool, uh, fast, fast scan tools, uh, like, uh, mess scan, uh, which can scan the port opening status in just a few minutes. Uh, for example, uh, we find, uh, a 4G module, uh, open port 23, uh, which means the Telnet service is started. Uh, in most cases, uh, Telnet, uh, need password to login. Uh, we can extract the ATC password file from the firmware and then correct it by using hashcat tools. And if you are rich, uh, you can buy a lot of GPU to speed up the crack. Uh, 4G modules, uh, generally are not using one machine, one secret key or one secret password, uh, strategy. So if you successfully correct the password, uh, which means that you have just cracked the password of all 4G modules of this manufacturer. Uh, once we get the password, uh, we can successfully log into the file system, uh, log into the system remotely and this device is ours. Uh, in addition, uh, we find that many well-known manufacturer of 4G modules has open remote ADB services by default. Uh, we only list some of them in this table. Uh, in fact, some manufacturers, uh, some automobile, uh, manufacturers, uh, when it costs. Uh, also open remote ADB services by default. What's the consequence of this? Uh, we can simply use ADB tool, uh, to connect, support 5, 5, 5, 5, 5 of this module. And in most cases, uh, without authentication, uh, we can get the shell remotely, so we can hack it. And there are many other type of system management services, vulnerabilities, uh, such as a weak password for web management services, and even SSH that do not require password, uh, are funded on some cars. And some manufacturers in order to convenient the repair of the 4G modules, uh, they hide them, backdoor, they hide back in some external monitoring port. Uh, maybe you can use the backdoor to open Telnet or do something dangerous. I will talk about, uh, an interesting case, uh, like this on the next page. This is, uh, this, uh, this bug was caused by a secondary development of 4G module on a card T-box, T-box. Uh, we reported this problem to manufacturer six months ago, and the manufacturer has completely fixed it. And nowadays, some cars can unlock and open its engine remotely through mobile phone APP, uh, which are our interests. We bought this card T-box, uh, from, uh, from the, uh, auto parts shop, uh, with this capability. Uh, the capability is, it can use a mobile phone APP to open its, uh, door and start its engine. Uh, first, we dumped the firmware with NAND program, program, and we find a process listening on two 4XXX port. Uh, and when we use IDA IDA to scan the string of this process, we find, uh, a T-net related string, uh, that's analysis it. As you see, we find a dangerous function. Uh, this function passed the received data from that port and build a command to execute. As the picture shows, uh, it can be used to open town DSRS. We analyzed the logic of the protocol, uh, of this port. Actually, it used the PKI system, RSA certifications and, uh, AES encryption. Uh, but we find there are multiple vulnerabilities in, uh, this, uh, such as, uh, the AES key is hard-coded in binary, uh, and we get the RSA provide, uh, provide key from the file system. And the password of the fa-, uh, the private key, we can guess it. Uh, so we can use it to generate public key. Uh, and we use those problems to bypass the TRS, uh, certification successfully. After we was engineering, uh, we write the exploit code like this, uh, as expected. We finally start up the town at DSRS on this T-box through this port and using, uh, by using this exploit. However, uh, town at D in this mode requires password verification. So here comes the new power problem. What's the password is? Is. We use the most powerful four piece of NVIDIA 2080TI graphic, uh, card to crack the password. A day later, we finally, uh, got the password. The password is very complex. Uh, include, include big and little case charts, numbers, and special charts. Uh, so now we have a root shell of this T-box. So how can we control the car through, uh, this root shell? First, uh, let's learn how remote control of vehicle is implemented. First, uh, the red dotted line in this figure, uh, represents the 4G module. It has a long connection with the cloud server. Uh, the, uh, 4G module located, located in the T-box and located in the MPU of T-box. Uh, when the door, when the open door instruction is issued from mobile from APP, uh, the 4G module, uh, received the instruction. A process in MPU communicate with MCU through, uh, the serious port. Uh, another process in MPU, uh, yes, uh, another process in MCU that received the instruction and pass it and dispatch to, to canvas and the door open. I think this could be the easiest way to, uh, control the car. As we have got shell of the MPU, MPU, so we can write a program to record the date, uh, the date that MPU write to MCU. So when we want to hack another car, uh, the step is we use, uh, uh, exploit. We write before to the study standard and get a shell and execute, execute a new program to replace the date, uh, we recorded before so the door will open. The most important question is how to run our attack code or how to access that port. Do you remember that attack service, uh, the attack method that Supong, uh, just, uh, mentioned before, uh, through a fake base station, uh, operate internet or Wi-Fi hotspot, we can access that port by running, uh, the exploit without touching the car. Uh, if the car manufacturers use the private APN network without isolation, uh, everything will become simple or terrible. Uh, in the right picture, uh, we entered the private APN network of this T-box, uh, so we can scan the port to four X, X, X, X and we find there are many devices will open this port. So we could attack many devices at the same time. Uh, maybe we can use this ranged attack method to build a zombie car team just like the things in Fast Flushing 8. Next, let's talk about the vulnerability in FOTA. FOTA is a way to upgrade firmware. We find that, uh, some 4G modules frequently check whether, uh, the, the current version is the latest. Uh, some devices check update when the device start up and some are every 40 minutes. In this case, after the weather engineering, we find, uh, that he logged into an FTP server to check for new firmware version because FTP username and password is hardcoded. Uh, we can use it, we can use, use the FTP password to log in the FTP server successfully. And after logging in, we can download all the versions, uh, we got, wait for a second, yes, uh, we can download all versions of the firmware of all devices. So, uh, we probably get the old firmware version. Uh, but this is not the crazy thing. Uh, we find that this FTP account has write ball privilege. So, we can, uh, and another good news, uh, the 4G modules did not verify the firmware file in the FTP. So, we can use the write ball privilege to upload a new firmware with backdoor, uh, to the FTP server. And, uh, there are many, many 4G modules of this manufacturer. We are downloading the new firmware automatically and upgrade to it. That means, that means we can hack all 4G modules of this manufacturer in just, uh, last one day. Uh, that's a nice day problem. We have just talked about the problem on the FTP, uh, FOTA server side. Let's look at the vulnerability of the FOTA client side. We find that some 4G modules listen to some port for FOTA. Uh, for example, in this case, we find this 4G module listened to the port, uh, 45xxx, and it used to receive the upgrade command. Uh, this port was originally used for inter-process communication, but it was incorrectly bound to public, bounded to <IP_ADDRESS>.0, not local host. So, we can send data to this port remotely. And after crack the data exchange protocol to this car, uh, this port, and we were engineering the structure of the, uh, upgrade, uh, firmware file. Uh, as you can see, the structure of this, uh, firmware file is very complicated. It, it cost us a long time. But we finally get it. So, we can, so now we can make a new firmware file with Vector and force the 4G module upgrade to it. So, we hacked it again. Almost every 4G module has its own AT command, uh, passing process. And some manufacturers implement some customer capabilities. For example, uh, only the factory engineers know, know, they know some hidden AT command. Uh, if you can find them out, maybe you can open the ADB device, uh, through the hidden instructions or open, uh, open ADB or something. Uh, we mentioned it before. Uh, in another case, AT command injection vulnerability is also allowed. For example, this foreign picture in the left, uh, is an introduction for adding root in the development document. Uh, we analyzed, we analyzed the system command called here deeply. We find laser command injection vulnerabilities. In the image on the right, we append LS string to the AT command, uh, and the written content shows the LS command executed successfully. That proves laser command injection vulnerability in AT command passing. In general, the AT command can be only executed, uh, on the USB series port. Uh, but some 4G modules, uh, they support, they support use of SMS to execute AT commands. It's usually used for remote control. Uh, if we can find a AT, uh, if we can find an AT command injection vulnerability in this scenario, uh, we can explore the bug remotely by sending an attack message to it. In fact, we did find some, uh, we did find some, uh, some problem in some 4G modules like this. Uh, this is a 4G module that support use SMS to execute AT commands. In this case, we find it requires a password in the content to verify, uh, verification. Uh, if the password is right, uh, it will execute the AT command in the SMS. But the way, uh, the way he used to verification is too weak. Uh, still the old problem, the password is hardcoded in binary. And every device, the, the password is the same. And we can get it from, uh, uh, from the firmware once we get one, uh, one device. Uh, this is the, that, that 4G modules support, uh, AT command, uh, using SMS to, to control it. Uh, actually we find a command injection vulnerability in passing SMS AT command. The command name is set f c s n. And finally, we can get a reverse shell by simply sending a text message to it. We hacked it again remotely. There are many other successful case of attack. Because this talk, the limit of 50 minutes, I cannot talk about them detail one by one. Uh, let me talk about some other interesting cases quickly. Uh, such as, we can use, uh, the JAMA to attack the 4G module. Uh, using, and then using the main, in the middle. And combine with, uh, some browser vulnerabilities, such as zero day or end day to interesting, uh, interesting the IVI of our car. And the debug process on the 4G module is also an attack surface. Uh, DDoS it to death, that may cause the car lose connection, uh, with the cloud server for a long time. Uh, and the IPv6, uh, even if the 4G module has enable IP table, IP tables firewall. Uh, but sometimes we can still access that port. Why? Because the IP6 tables are not enabled. Uh, we can simply bypass the firewall, uh, by using IPv6 address. And almost every 4G Wi-Fi use 8-digit password. 8-digit password, that means the password is only number. N-numbers is, is weak password. Uh, we can use DDoS attack to get the handshake packet. And then crack the password with, uh, many, uh, graphic, uh, card like a NVIDIA 20 ADTI, uh, in a few minutes, or a few seconds. After cracked the password, we are in the same internet of the 4G module. We can launch the, uh, further attacks, such as we can attack the, um, uh, the system management of the 4G module, or we can attack, uh, all devices connected to the 4G module. Uh, in the next chapter, uh, let's talk about the suggestion for defending against, uh, those attacks. Uh, we have talked about, uh, uh, a lot of attack message that's, and when ability is detailed before. And it seems that there are many problems. So how should we, uh, do? We, uh, we can avoid those problems. After communicate with many 4G module manufacturers, hardware manufacturers, and car manufacturers, uh, uh, we find that they did not realize there is a completely, uh, completely operating system in 4G modules. Uh, sometimes there are many, uh, there could be many operating system on a motherboard. Uh, for example, there could be a three, uh, three operating system on a T-box motherboard. Uh, if one of the system has problem, it may affect each other, uh, it may, uh, affect each other. So, so first of all, we must identify, uh, those systems, uh, the IPs. And next, we should check the listening port, uh, ex, especially, uh, those ports that can be accessed remotely. Uh, we have found many, many high risk vulnerability in most of the listening port, listening port process. Uh, if not absolutely necessary, we should not listen in port. Yes. And be, uh, uh, and be aware of, uh, network access, uh, access by using 4G interface. Uh, many people think that 4G channel is thicker. Uh, but actually Hacker can play mainly in the middle easily through the fake base station. And another problem is that we find that 95% of IP tables rules in the 4G modules, uh, are empty. It's dangerous. So, uh, we think, we think the simplest way, we think the simplest way to defend this, uh, uh, attacks is to, uh, let the developer learn how to use IP tables, uh, well. Uh, here, uh, thanks to our team's member, uh, you know this is our teamwork. We have four analysts over 50, uh, 50, 50, yes, 5-0, uh, devices. Uh, this is our talk about security list, uh, research of 4G modules. I hope that our work can give you some inspiration. If you have any question, uh, you can email to us. Uh, thank you for listening.


Here are three mistakes that all students make in their math best mocks in their essays according to first rate tutors. Number one, students try to memorise everything. Don't memorise the whole play. Pick just three quotes for each of the main characters and use those for your essay. Number two, students always forget the thesis statement. Always remember that your introduction should be dedicated to using keywords from the question. Also, talking about what Shakespeare's main message is in relation to the key words and starting your thesis statement by showing exactly what your essay is going to be talking about. Number three, poor paragraph structure. Don't list or explain scenes. Use a clear set peel structure point evidence explanation link when analysing key quotes, key characters and key themes and dive straight into analysis. Remember that the bulk of your marks go into the second e in your pill paragraph, which is your explanation. Analyse, analyse.


It could be a little bit difficult working with control freaks because it takes a lot of effort to please them. It's safe to say that they are so demanding and that's because they are mostly perfectionist. A control freak is someone who has a compulsive need to have total control over every aspect of their life. They also feel justified in their attempts to control various aspects of the lives of those around them. Here's the thing about control freaks. Their goal isn't to intentionally make people around them feel bad about themselves or any of all that negative emotions but to take full charge of their lives because the fear that without that their lives will spiral out of control. Hence, attempting to control orders is a protective measure and a by-product of trying to have everything around them under control. Have you ever heard of the wise old saying, When you see someone who needs power and control and will not stop until they get it, you are seeing someone who is deeply afraid of life. Fearful people can only have things their way. Control freaks are not necessarily bad people but people who feel the need to be in charge because of fear of the unknown. However, in a bid to take control they sometimes become difficult people and hard to please. No one wants to be around such people. So how do you know if you are a control freak? Well, in this video, I'll share with you 8 signs of a control freak. If you are new here, consider subscribing so that you won't miss other exciting videos like this. 1.  Control freaks are not only concerned about avoiding failures but also about how the rest of the world perceives them. They always want to appear perfect because it will make people know that they are indeed in charge of their lives. The thing with being a perfectionist, however, is that not only is it driven by a desire to do well but also a fear of the consequences of not doing well. It makes you overly conscious of everything around you. Living your life this way will only make you lose out on the present moment and become too anxious about the future and the expectations you have set for yourselves. 2. You always refuse to delegate tasks. Nicole Martinez, a psychologist, said when we refuse to delegate, when we believe that no one can do a job as good as we can, so we overwhelm ourselves with tasks we might be a control freak. If you firmly believe that if you want something done right, you'd better do it yourself, then you might be a control freak. You avoid delegating tasks because you believe that it will only succeed in a waste of your time as you will end up making corrections to everything that other people did. 3. You are not a good team player. Being a part of a team means letting all the members of the team take responsibility for specific actions and you can't have that happen because you only trust yourself to deliver. As a result, you would rather be a loner than be a part of a team. On a few occasions, however, where you get to be part of a team, you quickly try to dictate everyone's behavior before someone else gets a chance to do so. 4. You spend a lot of time and energy trying to prevent bad things. Control freaks are too concerned about preventing unfortunate occurrences that they are about preparing themselves for such a situation. I mean, look at it this way. They think that they have control over everything including some unforeseen incidents. So instead of trying to prepare themselves for those unexpected situations to spend their time and energy trying to prevent them, control freaks often waste much time and energy hoping bad things won't happen because they doubt their ability to deal with hardship. 5. You never admit when you were wrong. One of the most annoying traits of a control freak is that they never admit when they are wrong or make mistakes no matter how small the error.  It's ironic. Considering that they don't hesitate to chastise anyone else who makes a mistake. If you feel that you are always right, it means that you might be a control freak and admitting that you're wrong in something will mean hotting your fragile ego, which doesn't sound good because you think people will perceive you as incompetent. 6. You micromanage others. Already, we know that control freaks prefer to do all the tasks all by themselves instead of delegating them. However, when they eventually do, they insist on micromanaging every step of the way. Again, the desire to micromanage people is because they don't trust anyone else but themselves. Micromanagers tend to be demanding when it comes to their employees. They want to be copied in every email because they cannot trust their team. 7. You judge and criticize others. The thing about control freaks is that they have an opinion about everything, starting from how a person should dress, talk, work, eat, and even live their lives. They believe their opinions are fact so when people don't value them or don't act accordingly, they criticize such people. However, in some cases, their judgmental behavior might be due to an experience they had in the past. According to Dr. Paul Hockmere, a licensed marriage and family therapist, judging others is a form of controlling behavior. It makes the people feel temporarily better about themselves by diminishing the other person. Unfortunately, in the long term, the person who judges suffers greatly because they lack quality relationship in their lives. Judging behavior as a defense against feeling judged. So the person who judges others is hypocritical of themselves and was judged at some point in their lives by some significant person is being inferior in some significant capacity. To avoid the pain that they experience from feeling judged, they act offensively by maliciously judging others. 8. You are always correcting people when they are wrong. Correcting people isn't wrong, but when it comes to a habit for you, then it shows that you are controlling because you can't stand people doing something in a way that isn't yours. Control Freaks believe that they are the only ones who know what's best for everyone, which is the reason they always try to get orders to do things their way. Once again, they like to feel in charge wherever they find themselves. Hence, the need to correct people always. There you have it. Now you can answer the question of whether you are a Control Freak or not. Thank you very much for watching our videos. If you liked this video, watch more videos on our channel and subscribe. We love you.


Dr. Scott Stornetta is an early blockchain pioneer dating back to 1991. He co-authored a series of papers and patents that laid the foundation for Bitcoin and other digital currencies. Of the eight citations in the original Bitcoin white paper, three reference his work. Dr. Stornetta is currently a partner at Eugen Partners, a blockchain and AI focused venture capital firm and serves on various boards. He also consults for governments on blockchain policy, is a frequent lecturer at universities, and serves as a fellow at the Creative Destruction Lab. Sounds interesting. Associated with the Rotman School of Management at the University of Toronto. He received his PhD in physics from Stanford University after attending MIT, Harvard, and Brigham Young University. Dr. Scott Stornetta, thank you. Thank you. I owe a particular thanks to Carl because I wasn't originally scheduled to participate in the conference and he found a way to sneak me in. I've often been called on to speak about the pre-Bitcoin origins of the blockchain and how the blockchain came to be, but I've never had opportunity to tell it from my Latter-day Saint perspective. So I very much welcome this unique opportunity. I will try to be, within my time, brief, if not to the point, as they say. I also, however, know what it's like now to be the last speaker in a sacrament meeting because Neil, Evan, Laura, Curtis, and Dr. Tilliman, you've taken my best scriptures and my best quotes and I'll improvise. No, again, they've been excellent talks. I have very few points where I would find disagreement with anything that's been said. As Carl mentioned briefly, for those of you that are not familiar with me, the publications that we made pre-Bitcoin constitute the core of the technology that Sotoshi built upon. And many people are surprised to find that there was a blockchain before Bitcoin, but we'll let it slide. I first found out about the Bitcoin White Paper because I had long since left the cypherpunk community and moved into other areas when I started getting unsolicited email and US mail from people saying, hey, I see that you've formed the bulk of the Bitcoin White Paper references and I also Googled you online and see that you were a missionary in Japan and that you're fluent in Japanese, so I was just wondering. And I always give people the same answer just to set the record straight on that question. I'm not a Sotoshi friend, but if you're a Sotoshi friend, do you think that would make sense? I don't know how to make it any clearer than that. Many people are puzzled or surprised to find out that there's been a blockchain in continuous operation actually since 1991. And in fact, the Genesis block to that blockchain appeared in the October 13th National Edition of the New York Times announcing the fact that there was now a way to create immutable records that were widely witnessed, cryptographically linked. But if you're first finding out about this, you're in good company. Even though this was widely discussed and recognized in publications like Science Magazine and The New York Times, and even Good Morning America and won the Discover Award for Software Innovation, it seems to have fallen away. I don't know if there's any of you that understand the concept of a global apostasy, but things have been restored. And you're in good company, two of my favorites. This is Ian Grig, who is sort of the father of smart contracts, until we were at a conference together last October where he actually read the footnotes. And I'm not going to quote his distinctly British comment about where the blockchain came from, but you have it there to read. And then there's Gary Gensler, who's reply when he first actually read the footnotes and the papers behind them. Who knew? Well, I knew. And again, for those of you that are not conversant with LDS Scripture and perhaps think maybe more along the line of Lord of the Rings, here's Galadriel chapter 1 verse 7. I do want to tell this one story, and it's quite personal to me, but as I say, I think this is the one audience where it makes sense to talk about. For about a year as I was finishing up my PhD at Stanford and then moved to part of the old Bell Labs tradition, Bell Communications Research, I had been obsessed with the problem of creating immutable records out of digital data. The fact that we were decoupling the medium from the message meant that anyone could alter a record and make it appear to be something that had never been altered. This was a true obsession for me. We're in an LDS audience, you might say it wrought upon me. And so when I got to Bell Core, you had the freedom to work on whatever you thought was important, and so I quickly hooked up with Dr. Stuart Haber, an imminent cryptologist. We began work on this, but the issue was that all existing systems had the need to trust some sort of central authority or third party, and so we spent several months working on the issue of not only a practical solution, but in the end one that removed the need to trust a central or privileged authority. Finally, Stuart pulled me over and he said, you know, Scott, I don't think this can be done, and I'd still like to get a publication out of this. So why don't we prove that it can't be done? Why don't we write a proof that you cannot remove central authority trust from a system? And so it was in fact in the process of working on the proof that we realized how to do it, and it happened in a very unique and particular way. I came home from work one day and my wife, who is right there, said, look, I've got, I've had two young kids all day, we're going out to dinner, whatever you had planned for, and so while we're standing in line at the Friendly's Restaurant, a very upscale restaurant for those of you that have been to Friendly's, I'm doing what obsessive people do, namely not talking to anyone, but in fact reviewing the proof that it couldn't be done in my mind. And the basic notion of the proof was we were going to show how, if you had two people working on a transaction, they could collude and the only way to prevent it was to have a third party looking over their shoulder. But what if they were to draw that third party in? Well, then you'd need a fourth party looking over their shoulder. And the reductio ad absurdum was our proof that you always had to include trust in the system. And as I was reviewing this proof in my mind, I said, and so it's obvious that you can't do that because it would require you to have the entire world in collusion. And it was at that point that I had this notion come to me plain as day, what if we made the entire world the witness? And for those of you that are LDS and have heard then Dr. Russell M. Nelson, now President Nelson, tell the story about being in the middle of surgery and having a picture come into his mind about how to tighten a tricuspid valve failure, I can assert that that happens to any and all who obsess and worry and work on something. To me, the insight to link blocks of records together, widely distribute them and make the world a witness, felt like three pay grades above my level when the idea came and I'll leave it at that. But I'm grateful that it's allowed me to be a participant in the situation. How we viewed the blockchain originally was as a kind of inverse panopticon. And I think many people are familiar with Jeremy Bentham's social engineering idea of a panopticon. And we felt that why this was a breakthrough was that we no longer needed to trust a central authority that even one individual could stand up for the truth. This was very meaningful to me and the notion that finally collectively we hold the power that we never could have had individually. It was a red letter day for me that day at Friendly's. I had hoped in an earlier iteration of this talk I actually built a custom blockchain for this conference that I wanted to allow each of you to become a node through your smartphones, but we don't have time to do that. Maybe there's some off time later today for those of you that would like to participate in creating an MTA blockchain that is unique to how the original blockchain functioned, and then you can all go home with some digital chachka that is that blockchain. But we'll see whether that arises in a break or something. I want to talk about the initial efforts that we did to bring this out into the world because for me I felt that we had established surety in a way that was truly new to the world. And it was in fact this very verse that inspired us to choose the name of the initial entity that operated the first blockchain because I truly felt that surety could allow us to hope for a better world. Now there's problems inherent in that. It's obvious to anyone that's read that scripture and pondered it that I'm proof texting. I'm taking the parts of it that seem to line up with what I want to say and sort of rolling my own religion out of it. It's not my intent to do that. It's my intent in fact to caution against that effort. I've been particularly happy to hear people talk about all the optimism that they have for this technology. And I am not myself a cynic. But I would say that the natural man has a way of undoing the hopes and dreams of technologies as if technology alone would make for a better world. And I just can't think of a better example of that than Orville writes non-preciant prediction about what the airplane would do. The reason people do this is they understand the problems in the existing world. They see their solution as part of surmounting those but they are not anticipating the way that the world responds to new solutions to old problems. And again I don't say that as a cynic but I just want to go on record so that 10 and 20 years from now when some of our dreams are not realized to not give up, things can go better. At the same time there's a similar thing that you have to be concerned about and that is when are we anxiously engaged in a good cause and when are we just trying to steady the arc. And I would also offer that as a cautionary tale as of you that are carrying the decentralization banner and its alignment with the restored gospel. Let me just talk briefly in the remaining couple of minutes I have about three things that to me in spite of those cautions I think still align with the original desires of my heart in creating immutable records. The first is to understand that better you'd have to know that myself and a number of the both early contributors to the blockchain as well as some of today's leading edge innovators are building a communal blockchain declaration about what we really think is at the heart of the blockchain innovation. And this is a quote from this not yet released you're seeing it for the first time this not yet released blockchain declaration that talks about what we think is really at the essence at the heart of the blockchain revolution. And I think of for me some of the wording is there I snuck in specifically because I had the following three scriptures in mind. One, this utter indictment of the world's current economic state namely it is not meat that one man should possess that which is above another. Wherefore think of the impact of this the world's lieth in sin. And with a blockchain record you are creating something collectively that no person can hold above another. Second, the fact that we are to create a surplus that becomes the common property that all of us should have equal claim on to develop our talents and to increase our stewardship. And I really think that some have alluded to this but I think people still have not grasped just how much the blockchain is similar to the notion of open source software. Because with open source software where we're putting the software in the creative commons. And the blockchain has the ability to do that not just for software but for all the world's data. And that I think is an enormously powerful economic driver of value creation. Finally, this 121 verse that I think people can quote more often than the articles of faith. We are ending the asymmetry of information as a coercive force. Much of the concerns about privacy really should be relabelled in my opinion as asymmetric information access. Maybe it's not as catchy as privacy. But this in fact is the way to level the playing field. Let me just close by saying a couple of things because I know we need to stay on time. This is the bad news. This is the good news. And so by the transitive property we can still win. But as important as technology is and what can I say, I love technology and I'm grateful for the role I had in it there is a superpower far greater than technology. We see this endless array of Marvel superheroes universe and each superhero has some different particular trait but in the real world the great superpower is empathy. And this is the technology if you will that triumphs over every obstruction and I hope that's helpful and we have no time for questions.


Hello and welcome to the session. In this session, we discussed the following question which says, in the given figure, A B C D is a quadrilateral, a line through D parallel to AC meets B C produced in P, prove that area of triangle A B P is equal to area of quadrilateral A B C D. Before moving on to the solution, let's recall the fact that says that two triangles on the same base or equal basis and between the same parallel are equal in area. This is the key idea for this question. Now we move on to the solution. This is the figure given to us. We are given that A B C D is a quadrilateral. Then it's also given to us that a line through D is parallel to AC, that is we have B P is parallel to AC. And we need to prove that area of triangle A B P is equal to the area of quadrilateral A B C D. Consider the triangles AC D and triangle AC P they lie on the same base AC and between the same parallel, that is we have AC is parallel to D P. So triangle AC D and triangle AC P lie on the base AC and between the same parallel AC and D P. Now since we know that triangles on the same base and between the same parallel are equal in area, therefore we say that area of triangle AC D is equal to the area of the triangle AC P. Now adding area of triangle A B C on both sides we get area of triangle AC D plus area of triangle A B C is equal to area of triangle AC P plus area of triangle A B C. Now from the figure you can see that area of triangle AC D plus area of triangle A B C gives us area of the quadrilateral A B C D and this is equal to area of triangle AC P plus area of triangle A B C which is given by area of triangle A B P. So we have now proved that area of triangle A B P is equal to the area of the quadrilateral A B C D so hence proved this completes the session hope you have understood the solution for this question.