Hi everyone, Brian Dumas here, digital content creator at IBM, and welcome to the Thomas J. Watson Research Center here in New York. This building has so much history and has been home to some of IBM's most important inventions which is why it's needless to say we do a lot of science here, which brings me to why I'm joining you. I'm proud to introduce a new series we'll be doing called Mythbusting, Science, Not Fiction. We'll be speaking to some of IBM's brightest minds and have them tell you why those theories and conspiracies you've been seeing on the internet and social media are or are not correct. We'll also talk about what we're up to at IBM and hopefully leave you a little bit smarter, a little bit more informed. For our first episode I spoke with Kimberly Green-Starks, who's IBM's global lead for infrastructure technology and planning, and she also leads up our university programs. She's an incredibly smart woman with over 70 patents to her name in areas such as data analytics and mobile technology. And she also lives in Nashville, Tennessee and was very close to the attack on the AT&T building a few months ago.  Kimberly, thank you for joining us. How are you doing today? I'm great, Brian. How about you? I'm doing fantastic. It's an honor to have you join us and really thankful that you made some time for us. So before we get into the myths, I guess let's talk to the people at home about what is 5G? 5G is the latest iteration of mobile communication technology and it builds upon 4G. 5G or 5th generation cellular wireless networks are powered by technology referred to as millimeter wave. So I've been reading some things. I guess 3G was the first technology that allowed us to send media via SMS. 4G kind of got us to a place where we could stream content and watch YouTube and games on our phones. What would we be able to do from a user standpoint with 5G that we can't do now? So the promise of 5G is pretty big. Have you ever been to a sporting event or a concert and wanted to post the selfie to your favorite social media outlet or send a text message to your friends to make them jealous about where you are and not been able to do that? You get a failed connection or message not sent.  So 5G networks promise faster speeds, higher bandwidth and lower latency in communications between devices and servers over 4G networks. Devices on these networks will be able to give everyone a chance to post that selfie. And so thank you for that background. That's important, you know, level setting just to make sure that everyone understands what really is going on out here. And so that brings me to my next point. Some of these myths that we've been hearing. I know you live in Nashville and so you were as close as any IBM or to the unfortunate attack that happened downtown at the H&T building. I know the guy, there was there was some talk that the gentleman who was who perpetrated that attack was a conspiracy theorist and believed that 5G was harmful to people when people are misinformed and they they act on that misinformation, dangerous things can happen. And so let's let's let's inform the people at home, right? You talked about that millipede wave technology. I've seen some information online. There's one gentleman saying that 5G technology can go through walls and it could maybe, you know, give you adverse health effects and transmit diseases. Tell us why that's not the case. So for the for the people who say that 5G causes headaches, to cause a headache would require prolonged exposure to frequencies in the range of thousands more than the 5G network which operates around the range of a transistor radio from the old school from our grandparents transistor radio. It's just not possible that 5G in itself could be causing your headache. Or for those who say that 5G has caused the coronavirus. Well, the coronavirus is present in every continent on earth. And many of many of the countries where 5G has shown its its ugly head in the pandemic don't even have 5G technology rollout underway. So that can't be possible. Let's see. This is why we need smart people like you to come on and tell us what's really going on, right? Like how can something that has the the power of a transistor radio, you know, give us adverse health effects? We've been having transistors in our homes for over 60 years now, you know, and we've been okay. So, you know, that clarity, that perspective is important. And to your point about 5G and coronavirus, right? Like how can how can the technology transmitting disease in an area where the technology doesn't even exist? You know, that's right. So that perspective is important. Thank you for for helping us understand a little bit more. And so is there anything else you want to share with the folks at home before we before we wrap? Be safe out there, everyone, and embrace technology. Embrace technology. That's a great a great parting statement. And that's why we're doing this. We want to make people more informed, a little bit smarter, and let them know how technology is working in real ways to make impactful differences in people's lives. So thank you for being on the right side of that fight and looking forward to seeing more great things from you and the rest of IBM in the coming coming months. Thank you, Brian. Take care. Well, thank you so much, Kimberly, for making time for us. This has been a great conversation, very insightful, very informative. We hope you folks at home learn something as well. We'll be doing more of these in the future, so please subscribe to the channel if you haven't already, and be sure to share this with your friends and family and anyone else who you think will appreciate facts. Until next time, take care.


In the very beginning, Nicolet was a partner. What we really wanted to do was get a field for how the businesses were doing up here. Economic development is something that takes a long time. It is not something you do and stop and say, okay, we're done. It is a long-term proposition and they've been one of us every step of the way since. If we didn't have the relationship with Nicolet as an educational technical college partner, we would not be able to put together some of the programs and I think some of our, we know some of the programs that are being done in some of the high schools wouldn't be able to be put together without Nicolet. We started what we call the EC class in 2012, which is now involved into what is the Nicolet Net or Nicolet Entrepreneurial. Nicolet has been willing to constantly change the program to meet the needs of the entrepreneurs. It's just been amazing cooperation. The access we have to any and all areas in college and the expertise. Nicolet of course is a real driver, an economic driver in addition to being a thought leader for the area. It's just very logical that you would have a close relationship. So it was very easy for us when situations arose that we would need help or need assistance or have some ideas to have access and we found the people here to be very accessible. I think that there's a very clear intuitive as well as an intellectual understanding of the dependency we have on the world of economic development, the world of education, just one and the same.


Well, the deer hunting season has become an official holiday around Minnesota and in this week's northward's adventure, Josh Peterson takes us out to take a look at some early results at this past weekend's hunt. With the first few days of the firearms deer hunting season in the books, this year so far has received mixed reviews. While some hunters had great luck hunting their prized buck, others did not. But this week's wintery weather may make conditions ideal for hunting. I think that the rut is just a little bit behind where last year was at the opener because it was a little colder at the opener last year. But I have heard a lot of reports of really nice bucks being shot. While the weather can play a major factor, early numbers are still expected to be up over last year. But it's too soon to tell. I haven't seen any numbers as of this point. I think there's still a lot of people out hunting. I know a lot of our wildlife people are down working on CWD sampling still. They won't be back until tomorrow and so I expect to get more information by tomorrow. While it's still early to get official numbers on just how successful the deer opener was from the Minnesota DNR, one indicator is to visit your local butcher shop and just see how busy they really are. At Stitsworth Meats, hunters have been bringing in their deer since opening morning. And already over the past couple of days have seen an increase over last deer season's record year. Taking them in, we're probably a little ahead of pace so last year which is one of the higher years we've had so it's been good so I'm kind of nervous to see what happens this next weekend. So far over 200 deer have been brought in to Stitsworth Meats to be processed, but with ideal hunting conditions to come later this week, they are prepared to take in more deer than ever this year. Yeah, I would say we're probably a little ahead of pace last year so every year the last two, three years have been up so we may hit another record this year. Michael Stitsworth says that every deer brought in will be made to order and return back to its original owner. He also added that with a dramatic increase over last year, this year could be one of the best for hunters. With this week's Northwoods Adventure in Bemidji, Josh Peterson, Lakeland News. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


Hello everyone I'm Brad Topol and this is Steve Martinelli We have Phil Estes and Jason McGee. We have a nice session some hot topics Federated identity and containers I'm an IBM Distinguished Engineer I lead all of our open-stack upstream contributions And I'll let the other speakers introduce themselves when they speak I'm I'm Steve. I'm gonna be the Keystone PTL. This is the project team lead during the metaka release For the Keystone project. So our first topic is federated identity When we talk federated identity The open-stack component that is responsible for federated identity is Keystone This is open-stacks authentication and Authorization and access management service it also provides audit capabilities identity and service discovery Supports a lot of token formats And includes new enhancements for things such as federation And it's used by all the open-stack services so Identities are you know what are authenticated by Keystone and open-stack and where can these identities come from? Well, the operator can store the identities inside Keystone inside its own little SQL It doesn't have very good password support The next step is the identities can come from an enterprise LDAP and That's very common. That's a nice way to do things so that gives you integration with The customers existing place for storing identities, but Keystone still sees the passwords the most secure way to do things is through federated identity provider and Keystone's federated identity provider support This is the most secure approach Keystone never sees the passwords. It also allows you to do single sign-on and and these types of capabilities So Steve's gonna take us through more detail on this Thanks, Brad So taking a step back Federation if you kind of break it down to the basic terms, it's when two different organizations are trusting each other And in the Keystone case what we want to what we want What we want to see is Two different entities trusting each other for identity. So in this case Keystone can have identity providers and it trusts that the users have authenticated with their identity providers and They're now able to do things in Keystone And single sign-on if you know we see this in examples all over the place on the web It's a it's a it's a just using your own Credentials so in this example. I'm using my Google credentials to sign in and access another application So if you think about it, it's just using credentials from one place and using and then using an application on another place and Most enterprises already have a single sign-on and federated identity solution So internally you might be using single sign-on and federation to do things such as book travel Assign meeting rooms things like that do expense reports. I Now a little bit of a history of federated identity in OpenStack So why did we want it? Well, we wanted it for the reasons that Brad had mentioned in the one of the previous slides there We could store users in the sequel back end or use LDAP our LDAP plugin But they're they're not as secure as a pure federation approach because Keystone is still seeing your passwords in there And this way if you create a trust relationship between Keystone and an identity provider Keystone will never see the password It's a lot more secure It's just somewhere we where we want to be and we started this in the ice house release So in the ice house release we finally introduced a initial set of APIs that Where you could create identity providers create protocols and and authenticate against Keystone In the Juneau release we advanced this into including something called keystone keystone support Which you could exchange identities between different keystone deployments and we start to include command line interface support In kilo we worked with the horizon team to include single sign-on support for OpenStack and in Liberty We finally start to see Other projects kind of embrace this so you saw Ansible and Puppet and Chef kind of and even the OpenStack client command line project Started to adopt this as well and take an interest in it So what is IBM doing for federation and OpenStack? Well, I've been involved with it ever since the beginning since the initial first talks start to happen I've contributed to all of the blueprints that we listed in the previous slide there And we've collaborated a lot with the different folks such as Rackspace, Red Hat, CERN, HP we've collaborated with them to create the APIs and the functionality in the code and Like I said, we've implemented several of blueprints together and I like to think that we're seeing those leaders in this space So what can you do with OpenStack now? You could use it for things such as social log-in So you could actually sign in with your Google credentials if you set it up correctly and even further you could actually use a command line support for this as well and So what else can you do with it? You could also use it with an existing enterprise identity provider So something such as Tivoli's Federated Identity Manager, which is an IBM product as well as what's your Liberty? if you install the correct Extensions it can act as an identity provider and again Keystone can interact with those as well and Both of these support single sign-on and access through a command line interface as well. So we're pretty happy about that If there's just one takeaway you could get from this though is that Keystone support for Federated Identity is Agnostic it doesn't care what your identity provider is it just cares if you have it set up correctly and I think that's the big takeaway there. It's it's pluggable and it's agnostic And Brady want to talk about the future. Sure. Where are we heading? So we have some wonderful offerings You know our cloud foundry based offering is IBM Bluemix You heard about the announcement of blue box local, which is open-stack based Local cloud and of course we have the dedicated cloud So where we're looking to use Federation is to provide seamless integration for all these these different Offerings that we have so you'll you'll see a lot of work there behind the scenes you may not see it yourself But it'll make things a lot more consumable and now we're gonna hand it off to Phil and Jason talk about Containers I Think Jason's gonna kick it off. Cool. Oh, there you go. How are you guys? It's a after lunch tired For those of us from the West it's like three in the morning or something I Want to talk a little bit about We're gonna switch gears here and talk about containers And what we've been doing in IBM around containers I'm gonna talk about kind of our overall strategy and some of the things that we've been delivering For container capability in IBM's cloud portfolio Phil's gonna come up in a minute and and talk about some of the Contributions and work we've been doing in the community In in the Docker ecosystem and other places around the container space. How many of you have heard about containers? That's like an easy question, right? How many of you have actually run a container yourself? Good. All right, so this is like the hot topic that everyone wants to talk about and I think for a very good reason I think containers are a pretty transformative technology Transformative to how we build apps and transformative to how we run infrastructure With an IBM as we've been kind of building out our cloud architecture We've been looking at how Different technologies different open technologies fit together in the role that they play in providing a robust platform for hosting applications in the cloud And we really have kind of settled on there being three Or actually for fundamental compute models that we think need to be made available in a cloud environment You have bare metal infrastructure, right? There are use cases where The control and the performance of bare metal makes a ton of sense We have virtual machines Provided by from an API perspective by Nova Nova API is an open stack. We have containers Based on Docker in in our strategy and then we have what we call instant run times Which is essentially the capability we get out of cloud foundry Think of instant run times as containers with a prescriptive programming model It's an opinionated version of containers We're straight Docker containers give you a lot of flexibility on the kinds of applications you can run But instant run times I give you a quicker way to get started with your code as long as you fit Within a certain set of rules about how your applications are built and so what we've been doing In IBM is bringing together all of these technologies as we build our cloud and Working across all of these communities across open stack across the docker ecosystem across the co foundry foundation Linux and other places to bring these technologies together to integrate them together And to allow them to work seamlessly together So whether that means using things like Keystone for doing identity and access across all these capabilities Or whether that's the work we're doing with networking around things like neutron to allow us to have common networking Across all of these technologies. We believe the future of cloud is about bringing these open technologies together into a coherent platform So let's talk then about the container piece in in particular and if you looked at IBM's cloud portfolio The kind of highlight capability around containers is a service that we've made available through blue mix called IBM containers IBM containers is a Containers as a service Hosting environment a place for you to deploy run and manage all of your container based applications It's built on top of Docker right use a standard Docker images Exposes a Docker API you can use the standard Docker tools like the Docker CLI to interact with that service But it's a cloud service and one where containers are a first-class citizen You don't have to deploy clusters set up Docker hosts You can simply come to the cloud with a Docker image and run it and manage it without having to worry about the infrastructure It runs on that's our job One of the things that I think is really powerful about what we're doing around containers And something that you see a lot of active discussion in the industry and in the open communities about is the life cycle around a Container, you know, how do you build them? How do you deploy them? How do you orchestrate multiple containers working together? How do you scale them? How do you monitor and do problem determination on containers? All of those life cycle problems have to get solved When you're running a container-based workload, and so within IBM containers We've been trying to bring together all of those pieces as well. And so here's a representation of Of what that life cycle might look like if you kind of think about a container-based application And taking it through all of its Steps as you build it and run it and maintain and deploy that thing over time And throughout that life cycle, there's a number of capabilities that you need Besides just the basic container in which you're running your application So if you start at the beginning The first step in building a container-based app is you need some content to start with right you need some Docker images that provide the foundation on which you're building your application The obvious place to get those images is Docker Hub, which is the kind of central public repository today for Docker images IBM has been doing some work to make IBM software content available as images So we've made things like Webster Liberty or our Node.js platform Or our mobile foundation that you might have heard about in the previous talk available as images on Docker available in places like Docker Hub The other thing though is your images might actually be things you've built yourself So you need a place to store and manage private images that are relevant for your team or your company And so we've provided a private registry capability on cloud where you can store and manage all of your images in a In a non-public location, but a location that's private to you and your team step 2 In the life cycle is building your new Docker images, right? So you take some starting point some base image you add your application into it And you now need to build that image you can do that of course locally on your laptop right using Docker build But we also provide a cloud-hosted service that does Docker build for you so you can actually Build your image build your Docker file and then actually run a remote build where the build will happen in the cloud The build resources are managed for you in the cloud and the result an image will be pushed automatically Into your private registry of Docker images Step three in the pipeline is delivery. How do you actually now take that application? You've built in a container and deliver it Into a running system into running production into a running test environment There's really two capabilities here, which I think are relevant. The first is Build pipeline service right so the ability to actually define a repeatable continuous deliveries pipeline that lets you take that application and run it in a structured way through Automated build through testing from test environments to staging environments to production environments in a controlled way And so we have a pipeline service that allows you to define a delivery pipeline that works for your team and automate the process of delivering that change throughout the steps that you want it to go through to get to production and That pipeline understands containers it understands Docker and knows how to do builds it knows how to publish to Docker registries it knows how to talk to a Docker host or to our container service and Execute those containers on your behalf The next step in the pipeline is actually deploying the container into a running container service And of course the heart of that is this service that we've built on Bluemix the container service that gives us a Shared pool of Docker hosts on which we can run your container for you But there's some other capabilities wrapped around that we've done a bunch of work around Networking providing isolated private networking for containers We actually use neutron as the control plane for that So all of our Docker images running on the cloud get their own IP address their own private network that entire network Infrastructure is set up Automatically by leveraging neutron with OBS and other technologies to allow us to set up the networking infrastructure that you need to run your containers We've done work around persistent storage for containers So if you have a need let's say that you have a Docker image That's running a database and you want to mount persistent storage for the database information itself You can do that in an automated way Share that persistent storage across container images or have that data live beyond the life cycle of the container itself So if you're gonna update your database server You just want to throw the container away and replace it with a new one and reattach the same data to that container that you had before We've also done work on things like support for routes. So if you have a container based app that's handling HTTP Traffic like a rest API server.  And manage fault tolerance of that traffic path so that you have a very simple way to expose our container based HTTP endpoint Once the thing is up and running you need some capabilities to help keep it running You need clustering or container groups that allow you to scale that application that allow you to Respond to changes in demand and that allow you to recover in the event of failure We also are taking advantage of things like bare metal performance our containers run on top of bare metal They don't run on top of a hypervisor. So you have An a more efficient execution path where those containers can run directly on a bare metal server And then finally you want some visibility into your container based system And so we've done work around integrating logging and monitoring for containers automatically So any containers you run automatically get log analytics and metrics data and again We're doing this within the community We're leveraging technologies like elastic search and graphite as the infrastructure for doing that monitoring and we've integrated it in with with a docker We've open sourced technologies like a crawler technology that can automatically Extract all the log and metric data from a docker host from all the containers on that host and publish That information into a logging system. So as a developer you don't have to Deal with how do I instrument my container for logging that can happen automatically just by running that container on a host That's been instrumented to get that data for you So I just wanted to give you a sense for the kind of the full breadth of capability You need in any container environment if you really want to run production grade workloads within that environment So if we've been doing this alone and the answer is of course not we've been doing this With partners and in with the community IBM has a business partnership with Docker the company Phil's going to talk in a minute about some of the work We've been doing in the docker ecosystem from an open source perspective But IBM and docker have a business relationship where we've been working together To deliver containers in an enterprise context The IBM containers work. I just described is part of that but we're also doing work around on-premise Support for docker registries and run times and integration with other parts of our portfolio So Michael elder spoke before us on some of the work that he's been doing around heat patterns with things like urban code We have integration of docker into those platforms So as a developer if you're building applications using docker We can integrate that with your existing development processes that you might have built with tools like urban code deploy With the community there are two important things I wanted to highlight in the last six months or so Two important foundations have been created to help move the container Ecosystem to a more open governance model around the technologies that define containers And so so trying to make sure that all of us have the right voice in shaping the future of containers The first is something called the open container initiative And the open container initiative which was created underneath the Linux Foundation's mission is to define a standard Specification and reference runtime for a container runtime and image format, right? So this is actually defining the standard for what it is what it means to build a container image and What a container runtime should do and allows us a standard specification for that so that we can build Different implementations of container environments across different platforms, right or across different providers That was done with a whole bunch of industry players You can see here the guys at Docker contributed Parts of the Docker project like RunC as the initial reference implementation And that community is actively working right now to clarify its charter and to define The kind of key elements that will make up the basic definition of what a container is and what a container image is The second foundation is something called the cloud native computing foundation and this was formed a month or so later Again a huge collection of industry players Including other foundations like the cloud foundation And others that are part of the the cognitive computing foundation. This is a little bit different the goal of CNCF is to provide a place where we can all collaborate on the higher order problems around containers You know, how do we do orchestration? How do we do networking? How do we do service discovery or microservices patterns with containers? Its goal is not to come up with a single specification But to be a place where we can innovate together around Matureing the idea of containers and filling out that life cycle that I described Filling out all the capabilities in that life cycle in a community forum Google Contributed things like Kubernetes as part of that foundation The maze those guys are contributing IBM is contributing resource management and other technology into that space So I think this is going to become over the next year a really vibrant place where we'll see the development of a lot of important Container management technologies the things that we all need to make that full life cycle. I described real So that is a little bit of context on what we've been doing around containers Let me have Phil come up and he's going to talk about what we've been doing on the open source Mic on all right. I think it is So yeah, Jason's given you kind of a view into what we've been doing with Docker and Containers from an enterprise delivery and partnership But I think it'd be great to also step back and you know even going back to what Steve and Brad discussed And even if going all the way back to this morning's keynote when IBM Involves ourselves in an open-source community. We try and do it in an effective way That's not just beneficial to IBM's interest, but Beneficial to the community as a whole and so Docker is just another instance where we have starting a Little over a year ago with a single contributor in the upstream community Just as we've done with cloud foundry and with open stack We've grown that over the past year to approximately 25 different IBM contributors across many of the projects so a couple of us have become maintainers in the Docker engine so myself and another IBM or that I work closely with but we're not just working in the engine. You can see the list here I won't read all of them, but We've contributed to things like compose and swarm To the distribution project and some of the other pieces that are now going into these foundations such as lib container Which is now part of the open container initiative So across that set of releases that you can see there We've now grown our overall contributions to be the number three Non-docker ink contributor to the upstream project, which is exciting for us And in that time we've not only done things that are beneficial overall But we've also been able to integrate some of the things that enable our container service So integrations into software and object store And now in several cases working on enabling some of our other Architectures you've heard of power and system Z so enabling these in the Docker engine in the registry and Even in Docker's own test workflow to be able to test on other architectures And so you know you've seen that that much of this work has led into what we've been able to do in our blue mix container service But I thought I'd spend just a minute to list some of the very specific things that we've done That are both beneficial again to us, but but also to the overall community So in the area of security running a public cloud Obviously has some fairly significant security concerns. We have people at IBM research Looking at all the attack surface All across the container ecosystem, and so we've been able to add things like user namespaces, which is something that's coming in Docker 1 1.9 Trying to clean up the overall error handling paths debugging capabilities And several other key enhancements And of course we have many other things that we'd like to see happen in the future that we continue to work on I just mentioned that multi architecture support is key for us across all our platforms But it also enables things like arm and the Raspberry Pi work that's happening in the Docker community Things around internationalization, which is obviously of interest around the world And then we continue to work in the RunSea community. So for the open container initiative There's a set of work to continue moving the specification forward and the implementation of RunSea And even looking forward to Docker's REST API using swagger to formalize that so these are all areas where We are contributing or looking forward to do in the future And you can see a timeline there of both our business partnership But also our open source work with Docker and the rest of the community members One again, I just mentioned a moment ago that Running a public cloud with Docker containers has has caused us to look deeply in the area of security And so this has been a great way for us to partner with Docker both upstream in the open source community But also to have calls together with them on things that we're finding Research that we're doing and so a few areas where we've worked together. We've submitted pull requests We've we've had things merged related to app armor profiles Our work on multi-tenancy. So obviously we're running a multi-tenant container service Those of you who know the Docker engine today doesn't have multi-tenancy. So working on Some of those specifications. So Docker is now looking to add an authorization and authentication capabilities I mentioned user namespaces and Limitations on a container wanting to go wild and an open Millions of files or try and and bring the system down with fork bombs So these are all areas where we're working with Docker in with the community If you would like to hear more on that one of the one of our IBM security researchers is here this week And we'll be talking tomorrow on a lot of those lessons of running a production cloud and work that we're doing there so This is a bit of a shift. I think that's hopefully given you a good flavor of What we're doing with containers both in our enterprise Delivery of them through blue mix and the open-source work, but to jump back to Brad and Steve. We have book authors here They're not only Keystone Experts in the community, but they've written a book I don't know if you receive one on the way in but there are books available a free free copy for you to take That has already received great feedback just useful information and Then myself and another one of the docker Maintainers has written a book called open by design Research report that's available in e-book form And so as you're leaving the table that's directly outside the door There are postcards with the download link for that book if you'd like to receive that that's looking at really the strategy that we've talked about Just in the last little bit here about our Focus on open-source and open governor governance as the way to transform cloud technology So that's available as a free download As well, and then Jason was involved in the new stacks recent publication of the docker and container ecosystem You can download that from the new stack directly And so that's available as well And then in this room through the remainder of the day there are still talks available On various topics that may be of interest to you and with that I think We have complete our material so thank you for coming


MetSmarter actually began on a student-first, student-centered premise. What we identified was that students wanted something unique and not the same old cookie-cutter programs that were available from so many others. The students should work with MetSmarter because of our approach. We are a team of MDs and professionals who understand the struggles, first hand, of choosing a career in the medical field. MetSmarter's goal is to help students succeed in their journeys to becoming practicing physicians. MetSmarter is best described as a hybrid of tutoring and classroom learning. We provide the flexibility students require to successfully prepare for their MCATs, USMLE Step 1, USMLE Step 2, and gain clinical experience and eventually preparing for residency. You're not treated just as another number here at MetSmarter, but as an individual whose success is absolute paramount. Our approach to personalized attention allows us to be agile and adjust to what students' needs are. I think that any student that needs a unique experience in a plan designed specifically for them should call MetSmarter because we are going to provide them the true learning experience that's literally built just for them. Our culture was started and created by the people that work here every single day and it's carried forward by the relationships that we build. When you envision values and ideals of what you want your company to be and share them with the people that are there every day, that combination is what makes our environment and culture what it is today. To be able to give students the tools they need to succeed is really what motivates me every day. We want our students to come in and enjoy while they learn and not feel pressured. They have the flexibility and freedom to achieve the success and focus on their goals. Working at MetSmarter means building genuine partnerships, whether it be with our internal team that we work with daily or the partnerships that we have created with other physicians, medical schools and universities. Working to build strong relationships as a team is something that I'm proud of. We'd like to take our programs and be able to provide them to even more students with our unique teaching approach. Giving back is a big part of what we do at MetSmarter and we have actually started a charity called the MetSmarter Foundation with a goal to provide scholarship opportunities for deserving medical students. The mission and vision renew every single day when students come to our center and we feel like we're destined for greatness because of the impact of the relationships we build. We want more people to participate in our goals to help future physicians. Hopefully you have a chance to come join us and see what the smarter approach to a career in medicine is about.


The best part of PUDM is being able to look around the gym and look at the crowd of kids who have stayed there with you that whole time and have committed to being there for that 18 hours. Looking out into that crowd it is the most touching thing. It is something that is so selfless and humbling and so beautiful to get to see you and all of your best friends coming together for a big event like that. When I entered PUDM as a freshman it was mostly because I knew that my sister was involved in it and she talked it up so much that I was like okay well this has to be good I guess. PUDM stands for the Pretty University Dance Marathon. It's our largest student-run organization on campus but we raise funds and awareness for Riley Hospital for Children all year round and it's a part of a larger Asian-wide movement run by Children's Miracle Network. I'm the president of PUDM this year. My overall job is to oversee all the operations within the organization. We get to hear from a lot of Riley families which is amazing because it really brings people back down to earth and shows them what exactly they're fighting for and what we've been planning for for the whole year. We get to hear from Riley professionals that tell us about their research, the different areas of the hospital that we're funding. My experience with PUDM will affect me for the whole rest of my life. I feel like I've learned a lot of personal lessons about myself. I've had the chance to grow with an organization and make my way through different areas of it to see where I can apply myself and how I can grow personally, professionally. I've learned how to make deeper connections with people, be more genuine. I've had the opportunity to meet so many peers of mine who make me want to be more generous and make me want to give back more. Meeting those Riley kids is so, so special because they are just the most genuine and the sweetest and the bravest people in the world. When I was a senior in high school, I was diagnosed with a type of non-Hodgkin's lymphoma called T-cell lymphoblastic lymphoma. I received treatment at Riley. The treatment for that is two and a half years of chemotherapy. The last year and a half of that was less intense than the first year, so I was able to come to Purdue. And those experiences also convicted me towards PUDM and wanting to fundraise for Riley just because I know how much it matters for not only the organization but also Riley itself. I'm a part of the Morale Committee through PUDM. Our goal each year is to create the dance that everyone learns at the Dance Marathon. We get split up into different color tracks and each color gets to create the dance for part of the mix that we make. I have the opportunity to be a conductor for Morale. With that, I have new members for Morale that I help steward and motivate and get them acclimated to what Morale is and PUDM as a whole. When I joined PUDM, it was a great outlet for me to become a feeler with an organization and also meet new people, especially coming out and still being on treatment at that time, seeing the passion these people had for an organization that helped me so greatly. I was really appreciative just to begin with. And it was really easy for me to connect with them. They're going to be friends for life. When I first came to Purdue, I didn't know what I wanted to do. So I started off on the pre-med track. I joined PUDM because my friends convinced me to. And after going to one meeting, I really felt like it was the place to be. It felt like a home a little bit. After time, after making a lot of friends and connections, I really found my community there. In PUDM, I'm the Riley Relations Executive. So I essentially act as the bridge between our Riley families from Riley Hospital for Children and our members of Purdue University against Marathon. If a committee member and a kiddo are paired together, they're kind of with them through the entirety of their stay there, knowing that they have someone that they trust and that knows their way around the correct and can get help if there's need for that. My favorite part of the entire night of the marathon is when I walk up with the kiddos and I take them to the stage, seeing the kiddo get the courage to go up there and do their thing when they come off stage and they're so happy and smiling and they know they did a great job. I know that they did a great job and giving them that little high five, that little hug. And just knowing that they had a great time, it's more than enough for all of us. Sometimes I think of my friends being my little home at PUDM. It's just made it feel really cozy being here at Purdue. Last couple of hours is always really crazy because you're running off the hype before almost there and whole year of hard work is coming to a close. These are all my best friends. I love like having the chance to spend a big event like this with them because they make it so easy to like fall in love with it. I'm definitely very tired but it's very rewarding to know that like we made such a huge impact in only 18 hours and that it was like a celebration of all the hard work that we succeeded in for the whole rest of the year. So I feel very good.


Lanka  Korole   Lama Chiixi                                                                                నిivenనలిక్ మాప్ � guide పతే ధంచట్James Kapu వడె నిక్���ికిక్ ని సైటక్ పటచ్ కార anysినినం నికలితూ మసంచట్ selbstగాచటి Л Bi harmonic కఞULLనౚపినిస్ఖనౕ And we should just say it as it is. We should just say it as it is. Let us not pretend that you're going to change to pray. If you're going to change, then you're going to change. I go to change every day. Every day I go to change. Every day I go to change. Have you ever seen me going with you with my camera? Do you see me doing that? I go to change quickly, I pray. I even spoke to Bahadhan Khalil. I even spoke to Bahadhan Khalil. He told me, oh no, I'm going to change. Did you see me with my camera with Bahadhan Khalil? Did you see that? Because for me, you can say no, because you don't have members. But Bahadhan Khalil has got the rate of members. Do you see him going to change quickly, quickly? We should stop this behavior women politicians in Mozambia. You should stop it.  And I'm going to change. I'm a papa as a malevran. You are also very political.  You don't call these people to come and pray. You call them so that you can change. That's why you call them. That's why you call them to change. You don't have this behavior. You don't have this behavior. You don't have this behavior. For your personal whatever. Stop using it. And you politicians stop using our changes. And I'm saying this. I criticize it even during our kind of HLMO. I criticize it. Why are you doing this?  No, in some of us we are Christians. We don't stop us from praying. Do you even understand what it means to be Christian? You should even more and more you go and get baptized. You belong to. Because some of you don't even know which church you belong to. You don't even have a church where you belong to. And you want to claim to be more Christian than others. Stop using changes for your political experience. Stop it. It is wrong. And you are only fooling yourself and those other people, zambians who are naive. Otherwise we can see it. We can see it. You don't have the courage to come out. Have the courage. Yes. Challenge them. We want to hold a meeting and talk politics. We want to have a meeting. We want to do this. I want to challenge people. So this is me now. Saying things as they are. I think now move.


Following the crisis between the academic staff, union of universities and the federal government of Nigeria, members of ASU at the Federal University, Lafayette National State on Friday staged a peaceful protest in the school premises and called for the sack of the Ministry of Labor and Employment, Chris Ngige. The ASU-Lafayette members earlier in the day had a one-hour congress where the decision was reached to embark on the protest. Speaking during the demonstration, Chairman of ASU and the institution, Adam Ablai, said they decided to organize the peaceful protest to demand for Ngige's sack because they were paid half salaries for the month of October and the Ministry's refusal to pay them their eight-month outstanding salaries since the union embarked on a strike in the month of February. Ablai, you want that if the current crisis between the federal government and the national body of the union is not urgently resolved, it could cause a bleak future for the Nigerian youths. We do work beyond standing in the class. We research from our homes on our telephones in the library and this cannot be seen. We are not casual workers. We are not casual workers. The pro rata is the casualization of the university workforce and we are saying no to this. Academic work is not a casual work so government should not pay us as people who work on daily basis and who receive money weekly or daily. So that is why we have set this protest and it may go on, but this is just to tell the president wherever he is to listen to the Nigerian academics and meet their demands. The demands that we put on the table before the strike has gone, none of this has been met. Any time it was due for government to pay, instead of paying, they create an emergency. The other time they create the IPPIS, we are still battling with it.  Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Thank you guys very much. We're here to talk about an attack that happened last October. We call it the meat decide attack after the guy who wrote the code that caused the incident. But before we get into the details of that, just a quick little bit about me. I'm Sync Valfleet, otherwise known as Trey Forgity. I'm a hacker, lawyer, navigator and physicist. I work for an association called Nina, the 9-1-1 association. We improve 9-1-1 by doing all of the things in that lengthy statement. Advocacy is my part of it. As a lawyer, I mainly do stuff in Washington.  And so I'm pleased to be presenting about this attack and what we're doing to try and help defend against these types of attacks going forward. So this past November, a teenager from Arizona launched a telephone denial of service attack. The first distributed telephone denial of service attack against 9-1-1 centers across the entire country using eight lines of code and a tweet. Now, before I get into the details of all of this, this is DEF CON 101. And so we're supposed to talk about some more basic type things. And one thing that I personally think has become a little bit missing in the world of information theory, as we've gone from the telephone network into all IP networks like the internet, is some mathematical rigor. Now, according to Stephen Hawking, if you put a formula in something, you cut the number of people interested in it by half. So if the back half of the room will please stay seated, I don't want everybody leaving at once when I put this up. But I want to talk to you about a formula that was invented by this guy. This is Agner Crerop Erlang. And he came up with something called the Erlang B formula. He was a Swedish telephone engineer back in the 20s. Brilliant guy. He was the one who first put some rigor around how many things you need to service some number of requests. And the cool thing about it was he did it in the abstract. This can apply to telephone lines, telephone trunks, servers, the number of threads that you need to do something. But for our purposes, it deals with how much carrying capacity a network needs to absorb some amount of traffic that's thrown at it. So this is his B formula. This is the Erlang B formula. You don't need to remember this. If you want to go online and take a look at the DEF CON materials once they're posted, I put a much longer version of this slide deck up so that you can actually see a walk through of the equation and learn what all the parts of it do. But basically this tells us the probability of blocking. That's PB. The probability that we'll have a resource unavailable if we have M resources available. And we have E, which is the normalized ingress load. So normalized ingress load is fairly simple. It just means the average call time or transaction time if you're doing like server type stuff, multiplied by the average holding time. So how often you get calls times how long they are tells you you're normalized. Ingress load. And then if you do this summation over here, you can come up with a probability of blocking. Now in the abstract you say okay that's fine but so what? Well if you reorganize this and you actually solve for M, you can start out with a target. You can say I want no more than a 1% probability of blocking a call or a transaction or whatever it is I'm trying to do. And that was very important to Erlang and it's still very important to us in the 9-1-1 field because telephone lines or telephone trunks that connect switches with 9-1-1 centers are very finite resource. We have very few of those. 9-1-1 and the telephone network in particular are the last sort of thing in the information world where it's physical wires that matter. All of this stuff you want to go make a change to a 9-1-1 network.  So last year we got a call from the Department of Homeland Security asking us to take a look at a research paper that was put out by Ben-Gurion University in Israel. And they did a lot of really cool math, a lot of great research. They deeply analyzed the 9-1-1 system in the state of North Carolina based mostly on open source information that they were able to develop. And so they developed a model of sort of what a typical 9-1-1 system might look like. And what they came up with was this notion that a typical 9-1-1 system probably has about 1.7053 trunks for every 10,000 population in the area that it serves. Now I want to point out this is, all of this stuff was based on the wire line network. 9-1-1 started back in the late 60s and that was all there was. There were no cell phones back then, there was no VoIP. So all of this stuff was built on this kind of physical infrastructure basis. Once upon a time that was probably really right. Like that, I'm sure there's some traffic engineering table somewhere where you can go look that up and just build that. The bell system was great about that. They estimated that 75% of those trunks were shared between wire line and wireless and 9.5% were dedicated for wireless only. For reasons that wireless was kind of this bolt on sort of thing that we did decades after wire line. There are some places where like the wireless trunks are separate from the wire line trunks. The only problem about this is when we read this in our organization, we deal with this stuff every day. Our members are the people who have to, you know, build and operate these things. We thought that was a really aggressive estimate. We actually believe that the number is more like 12 or less trunks per average 9-1-1 center, average PSAP. You'll see me use that term that stands for public safety answering point. I use it as a shorthand for 9-1-1 center. I'll try not to be jargony, but if I slip into it just know that PSAP is a 9-1-1 center. There are about 7,000 of these across the United States and another couple of hundred across Canada that we represent. So about 12 on average. Bigger places, bigger populations, you will see more of that.  Like how many do you actually have? That's not something that we knew on a national basis. And by way of example, I called up some folks in Denver and the Hungarian paper predicts between 79 and 95 wireless trunks for a city with 663,000 population. And that's just the city of Denver. If you're one of the people who lives out there and knows it's growing very quickly, you go, oh my God, there's way more than that. This is just the city proper because that's what's served by their peace app, their 9-1-1 center. The reality when we call them up is they have 32. And that's about a 2.5 to 3 times smaller number than what was expected.  They just fundamentally overestimated the carrying capacity of these systems. It's actually much smaller. We have very few trunks compared to what you might expect. And this was actually a problem that we were aware of. This was not something that was new. Back in 2012, I and a few other people in the public safety field actually worked with the Department of Homeland Security to stand up a working group on telephone denial of service and cybersecurity issues in 9-1-1. And through that process, we focused on a few things. We had gotten requests from California and a few other states who wanted to know what do we do if X happens? And the X's that they were worried about tended to be things like Android malware. What if somebody infects a whole bunch of these vulnerable Android devices and they go out and start making 9-1-1 calls? What do we do? Who do we call? What if they geo-target it? So, you know, 9-1-1 centers have defined geographic service areas. You only get to that 9-1-1 center if you're within the service area or maybe a little bit of a radio margin around it. So, the question was, well, okay, what if they start targeting a 9-1-1 center as a prelude to a kinetic attack? If you want to bomb something and you want to make sure you have the most possible casualties, one way to do that, shut down the 9-1-1 service, stop the response. And they also were really worried about single PSAP incidents. You know, when something happens and one 9-1-1 center is affected, what do they do? Who do they call? Remember, these are not folks who deal with the feds on a daily basis. They don't have U.S. cert on speed dial. The FBI is somebody that comes in and takes over, not somebody that, you know, like you routinely reach out to call. So, through this process, we came up with a few things. We helped our members to understand how to recognize an attack, how to report an attack, who to call at the FCC, at homeland, at the FBI, et cetera, to let folks know, hey, something's going on, and also how to recover service, how to get things back running the way they should be. But we never thought that it would happen the way it ultimately did. Again, we were focused on things like, you know, Android malware, geofencing, and so on. What we really expected was that the first 9-1-1 distributed T-DOS attack would happen as a result of native malicious code that was executable on a device, or, and this is the other big one that kind of kept me awake, was we expected an enterprise call manager to get popped. I did a quick show to end search and found 675 unprotected call, enterprise call managers sitting out on the internet just in North America. Any one of these boxes has far more traffic origination capability than even the biggest 9-1-1 centers in the country are capable of absorbing. There's just no way if one of these things gets popped we can defend against it. We also knew that there's almost a billion known vulnerable Android devices that are out there with, you know, legacy operating systems that are no longer patched on devices that the manufacturers are no longer supporting. So like, that was the thing that we expected. This is, nobody expected what actually happened. We also expected that attacks would be limited by user location. We thought at worst an attack could hit a region.  And, and you could get some failover between those if they're wired up just perfectly.  This is not going to be lots of 9-1-1 centers because it's really difficult to scale. And last, we never thought that there could be a distributed attack on distributed targets. Like that's not the normal model. You normally think of like Mariah going after Brian Krebs, not Mariah going after all of the internet. Like that's just, it's not within your norm. But when you're dealing with scales that are so much different, like in the telephone network, well all of a sudden that becomes true. And I'm going to argue later on that starts to become true very quickly for even the rest of the internet at large as the number of compromisable devices grows. So let's talk about a practical attack. You guys came to hear what actually happened, what, what actually hit these 9-1-1 centers. In the end, it was one YouTube comment, an obfuscated URL, and eight lines of really simple code. So the guy behind the incident ultimately, and I want to be very clear here, when I was this guy's age, I did dumb stuff with scripts that could have landed me in a lot of trouble too. And I imagine that's a shared experience in this room. I find it very hard to be really harsh about this because like people do dumb stuff. In this case, it works possible target. 9-1-1 is not the thing you want to mess around with because people are going to freak out about it, right? But in fairness to him, he was a teenager who did a very, very dumb thing. Fortunately, he didn't have all that many followers. If this had gone out from Kim Kardashian, we would have been in a world of hurt. Ultimately, he wasn't even the guy who originally found the vulnerability in iOS that led to this. He was actually helping somebody out saying, hey, you guys took down this guy's site clicking on his links. Here, let me put that back up for you. And well, unfortunately, then it got out because the following day, oh, it's still going strong. People are still clicking. Large numbers of hits on the link. And then the really amazing thing for us about all of this is the attack really wouldn't have been that bad if this had just stayed within the hacker community. Like, in fact, I doubt most 9-1-1 centers would have noticed if this was just, hey, I found this cool iOS phone, everybody go check it out, right?  Unfortunately, there's this thing out there called the music community. And the music community has like, lives on social media. People who are into music, people who make music, et cetera, they live their lives on social media and they click links from people they don't know absolutely all the time. The music community is an enormous, like, weaponizable net that you can exploit. It's amazing. So the social media personalities just happen to be in the wrong time zone so that literally everybody in the U.S. is awake when they're doing these things.  They weren't thinking about what are the other possible consequences.  Remember that. We'll come back to it. And then this guy, this was the thing that really like made this go pear shaped. This is Mark Thomas. He is, as far as I can tell, this guy doesn't actually do anything other than show up at places and look good. That's, and somehow he gets paid for it, I think. I don't understand that, but it's a thing on social media. He has 532,000 Twitter followers who love to click things. And they did. Because what they saw when they went to Twitter was a helpfully shortened URL, something like this, you know, the average user doesn't understand that that blob of nothing down below really points to a really shady URL.com and is going to get them pwned. And so they don't expect what's coming next. Because what this linked to was a very simple web page, and I'm going to show you the code here in just a second, but the basis of the vulnerability that these guys were exploiting is once upon a time on iOS, very helpfully, if you clicked on a phone number or a tell URI in our speak, you would get an automatic call generation. I could click a phone number for one of my friends and it would automatically call them. And that was helpful and useful and quick and low friction. Good thing, right? The problem is user interaction is not the only way to call a tell URI. You can also write a script that calls a tell URI and says, oh, click that. And if you put that in a for loop, you can click that a lot of times very quickly. And that's what this guy did. So on this page, here's the actual code that caused the incident. It's not the most sophisticated thing in the world, but there is sort of this internal elegant simplicity to it. Like, you do it for the laws, first of all. I mean, that's like, why do we do anything? We do it for the laws, right? So that's what the user saw in their browser. They just saw a string of laws. And then within about a second, the script down at the bottom there started. So, and I'm going to walk through this in pseudo code for those of you who don't read script in just a minute. But basically, you've got at the top, you've got a definition of a couple of links, one of which for a phone number and one of which for an email thing. And this was the other kind of elegant, clever thing about this is like, if you want to crash somebody's device, make it do lots of stuff and cover up the fact that it's doing lots of stuff, right? So in addition to continuously calling 911 something like 10 to 16 times, apparently an earlier version of the code used it 1337 times, but that was deemed to be insufficient. So inside the for loop, it basically says look call 911 and look, put up an email thing, you know, put up this email thing that tells people they have a virus on their phone, which would worry most people. And you know, the worrisome thing about this is, Safari is a great browser. I love it. I use it all the time. It does very helpful things that are also very exploitable. So in this particular case, if you just power cycled your device, when you reopened it and came back into Safari, Safari hopefully said you were just looking at this page on meet decide.com. Why don't I reopen that for you? So rinse and repeat, right?  I promise some pseudo code. Here's basically what I just walked you guys through. If you're not super into code, this is a nice kind of little explanation of what you can see in the rocket script on the previous page. So this was basically the whole thing. This is how you attack 911, at least on earlier versions of iOS. So let's talk a bit about like the prompt effects. What happened when this started? Well, we know from looking at the Google link shortener that there were about 117,500 clicks that we know of. Now, I also know that this URL and others like it got repackaged and reused roughly in the same time frame. So not all of these may have been actually a result of this one YouTube comment or these tweets. And I would also add this could wildly overestimate the number of times anything actually went wrong because this was, remember, an iOS unique vulnerability. This wasn't everywhere. And so other devices on different operating systems and potentially on different versions may not have reacted in the same way. So if it had really been 117,000 devices calling 911 constantly, I would have heard about it in 30 minutes instead of like six hours, right? My phone would have rung a lot faster. But it did have effects in the real world. It actually caused overloads at 911 centers in 12 states that we know about. And in some places there was peak traffic of about six times their average load. Now, that sounds really big and scary, but before everybody starts to freak out again, I want to emphasize the average 911 center in the country has maybe three positions and maybe six to 12 trunks. Like it's very small. So it's six times three is just like, oh, you got 18 calls in an hour instead of three. Like it, you know, some of them were admittedly bigger than that. But the numbers can be made to seem a lot larger than they really are when you start using multipliers like this. And I just kind of want to be clear that it wasn't that gigantic in most cases. The other thing, and this was really fascinating to find out, you can really exploit demographic differences in groups to create a lot of confusion around attacks. The first reports, the first three or four reports that I got from 911 centers and then ultimately from folks in the government was, you know, we think this is a vulnerability in one carrier's network that is causing this. Everybody was saying, oh, all the calls are coming from this particular carrier. And that seemed really strange. Like why should iOS on one carrier behave differently than it does on another? We didn't even know it was just iOS at that point. Why should any, you know, software respond differently to the carrier network? It turns out it doesn't. There was the carrier had absolutely nothing to do with it. It's just that all of the people, remember I talked about weaponizing the music community? Everybody in the music community uses one particular wireless carrier. I don't understand why, but like music fans have this particular bias. They like this particular carrier.  You know, not a good position to be in if you're that carrier, right? That's not a good thing. But it was just this weird asymmetry in this one particular subpopulation that just happened to confuse the heck out of everybody. So, and the big takeaway from all of this is that above some threshold, nothing is really safe. Like there is some traffic threshold when it really just doesn't matter anymore what you're doing. There's, there's, you're just not going to be able to defend against it. I'm sorry, that's, that's it. Um, we happen to find that in the telephone network in the 911 system, um, in this, uh, you know, in this instance because we're a softer target. We have this vulnerability that we knew about.  Um, we knew about that. And it's even actually worse than that because behind those 23 trunks there might only be like three or four people actually answering calls. So, funny story, you know, we talked about the Erlang formula. That doesn't just apply to technical things like gets and server transactions and trunks. It also applies to people. You can use the Erlang formula to model how many people, how many agents do I have to have to deal with a particular call load when the, you know, average arrival rate is, uh, lambda and the average holding time is h. You can work that out and figure out, okay, how many people do I have to hire? Um, the same holds true for things on the internet. I, I think, you know, I mentioned the Mariah attack against Brian Krebs earlier. Um, one of the articles that I read in the, in the mop up from that was when Google was trying to decide, hey should we take this guy on and defend him? They had to have a very adult conversation about, well, wait a minute, this thing is so big now that even if we are the 600 pound gorilla on the internet, we could be vulnerable too. And that's, if you think about the scale of somebody like Google having to have that very sober conversation, um, it really does demonstrate that, you know, especially in the IOT era that we live in where every little, you know, moat of dust is potentially an IP traffic source, um, we really have to start thinking about defense in, in very different ways because there is a scale at which there's just nothing else you can do and, and, and it becomes essentially indefensible. So what did we do? Knowing that we have these vulnerabilities, let's get into remediation. The, the first thing obviously was to stop propagation. We had to stop this thing getting bigger and we had to do that very quickly. Uh, we also had to do everything we could to remove, uh, de obfuscate the links if we could so that people would know it was potentially shady. And also to just take away that level of abstraction so that it was, you know, not, uh, something easy and, and, and convenient for users to click on. And then ultimately just get the site offline. Like I, you know, somehow get that code to a point where nobody can get to it. So very quick sort of things. Uh, Twitter was actually very helpful working with the government to, uh, basically pause the source accounts, filter out the malicious link, uh, stop this from circulating. Uh, Google equally very helpful disabling the shortened URL so that, you know, if you go try to click on that shortened URL now, nothing's going to happen. Um, and, uh, also to take, take down the website. I, I, and I don't have this confirmed. I am 99% certain this was a, a hosting site behind Cloudflare. I know Cloudflare was in front of it. Um, and they were actually very helpful in ultimately, uh, black hole in the domain. Um, the guy like knew that something wonky was going on, but was like, no, no, I took this on to like help everybody out. Don't worry, it'll come right back. Well, no, that, that's not coming back. Not ever. And remember this guy? He is now DEF CON famous. So, you know, and, and I love that, you know, just like to, to be that candid about it, you know, lawyers, we have a duty of perfect candor. Well, if you're telling people, well, I'm about to get arrested.  Uh, there's his mugshot. He, he, he didn't, didn't have a good time. And here's our August, uh, original vulnerability researcher. And, and again, I, like I said, I, I, I absolutely feel for this guy because I have been the 17 year old kid doing stuff with things that sometimes goes pear shaped. Um, and I know a lot of the folks in this room have too.  Like, and I say that as somebody coming from the 911 community where I know exactly what's at stake with every call, my members have to deal with people, you know, getting murdered in real time while they listen and eventually while they watch. And it, it's very meaningful to us. So a lot of folks will be very reactive, reactive, reactionary, sorry. Um, and we'll just say, you know, burn them at the stake or something.  Like, let's not completely destroy this guy just because of that. Um, uh, CVE. So interestingly enough, this vulnerability, although it does have a 2017 CVE that we'll talk about in a second, was not completely new. Um, this guy, Colin RM on Twitter, um, I threw a lot of very deep Googling. I managed to discover he had actually notified Apple, um, about this very issue back in 2008 or at least issues that could affect similar results and those were eventually patched. Um, they did eventually patch, uh, iOS as well against the particular flaw that was exploited in, in this incident. Um, but that patch actually didn't come out for another five months. That was May 30th. If memory serves, that was iOS 1032. Um, so five months later, it is actually patched. And you can see it, these are the, the write ups. If you want to go look at CVE 2017, 2484 and CVE 2017, 2404. Um, and these were the ones that ultimately were exploited to cause, uh, both the 911 denial of service attack and basically the shutdowns on, uh, user's devices or, or basically rendering the devices unusable. So one of the things that I put in the abstract, because we, we thought this was very important was to track, um, the extent to which these vulnerabilities are, you know, potentially hanging around. And, uh, part of the way that we did that, um, we, we went out there and looked at, uh, app-telegent data to see, okay, what's the, the rollover rate? How quickly are people patching? And, uh, I actually, uh, just refreshed this today. And 76% of active, uh, iOS versions that are being seen on the web now are 10-3. And I don't know how many of those are, it doesn't get broken down by sub-point. Um, but we're fairly confident that this problem is going away quickly. Um, but the trouble, and, and I think this goes to show, you know, a lot of folks, uh, kind of poo-poo the notion that, like, well, you know, iOS is always, like, so much better. Well, there's, you know, 11% that are on, still on 10-2. That's a lot of devices across the world. It may, may not be the billion that you have, like, with Android, but nothing, none of these types of vulnerabilities are unique to any particular, you know, smartphone ecosystem. Um, they're just a consequence of having little computers in our hands that can run code and that nonetheless connect to a telephone network that doesn't know what code is. So, we know we're vulnerable. The next obvious question is, okay, Trey, well, what do we do about it? Like, you can't just bring us your problems. You've got to propose some solutions. Otherwise, you know, you're really not doing anything for us. So, a few things to talk through. Um, and I, and I want to take a step back for a second because the 911 world right now is very fragmented. We have three feet in three different time frames. There's legacy, transitional, and next generation. Legacy is the part that is, like, strictly analog telephone network. Um, I, this ought to be good for a chuckle. Most of the nation's 911 systems still run on Cama and MF signaling. That's not a joke. We still use all the stuff that Captain Crunch and crew were messing around with, with blue boxes and gold boxes and stuff back in the day. That's still how most 911 calls are signaled and set up in the telephone network today. Um, Cama is handy, you know, handles a lot of the data. When we get your location in 911, that comes from something called automatic location identification, and it has an upper bound of 512 non-extended ASCII character set characters. That's it. That's the entire data block. That plus maybe 20 digits that we use for some routing and callback purposes. Not caller ID, but automatic number identification. That's really it. That's the legacy world. And that's all that analog stuff. In the middle, in the transitional case, we've got networks that have started to move to IP. So maybe you have IP trunking. You're no longer using those analog or TDM trunks to connect the local end office class 5 switch with the 911 center. Um, but you're doing some voice stuff. Maybe you have a sort of quasi cloud hosted service provider somewhere in like Colorado, California, or Washington, and you connect up to them over multiple links. And that's how you're doing it. Maybe even in some cases you're doing some cool stuff with location technology. You're adding some data in, bolting some stuff on so that, you know, you're doing some things out of bands so that you can get more data in on the 911 call. That's the transitional case. Where we're headed is next generation 911. Um, that's something that's defined by a thing called the i3 standard that my organization publishes. It's basically a model for all IP 911 service where we get deep, good location data that can be referenced to something that's like human readable like, you know, the Octavius ballroom at Caesars Palace for example. Um, it does things like much more intelligent routing and so on. And basically that's sort of the all IP case. There's a very little bit of that in existence today. Maybe four or five percent of the country, but it's still just doing voice. It's not doing video and text and data the way we really want it to be in the next, you know, three or four years. So I'm going to talk you through defense in all three of those cases like the options that we have available to us and the problems that we have with those options. So in the legacy world, the first defense is you can just over provision. You can go do the Erlang formula again. You can come up with a probability of blocking that's a tenth of one percent.  And it's great that works, but it's expensive. Number one, you've got to buy and build all that stuff. And number two, it may be impossible.  There's no way to do it. You can do contextual whitelisting. Banks do this. So most of the time when you call your bank, they're looking to see with automatic number identification, that's the theoretically not spoofable part of a not caller ID that they use to say, okay, who is this actually calling? And for the most part, it's well trusted because there are so many rules around it for number one. The trouble is for us, unlike a bank, we don't have a customer list. I mean, it's one thing to say, you know, in the wire line world, you could say, okay, here's the list of all the numbers that we know exist for telephones in our jurisdiction because somebody went out there and nailed one to the wall, right? Like you know where those lines go. That's, that would work. Trouble is now they move around. They're on these things. And that doesn't work anymore. So we don't have a customer list that we can use so we can't do contextual whitelisting. And we could do blacklisting. This is the other thing, like okay, you send us a hundred calls and they all turn out to be false.  You're over and done. We're just going to block your call now.  You know, and our members feel very strongly about that. I feel very strongly about that. You know, we, I talked last year at DEF CON about high availability systems when you have to carry traffic. You really don't have an option because it's 911. That complicates matters greatly. When you can't just say, sorry, I don't like your traffic, I'm not going to handle it, your life gets a lot more complicated. In the transitional case, some things that are being researched heavily right now, Homeland's doing a lot of work on this. We're working with some of the technical folks to connect them with our members and whatnot. You can do number reputation scoring. If you've got apps like, you know, I've got HIA on my phone and it like blocks, you know, bad calls for me. It's doing that in part on the basis of number reputation scoring. And that's a great thing. We know that this particular number is getting misused often. Great, let's block or at least flag that call. That's dangerous because lawyers and it's also a thing that, you know, may be dangerous because of human life. So we've got to be careful about that. I think we'll see some of this done soon with at least flagging. We'll start seeing like a little asterisk somewhere in that 512 character data block that says, this is a little squidgy.  We can also do real time threat scoring. So things like, should this call be coming from this location? In other words, if somebody was recently making calls from a cell sector in Boca Raton and now I'm getting and I'm on one call from them that's hitting a cell sector in Kansas City and there hasn't been enough time for them to get between one and the other, like we need to think about, okay, is that really a problem? Like that could be a real threat score. The trouble is for both of these, we haven't tested diverting calls. One way to handle that is to like send the call someplace else like an IVR or proof of humanness test or you got to like dial one, two, three to get access to number one or whatever. Those capabilities exist in some transitional systems but nobody's kind of been brave enough to turn them on yet. So we've got to get, we've got to go through a process of getting comfortable with, is this going to work in a way that doesn't endanger human life, that we can, you know, justify turning it on all the time and not just when we know we have an incident or an attack. And then in the next generation 911 world now, and I love to talk about this because in the legacy world, yes we have lots of vulnerabilities that are, but they're like impossible to defend against. In the next gen world, yes we have lots of vulnerabilities, maybe even more, but now we can do things to actually defend against them. And so the first thing on the list here is the stir and shaken framework. If anybody's a Bond fan, yes this is a Bond reference. Stir is an IETF track standard for cryptographically signing ownership of number blocks. So if I have, you know,<PHONE_NUMBER>, the North American numbering plan administrator should issue a signed thing that says that belongs to Verizon or AT&T or TMO or Sprinter somebody. They should sign it saying this particular number belongs to Sinkvallfleet and oh by the way the chain is all, you know, it all rolls up to some root CA and so we can trust that this is a legitimately originated call with that number. It's not being spoofed. Shaken is the same thing just done in the carrier standards body called Addis. Trouble with that, as I can't remember if it was Bruce Shiner or Phil Zimmerman said a couple of DEF CONs ago, PKI is really, really hard and if the PKI goes wrong I want to talk to 911. And that is the sanitized version of that line for everybody's, you know, anybody who knows them. We can also do bad actor marking. We can start to say look we know you're a bad guy because we've seen your traffic and it's not good we're going to stop that. That takes time to tune, could go wrong. We can do suspicious call diversion. We have the ability in the border control function of next generation 911 systems to mark traffic as suspicious and then say at a subsequent emergency services routing proxy if we see that 911 center is in load we can say okay prioritize the non-suspicious traffic first or if it gets in really high load maybe divert that to an IVR first, proof of humanist, etc. We get or you know fail it over to an investigatory center that's not handling live 911 calls but is just dealing with like the suspicious stuff. That's intelligence that we don't have and can't have in the telephone network but that we can have in next generation 911. Also a big work in progress there's a DHS pilot on threat scores using those frameworks that I just talked about and we're also working the I3 standard that I mentioned before and then the other big standard we publish for this is called NGSEC that's the next generation security standard it tells you and it's actually applicable in today's 911 environment too but it sort of tells you what to do to baseline properly configure and secure a big complex Harry next gen 911 system. And on that note I want to encourage everybody because those standards are still underactive development if you know things about these subjects and you want to help we would love to have you join in at dev.nina.org it's an amazing way to contribute to the safety and security of not just the community here in the United States but the I3 framework in particular I3 standard is actually being used in Canada and all of Europe as well as the basis for their emergency systems going forward so this is going to be a global kind of thing and we need the global information security community focused on it to make sure that as we add things like voice video text data etc that we have the capability to to do that securely so we'd love to have you. Before I close here a couple of things I will take some questions if we can do that but I want to say a special thanks to QueerCon we have the coolest badges at all of DEF CON and we do that every year because of some amazing people these guys are my family I love you all it's the reason I'm up here thank you so much also I am the cavalry for those of you who know something about tech and policy I absolutely encourage you to get involved with I am the cavalry we're doing amazing things in DC translating and being ambassadors for those in the policy community who don't know a lot about what all of you do from day to day and we need help we need more help there we're putting computers in every part of our lives today and that has huge policy implications for the safety of human life and literally every part of our economy so please please you know come join us also check out my other talk in the crypto privacy village hash tag shameless plug I will be I'll be talking there about location tracking so basically in 911 we don't want to track you but sometimes other people do and they always blame us when that happens but I want to assure everybody how that works so please come and see that in the CPV and at this point are there questions am I allowed to take questions anyone anyone