I'm here with Dr. Alice Simba, the Acting Director of ICT with the Ministry of Communication, Science and Technology in Tanzania, and also with Professor Encoma, the Director-General of the Tanzanian Communications Regulatory Authority. Gentlemen, you're very welcome to join us here today in the World Telecommunication Development Conference. Thank you very much. May I start by asking you, Dr. Simba, how is the Ministry and the Regulatory Authority working together in Tanzania? Yeah, basically the Ministry of Communication, Science and Technology is divided into two major sub-sectors, that is, communication of what we call ICT and the science and technology. Now in terms of ICT, the Ministry is mandated to coordinate, formulate, develop and implement national ICT policies, guidelines, programs and other projects so as to enhance the use of ICT in improving national socioeconomic programs. Very good. So you're working in the whole ecosystem there. And Professor Encoma, from your perspective and the Regulatory Authority, how is it working? Well, as you know, at the present moment, the communication services are very important in any society. And the communication services providers are actually licensed by the regulatory body. So we license them and we also manage the resources like frequencies and numbers. Okay. And Dr. Simba, the Connector School Connector Community Project, the success of that is well known and well documented in Tanzania. Can you tell us a little bit about what the next steps will be? Thank you very much. I'm not sure if the time will allow, but maybe I should get back where it started. Basically it started in 2010 in Adobat where the ITU put the call for proposal from countries and Tanzania applied for the support and we got it. And now we have 49 schools, basically some are nursing schools, some are the secondary school and some are just one primary school. Now when we look into the project, we are very interested because in terms of course resources, you know, you have only two computers, but 12 kids can use it. So it is something that we are very much appreciated. And based on that fact, the government now is in the plan to implement other projects from other funds to increase the number of schools connected. In the near future, our plan is to have around 300 schools connected. But we have what we call Tanzania Beyond Tomorrow that is going to look heuristically on the issue of e-learning and we believe this will be part of that initiative. So you are really heading towards a future of fully connected schools throughout Tanzania? Correct. And Professor Enkomal, can you give us an example of the types of ICT applications that are being used currently in Tanzania? Right, there are quite a number of applications, but I'll pick two. One is the internet service provision where somebody actually gets internet through the mobile phone. And another one is financial services. I mean, the financial services in terms of making payments to other people, utility payments, for example, water, electricity, pay television, and checking with bank accounts, those are very popular applications. And from your perspective in the ministry, are there other applications that you see becoming really prevalent? Yeah, I think in the near future we are going to have a lot of applications. Basically, we are now finalizing the use of the government. The agency has been set and now we are in the preparatory mode where the citizen can start paying their taxes and everything using, or doing applications for passport and everything from the internet. But again, I understand a way of the e-learning strategy that is going to allow people now to use ICT as a means to get their services. And again, when you talk about e-education, there is a lot of initiative living along the school-connected community and now looking into content so that the student can be able to access this content from a single source and can be used in many other schools to cut costs and, of course, to have better materials. And Professor Encomma, can you tell us some of the key achievements and also what the future holds for the regulatory authority? Right. First of all, infrastructure development. We have a lot of wireless networks, but also now we have optical fiber networks, both terrestrial and submarine, learning Darius Lam. I think we have three cables learning there. And then services, either voice services or video services or data services. These are also growing very fast. And then applications, as I said earlier, mobile payments, internet service provision. And recently we had the digital broadcasting migration. It's also very important. Dr. Simba, may I conclude with the question to you about the broadband future of Tanzania? What are your hopes for the broadband future, which is, of course, our theme here at the WOTDC this week? Correct. And I think the theme came at a very right time because right now in the country, we're in the pose of developing the broadband strategy. Now, but when you look into the ground, because you understand the broadband is an ecosystem, we have a very well improved infrastructure that the professor mentioned. The fiber cable now goes about 7,000 kilometers. It goes to every region and our future in two, three years to make sure it goes to every district of the country. We are now also connecting the government. We have what we call government, where all the government institutions are going to be connected by the fiber. So the future reel is very bright. We have some challenges, of course, in the area of content. We need to do a lot of issue there and issue of contents. But investment is good because the government is working very closely with the private sector, where the private sector is not there. The government is doing its work. We have universal access fund for the communication, where we are trying to send the broadband to the rural area using the wireless technology. So we are in a very right position. And the theme of this meeting, I think, is perfect. And what we will get here going back home is something we are going to use it very well. Dr. Simba, thank you very much. Professor Encoma, thank you very much. Thank you very much for having us.


Okay, so now last talk in this session is Refined Cryptanalysis of GPRS Cypers, GEA1 and GEA2 by Itai Jinnur and Dor Anja Lake and Itai will present this paper. Very much for the introduction, I hope that you can hear me well. So this talk is about the GEA1 and GEA2 cypers that were used in the GPRS. So GPRS is a mobile data standard, was used to encrypt data, it was widely deployed in the early 2000s and the encryption was used to protect against eavesdropping on the communication and initially GPRS used the two proprietary screen cypers named GEA1 and GEA2. Now at last year at Eurocrate, a very nice paper by eight authors that are given here. So it presented the first public analysis of the cypers GEA1 and GEA2 and in fact this paper actually first disclosed the specification of the cypers. So I'm going to call this paper in short the BDL from now on. So GEA1 and GEA2 both have 64 bit session keys, nevertheless the previous Eurocrate paper described the weakness that allows to recover the session key of GEA1 and time complexity only two to the 40, given roughly 44 gigabytes of memory. Now the attack only required 65 bits of known key stream that can typically be obtained just by knowing some fixed headers. So the attack is kind of practical, it's really practical, it was actually implemented and however it requires kind of a large amount of memory. So the attack is based on the weakness that is believed to be intentional and the weakness is probably due to some export regulations that were in place at the time that the cypher was designed. Now the use of GEA1 was already prohibited back in 2013 but kind of surprisingly BDL noticed that modern mobile phones still supported the Cypher GEA1 and this could actually lead to some downgrade attacks. So it could have an actual impact in practice but this defect is now supposedly fixed by some removing actually verifying that the GEA1 is no longer supported. Now for GEA2, so GEA2 does not have as far as we know a significant weakness as a GEA1, however the authors still described an attack on a cypher with time complexity two to the 45 but the main kind of practical obstacle in this attack is that it requires 12,800 key stream bits, the knowledge of them in order to that are used to encrypt the full JPRS frame. So this attack is kind of, this kind of limits the practicality of this attack and therefore the previous paper also presented the data time trade-off that beats exhausted search but only given at least 1,400 bits of known key stream. So that was the previous paper now let's move to our results. So basically what we do in the paper is describe improved and we find the attack impacts compared to the previous paper. So for GEA1 we reduce the memory complexity by a factor of roughly 8,000 bit more from 44 gigabytes to about four megabytes while the time complexity remains about two to the 40. So we implemented the attack and the attack runs on a standard laptop and roughly two and a half hours. On the other hand the previous paper, previous authors run the attack on a cluster probably due to the high memory complexity. It's not trivial to implement this on a standard laptop, the previous attack of these. So before moving on to GEA2 I want to just stress the motivation in improving this attack. So in the early 2000s high memory complexity such as the previous attack was actually not obvious to implement, especially if you want to run this attack is wrapping to multiple sessions and you want to implement this attack at scale. It's not obvious how to do it. I mean it's not obvious that you need a lot of resources to do it with a lot of memory. Another motivation and I should say this is a general motivation for this work is to better understand the security of Cypher that were at least the ones widely used. So that's for GEA1 and for GEA2 we actually present two attacks. So in this talk I'll only focus on just one attack, the first attack. So we improved the data time trade-offs presented in the previous papers but the improvement is only up to seven, given 7000 bits of consecutive history. That's what we assume about the data complexity. And the techniques that we use, as we will see, are borrowed from techniques for solving cakes or problems. Okay, so first I'll focus on the GEA1 attack. Before describing the attack then let's see how the Cypher actually works. So I'll start by describing the initialization process. So this process takes its input 64-bit session key and 32-bit IV. And first these inputs are used to compute 64-bit scene. It's not very important how it's done. And then in the second step of the initialization, the seed is used to initialize the 96-bit initial state of GEA1, which is composed of three LFSRs, A, B, and C, of sizes 31, 32, and 33 bits. Okay, as you can see here. And the snapping from the seed to a 96-bit state, we will denote it by M and it should be mentioned. I will mention that M is actually a linear function. Okay, so that's the initialization. And after the initialization, the Cypher is ready to produce a key stream or to encrypt. So how do we do this? So before actually describing how to do this, then let's fix some notation. So given some internal state A of this first LFSR, I'm going to denote F A applied to this internal state indexed by an integer tau. It's going to be just a function that computes the next tau output bits from the internal state A understood. And how is it done? Basically, we have tau iterations. And in each iteration, we apply some output function to the internal state. It's not very important what this function is. It just produces the next output bit. Then we clock the LFSR to obtain the next internal state. And we have tau of these iterations that produce the tau output bits. Okay, so now let's understand how the key stream is generated. So basically, the inputs to the key stream generation are the 96-bit of the initial state ABC and a 12,800-bit packet, which we denote by P. And basically, what we do is just produce 12,800 bits of key stream just by XORing the outputs of these three registers. And the ciphertext is just the XOR of the key stream with the plaintext. Okay, of course, you do this bit by bit, but in general, it doesn't really matter. You produce key stream and then you XOR it with the plaintext to output the ciphertext. Okay, so now that we understand how the GA1 works, let's think about how to break it. So the attacker, what we assume is that the attacker obtained 65 bits of known key stream, which we'll denote by Z, for some packet. So how do we obtain this key stream and practice what we need to do is to actually eavesdrop to get the ciphertext. Okay, eavesdrop to the communication. And we also need to assume that we know the corresponding plaintext that was used in the encryption and 65 bits of key stream is not typically difficult to actually guess or know because you can guess it from some known and fixed headers. Okay, and then the key stream is just the XOR of the plaintext and the ciphertext. Okay, so we assume that we have the 65 bit key stream. And now the goal of the attack is to run some state recovery attack and to recover the initial state ABC of the registers. And now, given the initial state, the attacker can actually invert the initialization process of GA1 and obtain the seed used to produce the states. And from this, it can actually go backwards and obtain the session key. I'm not going to describe how to do this. This is actually described in the video paper, but it's kind of simple. Okay, and given the session key, you can actually, by continuing to eavesdrop, you can actually decrypt the full GPR session. So you have all the communication. So now the goal is basically to right to focus here on this, how do we recover the initial state given the key stream. Well, let's see how to do this. And before we see that, let's describe the actual weakness that was used to that was described in this video paper. So the weakness is actually a weakness in the initialization process of GA1 in the second step of this initialization step that maps the 64 bits into a 96 bit state by this mapping M. And specifically, let's focus on the internal states of ANC. So it turns out that the joint internal states of ANC, which are 64 bits, they can actually assume or obtain only two to the 40 values out of the two to the 64 possible values. Okay, so that's kind of interesting. And equivalently, this means that the dimension of the image of this mapping M, this linear mapping, when projected to the registers ANC is only 40 out of 64, which can be readable. Okay, now given this, let's see how to break the cipher more efficiently than just exhaustive search. So in the attack, what we do is we search for internal states A, B and C that actually produce the given key streams as in this equation. And in order to do this, we will split the attack into the equation into two parts. So the right part only contains the internal states B and the left part only contains internal states of ANC. So how does the attack work? We first focus on the right hand side here. And what we're going to do is we're going to build a table, which we call TB for the function FB. And it's done as follows. So for each value of the internal state B, so we have two to the 32 such values, we're going to produce output 65 bits of output. So we're going to store all the all the states and the outputs and some table, which we'll denote by TB. And that's the size of two to the 32. Okay, that's the right hand side and that's we focus on the left hand side. So for each ANC and the image of M projected to ANC, we know that we have only two to the 40 such joint states. And then we compute the left hand side here and we search it in the table TB that we prepared for the right hand side. Okay, basically each match give you a candidate for the internal state. And because we are using 64, five bits here, then essentially you can do some calculation and show that we expect to actually only output the right internal states of this, if everything is done correctly. Okay, so the complexity of this attack is best if you dominated by this second step because we only have two to the 40 joint AC states and the image and the memory complexity is dominated by the stable TV, which is of size to the 32 words or if you do the calculations 44 gigabytes. Now, the goal, of course, our goal in the paper is actually to reduce the space to roughly two to the 19 words or four megabytes. So how do we do this? So here's an additional observation was actually already made in the previous paper. So let's look at the dimension of M of this linear mapping. Of course, it's max a 64 bit seed, so it's only 64. And on the other hand, let's look at the dimension of the image of M projected to AC, which it's 40, the dimension of the image of M projected to be a 32. So they sum up to 72. So you can see that there is a gap here of eight. And this gap basically means that there is a shared subspace between kind of between this and this subspace, both this image of dimension 72 minus 64, which is eight. Okay, and using this kind of shared subspace, you can actually decompose the images of M a B and M a C and to this search subspace. Let's go to be projected. I mean, this search subspace projected to be exhaust some direct sum with some other subspace of smaller dimensional dimension only 24. Okay, you can do a similar thing for M a C. Okay, you can decompose it similarly. And we're going to exploit this actually to reduce the memory was exploited previously in order to obtain more filtering condition for the attack but here we'll use a relatively standard trick to reduce the memory complexity of the attack. How does it work. Basically, we have the shares subspace and in general, if there is a common part between the two sides of the meeting in the middle attack, which is basically the share subspace, then can be used to partition the large meet in the middle attack and to smaller attacks, each of these smaller attacks require a smaller memory, because we kind of can reuse the memory for each attack. So let's see how this is done. So specifically, we have, we'll have an auto loop that iterates over all elements of the shared subspace. And now for the first part of the attack. So, instead of just iterating over all these, we need to iterate now, given the seal, we need to only iterate over the remaining elements of V one, and there are only two to the 24. And for each one of them we compute the internal states, according to kind of this equation of being and then we compute the output and we start in table TV. Of course it's a small table because we're only iterating over this V one space. So the tables only have side to the 24 for each iteration. And so when we do the same thing for the second part of the attack, we need to iterate only over this little space computer joint AC state. Compute the left hand side of the equation search it and TV and so forth. Okay, so that's basically how the, how the improve the attacks. So the complexity here while the time complexity remains the same. We didn't do anything to special to optimize time complexity over the space complexity is reduced to two to the 24. And just because the smaller tables to be here only require to the 24 words, which are the basically the dimension of the one. The memory complexity is now reduced to 256 megabyte roughly. However, if you remember correctly we want to reduce it to four megabytes so we're still missing something. Okay, so how can we reduce the memory further. And the main observation here is to notice that the steps, if you look at this attack the steps are actually not balanced. The first step, it requires relatively small amount of time but the large amount of memory to build this table to be. And the second step requires a relatively large amount of time but the smaller amount of space, so we can try to kind of balance the steps of the attack. So the idea is to use a technique called clamping through pre computation that is typically used to solve to solve in to solve the case or problem. The general idea is as follows we're going to add an additional condition to this loop. Okay, so let's assume that we just fix some five bit string, let's call it t just five bits and just a medical parameter here. We have more loops here but for each for each loop what we do is we're going to store. We're going to store FB we're going to store this internal state only if it produces this special the special output prefix. So we add another condition another five bit condition. And because that's because of this we're actually right storing less, less elements in the table by factor of two to the five, so the tables will be small. That's kind of makes sense. So we add this condition we of course need to iterate over all, over all output prefixes. And now we were storing in the table only kind of output prefixes that only sorry internal states that actually produce this output prefix. Okay, so the space is indeed in reduced like what we want to four megabytes. Okay, that kind of makes sense. So that that works. We did reduce the space. Unfortunately, we did not optimize the second step so the second step was the bottleneck in terms of time complexity and we did not optimize it and therefore because we have more loops here we have 32 factor we increase the number of loops by a factor of 32 or two to the five that over all time complexity will be increased from two to the 40 to two to the 45. So we kind of have to optimize the second step in order to actually reduce the time complexity back to two to the 40. So that's not really how to do this, actually, if you kind of try to look into the details it's it's actually not obvious if you can that you can do this at all. It turns out that you can do this, you can implement the step in the second step and reduce time complexity so I'm not going to destroy to you how to do this the details are in the paper. So even the main observation used to reduce the time complexity the main observation is that is that the output function of a restricted to five bits. It only depends on 26 bits out of the 31 of the of the internal state a. So we have a similar like a slow diffusion property for C, and you can use this properties actually to optimize this second step. So the details are a bit too technical to describe in this stuff but please look at the paper to understand that. So this will give us the time complexity to the 40 and the space complexity is like now really small for megabytes or it actually fits into cash. So that's the details about the GA one attack. Let's move quickly to the GA to attack and then I'll conclude. So, we call the GA to does not have a significant weakness as a GA one, but the previous paper still describe an attack on it with that. The attack is faster than the exhaustive search only from kind of 1,400. So this is kind of the data time trade off and that the only bits of exhaustive search kind of from this point, moving to the right. So we describe a different attack that improves the previous attack, given assuming that we have less history but at most 7,000. So you can imagine that this. I mean, it's probably easier to obtain limit more limited amount of data so in some sense it's. You can say it's more practical for these this region of data. And you can see the kind of the points that we get here. So specifically if we can focus on this point here. So, given 1,100 bits of available key screen the time complexity that we get this to the 54, whereas previously the best known attack was exhaustive search of to the 64. So we can improve it by a factor with the data. So I should mention that this attack is actually a generic attack it applies to all screen cypher combiners as we will see shorten. Okay, so that's an overview of the attack now let's I won't go into many details in this attack but let's kind of see how flavor how it works. And by describing the structure of the GA to cypher cypher. So during an initialization a 64 bit session key and 32 bit IV, as in GA one. So these are the inputs but now they are mapped into a larger state ABCD with four registers. So we have an additional register D of size at 29 bits and this gives a total size of the internal state of 125 bits, and not 96 bits like in GA one. Okay, so the details of the initialization are actually not important for this attack. Okay, and the key stream is basically generated in a similar way to GA one just that we need to sort the outputs of four registers instead of basically everything remains similar. Okay, so now moving on to the attack. So we assume for simplicity that the length of all registers is 32 bits, they're kind of close to that, but let's assume that they're all 32 bits for simplicity. So the attack is going to recover the initial states given the initial state given L known keys from bits. So, like in the case of the one from this initial state you can actually compute the session key and and the crib the entire GPR session. So again the focus here is on state recovery. Okay, so let's first assume that we're given just 128 output bits of the cycle. So assume you're given Z. This is the key stream of length 128. And again we're fine to manage the state recovery attack so we're looking for internal state ABCD such that that produces this key stream Z. And once again we can split this equation to two parts a part that involves on the NB and this the right part involves only CD. So the kind of each part has two to the 64 state and the standard beat in the middle attack will give you time complexity to the 64 and space complexity also to the 64. Okay. Now we can actually improve the memory complexity based on the classical Chapelle and Shamir algorithm for subsets subsets some. So, the idea is as follows so first if if this equation holds for states ABCD, then, once again we kind of partition it into two parts but the idea is now to enumerate over 32 bit values T of each side of the equation, kind of independently. So it allows us to split the fork store problem here into two to store problems and each one will be solved using a meat in the middle attack but it will operate on a smaller table. Okay, so specifically let's fix some 32 bit value here once again 32 bits is kind of a magical parameter here used to optimize the complexity. Okay, so let's fix some 32 bit value here for each side. And then what we'll do by emitting in metal tech so we can compute all internal states and be that actually satisfy this left hand side and will store all this internal states and table to be. And if you do the calculation the size of the table will be two to the 32. So the left hand side here and the right hand side you do similar thing. Okay, you compute all CD states that satisfy the right hand side and store them in a table, T CD. And then you merge these to take two tables according to the full equation here. Okay, and the full, full number of bits. So that's basically the attack and if you do the analysis then the sizes of T a B and T CD are each to the 32 so the space complexity is indeed to the 32 because we're reusing the space across iterations. And the time complexity we have to the 32 iterations each one of them takes to the 32 times so the time complexity remains to the 64 as in the previous. Okay, but remember that our goal is actually to improve the time complexity and using more larger key stream. Let's see how to do this. So we have an attack with 128 bits of history with time complexity to the 64. So how can you optimize it given the larger amount of history. So you kind of artificially create multiple solutions for the attack for the poor. That that actually solve the problem. So what is the solution here what what are we searching for we're, we're looking for an internal state ABCD at some, and the thing is, is that we don't actually need to recover the only the internal state we can actually recover some internal state at some clock see. So if we kind of try to focus to recover what some internal states that is used in the computation of the key stream then then we can we may have multiple solutions that we can work with. And once we recover one of them then the attack will actually work. So assume that we actually can do this that we can actually, you know, obtain some for in some way multiple solutions, then we can actually amount to more efficient, more efficient attack. And how this is done. So, if we look back at the previous attack so now assume that there are actually are solutions meaning our good ABCD states that actually produce. There are actually solutions to this problem so assuming that we have our solutions meaning that we have basically are good values of tea. We actually need to iterate only over roughly two to the 32 divided by our values of tea, because we just need to find one out of our solutions. And then the complexity of the attack drops by a factor of R so it will become to the 32 divided by R. Okay, this of course assume and assume that we can actually obtain this magic solutions are solutions. So how can we actually do this so how do we. We can use our solutions or target states, so given a longer history. The main idea. So I'm not going to describe this in detail you can look at the paper but the main idea is to actually look at shifted key strings that we have a long history and we can kind of look at the key string that starts from the first beat the key string that starts from the second bits and so forth. And, and if we have a little bit history that we actually have roughly L it's it's not really L it's a bit smaller but roughly L shifted key string produced by L internal states. Okay, this gives us actually the solutions the multiple solutions that we need for the attack. Again, this the details are described in the paper. One last thing that I want to mention before I conclude this that the attack is actually generic. It does not actually use any of the properties of the internal stream ciphers that are sort together. I mean, it can be applied also to if you change the output functions of the stream ciphers arbitrarily as long as you saw their outputs together. So it that that is actually generic and it's applicable to all source stream cipher to minus. Okay, so finally let me conclude so we're at this rather improved and refined the tax on the ciphers GA one and GA to the techniques that we use are based on on the new applications of cakes or algorithms to stream cycle crypt analysis. And in particular the attack on GA to is a generic attack that applicable to all sort of miners off for stream sectors. And finally, I think the main open problem here is that is we want what we would really like to have as a is to have a really efficient attack for GA to given a low amount of data and I think maybe. If you can optimize our tech further maybe exploiting the structure of the internal structure of the stream cipher. Then it would be I think, really interesting. Okay, so basically that that was my talk. Thank you very much. Yeah, question. Comments. Thank you very much for the talk. I wanted to know you said the GA to attack is generic. Was it. So is this in contrast to the BDL work or was it already generic there. No, no the BDR attack actually exploited the low algebraic degree of the output functions of the cipher. I mean, they exploited the fact that it's an LFSR and the output function is the filter function is of algebraic degree four. So if you kind of change it to an non linear, say feedback shift registered and this attack will not no no longer work but our attack will work. Okay, thank you very much. No problem. So this is on yes. And when you showed the attack on GA to right you sort of searched over the AB registers and the CD individually, do you think it would be possible to exploit the inherent weakness between the the A and C registers right that only can take two to 40 states. And the GA one attack. Yeah, well, could you reuse the because the the weakness from GA one is also inherent in GA to right. No, that's, it's not so I, I try to. I mentioned this year, maybe I did it quickly but I feel. Yeah, because the A and C registers are the same there in GA. No, no, but the initials but the initials they the weaknesses in the initialization it's not in the actual registers. So the weaknesses is in the mapping that takes a seed and maps it to an internal state. And this mapping is different for GA to so the weakness that's present in GA one does not actually. Yeah, right. Okay. Okay, thank you. Initialization initialization of GA two is different from the one of GA one. So it does not have the same weakness. Yeah, so it's not does not depend on the tap positions of A and C there. Okay, good. Thanks. No, it does depend but it's different. I mean, it's not, it's not the same. It's not, it's not the same weakness. I mean, it's not, it's not the same function so it doesn't have the same weakness. Yeah, any other question. Sorry. No, any other question, comments, anything. Okay, then let us dance.


Swung in from Hague and the volley into the back of the net Well, it's Solomon with the final touch for the away side and it was the first chance first goal Taken inside the first seven minutes 1-0 to Derby County Yeah, I mean it was a fantastic free-keep wasn't it went right across the defense there and Solomon's stolen in at the far post there Given will Dennis absolutely no chance roll that right into the bottom corner past him And hey goes deep we've made it seem to make a couple of surging runs, but it's time to get to the way And there's Stevens come forward to midfield position Johnson to his right He might go in the loon He just kept going Sherry's back on level terms with 14 minutes to play Bournemouth one Derby County one Bournemouth looking to search forward here with Burgess Johnson in front of him. He might go to the loon as well Greenwood might shoot. He does shoot Four minutes left to play I mean the crowd have been superb all night and then Greenwood just given them exactly what they wanted the fans behind the goal They're going mad there


Hello everyone and welcome back to another YouTube video still looking at the bandit wargame from over the wire and we just finished up level 19 or like now we are on level 19 and We're just jumping back in I'm going to still use SSH pass with the file that we're using to keep the password that we've been collecting and Estimating with the correct user. So once we are in we can see in our home directory a bandit 20 do But it's all red and weird. So the prompt here says it's gain access to the next level use a set UID binary in the home directory execute it without arguments to find out how to use it and Passive for the level can be found in the usual place after you've used a set UID binary So if you haven't seen a set UID to binary before you can read up on it But the gist of it is is that it lets you Within the scope of that program or within the scope of just running that program that binary that executable You get to act as another user. So if we check out the permissions on this, I'm going to LS tack L You can see RW s as part of the permissions that s means it's a set UID binary So it's owned by bandit 20. However, we are bandit 19 so it's owned by the next level so we can take advantage of it and exploit it quote-unquote to Get the password for bandit 20 that's typically how most war games work is that you have binaries or programs that will give you like temporary access for the user The user above the user currently in or the next level and then you just got to figure out a way to get it To spit out the password to let you into the next level. So let's try this bandit Do it it is just executable. We see that it's marked with that that x bit So we can use a period and a forward slash and dot slash the binary to run it So I use tab to autocomplete I'd enter It says run the command as another user example Bandit 20 tech do ID. So ID just to see what happens. Ah So our unique are you sorry not unique our user ID number is this and we can tell we're been at 19 Our group ID number been at 19, but our effective user ID or our EU ID our effective user ID is bandit 20 So we are acting for the moment as bandit 20 now if I ran this without That bandit 20 do if I just ran regular old ID command that bandit 20 is not in there Because within the scope of that program We're running a set you ID binary and we can do whatever we want as that user Especially if we can just run commands. Why not cat etc bandit pass. Oh, how about bandit 20? Why does that not work? Oh It's because I spelled bandit No, I didn't tell What am I doing wrong? Did I did I actually type something wrong there?  Okay after poking around a little bit Figured out what the issue was it's trying to run that whole thing as if it were a command as If that argument were a command, but we need to have those not in quotes so that it will run Everything tokenized and then cat the file out. Okay. I'm sorry. I Was misreading permission night as and it's not there But no such file directory as in it's actually not there permission I just saying oh, we don't have the permission to read it It was reading this entire string. You can see from the environment. It's not it's not wasn't it wasn't Like a bash error. It's just like environment. This isn't a command you can run So I realize okay, you can't have you can't have quotes in there peculiar thing to note but Password for bandit 20 good stuff. Let's keep moving. Let's try it one more time Get to bandit 20. All right. We're logged in and what is this man? We're getting close to the end Set UID binary in the home directory does the following it makes a connection to local hose on the port You specify as a command line or it then reads a line of text from the connection and compares it to the password in the previous level If the password is correct, it will transmit the password for the next level What? What? So s you connect This program will connect to the given port on teased on local port locals using TCP If it receives the correct, so the next password turns it back. Oh, so we need to have a connection just kind of listening just kind of Waiting to give it to okay waiting on itself to okay So we need two shells right now because one we do invoke as you connect to connect to ourself What's SSH bandit 20 at bandit labs dot over the wire Paste the password in Did I not paste it? What's going on?  I realized I was not on the right port number. That's silly me All right, cool. Now we're jumped in so if we had a netcat listener, which you may not have Heard before but let's put something on attack L listening on port eight eight eight eight Now that's doing its own thing like that is its own socket and servers Or server server service, whatever you want to call it running on 8888 on this local host on this on this computer let's actually Ensured that port is what we want with tech P and let's use V to be verbose So listening here and if we were to make a connection up top with 8888 Give it the port number that we are currently listening on you can see it makes a connection So connected here. So it wants to receive the correct password It wants to receive the current password. So if we paste this in send it It says great that client read the password Matches what it was supposed to be so it'll send the next one and we can see back down here We did get the password for bandit 21 Perfect does that make sense We set up a shell we set up another netcat listener to kind of act as a server so that it could send a Connection to it on that port number that we've supplied because we're the one creating that service creating that server And then if we just give it the password that it expected the input that it wanted it would send us the password Awesome Let's get to bandit 21 logged in Program is running automatically at regular intervals from cron the time-based job schedule looking etc cron.d for the configuration And see what command is being executed Ah, okay. So these are the commands we can check out if uh, you haven't heard of cron before it is just A task scheduler. It'll like run commands or run scripts at a specific time and You can run through all of the man pages if you really want to but if uh, I guess I'm just gonna Have us jump in because cron is the program that runs all this stuff at a specific time it will Schedule a job or schedule a task so You can modify these By using a cron tab editor and that is done with cron tab tag e to edit Okay permission denied So I can't edit these because I'm not allowed to Whatever rights I have is the bandit 21 user, but as it said we can check out the acetra cron tag d Uh folder in our file system and see what in that directory we can read So let's actually get there so I'm bandit 21 And I want the password for bandit 22. So let's check out what that file is Also on reboot it runs this and This syntax here Cron tabs have a uh here. I'll show you on my my host Cron tab tag e Let's just use nano You can specify a Minute hour day of month day of Something Whatever day of week. I don't know it doesn't really matter You can go through the details of this, but it will let you specify that at what interval you want this command to execute So if they're using a star, they're doing Every that's the wild card for every single occurrence. So in this case up top Since they've specified it for Every minute of every hour of every weekday, etc. Etc. It's doing this every minute. So This is the command that it must be running as the bandit 22 user So let's check out what that is You can cat that file Oh It's putting a temporary file Creating one and it's catting out the password to the bandit 22 user into that temporary file Well, if it's in temp, that's world readable world writable. It's not world readable in this case, but We might be able to read that file. Let's check it out. Do we have permissions on that thing? We do everyone has permission to read it So let's check it out There is the password for bandit 22 all right Let's note that one and let's hurry up here see What is that? Program is running automatically at regular intervals from cron the time-based jobs guys. So check out. Okay the same directory we were in the cron configuration We see a cron job bandit 23 let's uh See what is in this okay Another script in user bin Just as the previous level was Let's cat out what this is doing So it has a shebang line. It's a running a bash script. It's trying to Get the current user with who am I storing it as a variable my name It says my target is The output of echo. I am My name Pipe to md5 some cut tack d Okay, so Let's try and let's try and recreate this just to kind of get an idea of what it's doing Who am I is the command to get your username, right? So we stored it in the variable my name And if I use the dollar sign here that'll expand the variable They're using the dollar sign in parentheses to say that I'm doing command substitution a lot like our back ticks That's another syntax for command substitution. So they're saying my target is All this stuff what is Now the my target variable Okay A hash because this is echoing I am user Bandit 22 in this case putting it into md5 some an md5 some is taking just a hash. Okay Bandits Now you see we get the same hash because we are just doing that and it's cutting out this hyphen at the end They're just using cut tack d With the space and the getting the first field to get only that but This isn't being run from the cron job as user bandit 22. It's being run as bandit 23 So this is being executed with my target Using echo I am user bandit 23 We can make that change And now this must be the hash that we're actually going to be looking for because this script As we saw earlier Takes all these variables and then it copies The password file to a temporary location with that variable. Okay, so Can we cat out That file No Hmm Okay What's going wrong echo I am user Bandit. Ah, I wrote bandit 32. I'm a fool At least that wasn't Incredibly painful troubleshooting. Thanks for sticking with me guys. I'm sure you were screaming at your monitor the whole time. Great Now we have the password for bandit 23 All right, let's save this and put this in a new file, but let's uh table all these for now and we'll get back to The next level and finishing up bandit in the next video. So thanks so much again for sticking with me guys Hope you're enjoying these. Thanks for tolerating my mistakes, and I'll see you in the next video


The People's Democratic Party PDP speaks again on insecurity in an ex-President Bahá'í to start a national dialogue, while youths are encouraged to be united amidst the security concerns. And Governor Yosemite imposes a curfew on river states to address the security situation of the states. Well, this is plus politics and I am Mary Ann McCoy. The People's Democratic Party PDP has urged President Mohammed Bahá'í to begin a national dialogue to discuss the rising insecurity in the country. The PDP National Chairman Uche Second gave the advice that the emergency meeting of the party's National Executive Committee, he said the insecurity situation in the country, was alarming. And also the Nigerian youths have been advised to stay calm and united amid the rising security challenges that the country is facing. For joining us to have this conversation I have MC Abe, he is a comedian, and also someone who is an activist for social justice. We also have Reverend Father Edward, who will be a public affairs commentator, and Courage and Removal, who is a legal practitioner. Thank you very much gentlemen for joining us. Thank you. It's good to be here. Pleasure to be here. Great. Honour. Great. Thank you Father, because I know that you work with a non-governmental organisation, and of course as a preacher and a man of the class, you obviously would be one of those advocating for peace. But then we are experiencing a very, very disturbing level of insecurity and unrest in Nigeria as we speak. But then the PDP is asking for a national dialogue, explain to us what a national dialogue, what mode it would take and why it would be important if need be. Well, thank you Mary Ann for inviting me to this parley. And thank you listeners, thank you co-panelists. I think the PDP in asking for a national dialogue has not done anything wrong. I'm not a politician, so I cannot speak for the PDP, but what I as an ordinary Nigerian believe is that despite the country is degenerating into very, very dangerous times, is alarming. And any certain Nigerian should be worried about the state of affairs of our country at this time. We seem to be living in a place that is near to anarchy at this time and it seems like political leaders have rejected the functions for which they were elected, for which they implored us to put them in power. And now Nigerians seem to have been left to fend for themselves. So yes, I would concur with the PDP either a national dialogue or something close to it that would actually bring Nigerians to re-discuss and renegotiate how we wish to move forward in terms of security architecture and everything that should bind us together as a nation. So I think the PDP is right in doing that and I would urge other bodies, other organizations, other political entities to weigh in and to ensure that this doesn't continue to degenerate the way it is going. Father B, I'm just, I'm more curious as to these conversations. We've had several conversations in this country. I mean, we'll discuss in killings, kidnappings, banditry. Will it be the solution to the problem right now? Because a lot of people are advocating for action other than talk. There's been lots of talk. There's been talking tough, there's been just talk, there's been lip service. What change will this talk bring really in terms of what we're facing now? Because where we are, we're at the threshold of something really, really big that might just spiral out of control. So what will talk do for us right now? Yeah, I think dialogue is not the solution at this time. Action should be what we do. But so far we realize that the political authorities, especially those who in the country at this time are not or seem incapable of down the kind of force that is needed to arrest the situation at the present time. So that dialogue might be able to give or perhaps put the proper pressure the right places to enable the interventions that we do to do at this present time. Let me come to you. Dialogue is not a bad idea, but action is needed. If those who are able to precipitate that seem incapable or unwilling to do so, what else can we do? Citizens are not allowed to bear arms on their own if they lock into their hands. So perhaps that with the kind of, with more political entities, national figure being in maybe the real that may bring pressure to bear on the powers that we had in time. All right. Let me go to MCI Bay.  You have shows on the radio that talk and address the issues that we're facing, whether they be social, political in Nigeria. So he's talked about dialogue also being a pathway to helping solve the problem. But the level of insecurity that we're facing in Nigeria, according to the PDP, spokesperson Prince Uche Secundus, is taking some form of toll on our economy, is taking the toll on our education. Now people can't, children can't go to school. Remember there's a university in Kaduna State where students were abducted. So it's taking a huge toll on us as a country. But let's talk about us as a people, because it looks like we keep talking, but nobody gets to hear us. Now the PDP seems to be a way to its responsibility as a political party and now they're speaking. We've done a lot of talking. Can we be heard? Will we ever be heard? And the actions that we need to match this, can it be found under this administration? Well, this is a very, very cool gender question and like you said, there've been a lot of talks and a back and forth that has not yielded the necessary results. And I don't think there's no problem if we have more rooms for talk, but the bottom line is implementation of what is discussed. We have a problem of leadership. We have a problem where our leaders don't take the lead. Where our leaders have decided to turn their faces to the other side and allow things to just go on. A whole lot of insecurity all over the nation from the north to the south, to the east to the west. We are sitting in a keg of gunpowder. There's an implosion already in the country and people are just waiting for the next move to cause an explosion. Things are happening everywhere and our leaders are not taking the lead. I mean, we sit here and we look at these things and we observe. We know that if the security agencies, if they do what is right, we can achieve results. I'm sorry, can we leave that responsibility solely at the feet of security agencies? Let's not forget that these people also are at the mercy of the executive. Remember, we were all in this country where for the first time soldiers put out a video saying that they were playing their part. But they are playing their part. The fact that they have, and I'm not in any way spokesperson for the military, but the fact that they decided to step, just by enemy lines to fight for us is them playing their part. But what about what they need to carry out that? To put us to the soldiers, to put us to the military forces, I'm talking about the government. If the government themselves, the executives, if the leadership of the country play their part towards the security agents and towards the endurance, we would solve this issue. Because for me, I feel the problem lies with our leadership, not even with the security agencies, lies with our leadership.  Look, our security agents are not well equipped, there's no proper information, gadgets for them to tackle the issues, and our leaders are folding their hands like I said, nothing is happening.   We are on top of it, we are looking into it, we are setting up a committee, and they will set up another committee to look into the committee, all kinds of crap, all kinds of crap, because nothing is happening from there. Today they will come, look at what the governor of, is it the Benway state, look at what he said, which is that some misgrants will take those words and take that passion out of context and start to attack him, say why you are attacking the presidency, why you are attacking the government, the government of the day is not working, the government of the day is not functioning, they failed us, the same agent will soon become a failed state. Hello, we are already a failed state, what is holding us together is our individual love for ourselves, nothing more. Interesting. It is a terrible case, and if we don't make that decisive move from the government, if the government don't take that stand, no matter how many times we meet and dialogue and dialogue, the ball falls in their court for them to make the necessary move that is gotten from the dialogue, do you understand, a lot of talks have been back and forth, the government and their hands are just like this, and they cannot say that they don't know what's happening, they can't say that they don't, I mean all over the country if it's not kidnapping, it's not binding, it's not binding, it's Boko Haram, not Boko Haram it's just the problems everywhere. All right, let me bring Marisa Courage into the conversation, there have been national conferences, just like I said before, we've had the national confab that was won under the Abbasan Jawa administration, good luck, Jonathan did have one, and really we've not really seen anything done with whatever resolutions that were made at the end of the day, so again it makes an ordinary taxpayer wonder why there should be another convergence of whatever we want to call it, a national dialogue, a town hall, a national town hall, if there's nothing that would be done with the resolutions, even if it's one that is being used or implemented, if we don't see the body language of the government as one that wants to make use of those ideas that are put together and placed before the table of Mr. President, why waste taxpayers' monies on it, and do you believe that that's what we need right now, or maybe we should be going another route? Thank you for that question. Of course we've had national dialogues, the question is what's where the outcomes of those national dialogues, and are they relevant in the present day, so you know how the Bible says, come let us reason, I don't think it's actually a bad call from the PDP for us to have a national dialogue, but the question... I think we're losing you there, I'm gonna take this question back to Father Elbi, if we really are ready to fight this insecurity, because I'm sorry, I think we have to deal with Courage's internet and then we'll get back to him. So Father Elbi, I was asking if we really are ready to fight insecurity, why aren't we doing so? Why does the government of the day who took a nose to protect us, our properties and our lives, wait for us to scream and cry out to them to deal with this issue of insecurity, is this not a pointer to the fact that maybe because it's not hitting close to home, government is not prioritizing our safety? I might be wrong, but you can correct me. Well many Nigerians have been left to wonder why it would take so long for those to whom we have given the power to protect us, for them to react to these issues, because it seems that we have been abandoned and Nigerians are digging in deep and seeking other ways, alternative ways of addressing the security issues that attack, that confront them. It seems to me that there is a complete abandonment of shift here, because we have a government in name, we have a president sitting, but we never hear from him, attacks of all kinds occur from time to time, we hear nothing, no condemnation of it, and it seems to me that the bandits or whatever they are called are further emboldened by this silence, because they believe somehow that somebody right at the top has their back, and this cannot make a country function properly, because our citizens devise their own methods of protecting themselves, it cannot be organized, and it cannot sue for peace. So I think once again that yes, whereas it's way past the time for dialogue, dialogue is never too late. This is my own opinion. MC Abbey, young people have been asked to be calm, in fact I'd like to quote the Pan-African Youth Union, which under their auspices called for young people to be calm, because of all the security britches and the insecurity, but all that is happening should, I mean nobody's asking for anarchy, but unity, calling for unity at this point, and asking for young people to become, especially when young people try to come together, I mean we're all here when they came together and said enough is enough, we cannot be profiled wrongly and you know bitten battered and harassed by police officers, they were being shot at. Why would young people want to come together again for any reason in this country, especially at a time where every single person is now a target, and our governments seem not to be doing anything about it? Fantastic and I think on the case of young people, what we practically need right now, yes we need to become, we cannot go violent, we cannot cause anarchy, there is need for calmness, but there's also need for strategic planning and strategic projections by young people, this is the time where young people start engaging themselves, different pressure groups start engaging themselves, strategically with solutions, preferring solutions, bringing to the table how and what can be done, this is the time we need to speak truth to power on the situation of the nation, this is the time we need to stand for what is right and do it in such a strategic way that we don't come out being violent, we need to lend our voice, we need to keep speaking, we need to have that optimism of hope that Nigeria will be better or can be better again because I mean this is the only country we have, goes down we all go down, if it burns down we all burn, but we need to devise a better means of approach, no more a violent route but a more strategic think tank, engaging ourselves, projecting ourselves and positioning ourselves towards a better Nigeria and I think if we do that now it will add, give us more credit and put give a redirection or refocusing of the nation because a whole lot of things have to be talked about, you know when you try to shut the young minds from speaking truth what they don't understand is they are trying to cut short the destiny of the future or the power line or the fuel of this nation, you know and we will not we will not subject to that, we will not agree that a march should be short, nobody will speak truth to power, we should start engaging ourselves, talking about the unity of this nation, how can we be united, what's about restructuring, where is the place of the constitution, are we going to have a new constitution, what is the move of getting a new constitution, what are we talking about, I mean should we talk about should we engage the different units of the nation, let's know if we really want to stay together, let's know if we are, if we have agreed to be one, let's have a dialogue, let's discuss on how can we have a fair share, be together as one, what are you contributing, what am I contributing, what are the red flags, where are the lines that should not be crossed, let's have this conversation, let's engage ourselves, engage our minds, not just in the place of leadership or in government alone, but leadership in development, leadership in IT, leadership in, what are the words, leadership in structural development, let's position it in the country, in the place where the globe would look at Nigeria and they would love to identify with us, we need to do image laundry, we need to clean up our mess, we need to project our strength, we need to show for the things that we are good at, we need to celebrate them, we need to empower ourselves, look at SMEs, I mean it has been bastardized in these countries, in this country, but empowering the entrepreneurs, entrepreneurs are just there working hard for themselves, the government is not doing, we need to engage ourselves and start talking about things, talking about these issues, so that we can have a drive, a focus and position ourselves correctly to, if I, pardon me, do you want to take over, yes, I mean I think it's the right time, if the time is right, we've got to, you know, let black minds take over, let black minds be in place of authority, it's the high time we do that, yeah. I hope that courage is back with us, are you there, can you hear me? I can hear you clearly, clearly. Perfect, perfect, great, great, great, so let me pose this question to you, the very famous and somewhat controversial man of the cloth Rev. Mbaka is back in the news now and he's been asking for the President to step down because of his inability to handle the situation in the country as fair security, he's also asked that the National Assembly impeach Mr. President because he has been incapable of keeping the people of Nigeria safe, now not just that, the APC has responded with SWIFTS, well SWIFTly they have responded to Father Mbaka, in fact they have threatened to expose him, but then of course let's talk about communication and how it flows within this government and their response to what issues, be they interesting, be they expedient, be they important, and sometimes maybe trivia, in this case what should have been the response of the government in dealing with this kind of situation and the response that the government is giving, does it reflect a government that's really willing to do the beating of the people and to secure the lives of their people? Is it just a government that's more interested in how people speak to them or how people address them? First of all, Father Mbaka as a citizen of the Federal Republic of Nigeria, he has the right to freedom of expression, it's a legal call, the call he has made is a legal call. Oh dear, we're gonna have to let Courage go because he's having the problem with his internet, but Father Mbaka that is your colleague in the cloth, would you like to speak on what he has said, I mean of course everybody would say there's nothing wrong with what he has said, but again I'm looking at the body language of the government and the response to his call. Yes, well this is interesting because Father Mbaka is my colleague and we as priests are not supposed to meddle in politics or play active parties and politics, but he somehow doubled into it before the same Buhari that he now is calling to step down was elected and then since then he has remained in that fray, occasionally altering things positive or negative against the incumbent.  That perhaps is the situation that Father Mbaka finds himself now, but picking up from what my other panelist was saying, yes as a citizen of this country we all have the responsibility to nurture our country, to nurture thought, to direct our thinking towards what is right. If he has the inspiration and the boldness to ask Buhari to resign, this is not an unusual thing. Citizens in other countries in better climes do not even have to ask their political officials to resign. Those officials resign as a matter of their integrity. So I think I could join my voice to him by asking the president since he has demonstrated so manifestly the incapacity to contain the violence or check the insecurity, perhaps he should just bow out honorably and leave others who perhaps have a better idea on how to run things to step onto the fray. Well unfortunately we do not have more time, I would have loved to have MCIB's input on this but we have to go. Thank you very much but Albi is a Reverend Father and he is also a public affairs analyst. We also had MC Abbey, he's a comedian, a very renowned one and is also one of those people who is or could be referred to as a change agent and we were also joined by Vice of Courage, Mr. Removal, whose internet has not allowed him to really be part of this conversation. But thank you gentlemen for being here, we appreciate it. Thank you very much. Thanks for inviting us. All right well we'll take a short break and when we come back we, River State Governor imposes a cookie on the state, we'll get to find out why.


Human trafficking is a global crime that impacts people of all ages, genders, and nationalities. IOM's counter-trafficking data collaborative includes data on over 150,000 trafficked victims identified by IOMM partners between 2002 and 2021. But the real number is likely much higher. According to the Global Report on Child Trafficking, nearly half of child trafficking cases assisted by IOMM take place in the victims' own countries. Moreover, 94% of the victims detected are trafficked by perpetrators from within their regions, according to the world's first public data set on victims and perpetrators of trafficking developed by IOMM and Microsoft. Climate change, disasters, and the ongoing crises and conflicts continue to leave people vulnerable and at increased risk of trafficking. IOMM has directly assisted over 100,000 trafficked persons in the last 25 years and advanced knowledge on trafficking to foster targeted, effective, and evidence-based counter-trafficking policies and actions. However, despite significant advancements towards preventing trafficking in persons, protecting those affected, prosecuting perpetrators, and building strong partnerships, much still remains to be done. As a long-standing member and current co-chair of the Interagency Coordination Group against Trafficking in Persons and jointly with the UN Network on Migration, we remain committed to end human trafficking and keep victims and survivors at the center of our work. On this World Day against Trafficking in Persons, I call for our joint action and strong partnerships to leave no one behind.


Good afternoon everyone. My name is Ana Vallejo. I'm the communications manager of myeloma patient Europe And I will moderate this webinar today I would like to welcome you all to this online session on CAR-T cell treatment in myeloma And I would like also to thank you for joining us today to learn a little bit more about this treatment Well, the main goal of this webinar is to provide an overview of CAR-T cell treatment in myeloma And also an introduction to some of the advantages and challenges that patients need to face in bringing this treatment to the market Just for your information this webinar will be fully recorded and uploaded to the myeloma patient Europe website Which is www.mpurove.org and also to the MP youtube channel and Before I start I would like to make a small summary of the webinar dynamics As you know the webinar is scheduled from 6 to 7 so the presentation will last around 40 minutes And then I will open the session for questions There are two ways in which you can make questions to a doctor one of them is using the microphone in your computer Which is something that I am strongly recommend You just have to press the right hand bottom that you will see in your screen And then I will unmute you so you can make your question And the other possibility is to do that in writing in the question and answer window that you can also see in your screen I will receive those questions and I will read them so the doctor can answer them As you know the talk was going to be given by Dr. Samastaglio, but because of a last minute issues he can attend this webinar So finally this webinar is going to be given by Dr. Matteo Carava a hematology and bone marrow transplantation unit San Rafael Scientific Institute in Milan, Italy on behalf of my alumna patients Europe Dr. Carava, I would like to thank you for your kind collaboration and also for your time And forgive this overview about gut sale treatment Thank you. I met people this kind invitation and on behalf of professor Chichuri I apologize for his absence, but he had a family problem So can you hear me? Yes, I got you perfectly. You can start whenever you want Okay, so today we will speak about new frontiers in immunotherapy for hematological cancers focusing on CAR-T cells so let me go ahead and CAR-T cells are the newest form of cancer immunotherapy and We will address the issue of on what is immunotherapy Why is it all about T cells? What is CAR-T cell therapy? Why are people so excited about it? I have a problem But this is not my computer So what is immunotherapy immunotherapy uses our immune system to fight against cancer and it works by immunotherapy aims at Improving the capacity of the new system to recognize and attack cancer cells and As most of you probably know T cells are key players in immunosystem They are like the pivot of all the immune response the immune system and in particular this Immune the capacity of the immune system to recognize specifically an antigen that is the specificity which characterizes a Bacteria and even a tumor cells is tailored by T cells In particular T cells are cells that generates from the bone marrow from the stem cell which is characterized by the presence of CD-44 Antigen which is in the bone marrow and which can differentiate in T cell and in B cell Which are in many other type of cell but T and B cell are the two group of cells which Confirm specificity to the capacity of our immune system to recognize specific targets T cells develop in the team of during the development and in the shielded and they differentiate in various group which In particular two main type are CD4 positive T cells and this CD8 positive T cells are Cytolithic T cells that eliminates the target by lesion CD4 T cells are the somehow the organizer of the T the of the immune response Be another important line for Which we will not focus today, but we must keep in mind that exist and that was important in our capacity to generate the CAR T cells is the B cell compartment B cells are the one which produce antibodies and various class of antibody in in real life in the body B and T cells strictly collaborate and Cellular responses and antibody responses are somehow coordinated by T cells itself so T cells recognize and promote the elimination of use but they're into more cells each T cells is different from The other in the normal physiology and each T cells as a specific T cell receptor that Recognizes the foreign peptides loaded on antigen presenting cells that are cells which for example during a viral infection Most of you have experienced pain in their throat This is due to the fact that the antigen that is the virus is Captured by macrophages and other cell of the new system is processed and Presented to T cells the T cells Which have the specific receptor to recognize this virus Expands produce cytokines and these cytokines Modulates the end coordinates the response against this virus in order to have an efficient clearance of the pathogen Somehow the same occurs when Immune response against tumor cells are generated Importantly T cells are responsible for the long term memory of infection If We are protected somehow against infection like flu or other flu because other T cells Have encountered the antigen during shoot the voodoo during The last season of flu for example and this T cells persist The persistence of the T cells makes the response against this antigen that we have encountered during Our life particularly rapid and efficiently. This is due to a soup of T cells Which are memory T cells which are antigen specific with the specific receptor which Persist for a long time and even the old life So you can understand the importance to have T cells that are potentially capable to recognize A tumor antigen which persists Due to the life long of an individual T cells can live for years and The memory T cells are those responses for the rapid immune response but If this system was perfect and No tumors or voodoo cure in the real life Tumor which are Autologous data mean that are not like a Bacteria or virus acquired by from the environment but Are press are generated by Cells of the same Individual which monitor the response somehow are very Efficiently in Or should have Hidden themselves from T cell recognition Overwise they would not have developed So The Our capacity to Generate or redirect T cells against tumor Could be particularly important in Fighting cancer and Eliminating it even if the tumor Was able to escape from the original Or the control of our physiological Immune system and T cells There are different phasing in the response that are The encounter with the the virus is captured as I told you by Macrofactor and the process and presented the tool Now if the lymphocyte which expanded as I told you and the coordinated the Productions of antipodes and of CD8 T cells that are capable to Recognize and eliminate the the antigen and after antigen elimination Only memory T cells survives and are ready to fight the ones The potential Pathogen represent T cell Physiological here is represented a city 40 cells as Specific receptor that is here represented that is called T cell receptor Which is has a lot of receptor but the most important and the one which characterizes T cell is this T cell receptor which recognize the antigen that are The Imaginary virus or a party is the virus which is cut in is part in very small part and this specific part are Presented to the T cell through the T cell receptor in the context of a molecule Which is called the MAHC molecule class 2 for city 40 cell which is present on the nitric cell or macrophage the encounter of The specific Epitope in the context of MAHC cell and T cell receptor together with the trigger of Specific signal which are called costimulatory signal lead to the production of IL2 or other cytokine by city 40 cell which Activate the immune response here is the CD8 T80 cells which is an effector cell which are capable to eliminate both the Presenting cell and the cell which are for example infected by the virus or which are tumor cell in case of tumor So you understand how important could be the development of What we call adoptive T cell therapy that is the capacity to instruct T cell of a given individual to recognize a specific antigen this effort Took as taken several years several decades in which in particular for cancer patients This effort was where aimed to Reactivate the capacity of T cell or induce the capacity of T cell to recognize and eliminate the tumor If you search on clinicaltrial.gov You can Find More than ten thousands of studies for cellular Therapies around the world as you can see most of the study are Conducted in the US in Europe and but also in China. There is a growing interest in this in this type of So now let's come to CAR T cell. What is a CAR T? A CAR T is a T cell in which the T cell receptor has been Substituted or even better in this moment maybe in the future completely substituted in this moment is Introduced in the C cells A specific Chimeric antigen receptor The acronym of CAR cell Chimeric which is composed by the valuable part of an antibody And with Costimulatory signals which Demonstrated to be very important in the capacity of this cell and eliminating their target So patient T cells are generally genetically modified to express a car on surface The car which is this receptor the car Binds to its target on cancer cell and the T cell no longer requires antigen presentation to become Active because are activated by the The specific target without the need of actually and the tumor antigen presentation This is an effort which took More than a decade The first generation CAR T Reproduce the original T cell receptor Unvailable part of the specificity of an antigen with ACG free signaling domain This CAR T Didn't work so good and the result whereas the result came when To this construct was combined a costimulatory signaling domain And the second generation CAR T were Prepared data which are available in clinical now derives from the second generation CAR T and of Particular interest from my point of view is the possibility In the next few years To have data from Optimized the generation CAR T are ready for the fourth generation CAR T Which are which were designed according to our knowledge of immunotherapy So we can data now about second generation CAR T, but third and fourth generation CAR T are ready Or are going to be ready to do for clinical testing So CAR T cell therapy Which most of the data about were conducted on the few large B cell lymphomas and Acute lymphoblastic leukemia and in particular Were conducted with CAR T which were Constructed against a B cell antigen to fight these B cell malignancies Where CAR T is where a big effort because requires the removal From the blood of the patient of T cells Then T cells should be engineered in laboratory And it should be insert the gene for CAR in this CAR T And so that they can express the chimeric antigen receptor These cells should be expanded in the laboratory then should be sent back to the Clinic and infused in the patient where they expand and go directly to recognize The cell in the cancer cells Which express the antigens against which The engineer the receptor was introduced in them So in the real life what does it happen There is an outpatient and possibly an outpatient And sorry I go back of one slide because there is another point which is particularly important As you can guess from this slide this process requires time Now it requires around 4-6 weeks in which the patient should remain somehow in acceptable condition To receive this therapy which as we will see may have an important toxicity And the disease should remain somehow controlled by the possible therapy In order to have that the patient condition do not deteriorate too much in the period in which the CAR T are prepared So in the real life a potential patient Should be carefully selected and first of all should have an indication that is a disease for which a CAR T existed That is capable to recognize the cell of this disease or potentially recognize this place Then the patient should be carefully evaluated for eligibility That is we must find out a patient who can probably not only benefit from CAR T but also can make all the procedure visible That is condition are good enough to face this complex and time requiring process Then if the patient is judge a legible, a leucopharyngeal schedule and in which the T cells are collected These cells are shipped to the manufacturing It takes 4-6 weeks for preparing the CAR T and the CAR T are sent back to the center And infused by a central venous cotator after that the patient has received a conditional chemotherapy Which is aimed not at controlling the disease itself Most of the studies were conducted in patients which were chemorefractory or relapsing after chemo But to reshape the immune system and the T cell repertoire in order to be able to accept the CAR T cells And let these cells expand and work in the best condition as possible After this therapy, which is made mostly for most of the protocol by Fudarabin and Cyclo-Postamin At day zero after premedication the CAR T is infused Then the patient, at least in most of the European center but even in the US Should remain under strict control in the first week Because two major complications have been associated with the activation of these T cells And probably are a direct consequence of these T cells Which are related to the release of cytokine by this T cell And in fact what it has been observed is a cytokine-releasing syndrome In the medial onset of this syndrome is two days after CAR T infusion The release of cytokine is also associated with medial delay of 5-6 days from infusion of CAR T by neurotoxicity Other known toxicity were also reported but the two main toxicity are neurotoxicity and cytokine-releasing So going back to what happens after CAR T infusion Here is the CAR T from the blood goes to the tumor site Recognize the antican and produce cytokine that eliminates tumor cells The production of cytokine induces CRS syndrome which occurs in most of the patients who receive CAR T And the most frequent expression of this syndrome is high fever Fever itself is a physiological response to virus or bacteria And due to the release of cytokines by the immune system In this case the second I released by the CAR T that we infuse and go to their target Recognize it, release cytokine lead to fever, pneumonia, malase, heart failure, edema But also potentially life-threatening symptoms like hypoxia, pulmonary edema, capillary leak, hypotension And almost all organs may be target of this complication Which can be also associated with encephalopathy These are data and neurological and neurological symptoms These are the two products or which there is the greater experience This is chymriam from Novartis and yeskarta from Kaita in the fuselage vision lymphomas and acute lymphoblastic leukemia Also other toxicity are possible after CAR T, in particular tumor-lase syndrome Which is somehow expected or may occur after tumor recognition by the CAR T which eliminates the tumor Of course infection, most of you as you know patients with myeloma for example are prone to infection due to their hematological condition Also allergic reaction and then other that we call on target of tumor toxicity That is the possibility that CAR T eliminates all the cells that express the antigens against which they are directed So if this antigen is for example expressed by a normal counterpart, this counterpart might be eliminated by the CAR T And it is even possible that he is eliminated by the CAR T For example CAR T against CD19 eliminates also CD19 positive B cells which are not malignant So why are people so excited about CAR T cells? There are about more than 700 CAR T, more than 160 trials have been completed and 300-400 trials are enrolling A lot of trials are under preparation, most of the data are so far are on targeting of CD19 Which is I told you before is expressed by acute lymphoblastic leukemia, lymphoma chronic lymphocytic leukemia, LTB cells In myeloma most of the data available which are much more limited that those about CD19 are about the BCMA CAR T BCMA is an antigen expressed by plasma cells And the number of patients is not so big as for CD19 patients but the results which have been recently published on the most important Journal in medicine which is known around the Journal of Medicine are very very interesting Trials have most of the trials that are currently available are quite small and have been generated as I told you on the Salma lineas These are the impressive results that were granted by the Brexpo approval of this therapy by FDA and EMA on acute lymphoblastic leukemia and non-oxygen lymphomas In patients who did not have therapeutic alternatives Many other targets as I told you are under investigation The result of CD19 therapies led to the approval of two products, one from Novartis, Kim Ray and the other from Gilead Yes, Kata, on pediatrics and young adult patients up to 25-year-olds who fail to sell acute lymphoblastic leukemia Refracts or relapses for transplants, or in second rate relapses, or patients with diffusory lymphomas after two or more months Yes, Kata was granted and approved for diffusory lymphoma from her primary mediation therapy after two or more months of systemic therapy The most data on CAR-T available in clinic are those on advanced patients who had poor therapeutic alternatives I would like to point out because many times I am asked if there is a CAR-T self-therapy available, for example myeloma or something else As I told you before, the specificity of CAR-T may lead to several results which can be very different We cannot take per se the result from Kim Ray or Kata and say if I take a CAR-T from myeloma, I will have the same result of these two drugs Exactly with monoclonal antibodies, the specificity of these products may lead to different results And either the characteristic of the product may lead to different results So each product should be, on my point of view, really tested in clinical trials and the results should be validated And moreover what I would like to point out is that these results are from what we call in medical research phase two trials That is trials which were not directly of comparison with the best available therapy in the moment Because these patients received so bad promises that the results have been observed with these two products were judged good enough to introduce them in the market But we lack data really on a large number of patients and we lack data on long-term follow-up Which should be carefully observed in the context of CT-19 and should be generated for all other types of CARs What makes for me a lot of fantasies on this therapy is the possibility to improve and work on the mechanism in order to make this therapy really a step up in our capacity to fight potentially a lot of disease But in this moment I should say potentially So going to relapse refactoring myeloma, some combination drugs, standard for treatment of myeloma may not be effective for particular people as you know And maybe it is necessary to try new combination For some people a treatment that worked well earlier can be repeated with good result The same reasoning applies when a treatment that has been effective no longer appears to work for well known as refactoring myeloma The first time a relapse happens most people will be given more take from it It is usually given in combination with the steroid, the metazone and often with chemotherapy agent like cyclopostramine or Melfan as most of you probably know The drug must often given at a second relapse is renalidimide Usually in combination with the metazone and cyclopostramine, alternatively it may be possible to have a second stem cell transplantation Carfliton is approved in both US and Europe for treatment following a third relapse A number of other new treatments have recently been approved or under consideration to use for relapsing or refactoring myeloma such as paladino stathe, tubumab, Vagvomib and other tubumab And some of these drugs are really important result of impressive data So the patient with myeloma has many therapeutic options in this moment Probably it is still difficult to achieve an eradication in the cure of myeloma but the myeloma can be kept under under under under controlled for many for many years For this reason, CAR-T cells have been tested in multiple myeloma In particular, most of the studies have been conducted with BCMA CAR This CAR is directed against this antigen which is expressed mostly on plasma cells with an important overall response rate It was about 80% according to the study but as you can see in this tab, most of the first messenger not so much patients have been treated This is a study on a relatively small amount of patients, 24, 25, 43, 55, 7, 12 So not many patients have been treated yet with this kind of CAR No direct comparison with other treatment, I have been conducted but a promising overall response rate was observed in advanced patients Moreover, the construct of this CAR was different There are CAR which has some types like CD28 of costimulatory molecules other with 4, 1, 2 So a work is in progress, I would say In this field, these data are very interesting and promising And should be evaluated and are more careful and further evaluation So some of the targets that are in the investigation, as I told you before, BCMA CAR is the one which has been most investigated Then there is CD19 We are working on preparing a trial against CD44D6, which is a molecule expressed in myeloma This is a phase 1 trial There are interesting initial data on targeting CD38 Which is the same antigen which is targeted by Daratumab Work is in progress on taxi But what I would like to say is that you cannot take the promising data on BCMA CAR and say that CD44D6 CAR is the same It's not the same because on this CAR, for example, there are available data on about more than 100 of patients No patients have been treated yet, like on the few ones on this one So the CAR may have a different grade of the mechanism and the type of drug is similar But changing the antigen, the result might be and the benefit and the risk might be different BCMA CAR T-Lesson, clinical manifestation of CRS and neurotoxicity reported in different CAR T-T cell trials in multiple myeloma patients Were similar to those observed with CAR T-C and against CD19 The clinical efficiency of anti-BCMA CAR is very interesting It's very promising Moreover, this is important because the CD19 paradigm can be extended to other antigen And the BCMA CAR offered the first proof that multiple myeloma is generally and potentially treatable to CAR T-C cell therapy Two years ago, we could not say this We are part of a European grant group of a group which was granted by European grant of the Caramba-Consoxum Which is coordinated by the Google University And is an academic CAR T-T directed against SLAMF-7 And which is prepared by Sleeping Beauty Clean Transplant for immunotherapy in multiple myeloma 10 partners are participating to this project, 6 European unit countries Which are close in collaborating to transfer the CAR T-Breakthrough therapy from base to bedside The University of Rup-Bur is the co-ordinating centre The target molecule was chosen based on the fact which is uniformly expressed on all multiple myeloma cells in every patient And the Caramba will be the first clinical trial to target SLAMF-7 This CAR T-T is, from my point of view, a particular intrigue for the fact that Normally CAR T-T, most of the CAR T-T which have been tested in clinical were generated by lentivirus mediated or retrovirus mediated gene transfer For this CAR T-T, Sleeping Beauty technology was used that is an economic and sustainable medicinal product which is virus free And there are safety switch that can be triggered to deplete the CAR T-Cell The CAR T-Cell constructs against SLAMF-7 in order to switch off the cells in case of toxicity Because every time we test a new target, a new antigen as a target we should keep in mind to observe on target of tumor toxicity or other unexpected toxicity So to have mechanism to which of this toxicity is also important A phasor and clinical trial is under preparation and in advance phase of development Which clinical side will participate to the trial and can be contacted for information? The University of Liverpool in Germany, Pamplona, Spain, Milan, Italy and the Central Hospital Regulatory at the University of Berlin What next? So first of all, next there is the trial from my personal point of view and looking at our center Next is the trial with SLAMF-7 and possibly CD44-6 In particular, both of these trials should involve patient with multiple myeloma When they will be open for enrollment and this is the next step These both are phase one trial, first in men, that means that the aim of this trial is not efficacy but the toxicity and the feasibility of this CAR T-Cell therapy in men And then if this part is the dospine feasibility and the safety is good in the first part of the trial Then they became a phase two trial in the act of serving and reporting the efficacy So this is the next step Future direction Based on the fact that anti-BCMA CAR T-Cell I have demonstrated or I suggest the efficacy multiple myeloma The main challenge are to improve the duration of response and understand the resistance mechanisms Because most of the patients tend to relapse even after BCMA CAR T-Cell therapy Many advances in CAR T-Cell therapy for multiple myeloma will come from general advances in CAR T-Cell technology What I would like to point out is that is CAR T-Cell technology itself as I told you before A step up from my point of view in the therapeutic possibilities of our patient Then is probably like the first mobile phone if some of you remember They were so big mobile that we laughed when we look at them with an iPhone X So I think that in the CAR T-Cell are somehow in the same condition We are at the beginning of a new era And there is a lot of work to do The CARamba project as I told you is part of this big order which is going to open in the next few years We must keep in mind that standard multiple myeloma therapy improves So the position of CAR T-Cell in this context is to be determined In increasing complex landscape of multiple myeloma therapy Nobody knows now if it is better to target BCMA with a CAR T-Cell or with a B-specific antibody Of course once the data are mature it will be very intriguing to know whether it is better to stimulate the immune system With a B-functional antibody or directly provided to the patient Specific T-Cells directed against the antigens Thank you for your attention Thank you very much for this wonderful explanation about CAR T-Cells Now I will open the floor for questions Just to remind you that there are two ways to make questions One of them is using the microphone in your computer by clicking in the right hand bottom Or just you can just write your question in writing in the Q&A window Which is something that some people are already doing One of the first questions that arrives during your presentation is why chemotherapy if not transplantation is required? Because before CAR T-Cell I guess So because the CAR T-Cells are infused in a context of all other T-Cells Among these T-Cells there are also T-Cells that maybe have a new suppressive effect So it has been observed that depleting the T-Cell repertoire before CAR T-Cell infusion provides better results This was also observing the context for example of allogenic transplantation When we give donor line for site infusion The preparation of the patient with chemotherapy directed in order to modulate the immunological environment Provides a better activation of the T-Cells that we give to the patient Thank you very much This question is from Jaime Cooper which wants to do the question through the microphone So I will unmute you so you can just make your question Go ahead Hello Jaime Cooper I unmute your microphone so you can just make the question to the doctor Well I'm not sure if he's listening to me I cannot listen to the question Well we are going for the next question and if you want to ask again then we will give him the floor So the next question is in England for a child with acute lymphoblastically eukemia received CAR T therapy on the NHL And the treatment is made available to another lymphoma patient Is that the first time it's being used CAR T? For what? For another lymphoma patient? Lymphoblastically eukemia Sorry it's made available to another lymphoma patient So most of the data that are currently available comes from TAYAL in lymphoblastically eukemia and B cell lymphoma So the original patients were the first data were generated at the Pennsylvania University in US Thank you very much The next question is the data on CAR T in myeloma is good but it is incurative Do you think it will work better used in earlier stages of the disease? This is a very important question And I personally think yes but it should be proved This is a very very important question It should be addressed in lymphomas in the field of lymphomas on which there are more mature data What is going to be done is to test this therapy in an earlier phase of disease Because this is an important scientific and clinical question Well thank you very much The next question is what are the reimbursement challenges with CAR T and how can we overcome this? I don't know Very good question I think This is a good question I don't know the answer Okay For the next question I hope that with improving the technologies that the price will go down But of course this may not be one of the biggest questions I must leave in a few minutes unfortunately So it's time probably for two or three questions Okay then I'm going to ask you the last question Will patients still need a hematopoietic stem cell transplantation after CAR T cell treatment? CAR T cell infusion Okay you do very very good questions My answer is again I don't know This also should be tested It should be also tested if the different type of CAR T Because the CAR T as I told you before are not the same There are CAR T which have been found in the body at medium term Whereas there are CAR T which disappear from the blood And is this the same or not in case the CAR T disappear the transplantation in the other case no In both cases yes So my answer is I don't know We have two preliminary data to answer this question But this is a point that should be addressed by clinical plan in the next years Okay thank you very much We are running out of time so we don't have time for more questions But if you have more questions you can send them to us And we will make sure that those questions are answered by our specialist Thank you very much Dr. Kava for being in this webinar for giving this talk Just remind you all the attendees that this webinar has been recorded and it will be available in the MP website And also in our YouTube channel Thank you very much Dr. Kava Thank you, bye bye