Hi guys, welcome back to this chano, it's Meks from Meks creation and if it's your first time come across this channel, please consider supporting this channel by clicking the subscribe button and also don't forget to click the notification bell because you will not be updated whenever I upload a new video Today's video, we are looking at the latest updates around Qatar as I promised you and today's video, we look at the announcement that has been made by the Ministry of Labour regarding working hours in open spaces that is supposed to end on 15th of September remember before I made a video that was stating whereby the working hours in the summer time the working hours of all labourers working open spaces was reduced from 10am from 10am until 3am the working hours was reduced at that moment because of the too much sun the too much heat and to avoid what we call the heat stress as according to the latest development the Ministry of Labour has announced that with the effect starting from Feb 15 I say September 15 all working hours that we have previously put into action as according to the official gazette or according to the loop balloon and according to the resolution of the Cabinet of Number 17 of 2021 it will end now meaning that all labourers or those workers that are working in what we call open places they will definitely have to go back to their normal work or their normal duties before we had very many people who were affected especially people from delivery we have people doing in the construction period they will definitely have to work into what we call phases but the latest movement that we have it actually means that by September September 15 then that the credit was put it will definitely be meaning that everyone will definitely have to go back and work in the normal working hours and this is actually very good news remember why normally the Government tends to put in those that kind of restrictions especially when it comes to summer because of the too much heat or too much sun that goes beyond being could work in and definitely sometime we see rising after even 50 degrees or 46 degrees meaning that is not safe for people who are working in open spaces and this is also one of the way that it tends to what we call to reduce what we call the heat space and according to the Minister of Labour has announced at the end of the summer working hours in open spaces with the effective tomorrow is 15th of September as according to the legal period of provepter morning hour in open and shaded places are not equipped with what you call appropriate means and ventilations tomorrow it will be ending and definitely that everyone has to go back to his normal working hours as before hope that is very good news for people who have been working and people who have been affected for such a long period of time since this was announced by the Government Ministry so it's good news that everyone has to go back to his or her normal working hours especially people who are working outside or people who are working in open places and remember this when we talk about this we cannot fail to also talk about what we call the FIFA World Cup because it's a celebration or it's a kind of preparation that everyone or every company is trying to see that it can hold itself in that kind of water that will be able to be applicable or unacceptable in as per the requirement hope I try to share something for you it's good news for our brothers for our working from delivery people working from people working and construction and all those other entities or other groups that are working what you call open places when it comes to some period of time thank you so much see you again in the next period or in the next video as we try to see more of the latest updates and more of the updates that we run by the way if it's your first time if you are new across the channel don't forget to click that subscribe button let us we are looking at a road to 5000 subscribers and it's just on your support that we will be able to achieve this by the end of this year thank you so much see you again in the next video


Are you looking for a high-performance 32-bit microcontroller? Then the STM32-F2 series is for you. This new high-performance member of the STM32 platform frees the full performance of the Cortex-M3 MCU core. It also offers significant improvements in features and system performance, thus opening up new possibilities for applications and creativity. The STM32-F2 series offers all the features you ever needed and extends the opportunities for creativity. Now let's take a look at the benefits of the product in more detail, starting with the STM32-F2's real-time performance. The STM32-F2's outstanding processing performance results include 150 DMIPS at 120 MHz over the entire voltage range and execution from flash that opens the door to zero-weight state performance. This processing performance is made possible by ST's advanced technology and process, and in particular the ART accelerator memory accelerator, the multi-AHB bus matrix, and the 90-nanometer process. In addition to the execution excellence offered by the ART accelerator, the STM32-F2 series embeds a 32-bit multi-AHB bus matrix that ensures seamless and efficient operation of the core and peripherals, even when several high-speed peripherals are working simultaneously. For instance, the core can access the flash through the ART accelerator and the 112-kilobyte SRAM, while the DMA-2 controller is transferring data from the camera interface located on the AHB-2 peripheral bus to an LCD connected to the FSMC, and while the USB OTG high-speed interface is storing received data in the 16-kilobyte SRAM block. Simultaneous processing and data transfer is made possible by the 32-bit multi-AHB bus matrix. Who said high performance and low dynamic power were incompatible? The STM32-F2 achieves 188 macro amperes per megahertz, which means 22.5 micro amperes at 120 megahertz, executing core mark benchmark from flash memory. Such outstanding dynamic power consumption is made possible using ST's 90-nanometer process that enables the CPU core to run at only 1.2 volts and the ART accelerator that reduces the number of accesses to the embedded flash memory. The STM32-F2 series adds new peripherals and performance to the STM32 platform. The audio architecture provides a dual PLL and I-squared S and USB peripherals to support data synchronization schemes. The device also offers a high-speed USB OTG interface with transfer rates up to 480 megabits per second and an Ethernet MAC 10100 interface with IEEE 1588v2 hardware support. The camera interface operates at up to 48 megabytes per second at 48 megahertz and the flexible static memory interface runs at up to 60 megahertz to expand memory space or support an external display. For secure needs, the device has a hardware crypto hash processor and of course the device provides other useful interfaces. One of the benefits of the STM32-F2 series is to provide a high level of integration. The embedded 1 megabyte flash and 128 kilobyte SRAM give you the memory power you need to accommodate advanced software stacks and user data with no need for external memories. The 4-kilobyte backup SRAM is used as an EEPROM to save the application state and calibration data. In addition, 512 bytes of one-time programming memory make it possible to store critical user data such as Ethernet MAC addresses or cryptographic keys.  ST offers an evaluation board that allows you to fully evaluate the STM32-F2 series interfaces including the external memories, the Ethernet and USB OTG connectors, touchscreen TFT display, CMOS camera and audio output. In addition to ST's evaluation board, a large choice of development solutions from the STM32 and ARM ecosystem are also available. Check out the STM32's potential and release your creativity. Visit ST.com.


My name is Maria and I am currently from Kennewick, Washington. I first got invited to Hungry Generation through both Martin and Sylvia. I remember hearing Martin talk about it and how great of a place it was and all his experiences. And I knew at that moment that's what I needed, that's what I needed in my life, that's where I wanted to be. I decided to give my life to Christ because before my life was empty, I was fighting depression. I went from being really happy and everything's great, everything's perfect, to all of a sudden, just like that, I reached the lowest point in my life emotionally. I was feeling empty, I was feeling lonely and I couldn't figure out why. I couldn't figure out why I couldn't stay away from what was making me feel that way. It was one particular service during worship that I just felt this peace in me and I knew right there and then that I had to give my life to Christ. Because I knew right there and then that that's the only thing that was going to help me get through this. That was what I needed in my life, that's what I was missing. I'm getting baptized today as a declaration of my new beginning and my walk with Christ. Come on church, put your hands together for Jesus Christ. Maria, do you believe in Jesus Christ as God's Son and your personal Lord and Savior? Yes. Do you promise to follow Him with good and clear conscience for the rest of your life? Yes. Now based on your faith, confession and your commitment will baptize you in the name of the Father, Son and the Holy Spirit.


I have more ideas than I know what to do with. Many of them are hibernating in one of my 41 everything notebooks, but once in a while a few of them intersect and emerge as a new trajectory for my next annual project. It's never just one idea, but it's always an intersection of things. Creativity is always collaborative, even when it's the combination of your own ideas. And let's be honest, anything that I consider to be my own idea is just an idea that I've forgotten who I'm stealing it from. And so as a new year is about to begin, a new annual project comes with it. The ties will continue, the push-ups might make a resurgence, the bridge is still resting for now, but in 2015 I will be undergoing an experiment in iteration and ideation. And it all starts tomorrow.


Realistic Gaming here. Today, we are on the creepy elevator by Mr. Luat. Oh my God, Mickey Mouse. As we can see, he updated like the whole lobby and everything. I'll show you guys after if when I die.  Oh my God, Mickey Mouse. Oh, there he is. Don't get away from me. Dude, why is he just standing there? Dude, the elevator's bleeding. No, Mickey, please don't do this. I used to have my diss in that pass. I swear, man, don't do this. I swear I'll renew it. Fight! Okay, no. Oh my God, okay, he's too close. Yo, you need to give me some space, man. If you leave me alone, I'll give you cheese. Thank you, he left. Oh my God, that was super close. Who would have ever imagined Mickey Mouse so evil, right? Like, he's always happy and everything. And he lives in the happiest place on earth. Put in the Roblox creepy elevator. This is not the happiest place on earth. Oh my God, okay. Let's see what floor we got next. We got SCP-96. Nice, man. Uh-oh. Oh my God. Oh, dude, this guy is fast.  Dude, he ripped off this guy's head. That is pretty gruesome. Okay, so it seems like this is where he broke out from or something. Oh my God, recipes to everybody here. Wait, does this button work? Nope. The button is a lie like the cake. Why did you do this to me game? Okay, so it seems like this is pretty much it. The use of cameras or video equipment is prohibited. Well, guess what? I'm recording here, man. I'm a savage. Okay, let's get out of here. Where is Mr. Shy Guy? Hey Shy Guy, let's try to get him on strike because it looks like he's in the little predicament right now. Yo, what are you doing, man? What is wrong with you? Okay, dude, he wouldn't get off of the railing.  Let me tell him yes. Okay, I told him to get off of there because it's not fun when the killers get stuck in here and they're not chasing you around, which is their job to do to cool everybody. And we're here with the whole squad. Man, what's up squad? Floor the eyes. Uh-oh, this is Crassu from Eyes of Horror Game.  Oh, oh my God. Okay, that is a teleporting head. I am out of here, man. There is no way to survive in that. Is she coming? Uh-oh, here she comes. Run! Run for your life! Oh my God, where do I hide? Can I hide behind the piano? Okay, hopefully she won't come in here. Uh-oh, I think I hear her nearby. No, don't tell me this dude brought her over here. You better not have brought her this way. Oh, dude, she just passed us. No, no, no, no. Get away, dude. Why is she chasing me?   Oh my God, that was so close. Okay, I think we lost her. No, he didn't. I'm out of here, man. Dude, she wouldn't get off of my big head the entire match. What round should I say? She just kept chasing me. I think she has a crush on me or something. Okay, so as we can see here, this is a brand new lobby. I mean, it's pretty cool. It's like we're underground. Something came with some duty. Okay, so I don't think that takes you anywhere. Haunted bathroom. What? Haunted bathroom? Wait, let me get my coil so I can get over there quick. Dude, I want to see a haunted bathroom. Okay, who is this haunted bathroom? Oh, Bloody Mary.  I don't think I would ever use that toilet at all. Okay, Bloody Mary.  Okay, so she just resummoned her. All right, at least that's what it seems like. Stop crying, girl. It's okay. It's okay, little girlie. Oh, don't slash me. You know, I'm trying to comfort her and she's over here trying to slash me. Like, what's her deal, man? She's chasing Deedee. Oh, no recipes. Uh-oh. Now we got the girl chasing us.  I'm going to start crying too if you don't leave me alone, Bloody Mary. Okay, geez, she was quick.  That was pretty funny though. It seems like every time I announce a killer's name, they summon to appear. Oh, thank you for the free ride, Blazer. Oh, okay, so he just transferred me over. What was that? It's like I took a bus and I caught another bus. And then I arrived to my destination. Okay, middle of nowhere. Okay, let's see where we are. Uh-oh, it's Ben. Ben. Why is he just standing there? He's saying something. I know he's going to rush at us, bro. Uh-oh, there you go. Okay, so they changed Ben to like a cemetery as we can see. It's pretty cool here. Can we go up there? Man, I'm going to try to go up there. Oh, you can't go up there. There's like a barrier. Where's Ben? He was somewhere around here. Oh, I hear this dude. Dude, how do you run over here so quick to the elevator? Ben, look at those poor people. Alone? Oh, my God. Look, even when I die, I die in style. You guys, you saw that? I had those cool glasses on because I'm epic. Okay, let's go back out here. Rio, Rio. What's up, man? Some of your head is a safe place.  Oh, there. I passed my Spanish lesson. I'm out of there, man. Evil skeleton. All right, let's see what this is all about. I assume that's his brother. Oh, my God. Okay. He's pretty evil already. Wait, what is this? What's that noise? Is it like a giant skeleton or something? Um, hello? Anybody here? Dude, there's nobody here. This whole floor is a lie, man. I'm getting real tired of your lies, Roblox. What if we climb up here? Oh, my God. Okay, that is definitely the giant skeleton. Dude, I thought there was nobody here. Oh, okay. So we have this giant skeleton shooting at us. Oh, my God. Okay, um, dude, he wasn't. Oh, no, that was a picture of him. I forgot that need to showcase the killer on the elevator. Oh, my God. Okay. So it was like some giant skeleton man shooting lasers. That was crazy, yo. And I don't like how every time you like survive at the end of the elevator and teleport you back out. I come on. That's not cool, man. SCP 682. Which was this one? Uh-oh. Um, guys, why is there a... Oh, my God. Okay, why is it like water? Oh, my God. What? No. Okay. Oh, my God. I thought he was open. I was trying to rush in there. Dude, what in the world is that thing?  Uh-oh. Be careful, guys. Oh, my God. That thing looks terrifying. Oh, my God. Dude, he has like four eyes. What? That is not normal, yo. Okay, we can't go in there. Please, gate B. Dude, all the gates are closed.  Dude, he's in the elevator. Yo, get out of there, man. Uh-oh. No, no, he's chasing me. Uh-oh, nice. Dude, that was insane. Oh, my God. It was like a meaning Godzilla. S.B. don't want to learn. Why do they do that all the time? Come on. Okay, whatever. So every time I'm going to try to rush back into the elevator so it doesn't teleport me to the lobby. Okay, let's see who we got next, y'all. Massacre in Texas. A.K.A. Texas Chainsaw Massacre or Leatherface. Okay, so we're in Texas right now. Oh, my God. Okay, he looks creepy. Oh, my God. Kind of looks like the Krusty SCP and Texas Chainsaw Massacre put together. Yo, my boy. You good, man? Okay, this guy is definitely not good when you get out of here. Run for your life. Oh, no. Oh, God. Okay, I'm out of there, man. I'm going to go on top of his house. Dude, he's so creepy looking. He's trying to get me up here. You'll never get me alive in Leatherface. Oh, my God. Ow. Okay, this guy is definitely on one, bro. He's crazy. Uh-oh. No, I'm going back to the elevator, dude. I do not want to get spawned back in the lobby. Nice. We made it just in time. Halloween. That should be Michael Myers. Michael. Oh, poor Michael. He didn't get a renovation on his house. Oh, man. Ow, dude, what is wrong with you, man? Look at this dude. He's like tee-pee-ing everywhere. Oh, my God, he's coming up here. Run, run. All right, nice. I think we're safe up here. Okay, now he went all the way back down. Oh, my God. Okay, so it seems like maybe there was like people crashing in this place and then Michael found them and he murdered everybody in this house. Yeah, right? Pretty terrible if Michael would do such a thing. Yeah, my head is not a nest, man.  Everybody thinks my head is a nest. Ow, Michael, dude. Look at this dude. All right, I'm out of here, man. Ow. Michael, please leave me alone. My God, that guy's a savage. I think him and Jason are the biggest savages in the elevator. Oh, my God, look at the Helen Horseman goal. You go, buddy.  Thank you guys for watching. Thank you guys for amazing support. If you guys enjoyed the video, make sure to slap the like button. If you're new to the channel, make sure to subscribe and turn that notification bell on. And I will see you guys in the next one. Bye.


All right, we're moving on to our third category, Voote Innovation, to do the honors may invite on stage, Mr. Siddharth Ghosh, sales director Moseo, and Mr. Naveen Kansal, national creative director, Indigo Consulting to please do the honors for innovation. Let's find out who the shortlisted nominees are. The foremost piece in this category was innovation, was enabling technologies, where how do you use an existing tech feature, which is not usually part of the marketing side's brief or even an agenda, and someone comes up with an answer through tech in an absolute sense, right? So how different kind of technology was used, was it a internet of things as an approach? So all those absolutely technologically enabled possibilities were the way we saw as winners very clearly. All right, we don't have a bronze medal winner in this particular category, but we do have a silver and a gold. Let's find out who the silver goes to. Let's find out who the silver goes to. Let's find out who the silver goes to. Congratulations, PhD and HUL for winning both the medals in this category, and thank you so much, Siddharth and Mr. Naveen Kansal.


good afternoon thank you all for being in here you are in track 3 and this is hooked browser mesh networks with web RTC and beef and without further ado the eccentric Christian for show. Hey everybody how's everyone's DEF CON going? Yeah I can't believe you guys are still hanging out here at 6 although I know like a big you know 100% of the Australians here have just woken up so awesome if someone is going to find me a beer later on that would be really really fantastic. So my name is Christian free show I'm happy to be here talking to you guys about some pretty fun stuff. I'm one of the co-authors of the browser hackers handbook and I'm also one of the developers of the beef project or the browser exploitation framework and in case you couldn't pick from the accent I'm also an Australian well ex Australian well Australian ex Australian I've just relocated with the family up to California.  Anyway so what are we going to be talking about this afternoon? There's probably a few main themes that I'm going to be brushing across firstly obviously is this JavaScript so I apologize in advance there's going to be quite a bit of JavaScript in this talk obviously client side security and kind of social engineering testing and then onto the browser exploitation framework or beef.  Okay awesome. Another one of the themes I'm going to be talking about is obviously problems with browser communication channels so after you initiate a hook into a browser how you kind of maintain those comms obviously how webRTC can help and then finally integrating webRTC into beef and then I'm going to have a demo of some variety. So let's kick this off. So when Wade another Aussie created beef he basically came up with he just wanted to not pop alert dialogues anymore for cross-site scripting and people still do this all the time like how many like honestly how often do you guys do engagements and you find a cross-site scripting floor and the first thing you do is like alert parentheses one, parentheses colon. You know it's the first thing it's like the knee-jerk reaction to what you want to do if you find a cross-site scripting floor and Wade was sitting there going this means absolutely dick to everyone like it doesn't mean anything it's useless for developers it's kind of the business owners don't understand what it is and there's so much more that you can do when you have this foothold inside of the browser context. And I guess as the framework kind of grew and as security testing as a process sort of grew and changed we started to see people I guess targeting end users more and more and more and the browser is obviously a really interesting channel to be able to do that. And obviously as the internet grows so did the use of browser technology and this is a really interesting concept because if you think about it right now you guys will definitely have well probably have a smartphone of some variety in your pocket which may have one or more web browsers those browsers probably have multiple tabs if you guys have your laptops here you'll probably have two or three browsers all with multiple tabs and you might have more than one computer because you'll have a work laptop and a personal laptop and if you start to break that down the attack surface for kind of web based traffic is enormous. There's a lot of things that can go wrong. And you know browser developers have done this really fantastic thing where you open up Chrome and it's got three buttons or like four buttons or whatever like Chrome's got the burger and the backwards and the forwards and the refresh or whatever and it looks super simple like my mom can and does use it but Chrome is seriously complicated. Modern JavaScript is just really, really complicated and basically this attack surface is you know it's ginormous. Wade posits this really interesting kind of risk discussion. I like to use this example because I think if you kind of think about it this way it's kind of a bit petrifying but if you're working as like the security guy inside of your company and someone came up and said hey we need to get your approval to install this application on everyone's computer and you're like okay cool and they're like oh yeah and the primary purpose of this application is to go out onto the internet and just access arbitrary things on the internet and we can't vet whether or not they're secure or not and you're like okay well that sounds pretty risky and then they also tell you that the other like secondary use case of this piece of software is to access all the sensitive internet material that you have. At the same time multiple tabs with things happening in the background. Like if you knew that we weren't talking about web browsers a lot of people would say there's no way we should be using this technology. Like it's very very risky. I guess another one of the things that we're sort of seeing happen and why we're seeing more people kind of shift to these javascript style attacks is thick browser style technology is disappearing. You know so who here hasn't uninstalled Flash yet? Alright you've all uninstalled Flash. This is Flash Gordon. Have you guys met Flash Gordon before? It's like awesome 80's idol. Whatever. And so like most of the kind of thick web technology that we did have like Flash and Silverlight and all that sort of stuff is kind of being replaced almost feature by feature by modern HTML5 which as far as I know doesn't actually mean anything except for more crazy javascript. Like lots and lots and lots of javascript. So what the fridge is browser hacking? So when I guess we talk about browser hacking we basically talk about putting payloads in the context of a document object model and then using javascript either maliciously or just because that's the way it's meant to work to try and exfiltrate information or find other systems or trick the user into divulging information you know using social engineering techniques or whatever. The browser hackers handbook and here are the two other co-authors. Michele doesn't like pants apparently. And he's up there. I'm so happy that you saw that slide and Wade actually really likes pants. It's basically focus on various attacks and attack patterns that can occur once someone has injected I guess a controlling piece of javascript inside of the document object model inside of a browser. Or not necessarily even just within the DOM but also in the multiple contexts that do exist within a browser such as within plug-ins and so on. And in the book we define this methodology of attacking which I kind of I really like is I think it kind of stages through exactly what we're trying to achieve and what the framework inside of beef is actually trying to do to make people who do these sorts of assessments their lives a bit easier. Obviously there's the initiation of control so this is by exploiting things like cross-site scripting or stored cross-site scripting or other ways that you might be able to point a website and put a payload on there. Could be man in the middle style attacks or phishing attacks or whatever. But obviously executing a piece of javascript by itself is kind of useless unless you can maintain those communications back to your controlling interface. So the next phase is obviously retaining that control and then at that point if you have established both of those things in a very, very kind of rigorous and stable manner you can then move on to your attack scenarios and then the book obviously goes onto a bunch of other stuff. Most of this talk is just about the retaining of control. So I'm not going to be dropping universal cross-site scripting flaws that I found in anything. This talk does not contain any zero days. I apologize. It's just kind of looking at interesting channels for the maintenance of comms. So let's introduce beef. That's a picture that doesn't really show or help you showing what beef is at all. But I guess the idea is at the core of beef is that there's a hook.js file and it's called hook.js by default. You can obviously change that to be called whatever. And once you basically get that JavaScript executing within a document it will start pulling back to the server.  They will start talking to your controlling server and then you can use that controlling server to kind of queue up command modules to execute within the document object model. And obviously you have like a pretty user interface. This is the serious part of the talk by the way because I'm a Virgin Defcon talker. All right. Okay. So obviously right now the way that beef currently maintains its comms is through kind of two, two and a half primary data channels. The first one is obviously XMLHTTP request objects within the DOM. And these are pretty much just like dynamic get requests. Like it's all pretty simple. And I guess the importance comes down to like you know why would you need to be able to retain your communication channels for a long period of time? It kind of comes down to you want to retain that comm for as long as you can because certain attacks scenarios need time to complete. And a really good example that I like to talk about is McKellie did some research that he presented at Rux a couple of years ago on like distributed blind time based SQL injection using multiple browsers. Really, really interesting technique. Hello. Okay. Now stop talking. All right. All right. So I just want to say thank you to everybody that's here this late. You know coming in to see a new speaker. That's just fantastic. Give yourselves a round of applause. Yeah. How's he doing? Is he doing well?   Can you understand anything he's saying? I don't know. Dude, thank you. Awesome. He said he's going to make a boiler maker. All right. Well, anyway, I think you guys all know the drill to new speakers, to Defcon, to all the new attendees. Thank you for coming. Cheers. As you were. So obviously if you're kind of doing these sorts of attacks, the longer you can kind of maintain that communication channel, the more likely it is that you're going to be able to see your results. And sometimes you will need the time because certain attacks are slow. The second channel is obviously WebSockets, which is kind of like an asynchronous client-to-server channel that I guess is like a new Web 2.0 thing that they've introduced kind of recently. Also another piece of awesome software engineering from McKellie. And also DNS, which is a kind of relatively new communication channel. Here's some JavaScript. I'm not too sure. You guys probably can't read this. But basically what this is showing is some of the beef client-side JavaScript library, which basically comes down when you initialize a browser into beef. And what we actually do is we just wrap around jQuery. And you can see here this is just like a jQuery Ajax call. And what happens is on a polling period of I think by default one second right now, the browser will basically send a get request to beef. And if there's a new command queued up, it will pull it back and execute that module and send back the results. It's not too complicated. That's how Gmail works pretty much. We basically wrote Gmail. WebSockets are another really interesting way to do this. One of the really cool benefits of WebSockets is that because they are asynchronous. So there's no more polling. And what you see here right in the middle there is basically an event handler for this dot socket dot on message. So what that means is if you kind of submit a command through the UI interface, it will basically kind of just send through real fast. And there are a lot of different use cases where you'll need the rapid response for that sort of communication channel. WebSockets are pretty cool. Also kind of hit and miss depending on what if you're targeting a corporate, whether or not it'll get out through firewalls and stuff, but quite often it does. And it's pretty interesting technology in general. And finally DNS. So this is a relatively new way to be able to communicate from a browser back to beef. But this idea is basically there's a couple of encoding functions. So if you have to send data back to the beef server, you kind of encode it up and break it down into some payloads. And then you dynamically build images which are put into the DOM. And those images are on domains which are dynamically generated, which I guess are sub-domains to the beef server itself. So when you start at beef it actually listens as a DNS server. Like right now you start beef, you've got a DNS server running as well. So you can see there the send query function, var image equals new image, image source, blah, blah, blah. Now there's a problem with each of these communication channels and if you look at this picture it's kind of obvious. Regardless of if you're using get requests, DNS, WebSockets whatever, all your traffic goes to your server. So from a defender's point of view that's awesome. You see one browser that's talking to a beef server and then you very quickly find all the other browsers which are talking to your beef server if you're not terrible at what you do. All cows lead to Rome. Now there's a couple of ways that you can kind of get around this. You could set up multiple beef servers. So that could help you obfuscate I guess where communications are going to. You could achieve this by having multiple interfaces on a single server or is this thing catching my accent at all? Apparently that's a computer. Like that's not a human there. And that's what I said. And American people paraphernalia. Maybe you knew what I was going to say before I was going to say it. Or you could set up proxy servers. So that's another interesting channel I've seen people use and talk about. Set up some proxy servers and kind of distribute them around the place and have a central beef server. There's obviously a bunch of different ways that you can try and help obfuscate the data but it kind of doesn't help with hiding that concept of a single beef server. You could start by reducing your polling periods. So I said by default a second. You could reduce that to a minute. Now beef will still kind of work. But it's not going to be as useful as it possibly could be. We also have evasion and obfuscation extensions within the platform as well which is really cool. So that basically every time you kind of rendering and building the JavaScript on the beef server before it's sent over to the client, it'll be obfuscated. But that doesn't help obfuscate the server. And you can use HTTPS. Which is not going to help. Or you could do something crazy like that. Like let's make the browsers stop talking to the beef server. Because they don't like beef. Like what?  So this is the blurb. It's a free open project that enables web browsers with real time communication capabilities via simple JavaScript APIs. They made it so that you could web chat to each other. And I don't know maybe that was something that chat roulette were really into or something. It's actually really, really cool. And then the technology kind of matured and they were doing things like oh we can actually make it such that your browser can talk to your VoIP phone as well. Because it uses a lot of similar technology. Hands up, has anyone played with WebRTC before? A few hands. So this is not going to surprise you. I'm just yanking stuff. So obviously for the WebRTC stuff to work there's three primary JavaScript APIs. The media stream which is kind of why it was used like built in the first place. I don't really touch on that. The RTC peer connection which is where it starts to get interesting. And then finally the data channel which I use a lot. So the media stream on this little snippet of JavaScript allows you to kind of sense some constraints in what's happening inside of the browser. And then basically kind of use the get user media call against those constraints with like a success and an error call back. And when that happens because it's trying to access the video Chrome for example will pop up that dialogue that says hey this site is trying to access your camera. And then if you click yes your camera will start and there will be a blob stream of data inside the DOM now which is basically feeding from your camera. Now by default it's not going to do anything. It's just going to sit there. Your light will be on. But obviously they've got access to your media. Now the peer connection interface is where we start setting up connectivity from peer to peer. And here like furthering on this example we're obviously establishing a peer connection. We're setting some more event handlers and one of them is if we get like a remote stream for example we then attach that stream to a local div or whatever. So you can actually see the video from somewhere else. I'll go into a lot more detail for how this works in a bit. And then the data channel stuff is kind of what it sounds like if you've established a peer connection between two browsers the data channel basically gives you an asynchronous method within JavaScript to send data payloads from browser to browser. This is like a chat example. There's actually heaps and heaps of really interesting users like example WebRTC websites out on the internet. So if you go on some of the websites some guys have set up like peer to peer file transfer over WebRTC. So first person goes to a website and it has like a you know it'll generate like a unique URL. And you give that URL to your friend and they'll visit the website. Your browsers will establish connection to each other and you can drag and drop files to each other and they don't go through the server. Like it's actually the fact that it works is kind of I find quite surprising. I mean this is all JavaScript right it's freaking crazy. Yeah. And so it really really it really boggled me the fact that you could have two browsers that were just talking directly to each other. I was like that doesn't make sense.  They're not going to be listening on a port. This doesn't make any sense.  Now obviously there's a lot more moving parts for how this works. One of them is the use of things like the session description protocol. So if you've done work in SIP or VoIP you'll recognize this sort of stuff because this is how phones figure out how to work on a VoIP network. SDP is needed within the WebRTC peer connection because the two browsers need to know how to talk to each other. Because they do talk to each other. Now WebRTC itself doesn't actually specify how you share this signaling information. They just say that you do in fact have to share it. So in many instances they kind of say there will be a web application that when you first connect to this thing you'll share signaling data through there but then after you've established connectivity you can just talk directly to each other. We actually have used this capability within B for a couple of years. So when this first came out in Chrome many versions ago the get internal IP WebRTC module was created because for WebRTC peer connections and session description protocol to work the DOM has to be able to determine the local IP addresses of your computer. So that's your IPv4 and your IPv6 plus also your internet IP addresses as well. So Firefox and Chrome have WebRTC enabled by default so in case you didn't know like if you're using those browsers like and I think New York Times actually were just pinged on it recently they were using this technology to find internal IP addresses of LANs and stuff and organizations. It's on by default so go the internet. This is more JavaScript that's just an extract of what it is but basically what's happening here is down the bottom the JavaScript is creating a session description protocol offer and then that will cause the browser to basically kick off a bunch of requests within the browser to figure out its local STP information on those events we can extract IP addresses out of it. So this peer to peer stuff is really really great but obviously browsers are separated by firewalls right like a browser can't talk to a browser there's a firewall. This is an infosec reactions that says in firewall we trust. That's a tiger no it's a lion it's a female lion and some baby that's like completely oblivious. That's a duck I can't see from up here. So in an ideal world this is kind of how peer the web RTC peer connection would work. You'd have your signaling through the internet through a web application in our instance beef and then once connectivity is established media or data would start flowing between them but this is never the case like this is generally what we see. Now web RTC has methods to get around this. The first of which is stun servers or session traversal utilities for NAT. And basically it's a set of methods and technology that I'll provide for the ability for a browser for example to be able to get information about its IP address. Google run stun servers that you can use for free and I did in my demo. So you don't need to create these these exist. They're out there. Now if the NAT between these two devices is not symmetrical then peer to peer traffic won't work. And so at that point you're still kind of stuck. The browsers can figure out their IP addresses but they don't have data channels between each other and this is where the second component comes in and this is where the traversal using relays around NAT technology comes in. Turn servers are not necessarily free. There are some on the internet. Some of them you may be able to get onto without paying money. Some of them you maybe have to pay money. Depends on how cunning you are. Maybe. There's also open source software so you can actually spend these up yourself if you want. I didn't touch this in my demos because it wasn't in the context I guess I was working in. And basically the idea is that these things can take the handshake of an ITC peer connection and then you can just tunnel the data through that. So the browsers think that they're next to each other but they're in fact not. More Australians and people that are kind of Australian. Now this is all pretty complicated so to wrap this all together WebRTC uses this technology called interactive connectivity establishment protocol or ICE. And basically ICE is used to kind of encapsulate these protocols and basically helps you determine the best way to communicate from peer to peer. It's kind of like the Chrome way. Let's make it as simple as we possibly can. So let's set the scene. You're targeting an organization and you've shifted your focus to the internal resources and you're going to try and exploit their internal web apps and do some fingerprinting and try and do some social engineering stuff against internal guys. And you know you're allowed to use a tool like beef. So step one, obviously hook the browsers.  And then just like normal you have these two browsers which are talking about the server. At this point with the webRTC extension enabled you will also be able to kind of start to command them. So at this point you basically tell one to be the caller, one to be the receiver. The caller establishes its session description protocol information and sends the signaling information back up to the beef server as the signaling server which then gets kind of sent back down to the receiver who then goes okay cool now I've got this offer. I'm going to build my own session description protocol to get my own IP information and listening UDP ports and so on. Send that back up to beef. That goes back to the caller. At that point both browsers have enough IP information about each other that they can start actually trying to talk to each other directly. And if all things go well they do. And then they can also do things like they've established a data channel. So that's kind of after a peer, once a peer connection is established you have another event handled to up your data channels. But the browsers are still hooked. They're still talking to your beef server. It's really really cool that they're talking to each other but we still haven't gotten around that problem. They're still giving away your beef server. There's still obviously a problem. So this is where obviously because JavaScript is JavaScript, you can use commands that I've put into the web RTC extension inside a beef to tell one browser to command another to go to health mode as in stop talking to the beef server. You can only talk to me now. And then you can obviously use that channel to send commands through it as well. So enough talking. Let's look at this thing. This is going to be fun. I can't see it. What? You wish man. I've seen you do that. That did not end well. So we've started beef. I've got two Chrome browsers side by side here. So the one on the left will be browser one. And the one on the right will be browser two. And I've also got the console open. So I've turned on the both messages so you'll start to see stuff happen. So this is just one of the default hooks that exist within beef. And then once again, you jump back over to beef and you'll see you've now got two online browsers. And if you scroll down, you'll see that we've also determined that web RTC is enabled. So if that doesn't say yes, this won't work. And it won't say yes in Internet Explorer. And I think Safari works, I'm not too sure.  So I've got a different Chrome on a different computer. I've got a Chrome on an Android as well. Oh, and I did it in Firefox. Now the first time I did this research, I couldn't ever get this to work. I have now since gotten that, I've gotten past that problem. So Firefox now works fine. So we've got five browsers hooked. That's lovely. And we've got some new UI options. So you can right click a browser and go set as the web RTC caller. And then select a different one and go set as the receiver and go. And then you can click on a browser and there's a new tab called web RTC. And in there you can see the list of your peers and the status of their connectivity. Now in the browsers, there's been a lot of commands and stuff that have come up. And once that kind of connectivity has occurred, you'll see their connected status has gone into connected. So they now have a connection between each other. And I'll kind of walk through what's happening with the peer connection because the verbose messaging is relatively useful. So this browser on the left is the caller. And the first thing they do is they create the peer connection object with a bunch of settings that we set. And then it basically starts to do that, it has to build the session description offer. So this is the signal they get sent over to the receiver. So it builds this offer and then it builds a bunch of ICE candidates. So these are IP addresses and UDP ports and TCP ports that I should be able to accept the data channel on once everything is going. So it sends those signals up to beef and then it'll wait for the guy to send the answer back. So obviously the receiver starts receiving those messages and it's waiting for that message to be received. So it kind of goes like I've got this ICE candidate and I can't use that. And then finally it receives the offer message and it goes awesome. I'm now ready to kind of kick off my own peer connection object. It builds its own session description.  This is how you can talk to me. That signal against head back. I'm surprised this stuff works actually. So at this point now they each have enough information about each other. They can start trying to communicate directly with each other. And once the ICE state goes into a connected or complete state, they're actually connected. So those two browsers they now have an asynchronous data channel between each other. Yay. And what we're going to do is we're going to do like a star. So I'm going to make them all connect to browser number one. And you'll see slowly grow. Bless you. It goes on tight.  And then I got really drunk and I couldn't fix it and then I tried it when I was sober and I got it to work. Whether or not that's scientific proof of you get more stuff done without alcohol I don't know. I'm only a computer person. So at this point now we basically got each of the browsers connected to browser number one and that connection status gets polled and updated all the time so you can't see that column but there's like a date. And if we check the web RTC tab on the rest of the browsers you'll see that they're connected just to number one. Now what we can do from here is which also we couldn't do previously is we can pull up a module. So for example detect one of the browsers and go execute this module. And this will basically build the beef module kind of change some of the beef.net.send commands base 64 up, send it over the data channel, execute it on the peer and send the response back. So browser one send the command to browser two, detect last pass it couldn't determine that last pass was there. You can do it the opposite way. So browser two is running that command against browser one and send last pass because the DOM has been influenced by last pass. And that browser has last pass. So that's basically a command module dynamically kind of going across the data channel which is kind of cool. And the last pass module is pretty interesting as well. But obviously as you can see on the left all these browsers are still, they're still online. They're still talking to the beef server. So the option clicking now is stealth. So what we'll start to see now is each of these browsers will stop talking to the beef server and eventually they'll drop off the online folder. The admin UI has like a timing period of maybe 30 seconds or so. They take a little bit before they disappear off that column on the left so you'll see me refresh the browser. And once the browser is stealthed it starts sending a heartbeat message back over that data channel so it's still there. So you'll see eventually they'll fall out of the online folder and into the offline folder except for number one. So here's the only browser that we're still actively talking to. But they're still stealthed and we can still communicate with them. And this gets really interesting if you obviously jump into the browsers and you pull up the network tab because you'll see in the stealth browsers they're not making any web requests, they're not making any web requests. So you'll see I clear the network tab. Browser one is obviously actively talking to beef and browser two will no longer send any HTTP get requests. But you can still control it. JavaScript is pretty cool, huh? And just to demonstrate that there's like a bi-directional data channel available I use the silly prompt command. I'll send that over to one of the developers. It's not subtle but it's an easy example. It's one step up from doing an alert dialogue. At the moment running the command modules in the admin UI is still pretty gritty like you've got to put in numbers and do JSON and shit because the way that we build the actual command module tab inside of XJS is horrible.  I want to get away from XJS. I'm pretty sure McKellie does as well. This is a great example. And you'll see the dialogue pop up and it's like, hey, how you doing? And I'm like, what? Sweet, thanks Defcon. And I'll send it back. The response will come back into the WebRTC command results tab. So we've got that data back and you'll notice that the browser did not send any data at all to the beef server. So if you're sitting there monitoring your network egress points, that browser is not talking to the beef server. Like always I like to kind of show one of my favorite beef modules towards the end of my demos. I'm searching for the term Rick. That's my favorite. What?  So there's a few things happening under the hood. 10 minutes. A few things happening under the hood for beef to kind of behave in this way. I'm going to run fairly quickly over some snippets of terrible Ruby that I've done and some JavaScript. The first thing is that we have to establish some new database models inside of beef to be able to handle signaling messages and command module execution and other payloads and other things to communicate the specific RTC stuff to the browser. This is another one of the data models. Then we have done like an API hook. Actually for those who haven't developed in beef, one of the things I really like about it is it's super extendable. So I was able to basically interact with the hook.js dynamic construction through an extension. So it's one of those things where it's like if you want to play around with some of this stuff or if you're doing research in like malicious JavaScript or things inside the DOM, definitely check out beef. So this add RTC signal and basically it runs every time the hook is generated and it will add signaling messages if they're queued up inside of the database. The handlers define some new beef server URL endpoints. So these are the endpoints that when the browsers are sending RTC specific messages back into beef they hit these endpoints. We have some restful API. So most of the admin UI you can actually do from the, in fact all from the restful API. When I first demonstrated this I was doing it all on the interactive console but that shit is severely broken right now because of Ruby 2.2 and threads and jobs and stuff. Then obviously you kind of wrap it around beef's extension API. So you mount these handlers and you kind of set everything else up to work. Now the last piece of the pie is the core client side beef WebRTC JavaScript magic. And I am like I'm a terrible developer. I kind of like to think that I know what I'm doing but if I'm doing software development like this is mainly me I'm like on a computer with my elbows and I'll brute force it with my elbows until things work. It's 600 lines of JavaScript.  But it actually works.  And in the heart of it is the kind of obviously brushing over 600 lines of code right in the middle is kind of these event handling logic.   Now there are a bunch of issues with this. This one was an old issue. I got over that hurdle. Radical. Right at the beginning during the establishment of the peer connection there's a reliability option that you use. Now when I was first doing this they were recommending it set to reliability false. And this will by default try and use UDP between the browsers. Now I never had problems with it. So even though I turned off reliability which is a terrible name for it.  Now I don't play around with that but could be better. I'm not entirely sure.  Edge does not help. Microsoft Microsoft they talk so much about like modern web tech we're embracing it. You can do all your modern web stuff in Edge and whatever. They're implementing this bizarre subset of some of the WebRTC functionality just so they can bring Skype to browsers and that's it. And Chrome and Firefox have had this for maybe two or three years. I'm honestly surprised. It's kind of, it's shocking. Now obviously one other thing is the signaling component requires communicating back to the beef server. If a browser is stealthed it doesn't deliver. So if the browser starts to move around and IP addresses start to change the code currently does not handle that gracefully at all. It's terrible. And obviously you have to touch the beef server at least once or twice. So you know I'd like to think that you can get away with not having any interactivity with beef but you got to let it lick you on the face at least once. Well maybe twice. That dog is so not happy. And also if you're into incident response this stuff is pretty tricky. So this is another one of the infosec reactions that I yanked and it says incident response team after a late night weekend incident. Carol.  You might not spot the rest of them. Obviously in my example it was a star configuration but you can do logic to kind of pass around. I'm going to talk to beef. I'm going to talk to beef. I'm going to run a command module. Share the results with all my peers. If I lose a peer it doesn't matter because all the results are everywhere else. So this stuff can certainly be a lot more advanced than it is right now. Not that it matters because the virus total doesn't pick up on the default beef hook anyway. From time to time this might hit a one or a two and then we change the date because there were some guys that they did a chrome extension to detect beef because there were certain signature patterns in the cookies that were done. McKellie within four hours or something he's like push the change and it's gone. They make a change and then two hours later he makes another change and they have just like this is ridiculous. We're not doing this anymore. Because really we're just doing what JavaScript is meant to do. Now obviously because of those issues there's a bunch of things that I would like to do better. There's open source turn implementations it would be interesting to actually integrate that into beef so if you're behind firewalls you kind of would be able to do it. Handle those peer termination events better. Like there's stuff that you can do there which I'm not doing. Obviously round robbing the peers and I've actually run this in a bunch of corporates and I'm always surprised the traffic quite often does make its proxy style environments. That could be interesting. And that kind of comes to the end of my talk. I need to call some shout outs.  McKellie who is here. He's lovely as well. Obviously everyone that helps with beef and there's probably people in the room or at the event that have contributed stuff to beef come and say hi I will buy you a beer.  As well there was the three of us that kind of managed it. There was tens of other people that also helped contribute. Shout outs to my old dudes in Australia.  I think I've got two minutes for questions. So if anyone has a question I'll probably answer half of the question. I'll repel and hear you. Okay so the question was Christian you're really handsome.  Any other questions? Yeah over there. Okay so the question was what tool do I use to debug JavaScript? That's a really interesting question. So Rapid7 did an open source security matters last night or the night before and I did a little beef talk and I basically said most of the JavaScript inside of beef is kind of 1990s JavaScript. ECMAScript 6 and all the modern stuff that's coming out in JavaScript we're not really using too much of that. We're also like not doing a lot of dynamic loading using a lot of the technology that people use like browserifying that sort of stuff. We don't test like we don't but I think some of the guys might use tools and stuff to help them debug JavaScript I debug it by basically like console.logging and opening up a console log which is terrible. I'm getting thumbs up. It's the terrible hack way to do it. I think that's what he's trying to say. We know I think it's just one of those things because mostly people are trying to squeeze stuff out in a really short period of time. A lot of the testing framework is not as mature as it probably should be. And the use of XJS for example to me is a really big indicator that there's not been love as much for the project over the last couple of years as it probably should be.  I'm not too sure if you guys would have seen that. If you want to talk to him about it definitely hit it up. Feature wise that's probably the biggest thing that we've seen over the last couple of years but no I'm terrible I don't have a script. I don't have any good way to debug it. Ruby side I'm also the same. I just put puts everywhere.  And these guys are all like use Ruby mind. Like do debugging properly you plebian and I'm like I computer really good.  Any other questions? No I'm out. Guys thank you so much.


Hello everyone, welcome to today's current of session of Swisspedia. The topics we are going to see is South Asian Nitrogen Hub, Global Talent Competitiveness Index, Bharat Ratna Award and with respect to editorial topic is Highlights of President Speech. South Asian Nitrogen Hub. This is a partnership program that has been led by UK to study the impact of nitrogen in India and South Asia. It consists of 50 organizations from UK and South Asia, among them 18 or Indian organizations that are undergoing the study of how the nitrogen pollution has been impacting India and South Asia. Apart from that, this partnership program has been funded by UK Research and Innovation under its Global Challenges Research Fund and this nitrogen hub is one of its 12 GCRF hub under UK Research and Innovation. The parties that has been involved in this hub is government, NGOs as well as international agencies. Apart from that, India is the only country in South Asia to complete its overall nitrogen assessment for one year. And apart from that we will see what are the nitrogen impacts and how it is going to India is undergoing. So this overall impact of this nitrogen is in atmospheric nitrogen, in atmospheric air, totally 78% of air consists of nitrogen and they are in an inert condition that is unreactive and it cannot be utilized by plants or any other species directly. So it has to be fixed through bacteria, through the nitrogen natural nitrogen fixation process as well as this cannot be helped to feed the whole growing population. So we started to invent a new process of ammonia fixation that is artificial nitrogen fixation through the process called Haber-Bosch process. In this process, this atmospheric nitrogen along with hydrogen gas at high temperature and pressure will produce ammonia. Through this we are converting into nitrate and nitrate that will absorb by the plants for their growth purpose. And this has been, nitrogen has played a huge role in green revolution. So through the green revolution India started to use more amount of nitrogen. So for the plant, in agriculture in the NPK that is nitrogen, phosphorus and potassium, the ratio has to be 4 is to 2 is to 1. But instead we started to use more nitrogen that leads to 8 is to 4 is to 1 ratio. So our Indian soil consists of more amount of nitrogen. This started to become a pollution. So a normal nitrogen started to become a pollution. So this green revolution, due to this green revolution we started to use more amount of nitrogen. So when there was a rain or when there was a runoff water from this agriculture field, it started to enter into the lakes and nearby water bodies that by causing utopia and it leads to algal bloom that it causes to water pollution. Apart from that it started to lead to soil acidification process also. And also this ammonia and nitrogen dioxide which has been emitted from this industries as well as vehicle leads to this air pollution that contribute to this ozone depletion. And apart from that the another form of nitrogen is nitrous oxide which has the highest global warm potential of 310 times that is 110 of nitrous oxide can harm that can be retained this heat trapped by or compared to this carbon dioxide amount is 310 times of 110 of carbon dioxide amount that this 110 of nitrous oxide can hold. So this global warming potential of this nitrous oxide is also too high. And apart from that in comparing the report recent study that is comparing this 2001 to 2011 the nitrogen emission has been increased from India about 69 percentage. That shows how seriously India is undergoing this nitrogen pollution. So we need to started to tackle this nitrogen pollution with a long term mission because the short term measures will not handle this nitrogen impact because we have increased the amount of a 69 percentage. So we started to have a long term mission how we can face by face we can reduce this nitrogen pollution. And the next topic is global talent competitiveness index. This index has been launched in 2013 to measure the ability of each and every countries to compete for the talent how they can grow, how they can retain and they can nurture this entrepreneurship as well as this talent in their own country. So this index has been prepared by INSEAD the Business School along with the partnership with Tata Communication and Atco Group. And this index has 5 pillars and 68 variables and it consists of 125 countries and 114 cities. And this year the country that has been topped in this global talent competitiveness index is Switzerland with the score of 81.82 while among the bricks the top performer is China of 45, the score of 45.44. And India has increased one rank from the 81 to 80 this year with the score of 35.98. The major challenge of this India with respect to this global talent competitiveness index is how to retain this talent people and how to attract this talent people within India. And this year this report this 2019 index report has been special focus on how to nurturing this entrepreneurship and intrapreneurship that is intrapreneurship means that is a person having a vision of entrepreneur within a large organization. So this focus has been on how to nurture this entrepreneurship as well as intrapreneurship talent among the Indian. Apart from that this smart cities program can be merged along with this competitiveness index so that we can have this smart cities can act as a talent magnet. So more people started to attract towards this smart cities. And the recent longitudinal analysis that is studying from 2013 to 2019. So for the past five years how this talent research has been underground by studying this we came to know about that the countries which have more powerful talent attractiveness started to grow a much level that is each and every year the countries that have more talent started to have more and more talent while the countries that have a weak potential to attract the talent become more and more weaker. So the strong become stronger and weak become a weaker. So among this top ten countries only two countries come from this non-European. Rest of the eight countries has been European countries that two non-European countries is US and Singapore and apart from that this shows that US Europe still act as the talent powers that is most and most of brains from all the talented people from all the countries are started to pull towards this Europe. And this analysis the recent analysis from 2013 to 2019 shows that there was a widening gap between the talents unequal economies that is more higher economies developed economies started to have more and more talented people and this developed countries will have more and more lesser number of talented people this gap started to having much more widen. So this long unit analysis shows that with stronger countries become more stronger and weaker country becomes more weaker. So the country that India we need to have more become a stronger country like European countries to attract more people towards India. Rather we India have more and more brain drain that is more talented people started to leave India and go to Europe and US or Singapore to have more and more entrepreneurship they can nurture in that own country. So we need to this India we need to have more nurture this entrepreneurship then only the more talented people will started to retain within India and more other country talented people will also flow towards India. So the major challenge between India is how to increase our ability to attract and retain this talented people. And apart from this this global talent competitive index we have also have with respect to the city that is global city talent competitive index. Among that the top city that has been having more talented people attracting potential is Washington DC. And with respect to India Delhi and Mumbai is only in the list with Delhi having a 95th rank and Mumbai with 96th rank. The next topic is Bharatathana award. This Bharatathana award has been delivered in this republic day by the president of India. And this Bharatathana award is the highest civilian award in India. The second most highest civilian award in India is Padma Bhushan Padma Bhushan. So the criteria that for to award a Bharatathana is earlier it has been limited to some categories of art, literature, science and public services. While in 2011 it has been extended to any human achievements. So it can be given for Bharatathana award. So maximum three people can be given awarded this Bharatathana award every year. But it is not mandatory we have to give each and every year to Bharatathana award. So maximum three people has to be given. And it will be this award this list will be recommended by PM to the president of India. And the order of presidents with respect to this Bharatathana award is it has the seventh rank of Bharatathana award president. The first rank goes for this president and the order of president. And the second rank will be this vice president. And the third will be prime minister. And fourth the governors within their respective states. And fifth will be former president and six CJA and speaker of Lok Sabha. And seventh will be cabinet ministers, CM within that state and former PM leader of opposition party in Rajasabha. And this Bharatathana awardees will come under this 7A, that is the seventh order of presidents. And apart from that, the first Indian to get the Bharatathana award is Sassivi Raman. And the naturalized Indian citizen, that is the citizen who got Indian citizenship through the naturalization process. So the Mother Teresa is the person who got this Bharatathana award in 1980. And two non-Indians that who got this Bharatathana award is Khan Abdul Ghaffar Khan and Nelson Mandela in 1919. And in the 2019 the awardees are, first one is Pranab Mukherjee, who served as the 13th president of India, as well as the defense minister. And he contributed much as a finance minister, foreign minister. And has lead role in the board of governors in IMF, World Bank, Asian Development Bank and African Development Bank. And the second person who got this Bharatathana award in 2019 is Nanaji Deshmukh. He is a social activist, as well as he's a member of the RSS. And he played a key role in the merging of Jansang with Janata Party. And he is also awarded Padma Vibhushan. And third person is Bhupan Haferika. So Bhupan Haferika is also known as the Bard of Brahma Putram. He is a singer, musician, lyricist, as well as a politician from Assam. He also awarded with Bharat Padma Vibhushan. And this recent India's longest bridge, this Dola Sadia Bridge that is over, River Lokit has been named as per this Bhupan Haferika bridge. And the last topic is this highlights of President's speech in this Republic Day celebration. This celebration is one of the special thing because this year we are going to have this October 2nd will be the 150th birth anniversary of Gandhiji. As well as this November 26th will be the 70th anniversary of adoption of our Indian constitution. And this Lok Sabha election, this 17th Lok Sabha election will be the first time when the voters that has been born in the 21st century will be the major contributor in this Lok Sabha election. And President has said that this election process is not just a political exercise. Apart from that, it is the collective call to the wisdom to transform the India. And he also said that the connectivity is more important thing, the crucial thing that India is undergoing because that connectivity is the one that brings us together in the form of ports or inland waterways, national highways, metros, rural roads, as well as the cheap gas services. So we can have more connectedness. So each and every people started to have more and more economic activity. And the next is the President has said that we need to have a more and more leapfrogging technologies that will transform each and every phase of the Indian people. So it will empower the farmers as well as it will help to equip the soldiers and it will help to nurture the startup culture within India also. And the President has said that Indian model has been based on this 3D that is this diversity, democracy and development. These three things are the pillars of this Indian model. We cannot have one over the another that is one priority over another. We need to have all the three merged together because all the three are the pillars of this Indian model. And the best indicator that the social change has been happening in India is how we are changing towards this gender equality that will show this how Indian men and Indian women will be equal to each other so they will be grow at the equal past level. And apart from that we have to transform this Indian literate society into a knowledge society because Indian literacy rate has started increasing but the knowledge level it's not that much level increasing. So we need to have transform this literate society into a knowledge society. Apart from that President has said that India is the one country that has the feeling of the universal brotherhood. So it propagates the universal brotherhood in the form of Vasudeva Kudumbakam. So we are feeling that all the whole universe is a one family. So in that manner the partnership is one of the important thing that is a thread that has been knitting towards all the families and nation and world together. So India need to have more and more partnership with all the countries within the family within the nation as well as with the world countries. But that thing we will end up to this current of a session. Thank you. Have a nice day. Share and like comment on this channel.


As we learn more about the attempted coup that took place on January 6th, we're learning just how interconnected the entire web of Republican Party politics was in orchestrating this event.  It was the far-right pundits like Steven Crowder who egged them on and Charlie Kirk who supplied them with the means necessary to get to the Capitol. Not on top of that, literal sitting members of Congress, Republicans, actually aided and abetted this coup attempt. That's what the founder of Stop the Steel, Ali Alexander, alleged before he was deplatformed from Twitter. He has since gone into hiding because I'm assuming he doesn't want to go to jail for inciting a riot and a literal insurrection. But the videos that he posted to social media, they show a lot happened. A lot of crimes were committed by members of Congress, in particular Andy Biggs, Mo Brooks, and Paul Gosar. Now the Intercept, they did a phenomenal job putting all of this together. This is kind of a long clip. It's about four minutes, but it is worth watching because what we're going to see here is very, very incriminating for these three members of Congress in question. The head of the House Freedom Caucus, Republican Representative Andy Biggs of Arizona helped plan the January 6th event that culminated in a storming of the Capitol. It's according to Ali Alexander, a lead organizer of the gathering. Alexander, a pro-Trump personality, was an early founder of the Stop the Steel movement. We're going to save the public, right? He helped bring together various right-wing factions around a mass event on January 6th. It was aimed to coincide with objections to the counting of the Electoral College. Alexander made his claim in three separate live streams in late December, adding that representatives Paul Gosar of Arizona and Mo Brooks of Alabama were also involved. I was the person who came up with the January 6th idea, and I'm the guy who came up with the idea of January 6th when I was talking with Congressman Gosar, Congressman Andy Biggs and Congressman Mo Brooks. So we're working with members of Congress while other people are trying to show about. We're really working hard because, look, I believe that the President should do something brave. I think that the Vice President should do something brave. I believe that that's how we maintain the White House, and I believe that we need to maintain the White House. I think it's a moral imperative. His claim is buttressed by another video from a December 19th rally at the Arizona State Capitol at which Alexander played a video that Biggs had supplied. Congressman Gosar has been the spirit animal of this movement. One of the other heroes has been Congressman Andy Biggs. Congressman Andy Biggs sent us a video. Congressman Andy Biggs, here. I wish I could be with you today. I pledge to you that I'm going to keep fighting for President Trump. And when it comes to January 6th, I'll be right down there in the well of the house with my friend from Alabama, Mo Brooks. In the video, Biggs mentions Brooks as his ally in the fight. Gosar spoke in person at the event. Freedom isn't cheap, folks. Freedom isn't cheap. But you know what? Imagine this. If you get a step and go back home once we conquer the hill. Donald Trump's return to being the President. Amazing things will happen if there were more you. Biggs' connection to Alexander was reported on Sunday by the Arizona Republic, which quoted his spokesperson, Daniel Stefanski. Congressman Biggs is not aware of hearing of or meeting Mr. Alexander at any point, let alone working with him to organize some part of a planned protest, Stefanski said. He did not have any contact with protesters or rioters, nor did he ever encourage or foster the rally or protests. When asked why Biggs would record a video for someone he doesn't know, Stefanski told the Intercept, Representative Gosar's team asked for the video and he provided it. That day, Trump posted to his since suspended Twitter account, Big protest in D.C. on January 6th. Be there. Will be wild. On the day of the riot, Gosar used his official Twitter account to call for peaceful protests, urging Trump supporters not to get carried away so no one gets hurt while spreading an entirely different message on parlor. A right-wing alternative social media platform created in opposition to Twitter.  Brooks, after the event, sought to legitimize political violence in a radio interview. In a republic, your principal form of redress of political grievances is at the ballot box. What are your options if you no longer have faith that the ballot box is a way to address grievances because it is no longer honest or accurate? Neither Gos nor Brooks responded immediately to inquiries from the Intercept. Alexander did not respond to a text or phone call. His voicemail was full and he has told the Daily Beast that he's gone underground. As the mob broke into the Capitol, Gosar was in the middle of his speech objecting to the certification of Arizona's Electoral College votes. Once the Capitol was cleared and members of Congress returned, Gosar continued to object as blood dried on the marble floors just steps away. Very very interesting. Again, that was Andy Biggs, Mo Brooks, and Paul Gosar. All working with the organizer of the so-called Stop the Steel rallies, Ali Alexander who has now gone into hiding because he is worried that he will go to jail for inciting a riot and he should be worried. But also these Republican lawmakers should be worried as well. I mean Paul Gosar on video is saying we're going to quote unquote conquer the hill. What are those folks who believe the election was stolen from Donald Trump expected to take away from that language? When you use that sort of incendiary rhetoric, what do you expect them to do? Paul Gosar, Mo Brooks, Andy Biggs, all of these individuals, very very clearly culpable here. Now they're trying to either do damage control or outright reject this like Mo Brooks put out this like batshit insane statement saying that this is a political attack on him. But make no mistake about it, we have the evidence now. We've got receipts. You all worked with the organizer of this coup attempt. And now it's time to pay for that, right? They should be not only expelled from Congress but there should be legal consequences for this. And it's not just these three folks because while we don't have evidence that newly elected QAnon conspiracy theorist Laura Boebert aided and abetted the organizers in the way that those three members of Congress did, she did tweet out on the day that the riot happened this is 1776 and while the siege was taking place she was actually tweeting out the location of Nancy Pelosi. Does that not seem odd and suspicious? While there's a coup and you have pro-Trump chuds trying to take over the Capitol, very clearly hate Nancy Pelosi, isn't it weird that you're tweeting out the location of the Speaker of the House? That sounds like you're trying to work with them, get them to find Nancy Pelosi. Now it's not just Laura Boebert because Louis Gomert, one of the dumbest members of Congress, tacitly suggested that you know since this election was stolen from Donald Trump there's only one thing that we can do. Get violent. This is what he said in an interview on Newsmax. But at bottom line is the court is saying we're not going to touch this, you have no remedy, basically in effect the ruling would be that you got to go to the streets and be as violent as Antifa and BLM because I'm the big man. He knows what he's doing. He knows exactly what he's doing. And of course we can't forget about the role that Ted Cruz and Josh Hawley played in basically leading the charge in the Senate to get Trump supporters to believe that the election was stolen and that they're the fighters here who are going to save democracy from the evil Democrats who stole the election from Donald Trump. But these are just the lawmakers. Like the right wing bubble is really vast and there were other individuals who did in fact act as co-conspirators. I'm talking about Charlie Kirk of course. He broadcasted the fact that his organization was sending 80 plus buses full of patriots to DC to fight for this president. So Charlie Kirk helped these fascists get to DC to storm the Capitol. That's what he did. Now in a recent episode of his podcast he did a little bit of damage control and tried to downplay the fact that this was an insurrection. Keep in mind that like if this were a Black Lives Matter he'd be saying something entirely different. But this is what he says. Now we sent our students home on our buses and they left. However, some people went to the United States Capitol and just decided to kind of sit there and watch and look and wave flags perfectly and permissible with First Amendment rights. Now a lesson that my parents taught me early on is as soon as you see trouble go the other way. I do not think it was good judgment for people that started to see things happen and they're all this and they rushed to the now that's just here's here's a good rule of life. You start to see trouble just go the other way. Okay. Unless you feel as if your independent action can save an innocent person. Okay. That's one nuance I'll say if you see someone getting beaten up in a subway or something then you could do something. But all of a sudden if you start to see mass trouble just go the other way. As you know very wise people say nothing good happens after 2 AM right or happens after midnight and nothing really good happens as soon as tear gas starts getting spread on the US Capitol right? And so is that a crime? No it's not. Is it bad judgment? Yeah. It's bad judgment. Okay. It's bad judgment all of a sudden to climb the Capitol steps and walk in the rotunda and it's just it's not wise. Okay. Not wise does not mean you're an insurrectionist. Okay. Let me be very clear.  Just because you do something that is regrettable does not mean that you're planning an armed insurrection against the United States government. Now the guy that had the zip ties I hope he goes to jail. That's just weird. Creepy. Wrong. Evil. Okay. Police officers. Jail. But the guys that were just kind of air waving flags and they're walking up the steps and I'm sure that they regret it. I'm sure that a lot of them have said that. In fact in a lot of these arrests a lot of these people say this was the worst decision of my entire life. That doesn't exactly talk like a domestic terrorist trying to overthrow the government. Okay. Well their actions indicate otherwise. And look let's be a little bit charitable. Let's assume that Charlie Kirk supplied these terrorists with buses so they can go to the Capitol and peacefully protest and he never expected it to get out of hand like that. But ask yourself this Charlie.  And other folks who haven't said a word but we hear you your silence is deafening Stephen Crowder at the time I record this video he hasn't said a single thing.  Perhaps Stephen Crowder is culpable as well culpability here is it's gonna I think it's gonna be far and wide. There's a lot of Republicans who aided and abetted this effort folks who lied about the election who knew what they were doing. I'm talking about Charlie Kirk I'm talking about Stephen Crowder I'm talking about elected Republicans such as Ted Cruz and Josh Hawley there's a lot of blame to go around but it's not just that like politically and socially we should shun these people. This is a coup attempt five people died we can't just shame you that's not enough you can't just be blamed and be shamed there has to be accountability. There needs to be members of Congress get expelled for what they did especially Andy Biggs Paul Gosar Mo Brooks possibly Laura Boebert you all helped with this coup event like this is an attack on democracy so we can't take that lightly you can't serve in a democratic institution in a democratic regime if you literally are a threat to that regime.