Hi guys, it's nice to meet you at the open source summit 2021 again. My name is Jeongwon Kang, working at the affiliated institute of Atree in South Korea. As you know, we are in the COVID-19 pandemic situation, so I hope to see you in person next time. Today, I'm going to talk about a practical approach to control and authorize the execution of interpreters. As follows, the presentation slide consists of seven parts. Introduction. In the Linux system, there are many features to prevent or limit unauthorized execution, such as file mode bits, access control list, IMA EVM, FS Verity, no use amount option, and mandatory access control frameworks. It's too many, right? I think you have heard about them if you are interested in hardening security for new systems. However, do you think are they enough to control the unauthorized execution? In my opinion, they are not because of the interpreters and script files such as Python, Perl, and Ruby, and so on. Of course, they are very powerful in making a program that compiles the languages, so we use them, but it's a program that most cyber adversaries also like to use it for hiding their activities and artifacts. Also there are fileless morewares using interpreters in Linux systems. You can find out the morewares easily on the internet. To solve the issue, there are some previous works by ClipOS. OMEI is a flag of Open System Hall, and Astra Interpreters Lab, and OMEI is a counterpatch of counter self-protection process. There was also consideration regarding interpreters and script files of Chromium-OS development team. Anyway, we will look into the works in more detail in the related work slide. So what's the problem? As a result, they are insufficient to restrict interpreters. In short, they have some kind of force and flaws. That's why I proposed the approach related work. Let's take a look into ClipOS first. ClipOS is a kind of Linux distribution focused on security and developed by ANSI, a French government organization. ClipOS has a feature to control script files based on write, exclusive, or execute. As you see, it added a new flag of Open System Hall, so it decides whether to allow the execution in the corner, according to the path and no exact mount option. But the approach of ClipOS requires patch on interpreter and on Linux corner. As a result, it makes maintenance issues to keep up with a new person. Next, Astra Linux. It was developed for similar purpose for security like ClipOS. In the Astra Linux, the Astra interpreter's law is one of the laws that are security features. It means that Astra Linux considered many kinds of stuff for security. If you are curious about it, you can download the install image file on the website. Anyway, as you see, it controls many interpreters such as Python, Perl, Dash, Ruby, and so on. In detail, the Astra interpreter's law specifies the interpreters into the extended attribute via finding out each file. The pictures are showing what I described, and Astra Linux modified the Linux corner like ClipOS. On a side note, it wasn't working well when I tested it, and I didn't know the reason. Next, ChromiumOS. According to the ChromiumOS document, we can understand the reason why the ChromiumOS limits the interpreters, even Dash and Bash. So in ChromiumOS, most of the applications were implemented by compiled languages, not script files. So Dash and Bash are allowed restrictively only for development. Last, OMEI exec corner patch of corner self-protection process. As far as I know, it was proposed by Michael Salon from the ClipOS. He suggested OMEI exec as a new flag for the open add to system call. As we already know, it works in the path mounted with the no exec option. Also, it has the maintenance issue, depending on updated interpreters. Actually, I don't know when it will be merged into the main line design. This is a brief overview of my approach. Actually, I prefer to do the related work. From now, I will name the program implemented by my approach to interpreter lock for convenience. My interpreter lock works based on the right or execute policy like the ClipOS. It also handles the execution of an interpreter differently according to the range of UID. If a process has a UID more than or equal to 1,000, then the interpreter lock will control the process. It means that the interpreter lock only controls normal users, not root or administrator. Although I will explain in detail after, the target interpreters are Python and Per. Because most literate distributions install them by default. Also, as you see, the interpreter lock is a corner module, and it hooks the functions like exe-cv-e, exe-cv-f, and bprm, changing the p, within the corner by the ftrace feature. So it allows the execution of script files in the not writable path only for normal users. But as you know, the administrator like root can execute interpreters and script files in any path. Of course, the normal users and processes can't execute interpreters and script files in a writable path. In summary, my interpreter lock controls the unauthorized execution of interpreters and script files by the path and UID. Okay, let's have a look in more detail. You can divide the path whether writable and executable. As I already described, they are the exclusive or relation. I think you may be wondering that how I divided the path. First, I looked into the permission of path by users if they can write or execute. Also, to do it, I referred to policy manuals of Linux distributions. As you know, it describes the policy requirements for the distributions. It includes also the structure, contents and specifications for everything of them, such as UID classes, the list and purpose of path, and so on. As I mentioned, the interpreter lock only controls normal users who have UID more than or equal to 1000. So, the normal users can't execute interpreters and they are limited from executing the script files depending on the path. I already said that the interpreter lock targets Python and Perl. But there might be so many interpreters to control, right? Even I didn't know. Anyway, I classified the interpreters if I installed or not installed by default. So I chose Python and Perl. How about bash and dash? They are only for a command line tool, not much programmable than other interpreters. As you know, we can't live without them in the Linux system. So the interpreter lock doesn't care about bash and dash. To control the interpreters and script files, I thought it was proper to control them when it is execute. So I took a look into booking techniques by user mode and counter mode. At first, I wanted to solve the issue in the user mode by adding preload and Pinterest techniques. But they had its limitations. I'm sure that there is no best way than not to use interpreters. As you know, it's impossible practically. Modifying interpreters are two. Eventually, I solved the issue with the after-hook in counter mode. It is very useful for hooking the execution path of any functions within the corner. But it's not a panacea, right? To hook functions in counter mode, I have to consider stability and other things. Also, the Linux corner is really progressive. So I have to upgrade my interpreter lock according to our new version of the Linux corner. Implementation. On this slide, I will describe some kind of stuff for implementation briefly. I implemented and tested the interpreter lock in Debian and Ubuntu. You can test the interpreter lock on the distributions. Also, I implemented my interpreter lock based on the after-hook. I was able to save my time of trial and error thanks to it. Anyway, the interpreter lock hooks the three functions. CIS, EXE, CVE, CIS, EXE, CVS, and BPRM change into P. I will talk about more the three functions in the next slide. There are two ways to run the script language. First, we can run it as arguments of an interpreter binary. The second is running the executable script file directly. As you see, they are handled at the point of EXE, CVE, system core within the corner. So the interpreter lock hooks the point to control that. Next, I will describe the second case, which is executing script file itself. As you know, the script files include the shebang at the first line. It indicates which interpreter executes the script file. As you see, the BPRM change into P function chooses the proper interpreter for the script file. So the interpreter lock hooks the function and controls the execution of script files. Next, I'm going to talk about EXE, CVE, and system core. As you see, it is similar to EXE, CVE, system core. But the differences are a way to execute files. It executes files depending on the combination of directory file descriptor and path name. Of course, the directory file descriptor is obtained by the open system core. If it is known, then it will execute files by the path name only. Also, if EXE, CVE function calls the EXE, CVE, add system core within, I think you can understand how to use the EXE, CVE, add by the examples. In this slide, I'd like to show you how to hook EXE, CVE, and EXE, CVE, add system cores. The upper part is the interpreter lock and the lower part is the Linux corner. I made three functions and most of the work is done in the common function like the Linux corner. Also, the work is checking the file path execution arguments, environmental variables, whether they are valid. To inspect, environmental variables is done at the hook common and hook BPRM changing the P. The inspection is no problem at the hook common function because the address of the environmental variables is in the argument. But at the hook BPRM changing the P, it isn't easy to get the environmental variables. So I refer to an auxiliary factor. There is some extra space and it is OK at the moment because the Linux corner will initialize the auxiliary factor later. Also, I implemented the real path function to identify the precise path of interpreters and script files. If we want to hook, if we want to look into in detail, I recommend you visit my GitHub. The URL is on the last slide. And for EUID separation, like the source code on the slide, I did it to control only for more than equal 1000 EUID. Discussion. In this slide, I will describe some issues that I considered during the implementation. During the implementation, I suffered from many bypasses. Finding and fetching was really time consuming work. To handle it, I had help from skilled hackers who are working at theory in South Korea. The first case is to copy a binary file of interpreters. It's impossible to limit the execution by the copied interpreters. Of course, if I track the binaries from original duplication, then I can serve it. But tracking files is another work beyond the scope of my topic. Anyway, we need help from other security features like IMAEVM or NoExecMount option. To use IMAEVM, we have to sign every binary file and manage them. It is not a simple job, so I recommend using the NoExec option. It isn't complex as IMAEVM, but we should separate the home directory from the root partition. Another case is a hard and simple linked file. I could handle it by the real path function simply. As you know, interpreters have many options to execute a script. Also, there are environmental variables to consider. I developed the interpreter line, which handles all of them. In this slide, I will talk about unusual cases that bypassed the interpreter line. The first is the dynamic linker. I haven't seen it to execute binaries by the dynamic linker directly. So the interpreter line limits the case without difficulty. But another case by user-forged AFTI system core wasn't easy to serve. The original purpose of user-forged AFTI is to enhance performance by handling the page-forged exception in usual mode, not in kernel mode. But these days, many hackers use it to succeed in exploiting the Linux kernel. Also, the user-forged AFTI technique was able to bypass the checking rules in the interpreter line. To serve it, we have to use another kernel that is above the 5.2 version. The kernel serves the sys-control option to control the user-forged AFTI. The last one is related to a technique for file-less malware. As you see, you can find the mem-afTI file for post-audio in the pro file system. And then you can check it by copying any binaries to the mem-afTI. Especially also the IMEI EVM can't block the mem-afTI technique. In my opinion, the mem-afTI should be controlled for security. Anyway, I observed if there is a case that executes binaries by the mem-afTI. But I haven't found any case, so I added the mem-afTI file name to the checking rule in the interpreter line. There are also exceptional cases such as Python debugger, Python document, hyphen for bash, and a symbol and link tree. In the last case, the interpreter line mishandles the symbol and link as an execution option. Anyway, I fixed our issues that we checked until now. Frankly, it was a kind of paranoid war. Conclusion, although the interpreters and script files are convenient for developing programs. But they must be restricted if we focus on security. Unauthorized users can do any what they want by using interpreters, but controlling that is difficult. The best way is to remove them entirely if we can live with binaries only. So I proposed a better approach to handle the issue than other related works. As I mentioned, the approach needs the prerequisites, but I think it's a reasonable job for security. Finally, my presentation is over. If you have any questions, you can contact me by slack.


I think something that we are losing right now and something I really care about very much is this idea that you have to be singular as an artist. It can't be just copying can be part of the game obviously but and it should be at some point but you have to find the voice that's proper to you. And if today in Europe or I go to FilmFond or a broadcaster with a project and that's a screenplay and I tell them this is I'm gonna do this and chances are it's gonna be judged by commission and commissions are made of bureaucrats or pseudo-intellectuals disguising it so I don't know civil servants and they're gonna go for the average. They always go for the average. So in a way the films that you're gonna see chances are in the European system America is different it's a different hell but I mean we might talk about it later but in Europe I'm just talking about what I know it's always gonna be the last singular possible. I mean I know because in my first film it was a terrible war to make it happen. So there is an institutional reluctance to anything that's singular that's why I'm so I'm so impressed by painters because they can really you know they don't need stupid commissions. They can make their movies you know and my own master Bellatars just told me that you have to make your movie you know that's whatever it takes take your iPhone. And it's strange that the more people take their iPhones to make their movies the more standardized everything gets. You know it's weird that we have the diversity of point of views but people copy each other like never before even in the Western world singularity is despised because for many reasons why are people putting themselves on TikTok to watch themselves and communicate what they have to say. Is it democracy? I don't want to see your face. I don't want to say I'm not interested. Is it like the expression of art?  I mean for me as a filmmaker obstacles are part of the difficult the struggle is with yourself, with the material, material world the physical world that's always been part of the human expression.  I often or even what you said earlier about oh you have to make that movie even if it takes taking your iPhone to make the movie but then when many people are doing it it's not really worth it anymore or it just it's very it's not really good anymore so I often wonder because my generation what a lot of artists are doing is because the struggle of you know financially but also getting represented getting attention is so hard and it's so gate kept it's reliant on very old structures so they take their phones and the poets they publish their work online the painters they film their process all of these things so what we are doing our generation of artists we go online a big part of them and but because we do that it often gets devalued by older institutions and I mean there is a point for what art what art is good but we have I personally think we have found an answer to this because we have these means in technology where we can cheer each other up or find solutions but then how are we supposed to do that like how are we going to cheer them up you're speaking as what last law you want to say no I just wanted to say something to this so I mean when I talk to studio people all the time like executives in Hollywood all they want to do is please the youth there's nothing I mean they want to second guess the audience to the extent that they want to bring it down to their imagined audience so they take everybody for idiots basically they're possibly very idiotic themselves so they're definitely not keeping the gates for you know old people they want to make films for the imagined young people they don't even exist


This is stock number 10095, we are here at Summit Automotive in Fond du Lac, Wisconsin. Your new and used sports car headquarters. Today we are checking out this super clean 2013 Ford Mustang GT500. This vehicle has the 5.8 liter V8 supercharged motor which pumps out 662 horsepower. From this HD video you will be able to tell just how clean this car is all the way around inside and out. Performance white is the color. We shoot all of our videos in 1080p so if you have HD capabilities turn them on right now because it is like you're right here looking at the car with me and definitely your best way to check out the vehicle without actually being here. And on these sports cars you want to make sure that you know exactly what you're getting especially on these like collector pieces like this GT500. Has the SVT package which gives you the 19 inch front painted SVT rims. No scuffs or scrapes on them. It has the Brembo brakes on it as well. Goodyear 26540 ZR19 tires and they have a decent amount of tread left on them. Has the HID headlamps, the LED running lights, factory fog lights, front bumper is in really nice shape. It does have that skull sticker on it. It's just a sticker but it's kind of cool. It's got it's actually carbon fiber if you can see that but that can be removed if you'd like. The only thing I saw is one tiny little scuff on that front valance on the bottom there. Now there's nothing wrong with that because it has replacement pieces in the trunk for that front valance. Passenger side fender, no dents or dings on that, very nice condition. And the passenger side rim, no scuffs or scrapes on that, really nice clean condition as well. As you go down this side of the car you can see just how clean that body is, how reflective and mirror like that paint is. I wanted to point out the carbon fiber wrapped in mirrors as well, pretty cool looking. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down you can still see the car, hear the car and have confidence in the vehicle that you're looking at before you even get here. So that when you do get here there's absolutely no surprises. Back rim is in excellent shape as well, no scuffs or scrapes on that. And as we come around to the rear bumper here, has the factory exhaust, stripes are in really nice condition, no scuffs or scrapes on the rear bumper, the deck lid is in really nice condition as well. And this one does have the track pack, the only way you can tell is if you get underneath here and look up the rear diff, it's got that cooler tube, off the back there it has the track pack which it does, everything's nice and clean underneath here. As we come around to this side of the car, just as clean as that passenger side, and some denser dings in the rear quarter, has the capless fuel fill which is a really nice feature. And for full disclosure this back rim is in nice shape as well.  On the rest of this side of the car, no dents, no dings.  It has suede side bolsters, you get the Cobra embossed back rest, side current airbags, no rips or tears on the seat, very nice condition. The back seats are very clean as well, no rips or tears back here. It does have the latch child safety system if you want to try and get a car seat back there you're more than welcome. You can also see it has the ambient lighting, you can change those colors to be whatever you want. Has the GT500 floor mats back here, power windows, power locks and power mirrors. Has the auto headlamps, traction control, this car has 11,555 miles, instrument cluster is very clean, comes with the leather wrapped and suede steering wheel, Bluetooth and audio controls on the right, cruise controls and information center controls on the left, comes with the AM FM and Sirius XM radio capabilities, shaker sound system, climate controls that does have sync for your Bluetooth phone, six speed manual transmission. Your floor mat is very clean as well and the passenger seat no rips or tears on that. This car has never been smoked in, headliner is absolutely perfect, has the home link buttons for your garage door security systems and lighting systems and it has your map lights right there. We'll take a quick look at the trunk and then we will check out under the hood.  But very clean back there, trunk lid shuts nice and solidly, LED tail lamps and one more time down this side of the car. And under the hood we have the 5.8 liter supercharged V8 motor, has a K&N cold air intake filter, engine based, very clean, runs very smooth, this one looks like it was, they got the people who made it, so it looks like Carey Booth and Paula Courier hand built this motor, has another carbon fiber skull, motocraft battery, usually a good sign it was always serviced at a Ford dealership, engine based, very clean, runs very smooth, this car has been fully safe and inspected by our service shop, has a fresh oil and filter change, all the fluids have been checked and topped off. Car has been gone through mechanically 100% and is 100% ready to go. To see more pictures of this car, one of our other 450 new and used cars, trucks, SUVs, minivans, ringles, you name it, we got it, go to our website, www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at one website at summitauto.com. If you'd like to check out more HD videos like this one you can go to youtube.com slash summit auto. Remember to like, subscribe and share on this video and all the videos that you see there, in fact in a second you will see a link to subscribe to our YouTube channel on your left. You'll link to more sports car videos like this one on your right, if you've not been to our website on the bottom link to this vehicle on our website, click those, check us out and we really look forward to helping you with this super clean 2013 Ford Mustang Shelby GT500, thanks again.


I want to thank the people of Wales for welcoming me and my delegation so warmly. It's a great honor to be the first sitting U.S. President to visit Wales. It's a one-in-a-lifetime opportunity. You can't pay for that to happen. Many can't buy that. You can see the extraordinary beauty, the wonderful people, the great hospitality. So I'd encourage everybody in the states to come visit Wales.


Guys subscribe and turn notifications on leave a like and drop a comment down below. Get here first and win giveaway calls I will pin as first comment on some of my videos. Be fast and good luck. What is going on guys welcome back to the channel and I appreciate you being here today I am back with another Destiny 2 top 5 video and today we have top 5 luckiest loot drops of the week but before we go any further people if you do enjoy the video leave a like, leave a like, leave a comment and if you're new around here and enjoy daily destiny 2 videos be sure to subscribe but let's get straight into this top 5 and at number five we have a clip sent in by jqd so just one little ad pops out an exotic and a legendary Jesus what did he have for breakfast? Clip sent in by Diego I don't think I've ever seen two exotic shots for the same person at the end of a pvp game well now I have and number three we have a clip sent in by midnight three two zero seven damn I need this guy's rng we have a clip sent in by emperor face punch so he joins a gambit match gets stuck at the start his team gets murdered and he gets an exotic wow one we have a clip sent in by rare aids this has to be seen to be believed people but guys that is end of top five if you enjoyed it leaving a like really does helping me out if you are new around here and enjoy daily destiny 2 videos be sure to subscribe and if you have any amazing clip to send in send into the email just linked at the top of the video this guy's hopefully you enjoyed the video and hopefully I'll see you on that next one


Join me and my co-hosts every Saturday at 10 a.m. and 7 p.m. Pacific for cartoons and movies at the 50th Street Studio Twitch Channel. See you there Hello everybody. Thank you for coming this week. I'm gonna tell you about Girl in Landscape by Jonathan Latham. I learned about this book from Adam Savage of all people. I saw a video where somebody asked him what are his favorite recommended science fiction books and I knew immediately he was gonna recommend Dune, Neuromancer, and Lord of Light and sure enough Dune and Neuromancer came out of his mouth almost immediately but thankfully he did not say Lord of Light, but one thing he did say was this Girl in Landscape thing that I'd never heard of so I looked it up and it sounded intriguing So I got it read it First of all, it's extremely well-written. It is very very well-written. I recommend it just for that It's about a 12 year old girl whose family her father being a former politician decide to emigrate to a new planet that's been discovered and become Pioneer families out there and of course it ruins her life and That's the basics of the story. It's how this life on this new alien planet affects her How she deals with and how she becomes an adult it didn't really need to be science fiction There are some interesting science fiction elements to it, but I was I was waiting for there to be some tremendous reveal about the nature of the planet and and the and the local flora and fauna some some horrible realization Which never happened. It was just about this girl But extremely well-written and I recommend it for that Thank you for watching this week Please become a sponsor and help me make more videos follow the link on screen and in the description below to Make a monthly pledge or a one-time donation and please leave a comment Let me know what you think and come back next week. Bye


Machine learning algorithms are revolutionizing the way wildlife imagery is processed, enabling faster detection, counting, and classification of animals and their behaviors. However, there is a lack of systematic literature reviews on this topic, which limits our understanding of how these algorithms can be applied to wildlife imagery. To address this gap, we conducted a rapid review and bibliometric mapping of existing literature. The results showed that an increasing number of studies are using convolutional neural networks, CNNs, also known as deep learning, to process wildlife imagery. Most studies have focused on large charismatic or iconic mammalian species, while an increasing number of studies have been published in ecology-specific journals. Collaborative efforts between countries are rare, but there has been some progress in this area. Additionally, sharing of code is limited, with only 20% of studies providing links to analysis code. Finally, much of the published research and focus on animals comes from India, China, Australia, or the United States. We recommend increased collaboration and sharing of approaches to maximize the potential of wildlife imagery and accelerate the transformation of understanding of wildlife behavior and conservation. This article was authored by Nakagawa, Shinichi, Lejish, Mamburjana, Francis, Roxanne, and others. We are article.tv, links in the description below.