8, 9, 10, testing 1, 2, 3, 4, 5. He's happy with that. Hi, everybody. Thank you for being here. I just want to report on something. Last week, I sent a letter to President Trump's administration warning them of the disastrous effect that policies they have enacted, pursued and cheered, would have on the work that we're doing here in Pennsylvania to combat the heroin epidemic. Let's not mince words here. President Trump's agenda thus far on healthcare and the opioid crisis is dangerous and would undo much of what we've accomplished here in Pennsylvania. It is gravely concerning that the federal government does not seem to understand the impacts that their policies and proposals will have on the people and families of Pennsylvania, none of whom are immune from the effects of this public health crisis. As we all know, the opioid and heroin abuse crisis has hit Pennsylvania hard, and this crisis doesn't discriminate again on the basis of color, creed, region. It hits every age group, every color, every income level all across the state. And it has been incredibly damaging to Pennsylvania's families. In 2014, in Pennsylvania, we lost 2,500 people. In 2014, in 2015, we lost 3,500 people. And that's how many we know of. 2016, I don't have the exact numbers yet, but it looks like it's going to be way above that, maybe 4,500 people. So this has become the leading cause of death. Someone said today that we've lost more people. We lose more people every year in Pennsylvania to drug overdoses. Then we do a combination of traffic accidents and gun violence. At the state level, we're taking concrete and proactive steps to fight back against this public health crisis. These include things like more treatment for those suffering from substance use disorders, more resources for law enforcement, more restrictions on the prescription prescribing of opioids, and more resources and education for health professionals. Because no longer can we allow families and communities to be torn apart by the death of someone suffering from a disease, substance use disorder, a family member, a friend suffering from a disease that we can do something about. So I have been troubled by a number of steps that the federal government is taking, most striking of which is the Trump administration's enthusiastic embrace of the congressional Republicans repeal and somewhat replace policy toward the Affordable Care Act, which includes deep cuts to Medicaid, the end of the Medicaid expansion, and putting essential health benefits, including substance use and mental health treatment on the chopping block because of pre-existing conditions. When working with people with substance use disorders to help them overcome this disease, we need more evidence-based treatment options so that doctors and not politicians are making healthcare decisions. In Pennsylvania, thanks to my administration's decision to expand Medicaid right from the start, we've helped over 700,000 people to get health insurance who didn't have it before, and included in that number are 125, almost 126,000 Pennsylvanians who can now get treatment for substance use disorder. Medicaid pays for substance use disorder treatments. This so-called health plan that is coming out of Washington that has passed the House would tell basically those 125, 126,000 people in Pennsylvania, again, these are our friends, our neighbors, our family members, that no longer will they have access to treatment. Once again, they should deal with this disease on their own. These are people who cannot afford treatment and so would be left to suffer, not treat their disease on their own, and battle addiction without help, erasing the progress that they've made. In addition, the current proposal would allow states to opt out of the essential health benefits and pre-existing conditions that really protect people with this disease. So should this bill pass, substance use disorders will now be considered a pre-existing condition and insurance companies would once again be able to deny anyone who has this would deny them treatment. So we've already lost thousands of Pennsylvanians, our kids, our neighbors, our friends. This proposal will make the problem worse and we need our federal governments help to solve the heroin and opioid abuse crisis which is affecting people everywhere. We need them to help not hinder this process. So this is not a healthcare plan, this is wrong, and I would ask the Trump administration and the Republicans in the Congress to reverse course and look for solutions that can help their partners in the states rather than proposing plans that would not only hinder what we're doing here, but set the clock back. I think you all have a copy of the letter that I sent to Jared Kushner who I think is the point person for the Trump administration on this. I'd be happy to take any questions. All right, thank you very much. Charles. Before you close the curtain. Are you satisfied with, do you feel like you've been making any headway with Pennsylvania's delegation in Congress? I guess the House has already voted, but the Senate is still out there. I mean, we know pretty much where cases stand on this. How about Patentate making any headway in Congress? I'm actually having a long conversation with him tomorrow because he's one of the key people in the Senate on this. I've been down to Washington, made phone calls, written letters, and I made some progress with some and maybe less with others. I think you saw the roll call vote in the House. There were a number of Pennsylvania's who, I think, Republicans who made, I think, courageous decision to go against the majority of their party, and I applaud them for doing them because I think they were looking out for the interests of their constituents here in Pennsylvania. I also have had a number of conversations with Republican and Democratic governors, and they tend to take a more pragmatic approach to this. There are a number of Republican governors who are in the same situation I am. I have hundreds of thousands of people who now have health insurance because of the expanded Medicaid. And they're looking at this not as an ideological issue, but as just a practical issue that really affects people's lives. And I think that's the way we have to look at this. So I think the Republican governors, my approach, and I think the members of the House who voted against this looked at this issue in that pragmatic vein and said, you know, whatever the ideology here, we're actually talking about something that directly affects people's lives. It directly affects Republicans and Democrats, poor and rich, rural, urban, male, female, and we need to look at it as that, not as something that we can play around with because of some abstract attachment to an ideology. So here in Harrisburg, you'll be heading into high season for budget negotiations after the primary election here. And I'm just curious, I mean, with that issue on the docket before Congress, have you begun to consider any kind of plan B for how to handle people with substance abuse disorders here, that 126,000 that you referenced, if something did happen to the Affordable Care Act that you don't think is really a 17, 18 fiscal year issue? I just don't know. So I'm always thinking about what I might do from a contingent point of view, and there are a lot of different options, but at this point we simply don't know what is going to come out of Washington. The Senate is going to take, I think, a fairly, a very different view on this than the House, but we don't know. And I look forward to the debates that happen there. As I say, there are a lot of people in the country, governors especially, Republicans and Democrats who have a much more practical view of this, and they're looking at this as something that affects their constituents. Don't forget, we had a national health care policy before we had the Affordable Care Act. It was called the Emergency Room. And I know when I was in the private sector, it was never clear on how much of the insurance premiums that I was paying was going to pay for the uncompensated care that took place in hospitals, like in the emergency rooms. Sometimes we thought it was 10, 15, maybe even 20%. And that's the national health insurance plan we had before. It was unfair. It forced a lot of people to take advantage of our healthcare system at its most expensive part, the emergency room, and it cost those of us who were paying more than we should have been paying because we were paying not just for my employees but for people who were getting uncompensated care. That's what this program will take us back to. We need to, I think, move forward from where we are and not move back. Anything else? All right. Oh, yes. Can you relate with your concern? I'm forgetting you said something about this earlier on. Can you relate here about what's going on in Washington to the close consolidation of your Pennsylvania concerns and expressed by people about that? Yeah, I think there's a big difference. Here in Pennsylvania, we are having a very robust conversation about the best way to address the opioid crisis. We're not retreating from dealing with it. So here we've actually put Republicans and Democrats, we've worked across the aisle to, I think, become one of the leading states in the country in terms of addressing the opioid epidemic. And the debates you're seeing here, and the passion is just a reflection, I think, of how seriously we take this in Pennsylvania as opposed to, I think, as ignoring the problem in Washington. So I think there's a big difference. Any other questions? Yes. Any developments on the DNC's surpluses? And I don't know if that's in the order of general standards. Yes, it is. I don't have anything to add to what I've already said. I didn't know if you had heard anything out of Philly from the people from the DNC those committees. I didn't know. Okay, thank you very much.


Hubble is a supernova machine for probing the early universe. Here's a Type 1A it found that's approximately 8 billion light years from Earth.


Good morning, good afternoon, good evening, and welcome to another edition of DevSecOps as the way I am Chris Short, host of the most of Red Hat Live Streaming, and I'm joined by the one and only Dave Muir and the about to break some stuff, Jamie Scott. Dave, how's it going today, buddy? It's going awesome. Another great day down here, you know, in Tampa Bay, and that's right. I think we have a really good show this month. And Jamie's not only going to break stuff, he's going to hack some stuff. We're going to actually hack some Kubernetes today, which will be very cool. Yes. Before I do that, I just want to let the audience know some of you already know this is part of the monthly security series called DevSecOps is the way we've broken each month into different security categories. This is actually according to a framework Red Hat has developed around DevOps and security and what, how to make sense of all the different security categories and methods out there. We've actually got 34 different distinct functions underneath some of these categories that we detail. But this all consists of a lot of publications during each month. So this is one of two Red Hat Live Streaming shows we publish at most three podcasts per month. There's always a blog on that topic. Talk about, you know, the definition of what this category is and how it integrates within DevOps lifecycle and then any other sort of publications, webinars and things that we do with Red Hat and with our partner ecosystem. So stay tuned for a lot of that stuff or look at the old months. And if you're interested in any one of those categories, find more information. You can go to red.ht or slash DevSecOps or just contact us at that email. You see there. So without further ado, I want to bring Jamie in. Jamie, as we've said, is going to start breaking some stuff, which is great. But before we do that, Jamie, why don't you tell everybody who you are, where you're from, what you're doing at Red Hat? Awesome. So my name is Jamie Scott, I live in Santa Clara, California. Thanks. One of the most beautiful places in the world because it is either scorching hot or 60 and there's not really anything in the middle. I haven't seen snow in about three years, so I envy you, Dave, occasionally. But I haven't cleaned my car off in 10. So it's nice. Straight off. Oh, I think Chris is the one who sees snow. There's no snow down here in Florida.  So, you know, I mean, that's it's just life in Detroit. We're used to it up here, right? Like it's cold. It snows. That's the nice part, right? Like if it's going to be cold, at least it's snowing. That's awesome. So at Red Hat, we came over with the acquisition of Stack Rocks and we were a bunch of developers and security professionals who really wanted to take on the world and transform how security is done with a focus on Kubernetes. So one of the things we saw really early on was that Kubernetes is very holistically allowed you to have the context in order to make more informed risk management decisions. And we've tried over the last few years to put that context together in order to enable security teams. So our team came over with the acquisition and product manager of that team. Very cool. You had Stack Rocks is actually one of the partners that I dealt with before the acquisition. So it's interesting to see guys all come over. It's a great acquisition. Really helps to, you know, add that what we call Red Hat, the layered approach to container security or defense in depth. Of course, ACS, as it's now called advanced cluster security, there's a lot of things this month. We're going to talk specifically about runtime security. And in the show, we'll we'll look at actually how to hack a running Kubernetes cluster. But in terms of runtime analysis, how would you how would you define that? You know, or what would you say about that, I guess? Sure. So runtime analysis is the ability to look inside of a container and understand what processes are running. So I know that's a self-explanatory thing, but there's really two methods of doing that in the market today. One is the identification of what is known bad activity. So for instance, you don't want someone to be running a crypto miner in your side, one of your production applications. So looking for crypto mining processes is a potential way of runtime analysis. And the only alternative way to do it from known bad is to look at known good activity and differentiate between what is known good and what is anomalous from known good. So typically that's in the form of process baselining or establishing a list of what the container should run at any given time. Gotcha. Yeah, because typically, if you first think about it, the opposite might seem optimal, try to understand what's bad activity. But that doesn't necessarily lead into the right answer. Correct. Yeah, so there's two ways to look at it. In terms of known good activity, there is a higher likelihood of a false positive anomaly. So for instance, you could have an application running. Someone could be trying to troubleshoot that and exacting into the pod to troubleshoot it. And maybe they forgot to detach the container before they did that. So the commands they run would immediately be identified as anomalous from what is known to be good. So known good has a higher risk of a false positive and known bad has a higher risk of a false negative because an attacker could either leverage something that you have that is known good in the environment and try and use that as the basis for an attack or you could have just missed a process or they could have renamed a process, which is a reasonably standard way of getting around these things. Yeah, it's almost like you don't know what you don't know. So attackers can exploit all sorts of ways that you don't count for. Which is pretty interesting. So before we get to the demo, what we were talking earlier about the MITRE attack framework, can you comment on that? Like what is that? Are there different revisions? Is that helpful for understanding attack factors? Yeah, so there's actually a few industry standard ways of monitoring for attacks and mapping out a defensive strategy for and doing gap analysis. So MITRE attack specifically is one of the solutions in the market that defines ways that an attacker, the techniques and tactics that an attacker is going to use in order to get into your environment. And these range from the tactics, which are what you see at the top from initial access execution, which is I want to run delicious code in your environment, persistence, which is I'm trying to be able to establish a foothold into your environment, privilege escalation, which is I'm trying to get additional privileges to do more defensive evasion, meaning I want to delete all the logs and ensure that you can't find that I did it. Credential access, which is I am trying to get access to credentials, discovery is a basic understanding of your environment and impact, which is really your action on objective, which can be anything from hijacking your resources, such as the example of crypto mining to a denial of service attack, if say I'm a competitor trying to shut you down. So ultimately we see these tactics and techniques be used in order to map defensive strategies and prioritize where people are trying to target their instant response procedures. So for instance, something that is initial access might be a lower priority than something that is an indicator of privilege escalation. So this is an industry framework, which we see people using in order to map defensive strategies, but there's also ones that in my opinion are a little bit more mature. So for instance, the Microsoft threat matrix for Kubernetes also has a very similar mapping that's more Kubernetes specific. So really there are many industry standards and they help users to understand and prioritize where their gap analysis is and their instant response procedures. Yeah, it looks like this one has a bit more on cloud things like using cloud credentials and resources. So really interesting from a multi-hybrid cloud perspective. Yeah, cool. And in your experience, StackRocks and other places, where do you see most of the attacks in terms of mapping it to these matrices? Like do you see mostly execution attacks, privilege escalation, what do you see most? Yeah, so in terms of, so we don't actually get that information from our customers because we do sell the commercial off the shop software. So I'm gonna speak to what I've seen in things like hacker news, for instance. And usually what we see in hacker news and the attacks that are reported in the wild are mostly financially incentive. So crypto mining, for instance, we all know that Bitcoin and Ethereum have gone exponentially into a curve at this point. And we also know that most attacks not from complicated things, they're actually from gross misconfigurations, right? So for instance, an unauthenticated Kubernetes API endpoint, well, by default, most cloud providers, open shift, they're gonna have an authentication mechanism that prevents that. But if you're rolling your own Kubernetes, then it's really low hanging fruit to just start scanning the internet reports and trying to authenticate and then stealing all of those resources and doing what you want with them. So I mean, I'm gonna do this a bit ad hoc, but I can even show you that, like showdan.io is where a lot of these port scans are. So if I wanted to just search for 6443Cube, I don't know if I'll actually find anything, but here I can start to look to under, oh, perfect, container one is this image. So I found a Kubernetes API server here and I don't, let's stop showing this one. Thank you. So it is reasonably easy to do. It's public information and there are tools like showdan who ultimately are publicly accessible that are very easy to use and scrape the internet to understand that both defenders can use to understand if their network is vulnerable, but attackers can also use to target things. And ultimately, people test with these. Yeah, it was interesting you mentioned configurations because my mind, my past, it's all about applications and vulnerabilities in those applications as well as maybe credentials. But even, we did a show yesterday with a partner where we talked about the reports that Red Hat has put out and it was Aqua and Aqua that they put out and the reports on the Red Hat side listed that 60% of issues security instance were because of bad configurations. So it's really sort of been now the primary issue for getting hacked for security events is these bad configs that are, and there's so many different configs and Kubernetes that it's obviously tough to keep track of. Yeah, I mean, ultimately we do see that the basics of hardening and using compliance benchmarks like the CIS benchmarks are really effective methods to compete with attackers trying to exploit basic misconfigurations. So like ultimately, I think you'll realize that a lot of attacks are script kitties. An advanced nation state attacker is going to have a lot more of a budget in order to run a dedicated attack on you. So one of the largest exploitation methods that you hear about is someone launching a scan of a generic exploit and just seeing what they hit without any real intent of targeting any specific individual. Yeah, interesting. Cool. Well, I think we should probably get to the demo. Now, I guess in order to introduce it, you mentioned what it did before the show. What can you just tell everybody in a couple sentences? What are you planning to do? Sure, so first I wanna show you some examples of known good and known bad activity by going through a reasonably realistic attack scenario that to preface this is definitely set up in a way that will help me, but I wanna show you places and the steps that an attacker would go through in order to identify known bad attack vectors so that you can get a better idea to understand how to approach runtime analysis. So I wanna show you known good and how that works. I'm gonna do that through ACS and its baseline technologies and then we're gonna try to hone some Kubernetes and in running application in a more realistic scenario to see if we can get to the host and ultimately destroy the host. Nice. Sweet, let's do it. Yeah, so the goal would be to have the demo break at the end, we can't use it anymore. The cool thing though about this demo I believe it shows most of these minor attack columns, right? So we're doing privilege escalation, execution, credential access. Yep, so we'll start with initial access. We will then move on to some forms of execution and privilege escalation. I'm not gonna show you persistence but show you representative examples that could be used for persistence and we're gonna take care of impact and credential access as well. Nice. Cool, if you want, I can get started. Let's do it, have at it, man. Yeah. So this is Red Hat Advanced Cluster Security and the view that you're seeing here is a prioritized risk view. So this is used to identify what is known to be the potentially most risky deployments in your environment. So up here we see visa processor backend atlas and master card processor, master card processor and visa processor both in the payment namespace. So it's reasonable to assume, hey, maybe the potentially contained credit card information. So I'm gonna click on master card processor and get some identification of what the risk indicators are and why people are saying this is the riskiest in my environment. So I see I have several policy violations, I have suspicious processes running, images with vulnerabilities and some potential misconfigurations. So if I look at process discovery here, what I can see is that cat is being run and LS is being run in a way that is anomalous to what is the standard activity for master card processor. So I wanna look at this a little bit more because cat and LS don't really tell me much. It really just tells me maybe someone's troubleshooting something. So I click on cat and I can see they're catting the file of our lib processor card data and now this is beginning to concern me. So rather than understand, it looks like the LS was really just understand what was in the processor. So let's look a bit more about what's happening. I can see you name is a standard, they're not running arguments. There's a Java process running. Looks like this is Tomcat. So maybe they're exploiting a Tomcat vulnerability. I'm not sure how someone could have gotten in this or if someone just looked at that. Then I look at Carl and what I see here is that someone is posting the card data that was just catted to innocent.site.web. So obviously that's an innocent site and I'm going to completely overlook that for now because it says it's innocent, right? I'm gonna go to a visa processor now and basically do the same thing. And this is a lot more representative of an attack that you would see because you can see people are accessing the entry point, RM is standard, SH and sleep are standard. But if I look at what's actually happening in this environment, I can see a package manager was run. The package manager was used to install Netcat. Then Netcat was run and it looks like it's being used to initiate or reverse shell over port 9001 to shell.attacker.com. So ultimately these are the types of things that we can start to look for in terms of deviations from known good activity. Well, these are more drastic examples that you can get the value proposition of I understand what my container should be running, containers are ephemeral and if my container does not standardly run this process and I have not hardened it in order to remove processes that are not standardly run, then this is my best option. And this is some of the value add that you can see with I trying to identify the differences between known good and what could be anomalous. So that's just an example. But now I wanna talk about known bad because that's way more interesting. So I am going to move this and move over to our shell shock site. So if you're not familiar with shell shock, shell shock was a remote code execution vulnerability, I believe back in 2014 and it allowed users to effectively input trailing commands to as part of environment variables. So it impacted a large portion of the internet ranging from SSAH to Apache for instance. So what we're gonna do is we're gonna put exploit Apache. So I wanna show you just how to do that here. So what I'm doing here is Apache. So this exploit is about running trailing commands when you use environment variables. So Apache is using the user agent header here that I'm defining and it's inputting that as an environment variable. So now I'm escaping that, running echo really just for legibility and I wanna test to see if this works. I'm port forwarding to this instance because I don't wanna run random vulnerable things on the internet. So I can see here, I've got the command that I've tried to do, I'm just running ponage as a test and I know what I can do now. So I wanna see, now that I know I can exploit this, I wanna see what permissions I have. So I wanna see who I am. So this is disappointing to me because I'm running as www slash data which ultimately means it is a default configuration within Apache. So what saddens me is I now know that I won't be able to get root and it'll be incredibly more difficult for me to exploit this container, which is why users always say, don't run your containers as root. And they also say to harden it because I've just run two commands that are likely anomalous activity and ultimately this was not caught. So if you're looking at known good behavior and looking for deviations, I should now have lit up the sock to help people look and say, who's checking who am I? So now because I'm not root, I wanna see what I can get. So I'm gonna check my environment variables. And I can see here that we have a host we've identified. I can see my present working directory but there's nothing good here. So now I wanna see what commands I can actually run in my environment. So I'm really just gonna run an LS to bin to understand what I have access to. So now I have a list of the processes within the container that I can run. And this list is going to form the foundation for how I approach it because I have a few methods of approaching this at this point. I can either try to download tools so I can use a package manager, I can use WGIT for instance. But I need to put in the tools, if I do not have the tools here that I need in order to continue this hack, I'm screwed. But if I do, then I need to download them. So ultimately what I'll end up doing is I don't have WGIT, I have access to a package manager so let's see if we can do that a bit later. But ultimately I've already tested this, this is a pre-setup environment. So I wanna see how I can begin to escalate privileges. Kubernetes itself has a standard place that it puts service accounts in your environment. And if you don't explicitly say I do not want to mount a service account, then it will just add that a full service account. So that's why guidance like the NSA guidance, for instance, says to turn the auto mounting in your deployments for service accounts to a false. So this container specifically has not turned that off. So I am going to cat a token that can then be used to authenticate to the Kubernetes API server with whatever permissions the service account has. And at this point, I don't really know what service account it is. I can reasonably assume that given I can access this in the first place that it's going to be the default. So I now have used a remote code execution vulnerability in a website, initial access, run and executed multiple commands and use those commands to get an authentication credential to the API server. So I know that as the WW data user, if I explore this more, I'm really not going to be able to do anything effectively. So I need to begin to access the actual API server itself in order to launch as a mount point. So what I'm going to do is I'm going to exit this. I know that we do not have the actual information in the environment variable because this was not a root user to link to the Kubernetes API server. So let's assume for a second that I have managed to get that API server end point in a different way and that I would have access to it. So I'm going to export this token. Let me just copy paste that. Okay, I've exported that as environment variable. I'm just going to OC log out to make sure I am not, there we go, perfect. So now I've used this token to authenticate to the Kubernetes API server. So I've now begun to take initial access and I've begun to privilege escalate. So let's check OC project, OC projects. And I can see, okay, now I can begin to understand more about this environment that I'm trying to hack now that I have access to the API server.  So I want to check very slowly what level of access that I'm given with this account. So ultimately I would go through, I would do kubectl, can I? And I would check, hey, can I exec into pods? Because if I can exec into pods, then I can begin to run commands within them to try and see if I can access data or get other credentials. Or even run a crypto miner. So let's try kubectl, can I? And yes, I can exec into pods, perfect. And let's see if I can create pods because this is gonna allow me to create a backdoor. Yes, okay, perfect. So I now own this. So first off, I want to go back to that shell shock deployment that we had. So I'm gonna exec into that to really show you how I would have done this if we were running as root. So OC exec, IT shock, it's in the default namespace. So I'm not gonna put in namespace. Okay, so now I've exec into this shell shock deployment. I'm gonna run who am I? Okay, now I am root. And here's an important thing to say. Now that I am root, I have the information directly here in order to have authenticated to the API server in the first place. So I know the service host, I know exactly where it's hosted and I know it's port. So this has given me sufficient information in order to authenticate to the Kubernetes API server if I was not running as the WWW data user. So what do I wanna do here? I wanna install crypto miner on this service because I just really wanna see how insecure this is. So first off, I try and install WGIP because I wanna download a crypto miner. Looks like I can't do that. So the reason all the next step is to get update. Okay, it looks like I'm failing. I am failing because I am unable to reach out to places where packages are. I see that this is based on a really old container image which is also an alarming sign and no doubt the reason why this is vulnerable. So I am going to remove its sources and update them so that I can actually download packages because I do not have the ability to do a BI. I'm gonna have to print this and type it into the sources list itself. And now if I do app get update, I can see that I've now successfully updated. There are a few things I couldn't download but I think that'll be fine. So now I wanna begin to do an ingress tool transfer. So what an ingress tool transfer is, is it's the ability to download tools that can then be useful to me to continue the attack. So there are two types of tool transfers. I can either do one from a place within the network or I can do it from a place external to the network. This is an ingress tool transfer because it is getting tools from an external network. So I am gonna download Wget and curl. Perfect. And this is taking way slower than it should. Perfect. Now I'm gonna CD to temp. I am going to go to, I'm gonna Wget ethminer which is a standard tool for mining Ethereum. I've now downloaded ethminer as a tarball file so now I have to unzip it.  But ultimately at this point, I can now, I now have ethminer in bin. So I can CD to bin and LS, now I have ethminer. So I am going to just run this. Ultimately what I'm doing here is I'm using the tool to connect to an Ethereum mining pool. I am checking the farm and rechecking it. I'm using the stratum protocol and over encrypted transport. If I wanted to actually use my own crypto mining wallet, I would insert it here and then I would put in the worker name which is really just the identity of the mining pool and go to ethereum.org. So I'm gonna run that. This won't actually work in real time because I don't have my worker name or Ethereum wallet in here but it'll be used as a representative example or maybe not, that's probably a good thing. But you will see at the end of the day that I have attempted to run ethminer in solutions that monitor this and that this is a known bad process. So ultimately I wanna go through and see what I would do next. So this is my impact. Assuming that I could run ethminer, I could have gone through and really taken some of these resources but I'm still logged into the Kubernetes API server. So I can do a bunch of things but first before I do those because my now next goal is to destroy this entire cluster is I wanna show you what the identification of known bad activity looks like. So if I look at the shell shock deployment in here you can see we have run a crypto mining process. Now sure that crypto mining process did not actually function but you can see here that process did not work because it doesn't have the worker name or the eth wallet and you can also see that someone's running a crypto miner in my environment with the shell shock deployment which really is alarming. Yes. Do you think? Yep. You can identify that the package manager is executed. So this is an indicator of that ingress tool transfer. I'm port forwarding because I don't wanna expose any of this to the public internet. So ignore that for now. And you can see even that I've exacted into this backdoor container. So exact is that means of execution and monitoring for known bad activity like ingress tool transfers and crypto mining services is what's really important in this context. So I wanna move on a bit to how would I begin to finally escalate my privileges and show more about this environment? So I have a few things I can do but first I have a privilege container here. So I'm gonna use this privilege container and schedule it because I have access to create containers. And because I have access to create the containers create pods, I can schedule a pod that is purposely designed to give me access to the host. So this is designed to insecurity by me and by the attacker in order to facilitate a container escape. So the reason I can container escape here is because I'm a privileged container and I have a host mount. So what I'm gonna do is I'm gonna schedule this container that has privileges and I'm gonna treat to the host in order to get in. So first I'm going to OC apply F to privileged. Perfect, now I've now created my backdoor. So I also have access to exec in. So this is all of the access I need to get onto the host. So now I'm going to OC exec, IT. My container is called the back, my pod is called the backdoor pod. Looking for names like this is obviously alarming but the one thing I do wanna call out is that attackers aren't just going to schedule things called backdoor pod. They're gonna pick a random UID or something, right? Exactly, actually what I'm gonna do is I'm gonna look for the names within the actual name space I'm scheduling in and I'm going to try to name it as similarly as possible. So we showed the visa processor and the master card processor deployments in the payments name space. I'm gonna schedule this backdoor pod. I'm gonna call it the Mx processor. And see if anyone notices that they don't take Mx. So going to your security team, they might not know that. Exactly. So that's pretty good. But yeah. It's all about business context. So now I'm on this pod. I know that this pod is privileged and has a host mount at pwned. So I'm gonna LS check that that host mount is there and that I'm in the red container. I see pwned. I'm gonna true to pwned and I can now see that I'm on the host. So I'm going to check who am I. I'm root on the host. I LS and I can see, okay, this is different from the file system that I was on previously. And if I want to say cat at sea, cat at sea, let's see what's here. Oh, wow. What a terrible command, right? Yeah. You said you enjoyed watching people make blatant mistakes when they're not following scripts. Cool. So now I can see the configuration or if I'm really just bored, I can rmrf slash, right? So, oh wow. There are real file saves here. That is wonderful. Perfect. Preserve root. Man, it's gone. Bye. You can't touch anything in proc anyway. So, but yeah, it's Ninja Vanish. And now I go to back to the service and I wait slowly for everything to be deleted and nothing to function. That's not gonna take too long, I don't think. Exactly. So, ultimately, that's the way we tend to look at things. There are known good, bad. There are known bad. There are known good. We can monitor for those things. And if you look at it from a security perspective, you want your SIM to be notified near instantly. You want to initiate incident response activities as you start to see these things. And you need the business context in order to make more informed risk management decisions. Because like I said, if you see AMEX processor, you don't know. If you see AMEX processor and that's privileged, then that is terrifying. So, that's why a lot of guidance that people give are minimize privileged containers. Because, yes, they're absolutely going to be needed for something like a monitoring program or for a security solution within Kubernetes. But the reason why they say minimize is because we want to prevent backdoors. So, that ultimately is an example of a real world attack. And that's how we want to go through and monitor and initiate runtime analysis and why runtime analysis as a security program and I've visited DevSecOps program is important. So, there's a few things I could have done. If I wanted to, I could have initiated those policies that were catching and alerting on the things I was doing and I could have killed that pod, right? So, that's why as a DevOps program, it's really important that you have liveliness and readiness probes so that you can kill that pod effectively without business impact. So, DevOps does need to care about security and security does need to care about availability. And that is how ultimately you as a DevOps team can help identify what is known good with your security program for the most important things in your environment. And that's why those security controls are set up in DevSecOps. So, that is the value proposition for why DevSecOps is the way. That is awesome. Well done. Thank you. That was very cool. That whole thing though, interestingly, right? It all started with a vulnerable pod, right? So, one thing that you'd probably know, hopefully before you even push that into prod is, hey, you've got some vulnerabilities in here that you should resolve. And so, you talk about DevOps, DevSecOps, that stuff should always be caught early on in lifecycle during builds. Now, of course, vulnerabilities happen all the time. Your image is clean today, it won't be tomorrow. So, that's why it's good to have what Jamie was talking about. Some sort of, well, the liveliness probes and everything.  So, you can take care of that. Because DevOps ultimately also speeds up, helps you to fix production issues quicker, right? You don't wanna be sitting there with one legacy app, it gets hacked, you gotta shut down your payment processing application for any amount of time. Yeah, exactly. And that's why ultimately a security program and a development and application delivery program really have to care about informed risk management. Because monitoring and just securing all the things, like that's an anti-pattern. Security is about risk management and there is literally no point in trying to ensure that your rules apply to the least critical application environment that's locally hosted, not even externally exposed in any way versus your visa processor like you wanna monitor that, you wanna make sure that your program treats visa processor very differently than a cron job that really just sends a report to single developer. In a way, I noticed ACS pointed out how old the container was, right? To an extent, uptime is a bad metric nowadays, right? It's kind of flipped on its head. Those containers should kind of be cycled out more often, I feel like, right? So there's patches you can apply constantly, you should be swapping those containers out and updating them as you go. And that's why I always say security is interest-subshifted, right? So you'll hear a lot of people say like security is viewed broadly as a blocker. And security has stopped my application from being deployed. Now, why did they stop that? Okay, there's a critical vulnerability in it that they blocked you on, they want you to go fix it. Okay, that critical vulnerability is already there. So what is your next step? You do need to escalate that. You need to identify if you are actually vulnerable to that. But ultimately, fixing it is going to need to occur quickly. So DevOps is in the best interest of the security program because being able to deploy and remediate things quickly and having a mature testing program is going to be the ultimate indicator of success. And that's why I say there's no such thing as DevSecOps before DevOps. Absolutely true. Yeah, security was always part of DevOps from the beginning. We're just trying to put the focus more on security so that it isn't a blocker like it was. I always say I always remember when I deployed my apps as a developer, I'd get a spreadsheet from a security team saying your app is vulnerable but they wouldn't tell me any details. Right, your baby's ugly, sorry. Yeah. So yeah, so that's DevSecOps. You're totally right, Jamie. It's always been a part of DevOps. We just want to make sure to focus on, they give security a seat at the table, let them be part of the group, the lunch team, whatever.  Obviously DevSecOps is more of a culture shift initially at least than anything. Like getting security right and integrating it at the right time will definitely allow you to not make it a roadblock. Awesome. Well, cool, that was very sweet. Any other things you want to chat about, Jamie? Or is that, wrap it up? Wrapped, that might be the first time of VARMRF to know it, but. It's first time. I have to admit, right? Like I've never done that. I don't even want to type those words on a terminal. Well, cool. I want to thank you, Jamie, for coming on to DevSecOps is the way. So a really neat topic and loved how you hack some stuff. And so that probably is a wrap for today's show. Stay tuned for a blog, which will be coming out hopefully in the next week or so around the category. And then next month, October, we're going to have another exciting category and then all the way up until December. December, we're going to start talking about platform security. That's going to be a lot of red hat-ish type stuff, like SElytics and those type of good stuff. We'll see if we can get some good guests on for those shows. But with that, I want to thank you. Thank everybody.  Yeah, awesome. Thank you very much, Jamie. Awesome demo, as always. Coming up next on the channel here in an hour.  Sorry. We're going to have the StackRox office hours with we're going to be talking about Kubernetes network policies with, if I can say the name, right? No, I lost it. Nevermind. It's not on the screen anymore. So one of the StackRox team members is coming on. Going to kick tires on some network policies and show us the why and the how behind it all. So yeah, please stay tuned for that. And when in doubt, subscribe to our calendar or look at our calendar and you can see what's coming up next on the channel. And thank you, Dave, for coming on. Again, thank you, Jamie. And stay safe out there, folks. Here's Tyler.


From theCUBE Studios in Palo Alto in Boston, connecting with thought leaders all around the world, this is a CUBE Conversation. Hey, welcome back everybody. Jeff Frick here with theCUBE, coming to you from our Palo Alto Studios today for a CUBE Conversation. You know, we're like six, seven, eight months into this COVID thing. We're going to be doing it for a while. And one of the themes we've heard about over and over as kind of a result of COVID is an increase in the attack surface, as more people are working from home or working from anywhere. And security has only been increasing in importance. And we're excited to have somebody from the alumni group who's been on before. She is Sandra Wheatley, the SVP Marketing Threat Intelligence and Influencer Communications at Fortinet. Sandra, great to see you. Thank you, Jeff. I'm happy to be here. Yeah, I think actually I misspoke. We've had a ton of great Fortinet people on. We've talked to John and Ken and Phil and Tony. But actually, I'm not sure that we've had you on before. So great to have you. This is my first time. Awesome. So let's jump into it. But we're going to take a slightly different tack today. And we're not going to talk about the technology as much as this other pesky little problem, which is people. And we know there's a huge skills gap in tech in general. There's tons and tons of open recs if you go into all the big sites. And then security, it's even a more specific and a more acute problem. I wonder if you can tell us a little bit about kind of your perspective on this problem, being a senior executive at a security company. People is a big issue. How do you guys kind of look at the problem? How should people think about it? And what are we going to do about it? Well, Jeff, you were completely right. The Cypress security skills gap, it's one of the biggest challenges that are facing organizations today. I mean, if you look at the larger landscape, cyber crime, it's one of the fastest growing crimes in the world. In fact, by 2021, it'll cost the world about six trillion in total. And so tackling this issue continues to be a big problem and it's exasperated by the skills gap. We recently did a study at Fortinet and 73% of respondents acknowledged that at least one intrusion could be attributed to the lack of skilled professionals. So it's a huge problem. We know that it would take about four million professionals to close that gap. And in particular with COVID, it's become even more increased. We've seen a big uptick in attacks from cyber criminals, really targeting remote workers. It's a way into the enterprise network. We've seen a resurgence of ransomware and phishing targeting that workforce. And so as this landscape continues to increase, it's definitely a problem that cybersecurity organizations, public and private partnerships really need to tackle. It's interesting, because we talk a lot about automation and we talk about the scale of the attacks and the scale of data and everything is just going so up and to the right that without automation, you have no hope and you need some help to basically separate signal from noise, that said, you still need people. And really that automation is going to hopefully get the high visibility, the high priority issues to the right people, but ultimately that's an enabler for a person, not a replacement for people. And it doesn't take away this tremendous need for more security professionals. And the other thing that we hear, Sandra, over and over, right, is that security is no longer a bolt-on. It's no longer, you just build a wall around the outside of everything, right? It's got to be baked in throughout the entire process of the product development and deployment. So the importance and kind of the reach and the breadth of security people and the influence of building new products and shipping new products has never been greater. And yet we've got this huge shortage. Exactly. And I think you touched on it, what we're hearing from our customers is that they're really using this period during COVID to really take a long-term look at their cybersecurity investments and strategy. And so you're right. Increasingly, organizations are taking more of a platform approach to security where they have more automation integration and AI. That's one help. The other area is organizations need to be making their employees more cyber aware because it impacts everyone, even employees working at home, organizations. We just released InfoSec training and we offered it. We made it available for free and it really enables organizations to help educate their employees about the risk of cybersecurity and helping them to understand not to hit on the phishing email because 68% of intrusions happen as a result of careless mistakes by employees. That's a big issue. But also really making sure that we bring more professionals into the industry. I like to say there's no job security like cybersecurity. So at the beginning of COVID, we made all of our training free and to the public in general. And I believe we had 500,000 registrations in the first six months. So that really underscores the demand for cybersecurity skills. And then organizations can also really be tapping into under-representative demographics like veterans, like women, who make up only 14% of the workforce overall. So there's lots of things that we can be doing and working together on this problem. Yeah, you touched on a whole bunch of things here. So let's unpack a couple of them specifically. One of the cool things about security is that you guys do work together and that there is a big benefit from working together. So it's a great place for kind of co-opetition, especially as new threats come in and you guys can share that information. So there is an interesting kind of an ecosystem that there's shared basically resources against the bad guys. But you guys did a really interesting thing with Salesforce, with the World Economic Forum, specifically to go after this problem. So where did that come from? Why Salesforce? Why World Economic Forum? And why take kind of a, I guess out of the industry approach to really addressing getting more people as cybersecurity professionals? Well, Fortinet is a founding member of the C4C cybersecurity forum. It was created by the World Economic Forum about two years ago. And right from the beginning, one of the initiatives that we began working on was to reduce the skills gap. And so we started working with the World Economic Forum, Salesforce, which is another founding member and others to tackle this problem. And so we provide all of our training, we provide our training and curriculum on the Salesforce Trailhead platform. We've also entered into another partnership with IBM where we're providing our training on there as Cypress Girls platform. We're working with local universities like Berkeley and others to make sure that we're getting more of the curriculum into their certifications and degree programs. Interestingly enough, one of the issues with this challenge is that there's not a lot of universities offering degrees in cybersecurity, which is really surprising. And so we're seeing a lot more uptick and interest and awareness around this area. So it's very encouraging to see the results of some of these partnerships. I don't, I mean, I'm going to tease you, kind of buried the lead, but some people understand what you just said.  Am I getting that right? That's completely right. We saw that this is something that can really help our customers during this time. It's something we're committed to closing and we felt this was a really impactful way to help with that issue. That's amazing. And I saw, I saw you in an interview with Rob Rashat, I believe is his name from your team. I wonder if you can again, share with us some of the details in terms of the numbers of people that have gone through this program. Cause he mentioned them some, I didn't write them down. There's pretty significant numbers that you guys are running through this free program. Yeah, so we just passed a great big milestone of 500,000 certifications. Half of those have just been this year and that program's been in place for many, many years. So there's no doubt that this is something that's in huge demand. And so we continue to offer those trainings. This was one of the reasons why we just rolled out the InfoSec training for our customers and others to educate their employees. I mean, at one point, I think we had someone registering every seven minutes. And so the response to that was excellent. And that training program has eight different modules and the curriculum in that program actually provides credits for ISC, which is a big certification in cybersecurity and CISSP. So, it's just an invaluable training program. That's wild. And again, it's free all the way, not just to register for the 101s, but all the way through the certification process at the end. Well, I think at the end, if you want to get the actual certification, that's something that you can do separately after you do the training. Although we're working with some nonprofits to order to help pay for those certifications so that there's no financial burden to people. Wow, that's tremendous. And then the other piece that you mentioned, but I just want to highlight it, is the opportunity to go after underrepresented groups. And you specifically mentioned that you have a program for veterans. And again, it seems so logical, but some people just don't get it, right? Then you've got a skills shortage and you got a talent shortage. Why not tap into those markets and those pools of people that are underutilized?  That's exactly right. Like if you look at, take veterans for an example, they already have a lot of the skills that really work well for cybersecurity, like situational awareness. They work very well under pressure. And so we started our veterans program about two years ago. And in addition to our training, we offer mentoring, curriculum, vitae, resume building, interviews, skills building. And we're now at this point trained about 1,000 veterans. Many have had jobs. And one thing that we do that's different to other programs is that we bridge those candidates to our partners and customers who are looking for talent and really close that whole loop. So it's not just about the training, but it's also finding them jobs as well at the end of the training once it's been completed. Right, that's great. I also want to touch on another thing that you do beyond just training. And this comes from, you published a blog on July 8th of this year talking about overcoming the cybersecurity gap, skills gap, but you talked about other things beyond just the people. And I want to highlight really some some attitudinal things that you suggest for people to get over this. One, view cybersecurity as an enabler. Right, not an obstacle. Recognize cybersecurity as a team effort. It's not just some superstar. Get the C-suite involved, collaborate on cybersecurity awareness. And, you know, thinking about this issue at a little broader and a more kind of macro company-wide scale versus it's just the security people's job over in the security people's corner. And that's really the best way to take care of it. Absolutely. And that goes back to my earlier point.   I'm sure you've seen the increase in those. And so it's really, you're right. It's more, the responsibility just doesn't lie with the folks who lead the cybersecurity organization. We all have a responsibility to be much more educated and aware. And so I think, you know, the board has to get a more involved executive management needs to make sure that they're providing the right training and education to their employees, that they're providing mentoring, that they're really encouraging more employees to move into cybersecurity and become certified. So there's lots of things that organizations need to be doing that include education, training and then also making sure that you're making the right technology investments so that you have an infrastructure in place that's agile and can be flexible enough to meet the increasing demands of the threat landscape. Right. I just wonder if you can share some insight on the conversation that happened before you guys opened this up to be free. Cause it's clearly, it's a move to do the right thing. It's a move to, you know, to respond to the community that's suffering. And it's something that you guys could do. You had at your disposal, but I'm sure there was some naysayers in there that are saying, no, we can't, we can't get this away. This is super valuable stuff. How has, you know, how did you kind of make that decision to move forward? And I'm curious how it's kind of played out over time now that you've basically, as you said, increased your exposure and people that are trained and, you know, I'm sure a lot of positive, you know, kind of second order benefits that you really didn't plan on when you were just trying to make a decision to help the community. Well, this was a decision that came from the top. Our CEO has always been committed to training. I mean, this is why we even started the program, which our NSE program is one of the most robust in the industry. And so it's something that are, the founders have always been committed to. It's something that we've invested in. So there really wasn't any obstacles to doing this. This was something that everyone jumped on board with. The other thing is we really wanted to help our customers during this time. And we felt that this was one really meaningful way we could help them by providing this training for free and making sure that they have the talent that they need to really address all of the, you know, the expanding attack surface. So, but we were surprised by the demand and the response that was outstanding right from the get go. And so while we, you know, we've talked about this being offered to the end of the year, we haven't really made any plans to change that. And so that it may continue beyond the end of the year because the demand is so great and the results have been so positive. Right, right. And I'm just curious, do you have in the training, and I didn't go through exhaustively through the whole list of all the courses, but beyond just the professionals, do you have all the basic training just for employees? Like just don't click on the link. You know, it's so funny. I was at, I think it was RSA, one of the keynotes was a Cisco executive, as she said, you know, we tell people not to click links, but that's what we do all day long. We click links, that's what we do. It's part of our job. And you know, it's such a weird behavior to tell people not to do. And I'm still confused how SurveyMonkey gets people to click on SurveyMonkey links, but that's a different conversation for another day. But I mean, are you offering the whole suite? And I just love to get your perspective as a security executive when you talk to clients to how to think about things beyond just the obvious, you know, don't click on phishing emails and, you know, tighten up everything. But, you know, more kind of high level, how to think about security in this increasingly complex and dangerous world, if you will. Yeah, well, the training program has eight modules. It goes from the most basic training to the most advanced training. So our NSC one and two are really more about educating people about the threat landscape, the threats out there, what it looks like, the most basic emphasis security awareness around what you should do and what you should be looking out for. And all of our employees at Fortinet take that training. We take up to NSC four. That's something that's mandated. And so at the very basic level, all organizations should be leveraging those modules for their employees and for individuals who are just interested at large. And then it really advances very quickly after that.  And actually, as I mentioned earlier, it provides credits for some of the top cybersecurity certifications in the industry, especially at the level of CISO. So it's very broad, it's extremely robust. In addition to those modules, we also have what we call fast track training. And that's really utilized by our customers and partners. And that's more focused on specific technology areas. It's very condensed, it may be a day or two days. And the demand for that has been phenomenal. So that's been another program we added about two years ago that's been very well received. Wow. Well, good for you guys. Good for you guys for making a proactive move in a very positive way to help your customers and help the community at large. It's just, it's great to see these are tough times, they're going to be tough times for a little while longer. So, you know, it's nice that you have resources available that you're able to make available to the larger community. And I'm sure it's nothing but goodness will come from it. So good move by you guys. And I'm sure there's a lot of 10 gentle benefits as well. Thank you, Jeff. Well, thank you Sandra for sharing the story. Great to meet you and expand our community over on the Fortinet side. We've had a lot of great guests over the year. So it's great to have you on as well. Thank you very much. I'm really appreciate all the support. Absolutely, thank you.   And you too could be a security expert, or at least as far as you want to go, all with the certification. I'm Jeff, she's Sandra. You're watching theCUBE. Thanks for watching. We'll see you next time.


The Aliexpress dropshipping center is back and it's bigger and better than before. So if you're looking for a good way to add trending products to your stores and make more sales and profit in this video, that's exactly what I'm going to show you how to do. Quick intro and let's go. All right, so let's check out the new and revised Aliexpress dropshipping center. But one second before we get to it, if you haven't done so yet, don't forget to subscribe to our YouTube channel to always learn about the next step in your e-commerce business as well as join our Facebook community and our new discord channel where thousands of dropshippers just like you and I help each other succeed. That being said, let's dive inside and see what the new Aliexpress dropshipping center has to offer. First off, where do we find this new Aliexpress dropshipping center? So what you need to do is simply head over to the Aliexpress website, log into your account on the top right side and then hover over it and click on my orders. So they hit it here in the order screen. What you're going to do now is on the left menu, you're going to click on DS center, which we see right here on the left side. If you do not see the dropshipping center, first make some purchases with your new Aliexpress account, reach out to their support and let them know that you're a dropshipper and you'd like to see their dropshipping center. I didn't have to do that, but I do know cases where new accounts do not see it right away and that is what you're going to have to do in order to see it. So I click on the DS center and this is what we're seeing find products to sell. So here we're on the find products section and we can also click on top selection to see the top selling products, but we're also going to see them here. Now what else do we have here? We have find products to sell and we also have product analysis. This is where we can analyze products by just entering their URL right here, seeing their sales history as well as similar products to them. But right now let's keep it simple, find products to sell, let's see what options we have here. So first you're going to choose whatever category you're interested in. So what category would you like to brainstorm? For example, you can go with computer and office, home improvement, home and garden, all of the dropshipping categories here, all of the categories here are dropshipping categories, dropshipping friendly categories. So all of the products here, you can obviously dropship them and you don't have to worry much about it being a dropshippable product or not. Then you've got your ship from. So if you want to ship domestically to your audience and you want to have fast shipping times, what you're going to do is ship from the same place that you want to ship to. For example, if you're dropshipping to the United Kingdom, so you're targeting the UK audience, then you're also going to look for products that ship from the United Kingdom because AliExpress has warehouses today all around the world. And this way when you're shipping from and to the same country, you're going to have really fast shipping times, really happy customers who will repeat their purchases on your website. So that's the first thing. You want to try a ship from the same country that you want to ship to. Then you have other filters. For example, do you have a discount code available? Do you offer free shipping in this listing? Does this listing have a video that I can showcase to my audience? And do you have local stock, which you can pretty much find that out when you're dropshipping from the warehouse that you want to target? Then you've got a minimum and maximum price setting and you can search for a product. Okay. So if you already know what product you want to look for, like for example, pet supplies, then you're going to search for that. Okay. Let me just clear the rest of the filters and let's just search for pet supplies. Okay. I want to see how well that's doing. And here I can analyze the best pet supplies products. So what's the difference between doing this and simply going to Aliexpress and searching for pet supplies? I mean, we can, we can just do that, right? And see the results. Well, the difference is not only are you going to see the best sellers right here, okay, which you can also see in the regular search results. If you look for the ones that have a lot of orders, right? But here in the dropshipping center, you're also going to get this chart right here showing you how well this product is selling the selling history. Okay.  So information that you would get only after entering these product listings from the regular search field and even on the regular search field, you're not going to get the best product results on page one. You are going to get those that are selling well, but you're going to find the best ones through the dropshipping center. And with this chart here, you're also going to get historical data on how well this product has been performing recently and not just in all of its time since it was created. So when you're searching for a product, you don't know if this listing was created five years ago. And you know, in the last year, it's not really trending anymore. That is what you're going to see by simply hovering over the products in the dropshipping center. Okay. So here, for example, you can see this terrarium reptiles product, which is starting to trend pretty well. And of course, we're right before Christmas. So anything that has to do with Christmas is going to sell like crazy right now. But maybe by the time you're watching this video, it's not Christmas anymore. But that doesn't really matter. You got that product idea from the dropshipping center. Let's see if we've got Christmas ideas on the regular search results. Okay. Because if you're right before a certain holiday, you really want to sell those products. But because these products here on the regular search results are not products that are trending right now. They're just products that are trending in general or maybe trend it in the past. We're not going to see that right here in the search results. So that's another good reason to use the AliExpress dropshipping center to see what's trending now and not what trended a year back. Okay. What other information do we have here? Let's hover over this one. Another Christmas product. Okay. So this one, as you can see, of course, the cells are going to start trending. It's going to start going up because we're about a month and a half away from Christmas. But if I click on this product, okay, let's click on it. Then of course, you're going to go over to the product page. Now, what I could do is I could copy the URL. Okay.  Okay. It's the same as clicking on the product analysis up here. Now what it did is it's looking for similar products to the one that I just clicked on. So I was on these bandanas on these Christmas bandanas right here. I clicked on go to analyze. And what it's showing me now is other pet Christmas bandanas that are trending right now. So this is a good way to find all of these trending products and add them to your stores while it's trending, while it's hot. One quick way to do it. If you're using auto DS and you've got the auto DS Chrome extension installed, you can simply hover over the product and click on this icon right here. Then it will automatically move to the draft section of your store where you can publish the product or optimize it before publishing. And that's it. One click imports as easy as that. But if you don't want the one click import option, if you want to import all these products without having to click on them one by one, another way to do it is by once again using the auto DS Chrome extension. I'm going to click on the circle icon right here. Then I'm going to click on extract. Now all of the product IDs right here that we're seeing on the screen, all of these 16 products got extracted into this extension. Then I'm going to export it as a CSV file. Then a CSV file will download onto my computer. Now what I'm going to do with that AliExpress export CSV file is head over to the auto DS platform. On the left side, I'm going to click on add products. Then I'm going to go with multiple products to multiple stores, click on upload CSV, then I'm going to drag and drop that CSV file right here or click on it to open up my browser window. I'm going to double click on the AliExpress export CSV file and that's it in just a couple of seconds. The file is uploaded and of course I can add as many products as I want into this extension before exporting it as a CSV. And now I'm simply going to click on add as a draft. Okay, make sure that the supplier source and that the region is correct. Click on add as a draft and that's it. All of those products are going to be added to the draft section of my store where I can completely optimize them before publishing them and having them go live. So those are some really quick import options that you can do directly from the AliExpress drop shipping center and enjoy quick product imports on products that are trending right now. So don't waste any more time, import those products, start selling them, enjoy those sales and profits and don't waste all day just importing products and optimizing them and importing more and simply wasting all your time on importing products. That should only take a couple of minutes and that is all it's going to take you once you've got drop shipping automation. Now, even if you don't have a product idea that's completely fine, you don't have to search for something right away. Just go to the AliExpress drop shipping center and see what they're showing you right away. Okay, like we've got these espresso cups right here. So check it out. It was on a downwards trend and now it's completely on an upwards trend. We've got women hair scrunchies. Now this doesn't mean that you need to sell all of these products. Okay, you need to figure out your niche. You need to figure out what you're trying to sell but these products give you a good indication of what is selling hot right now. Okay, so you can see a nice mixture of products here and try to simply think of something. Now there are many ways to conduct product research. You can use the product research spreadsheet that we have that's completely free for you to use. If you want access to the product research spreadsheet just leave a comment right below this video and I will send you the link. And that product research spreadsheet is really going to help you find, narrow down the products that you find and see which products have the best potential to sell in your stores. Okay, so what I'm going to do now is just go over these products and look for something that's really different. Something that I haven't seen before with my over five years of drop shipping experience, it's easy to find products that are new, products that I haven't seen before that are on an upwards trend right now that I could take advantage of. So this is something that I haven't seen before and this actually looks pretty interesting. New Aviator hat that actually has the sunglasses embedded inside the hat. So this is a pretty unique product that I haven't seen before and I wouldn't have stumbled across this if I wouldn't use the AliExpress drop shipping center. And from what I can see here, it had an upwards trend. It started to go down and now it's starting to go back up again. So this one looks pretty good and that is just one original idea of what you can find using the AliExpress drop shipping center. Don't sell things like Pokemon. So you can sell almost everything that you see on AliExpress but stay away from big brands. And how about these waste trainers right here? I haven't seen anything that looks quite like that. That looks pretty interesting. That is worth researching. And also these garden solar lights. So these have been around for a while but this specific design really looks good. So anyway, that's just a quick one minute going through the AliExpress drop shipping center. You go through it right now and find out new product ideas to sell in your stores and keep in mind it's all about the data. So if you see the product is on an upwards trend especially if you look here the seven days growth rate 30% means that this product is trending right now. So you want to rely on the data as much as possible use the product research spreadsheet to narrow down these products that you're finding, these unique products that you haven't seen anywhere else before and this will help you find out what products have the best potential to sell. Once again, leave a comment below this video if you want access to the product research spreadsheet and I will send it to you. But what you need to do right now is go to the AliExpress drop shipping center and find some best sellers to sell in your store right after watching this video. I hope that you enjoyed this quick video tutorial on the new and revised AliExpress drop shipping center. Let me know in the comments below if you have any questions and I will personally answer them. Do not forget to subscribe to our YouTube channel as well as join our Facebook community group and our new Discord channel. All of the links to that right below this video. Thank you for watching and good luck finding the best products to sell through the AliExpress drop shipping center.


Hello and welcome to this week's Wednesday webinar. My name is Heidi Ruthmeyer. I am a staff developer at ESU 8 and today I'm going to introduce you to Breakout EDU, which is a great way to bring in gaming into your classroom. Also a great way to cover different or any really content area. And I think also more importantly some other skills that students really need including collaboration, teamwork and some creativity. So to introduce you to Breakout EDU, I'm just going to show the short little video clip from the website. Tired of students sitting in rows, bubbling in worksheets? Introducing Breakout EDU. Breakout EDU is a revolutionary new product that allows educators to bring gaming into the classroom in a meaningful way. Breakout EDU is great for getting learners out of their seats and moving around. Each game requires critical thinking, collaboration and creativity. Breakout EDU is great for learners of all ages including adults. Each game is centered around the Breakout EDU box and players have a set amount of time to open the box. During a game, players need to successfully navigate a series of mysteries and solve engaging problems. All games feature a blend of physical and online puzzles. Each breakout kit comes with a physical box and a series of locks and other items that can be used to play any of the Breakout EDU games. New games are being added to the store on a regular basis and there are many free games to get you started. Teachers and students can also use the online templates to design their own games. The Breakout EDU kit can be purchased directly from the website or can be assembled using the open source instructions. Learning has never been this much fun and the classroom will never be the same again. Every classroom needs a Breakout EDU kit. Let's reinvent education together. Breakout EDU. It's time for something different. Okay, so that was just a quick introduction to what Breakout EDU is about. Really it's just a game for the classroom where students have to work through some clues to break out of a box or find some more clues in a box to solve a problem. So why would you want to use Breakout EDU in your classroom? Well, all sorts of reasons, 10 listed here. First of all, it's a lot of fun and students I don't think even realize that they're learning as they go along. You can use it for any subject area and the website has lots of free games that have already been created by people in multiple areas. As I mentioned before, it's a great way to promote collaboration and team building, problem solving skills, critical thinking. It's also very important for the team members to communicate with each other and persevere. I like the opportunity for students to learn some grit. That's a word that we're hearing a lot more for students to persevere and get some grit and not just give up right away. They also have to infer. There's a timer that is on the website that you can put up on your screen so they have to work under pressure. And really it's all about the students. There is very little that the teacher does during the actual Breakout EDU. Now granted, there is some work up front that needs to be done, but really it's just up to the students. There's very little that you do throughout the actual lesson. And anytime we can do something that's a little more inquiry-based is always great fun for the students to try something a little different than a typical worksheet. So some tips for success. When you're talking to your students about doing a Breakout EDU, it's important that they understand that they need to work as a team. And you can break your classroom into multiple teams if you wish depending on the number of students that you have, or they can all work together. Also, they should realize the more they communicate and collaborate, the more successful they will be. And if they do solve a particular puzzle, as there is typically a series of puzzles, the rest of their team needs to be aware of that. So they need to check in with each other and make sure they know where everyone is at. And typically, you can give two hint cards to each team that they can use to ask for a hint. And really, that's really just your prerogative in terms of how many hint cards you give your students or what sort of hints that you do give them. So you do need to be very familiar with the game in order to offer them some hints. I'll take you to the website in a moment, but a lot of this information is already on there. For example, they do have a template for the hint cards that you can maybe just print out on card stock and laminate. And you can use those over and over for any breakout EDU game that you should use. They also offer a timer online, and their link is on there. And that would be great if you could put that up on your smart board or a big screen. So they can see that typically they're 45 minutes, so they can see the timer counting down and have to work under a little pressure. When the game is over or when the time for the class period is over, maybe they don't actually finish the game. I do think it's very important that you take some time to reflect and do some debriefing with your students about how the game went. So here are just some sample questions. You could certainly use these, a few of them or make your own particular questions. But I think it is important for the teams to reflect on the process. You know how well they work together, what would they have done differently. This can be just done verbally or they can do it as a group. Maybe you can make a Google form that the students could fill out. But I do think it is very important that you do some debriefing and talk about the actual process, the strengths and weaknesses of the game and your team. So always important to reflect and I think you learn a lot from those discussions. So here is the website address. And as I mentioned, I will go ahead and take you there and we will go through some of those games and I will show you some of the equipment and some resources that are available. One of the things I love about Breakout EDU is the journey often is more important than the destination. And I also think that learning needs to not be a spectator sport. We need to get the students up and moving and collaborating and having those conversations when they are working through the clues. So Breakout EDU is a great tool to do that. And this is just a fun photo showing some kids right after they've done a Breakout EDU. I like this guy right here. We broke out.  So that's just really exciting to see kids. And look, they had 15 minutes left on the clock when they finished their breakout. So they may escape from their breakout. They may almost escape but run out of time. And I've heard more often than not that they don't quite get broke out from their project. Or it may be an epic fail. And I think that is okay. I think actually we need to give our students more opportunities to fail because we learn so much from many of those failures. It was Henry Ford that said that failure is just the opportunity to begin again more intelligently. Breakout EDU website also has the ability to create your own games and design your own games and post them. They do give you a template. But that would be something that I would certainly do after I've done several games and I'm familiar with them. And then I'm eager to make my own or even have your students make your own game. I'm told the Facebook community has some wonderful ideas. I think you can find a lot on Pinterest also for Breakout EDU. So I encourage you to check some of those out to look for more ideas. Okay, so now I'm going to take us to the website. And here's just BreakoutEDU.com. This video would just show you the one that I showed you already. So we're going to go to Get Started. Now you can either, for your step one, purchase a kit from Breakout EDU. And I believe they said it was $99. And it will show you all the equipment that you will get. Typically you get a box, all sorts of different locks, some special pens, and some other equipment. So you can certainly order theirs. However, they also give you an open source list that if you wanted to combine, maybe you have some things laying around at home already. Actually here they give you links that go straight to Amazon where you can find a lot of these. Typically you have a number lock, a word lock. This is a directional lock, which is really unique. This is a clasp that would go on one of your boxes here so that you could put actually several locks on here. So they may have to solve, let's say, three different puzzles. One puzzle that gives them a number code for this lock. Another puzzle that gives them a word. And another puzzle that gives them directions. Or maybe even another puzzle that they have to find a key. So you can use several different locks. Or you can use only a couple depending on the time, the age level, and what you're working with with your students. Here's where I mentioned that they give you a template for hint cards. So you can print those out, put them on card stock, laminate them if you wish. Here is a link to the digital timer. It just takes you to a YouTube video. And the facilitator presentation is the one I just showed you. So if this is something that you wanted to present to other teachers in your district, this is a great resource for you. Alright, so now that was your first step is getting a kit. I will say here at ESU8 we just purchased a kit. We're in the process of going through it and eventually it will be available for checkout. We have to go through a process to make sure that when people do check it out, we get them back with everything. All the locks cleared and those sorts of things. But right now if you would want one of us to come out and do a breakout EDU with one of your classes, we would be happy to do that. So that's your first step. Your second step would be to complete this form. It's the beta form. Really it just classifies you as like an administrator so that you would get an email that would give you a password so that you have access to all the rules and the setup and the answers to all the different games that are available. So I did this last week. I've only received one email from them with my code.  I have not. I'm very good about just one email that gave me the code. So once you complete that, your next step then is to check out some of the breakout EDU games. So we're going to go to some of those. So here you can search for specific games. You can design your own games, but these are games that are already prepared for you. And there are all different grade levels, all different content areas. I see a lot for science and math. And of course I'm a science and math person. So I'm really excited about that. But if you go to each of these, it will give you all the information that you need to do a breakout EDU. And each of these would be able to use the kit that you would purchase. And you could certainly add things. You can modify it. But everything should be included in terms of how you would set it up and the equipment that you would need. And there are lots of them. Now if you scroll down, eventually you'll get to some that say they are in beta. Basically if they're in beta, that doesn't mean they are bad. It just means that no more than three people have actually played them and reviewed them. So they may be wonderful games, but just not enough people have responded in terms of reviewing them. So there may be some great ones on here. So certainly check those out also. So I'm going to go back up and we're going to just go into the spider heist. Now when you first click in here, it's going to ask for the code. I've already been on the website so it already has me logged in. So I have access to this. However, if it's your first time in, it's going to ask for that code that you will get once you fill out that beta form and then you will get the code through email. Okay, so this is going to give you all sorts of information about the particular game. I will show this or maybe just part of this video that sets the game up for the students. I won't play at all, but. Greetings fellow agents. I need your help. I am deep undercover investigating a criminal organization called spider. I have learned of a major theft that members of the organization carried out last night. Unfortunately, I cannot break cover to expose this theft. There is something much bigger going on at spider that I have not quite worked out yet. Okay, so that's just really, I won't play the whole thing, but there's about a minute and a half video that you would show the students to set the stage for them for the whole game. And this is a video overview given by the creator. It's about 11 minutes long, but it goes through step by step on how to set up this game, the equipment that you'll need, and she does just a fabulous job. So I'm really excited about getting into a classroom and doing this one with some students. She also then has just a step by step instructions written out in addition to the video. And then she has a, here at this link to digital resources. I'll go ahead and go to that. She has everything on Google Drive for all the information that you're going to need. I believe even including the video I think is on here. The video is down here. All the things that you're going to need for them to actually play this game are already on here. So all of this is already created for you. So I'm really excited about it and to have all this set up for you. So hopefully they're eliminating all the great deal of time that would be required to create your own game and to get started on one of these. Okay, then she also has a link to the timer that you've already seen and then a list of all the materials required. And she does mention that there are some steps that you could leave out depending on the grade level or the equipment that you have or maybe just the timeframe that you have. And then some additional materials. So that's just one example of the many that are already listed and already created for you on here. So I encourage you to try out a breakout EDU or give me a call or send me an email at hrethmeyer.org and I would be happy to talk to you about maybe coming out to one of your classes and doing a breakout EDU. If you have any questions, please let us know and thanks for listening.