Kia ora, kaupapa. I'm Vincent Herringa. Welcome to this sixth episode in our series of Otato Ngahere, produced by Pure Advantage and Tanei's Tree Trust. These webisodes are being hosted by our friends at Edmund Hillary Fellowship. In today's webinar will be a webisode, in fact, we like to call it. We'll be looking at what the financial and policy incentives should be that would create an incentive for landowners to commit to permanent forests and especially indigenous forests and we're joined today by Dr David Hall, who's a senior lecturer at the School of Social Science and Public Policy at AUT and he researches climate change policy and has been a contributor especially to the Te Arawa Circles Sustainable Finance Forum. Our second guest is Annabel Chartres, a partner at PWC New Zealand and she leads their sustainability and climate change practice and has been an author also of that report into biodiversity for the Te Arawa Circles. So welcome Annabel. Our third guest is Kevin Prime, whose family has just moved something, whose family have farmed beef entries and lately bees on their whanau land in Matato in Northland since 1963 and Kevin is also a commissioner with the Environment Court. And then finally, Waho, excuse me, Waho Roy Shortland, who is the leader. He was a leader in Te Reo Māori and has agreed to sit in on our webinar with Kevin to contribute to our understanding of Te Ao Māori, particularly in regards to our Nahiri. So, you know, one of the things we've been doing with these seminars is advertising really the opportunity for the content on our website, the Pure Advantage website, which you can find at pureadvantage.org. All of the contributors to tonight's webisode have written pieces for our website and you'll find them there. And I think that Simon, you're going to put them on the chat as we go through. So they're really worth a read. And in fact, that whole website is just a treasure trove of lovely information, including a beautiful film that was made and is now playing both on the website, also on TVNZ on demand of farmer Ian Brennan, who is a really good example of someone who's converted a lot of his farm into native forest. So it's a beautiful story of a tānei's tree trust farmer at work. All right, Simon, should we have a quick look at the poll results? See who is joining us tonight. As with previous episodes, we look like we have a good mattering of people who are landowners, foresters, farmers and landowners and also science and academia and other. And also a good number of people who have engaged in the material online. So thank you for that. And there's more going on there every time you visit. And at least half of you have seen that documentary, which means half can still watch it both on TVNZ and on our website. OK, well, the question of how do we incentivise landowners to plant native trees? That really is the subject of tonight's website. And we thought we would start with a real actual live forester and farmer. So Kevin Prime has a wonderful description on his website on the website. And I would love to just read that to you. And then we're going to ask Kevin to describe a little bit of his experience with farming and forestry. But Kevin's married to Margaret. They have 13 children over 30 mokopuna and two great-grandchildren. And he says hindsight is a wonderful thing with the benefit of modern science techniques now and his knowledge of Te O Māori. He wants to correct the mistakes that have been made in the past with managing the land for the benefit of future generations. Kevin, what would you regard as some of those mistakes? And I think especially in the story you quote your grandmother with instructions about what to do with the rivers. My grandmother had said to her children, koe, koe, turaki ngā rāko i ngā taha taha o ngawai. Essentially saying to her children and some of the grandchildren were around at the time not to cut down any trees along the waterways. And I guess that didn't really happen because... ...and she also started planting trees very early. Wai, wai, wa, sikoa, nga rapa-rapa haere. Hienkai nau te korotiki ngā iwi ne, kie te meatue, koroka e ta māta utupuna e hakahūana te whānau kia haka to rākau. Na, nanu e haka to ngā rākau ngā paina ne, ngā paina mege ne o tāwahi. He's taken his leave from his grandmother. And while it was pretty broad, we had to sort of learn through the experience of becoming a forester and becoming a working farmer on the lands that have been passed down. So the other thing, I think, in addition to what Kevin's saying, is he's become a model for the rest of us in the wider Ngāti Hine forest estate. He's led us. He's been at the forefront of many of the initiatives that are in front of Ngāti Hine now. Kevin, kia hako te kōreroi te rotu i te reo and I'll pick it up as you stop. Well, why is that, Kevin? In what ways do you think you have led the charge? And what have you learned as you look back on the past and now look to the future? Well, for example, in my time when I started, I think probably going back of this, I think you said we started in 1963. We actually started about 400 years ago on our... We have occupied, we can trace occupation, 400 years to our common ancestor Hini Ahmadu. I'm happy to be stand corrected. My grandparents had planted trees. They only planted about seven acres. My dad had planted about 70 acres. Then I planted about 1,700 acres. But mine was different in that I borrowed money and all they're trying to do a lot more. What kind of trees did you plant, Kevin? Mainly pine, just rainy after that. That's for you at Casey, I'm not an oxen. But I think we've learned our mistakes now. For example, like using a roller crusher and you find that the bulldozer driver anchors his machine just over a ridge and he lets the roller crusher roll down the hill. And even though you've told him not to go down to the streams, he can't see that it's not till the ropes go slack that he knows is hit the bottom and then he winds it up. So we ended up having burns that went right down to the stream. So those are lessons that we've learnt. We've learnt now that to have buffers along your stream. So we're having 50m buffers at minimum along all our waterways. So those are some of the lessons we've learnt and we're trying to address that now. And you've also diversified the range of plants and trees that you've planted, right? Yes, that's right. Well, we're planting mainly gani kapua, which I think most of you call T3. Or somebody called it manuka, but to us manuka is another plant. It's what most of you would call kanuka, I think, of T3. So we've been planting mainly T3, but within that T3 that we're planting, we're planting pockets of natives, like when he moved kahedra pair and any other different native tree plants. Like the problem with the way we're planting them, I think we still haven't learnt how nature or God plants them is that they'll drop seeds everywhere as the plants would grow where they're supposed to grow, whereas human beings tend to plant them and just put the trees and plant them in rows and that, which I don't think is natural. There must be a lot easier way we can copy nature. Well, there's not a lot of straight lines in nature. True. Are you expecting to get a financial return from these natives that you're planting? Well, the intention is that we do hope to be clear-felling natives in probably about 250 to 300 years' time, but we think we're still going to need pine trees for another five generations of pine trees, so that's probably about five to 250 years. So because we sure want to make money, but we will be reducing the amount of pine trees that we plant every year. We hope to phase out cattle probably in the next 40 years, so that's not very far away, a lot earlier if we could, just keep enough to have a tonguey and that sort of thing. What would stop you from planting more natives? You have to make a transition, right, and you're expecting your pine trees to be harvestable. That's your expectation? Yes, eventually we would still do the normal planting regime, which is about 28, 30 years, and to gain some income, we still have to pay the rates, we still have to meet all the costs of pest control, weed control, and all the other things that happen. We still have to earn some income to generate some income to do something with it. Yeah, which makes sense. I mean, it's a working farm. David, this story that Kevin has told would be repeated all over the country, and if we were ambitious, or at least our ambition was to incentivise more planting of trees and in particular more planting of native trees as this whole series is focused on, we have mechanisms to reward people for doing that, right? We have, at the very least, an emissions trading scheme that would effectively be a carbon farming model for someone like Kevin and for families like Kevin across the country. Yeah, that's right. I mean, the first mechanism, of course, is timber markets. So that was what Kevin was talking about. There's the possibility of sell timber, but then as climate change became a drive in concern, yes, we've also complemented that with the emissions trading scheme. So that is a mechanism which enables people to make money out of growing trees and sequestering carbon that is pulling carbon dioxide out of the atmosphere and storing it away in the form of forests and trees. So, yeah, it is enabling a land use which otherwise wouldn't be commercially possible because you can even plant a permanent forest and make money off that, at least while it's still growing and sequestering carbon and you don't even necessarily need to harvest trees to make that work. That's the end of the story, isn't it? Thank you very much and good night. I know that there's a but coming. And I guess the but is that people value forests and trees for a lot of different reasons and they value different sorts of forests for different reasons and the reason that we've been focused on native forests through the Ōtātunga Hedi series is that communities, Māori and Pākehā value native forests for a lot of different reasons. There's particular relationships for Māori to native species through whakapapa and the relations that they have to particular tree species. And then there's also all sorts of aesthetic values. People love native birds that live in these forests. And then, you know, there's also, as being discussed in some of the earlier webinars, there's possibilities to use some of these native species for timbers. There's potentially values that we don't even fully understand in regards to Rōngoa Māori and medicinal and other sorts of extractive purposes. And the mechanisms that we have at the moment don't necessarily value these things. And certainly the emissions trading scheme doesn't. It values carbon sequestration. So it is monetising the capacity for trees to pull carbon dioxide out of the atmosphere. And so the faster the tree grows, the more money you can earn from that. And it happens that we've spent decades perfecting the pinus radiata to be an incredibly fast-growing tree for timber purposes, but that works just as well for carbon sequestration purposes.  And so they don't earn as much money through the emissions trading scheme. So, you know, the emissions trading scheme is good at what it's designed to do, which is to reward carbon sequestration. But, you know, carbon sequestration is only one aspect of the climate change problem. When we have the Paris Agreement, you know, Article 2, we're committed to climate mitigation, so we're committed to sequestering carbon, but we're also committed to climate adaptation. We need to make climate resilient landscapes. We need to prepare for extreme weather events, floods and so on. And we need to be wary of increased fire risk and risk of introduced pests, which might attack forests. And there's a question here as to whether monoculture pines or monoculture of any species, really, is the most prudent choice in regards to climate adaptation, because actually, you know, monocultures tend to be quite exposed to these sorts of risks. You know, the general rule of thumb from a resilience perspective is to have biodiversity in a forest and biodiversity in the landscape. So, that is where the emissions trading scheme may well not be producing the optimal outcomes from a climate change perspective. And then there's other questions as well around biodiversity and also just transition questions, but... So, the ETS, as it exists now, is in some ways the wrong tool to be using... to incentivise and reward landowners like Kevin's family to really advance the cause of regenerating native nahiri and planting is what you're saying. It's a clumsy instrument. Yeah, it's clumsy is what I'm saying. It's good at what it's designed to do, but it was never really intended to deliver the more nuanced approach to the landscape that people really want to see where we're not just putting the fastest growing trees across the landscape and customising carbon sequestration, but a more nuanced approach where we're interweaving different sorts of land uses and interweaving different sorts of forestry uses even within agricultural production. I mean, it tends to work in a much more siloed way the emissions trading scheme. And so, I think it's... we have to be careful because it does enable forest land uses otherwise might not have been possible, especially putting forest in remote areas where perhaps it would be too expensive to transport the timber out. And so, you know, it wouldn't get forested for timber reasons. You know, the emissions trading scheme does enable permanent forest in some of those places. And that is a good thing, but it might not necessarily be the right species for those sites. And so, it's not necessarily getting that nuance that we want with the slogan, right tree, right place and right purpose. Yeah, indeed.  If the ETS is not the right instrument, or at least it's only one of what should be a range of instruments that could be used to reward people for regenerating and planting native forests. What other mechanisms could we look to? And I think in your excellent piece, you list four. I don't know if you want to rattle through those four now. I can certainly do that, Vince. I think the first thing before I do it, though, is both Kevin and David have pointed out that there's this real issue because we're facing into the need to function in economies and societies where we need cold hard cash. So, there is a need for return on investment in some way, shape or form. Well, at the same time, there's this issue with being able to value the other values or outcomes or impact that we get from, in this particular case, from native forestry, and that's where this seems to be the disconnect in what we're looking at. The other thing, of course, is what we need to do with native forestry is do it at scale. So, this is not a case of planting two trees every year. It's a case of being able to find financing instruments and mechanisms that can really turn the dial around regeneration of biodiversity and affecting some of the negative change we've made on our landscapes. So, the four instruments I wrote about are certainly not the only ones. They're just, I suppose, pretty commonly known ones. The other thing is that they're not mutually exclusive. So, there is not one size fits all, and just as the ETS is a blunt instrument that serves one purpose, it's also useful as David mentioned. It's not something that we should do away with. We need other things and better things. So, of the four that I mentioned, the first one was green bonds, which are pretty well established as a financial instrument, both in New Zealand increasingly, but also very much internationally. And in terms of what they are and the difference between them and a more traditional bond, is that they are issued to actually fund a project or investment that's going to drive a really clear environmental benefit. In terms of how that could fit with this issue we're trying to solve around native forestry, a green bond could, for example, fund seedlings or labour or maintenance of the forest. And then the issue, it just needs to evidence that the positive change that's driven out of that. So, that's one thing that could be used, and then there's the possibility with green bonds because they're really established of having formal certification in place. So, you know, with any financial instrument, with anything we look at, there has to be rigor around how the benefits are appraised or how the outcomes are appraised and that fits for both green bonds, but anything we look at. And I think A and Z were one of the first to issue green bonds in New Zealand. I seem to remember funding a geothermal facility for contact energy. Yep, that's right. Digging into my deep past as a business reporter. So, these mechanisms are quite commercial, right? We're not talking about necessarily charitable exercise. These are long-term investments by institutions. Absolutely, and there's a very, very clear commercial benefit that comes out the other side. And that's what I suppose we're facing into with native forestry in terms of defining that benefit in a way that is attractive to investors. And again, on a scale that means it's commercially viable in the market. Yes. And your right contact energy has issued green bonds. We've seen some from Auckland Council. Argusy property have done the same. Now, those have all been for different things, not for native forestry, but there's certainly a history of them being issued in New Zealand, increasingly being used as a source of funding. Yeah. The second thing that we're starting to see a little bit more, and particularly I would say this year is sustainability-linked loans. And this is where an organisation is looking to have a loan where the interest charge to the borrower and the performance of the loan is set against some predefined environmental or social governance criteria. So if they meet certain criteria, then they'll get a discount on their rate. If they don't, then the rate is higher in terms of repayments. And the agreed threshold is part of the criteria of how that loan is set up at the outset. I think the most recent one we've seen in the market in New Zealand is BNZ and Southern Pastures. They issued one couple of months ago, but Sinlay have done the same. Contact Energy again have done the same in terms of having these predefined criteria driving very specific outcomes that's going to give them a discounted rate on whatever their loan is. Why that's quite attractive is, of course, you're getting a discount on your lending and then for the banks, it's an opportunity for them to de-risk their loan book as well. So increasingly, as environmental and social and governance metrics come into play in terms of how a bank looks at its loan book, these sorts of products are going to be, I think, increasingly common in the market. And at the moment, there are great PR exercises for lots of organisations who are seeing, who want to be seen to progress in their environmental credentials in the market as much as you can. Well, I suspect that both with green, well, in fact, all three green bonds, green loans and also green funds, which I think you're going to be talking about next, is the potential for the alternative being you might be investing in a stranded asset. If you are investing as a bank or as a fund or an institution of some sort, there's a possibility your investments, whether they be fossil fuels or some sort of polluting factory or whatever or damaging practice, there is a possibility of you being stranded with this climate unfriendly investment, right? Absolutely. And the other element of that, that's sort of the negative element, is that if you are not doing environmentally or socially positive activity through the financing that you're accessing, your ability to access funding is going to become more limited. And we're already seeing, as a result of climate change, talking to banks in Australia and in parts of Europe and the UK, access to funding is getting more difficult for those organisations and sectors that have high risk, whether it's from environmental degradation or whether it's from high emissions. And I am sure we'll start to see that in New Zealand as well. Yes. Let's just touch on the third one very quickly, which... No, I won't put words in your mouth. What is the third category? Green funds. And this is a little bit different because it's, you know, it's a bucket or a portfolio of investments and what we're seeing is both negative and positive screening in terms of the investments that are going to a green fund. So choosing not to invest in certain things because of the negative externalities associated with that particular industry or company or idea, or choosing instead to use positive screening and think about impact investing around ideas, organisations, solutions that have a positive impact on the environment or society. And we're seeing more and more of that starting to happen as well. This idea of impact investing in New Zealand. Yeah, and I do carry on. I was going to say in New Zealand, still early days, but there are increasingly some impact funds starting to set up. And the idea, certainly from an investor perspective, that the negative screening goes without saying is happening all over the world. So you're seeing some of the big investment funds, the sovereign wealth funds, superannuation funds, Kiwis over here choosing to limit investment or actually reverse their investment. So disinvest from either industries or sectors or organisations that are having a negative impact or having a high emissions base. The fourth one, I know you're going to mention by diversity credits, but I'd like to just hold that thought because we'll explore that in some depth, but I wanted to ask Kevin thank you, Annabel. This pool of capital that Annabel has been talking about, have you been able, as a farmer, as a forester, as a whanau, have you been able to access any of this green capital to fund your business? No, we haven't we haven't tried any of it to date at all. I think it's been looked at. We did get an email from someone who did an assessment and said we have 300,000 odd sitting-in credits and I wasn't aware of that and we haven't tapped into it either and I don't think we wish to tap into it. Do you mean credit as in emissions trading credits? Yeah, the carbon credits. What would stop you from cashing that in? Well, I guess I think we'd have to pay back if we cut the trees down. Yes, I guess you would. I'm not paying back. Just don't go there. Yep, because your business model is still around harvesting. In SNS. Yeah. David, in your experience, the sort of wash of capital that's coming down from large institutions, is it having an effect on green investments and in particular on forestry? Have you noticed any impact yet? Well, certainly investors moving into the carbon farming space and the creation of permanent forests and pine forests, which are generating that revenue from the emissions trading scheme and producing units that might be used for offsetting internationally. But the real challenge is to steer that flow of capital and that wish to invest towards the most environmentally sound and the most socially just outcomes. And, you know, we've seen that backlash already from the investment into these sorts of forests and I think, you know, we'll see more of that investment and some of that may well be the right land use for the particular sites that they've been installed on. But, you know, I think a lot of landowners and a lot of communities are not going to want that as a large scale land use change across the whole country. And so, you know, we're going to have to pivot towards outcomes that have a better balance of, you know, what I was describing before where it's mitigation as well as adaptation, as well as biodiversity enhancements, as well as regional economic opportunities. And I this is why in a lot of my work I've been attracted to the idea of nature-based solutions. So this is an idea which is emerging in international climate change policy and strategy. And this really makes explicit that idea that we shouldn't be looking at using land use and ecosystem restoration to deliver climate mitigation alone. We should be striking that balance across multiple outcomes and using nature and using ecosystems to deliver that multifunctional outcome. Because, and just to underline the point of what you're saying, because the capital that Annabelle has talked about needs a return on investment, even if it's impact investing, it still needs a return on investment. And at the moment, unless you're harvesting trees, really the only alternative is the emissions trading scheme for returning some sort of value back to your investors, to your bank or to the buyers of your bonds. And so really what we need is another kind of mechanism, multiple mechanisms, as Annabelle has said, not mutually exclusive and that's where I suppose this idea of a biodiversity credit comes in. Tell us about these miracle drugs. I don't know if it's a miracle drug but it's certainly worth having a go at. So in terms of the instruments I talked about before, they are I suppose they are or green versions of existing financial instruments in some way, shape or form. And similarly, a biodiversity credit moves away from that traditional sort of financing product a little bit because it's trying to create a value that that represents a return on investment for an owner before they can establish another revenue stream from the forest. And so it's trying to say there is a way to incentivise people, organisations to invest in native forestry even if that initial revenue stream that you might get from other alternative sources of planting is not there to start with. So it's almost saying we'll give you a return by doing nothing and just doing the right thing so it's creating a different value structure in some respects. Appreciating that with native forestry in particular and David talked about this before looking at it from a sequestering perspective. The reality is that Pinus radiata is a much more commercially viable solution for a carbon revenue stream the native forestry particularly in the early decades of growing it with a biodiversity credit or a biodiversity payment it creates a revenue stream based on the environmental or social benefits that native forest that biodiverse forest is going to provide a head of the sequestration revenue that might come later and it certainly provides an alternative to the revenue that would come from say rotational pine and the timber that could be cut down. So the idea of course with something like this is that it's finding the source of the funding to make that payment and David can talk about this with much greater detail but you know many respects it does require the government to step in and say hey we will fund you to not chop down a tree and not to plant something that's monoculture or a mixotic species. It's saying we put a value on the biodiversity you're creating by planting natives by planting a mix of natives. We've talked about the intrinsic value of forests in their own right as having values that are beyond just timber or aesthetic in their complete sense forests that have values just by being forests is something that's a theme that's come really strongly through this whole webisode series and what you're saying is a biodiversity credit is a mechanism that would honour that and reward people for just planting and maintaining and regenerating forests for their own sake. I was going to say it's putting value on that concept of the ecosystem and it's a really really difficult thing to value but it's saying that ecosystem services deserve a value and this is one way of creating that. It's funny isn't it that we use the words ecosystem services as if they are still in service of us and it does remind me of human resources they're not people, they're human resources anyway. We're going to come back to that because that's a very interesting question looked at from an indigenous point of view but I'd like to ask David if you could just explain the mechanics of biodiversity credits how do these things work? Just to emphasise that point that you were just making actually I always find the language quite troubling around this of incentives and services. I actually think of it in terms of capabilities how do we enhance the capabilities of people of tanga defendua of all landowners to do and to deliver the sorts of outcomes that they really want to produce and to pursue those kinds of value and really appreciate from the forest and a biodiversity credit is one way. I tend to talk of it more broadly in terms of a biodiversity payment because a biodiversity credit tends to imply an offset scheme like the emissions trading scheme but that's just one possible mechanism for creating that payment and that payment is what would potentially enable people to deliver those outcomes so we already have kinds of biodiversity payment in the system already things like the one billion trees direct landowner grants were an output based payment where landowners were provided some cash which made up some of the costs of native forest establishment. There's also easement schemes like the QE2 National Trust where people are paid to retire land and essentially that's what it's doing it's creating a kind of payment for those biodiversity outcomes but I think these schemes that we have at the moment clearly aren't doing enough to address that disadvantage that native species need relative to fast growing exotics like pine trees so we really need to look at something bigger where biodiversity offsetting is one possible option but another scheme, another mechanism is outcomes based payments where landowners are paid to produce and to deliver those biodiversity outcomes in recognition of the public value that they're creating and I think I like this because restoring and protecting biodiversity on a farm, on a landscape could become part of agricultural production it could become another yield that sits alongside wool and meat and dairy and so that farmers are not just looking for those traditional agricultural outputs they're also looking to enhance their biodiversity outputs as part of their farm system an agroecological farming system and it's conceivable can I just interrupt with a thought that it's conceivable for instance if you were a Fonterra farmer that part of your payment from Fonterra would be your good practice around waterways and planting around waterways to maintain a clean, so not just a compliance exercise that comes at a cost to a farmer but it could be that that becomes part of your payment for being part of the Fonterra family. Exactly and it goes back to that issue that I started with it, these payments enhance the capabilities of farmers and landowners to undertake these activities because riparian plantings and planting up gullies and erosion prone slopes, they all cost money and most landowners and land managers would love to do more of these activities if they could but they just lack the time and the money to do so and at the larger scale a biodiversity payment like this as well could make some of those financial instruments that Annabel was talking about more viable I've looked at some of this through the Climate Innovation Lab project which is a partnership with ANZ and we've looked at things like green bonds for native trees and it's certainly possible but it would require incredibly patient investors because the returns are just that further and long coming because the native trees grow slower so it really stretches it stretches the patience of investors where you're looking at not harvesting trees and 25, 30 years like in pine plantations but 50 years will be on so that really stretches the patience of investors but if there was something like a biodiversity payment that those sorts of forests were eligible for and the pine plantations weren't then there's a bit of cash flow along the way there that would help to make that financial instrument more viable so it sounds wonderful and let's get there faster but what's the reality you both have written this piece for Te Arawa Circle it was an excellent report I don't know if you've submitted it but you published it did you get a response from industry and from government around the idea of biodiversity payments? We didn't touch so much on biodiversity payments in that particular paper it was very focused on reform of the ETS to consider natives more fully and to make amendments to the things that just were a bit creaky around creating a level playing field was a term that we talked about a lot so things like the lookup tables for natives the minimum per hectare size those sorts of things and then understanding how to address the delta between the cost of native planting versus the cost of exotics but just picking up on that question Vincent we're seeing some really encouraging signs with some of the clients we're working with at PWC some of the heavy emitters in New Zealand who are looking at the carbon pricing volatility and recognizing that because of their compliance obligations under the ETS they need to think about managing that risk because it's essentially a cost item on their balance sheet that is just going up each year what's really encouraging is that with some organizations they are taking more of a values based approach to how they're addressing this so they're looking at forestry options they have this commercial return they need to generate they need a stable and recurring carbon revenue from what they're choosing to plant if they're looking at forestry but they're also trying to understand how they can do mixed plantation how they can do permanent and how they can do a proportion of natives as well because they see that as part of the legacy of their organization and that's really really encouraging to see similarly the drylands partnership between Z Energy in New Zealand Contact and Meridian I may have got some of the players wrong but they we're looking at a mix in terms of what they've done partnerships around both exotics but also natives as well so trying to bring more natives into the mix it's not perfect because the balance is always in favour of exotics because of that high sequestration rate but more values based decisions legacy impact is coming into play which is really encouraging to see I just add Vincent that it might seem strange to think of people being paid for biodiversity but it might have seemed very strange a few decades ago to think of people being paid for carbon these systems keep changing and the system at the moment doesn't reward that but that's no reason to think that it won't now I remember even just four years ago I never talk on the idea of bonds for native forests and we were talking about some of these issues in a forest that said I've planted millions of trees in my life and the idea that government's ever going to pay for trees again is just absolute rubbish and yet within months the 1 billion trees programme had been announced and indeed the government was paying people to plant trees again and so we should just never get stuck thinking that the system that we have now is the system that we're destined to have forever these institutions these policy mechanisms are all of our creation and if they are enabling and empowering things that are of genuine human value which native forests are then I think there's a case to be made to design and create and implement them absolutely it turns out change is actually possible so thank you for that I think that's added a lot of light to the issues of funding mechanisms and capital flow and so on and as usual I've left the questions to the last nine minutes but we've got a ton of questions here and they're really good ones and actually some very practical questions for example here is a question from Keith Dark for you Kevin how are you managing your possums tests that we know just absolutely love your trees and all the birds and eggs inside them well to date we've been just doing no shooting that's all when people report they've seen a possum no they people go up and there's many of the whanau their nephews, nieces that just go up and do night shooting from the farm in the forest so it's very easy to recognise a forest that's been munched by possums and we just keep on on top of it as long as we keep on top of it yeah okay interesting there's also a question here around eucalyptus plantations again the two questions in fact about eucalyptus and one for you Annabel well actually Ann David because I know you hang around forestry types are there examples of eucalyptus being planted and harvested in a sustainable way in New Zealand? my comment on eucalyps and I'm not a tree specimen specialist so this comes from conversations with a lot of the big forestry managers is that it comes back to something David mentioned before about right tree, right place, right purpose and so with eucalyps it really depends on what variety you're planting and there are so many of them and where you're planting it as to whether it can be sustainable and also whether it can be productive in terms of being commercially viable forestry crop not my area of expertise but that's the advice that we have had when we've been dealing with the forestry managers who are looking at planting different specimens David I'd just recommend that there's groups at the School of Forestry and University of Canterbury the drylands eucalyps research team who are looking into this so I recommend tracking down their work okay thank you you've found that link Simon to there's a question but I do have a question here from Jackie Amers as well so Jackie is one of the contributors and has been on this series as well and this is probably something for you Kevin it's about continuous cover forestry you I think very early in the Kodaro you mentioned about harvesting your native forests and you talked about is have you investigated the possibility of managing by a continuous cover selective harvesting this question for you Kevin for native trees no we won't be clearfalling we'd be selective logging even when the what people call wilding pines I've no doubt that there's going to be pine trees that are growing will be growing within we'll just let them mature and cut them down and hopefully that time there'd be the technology to be able to extract them without too much damage to the remainder of the forest okay nice one there's a question here from Don Scarlett and perhaps one for you David how far away is Aotearoa from biodiversity offsets trading scheme not just an emissions carbon trading scheme but an offsets or biodiversity so there were provisions already for that under the resource management act that was a requirement that regional councils could put upon developers that they would need to undertake offsets as part of as part of their resource consents that wasn't that wasn't used as much as it might have been so so presently of course the resource management act is under review and that has certainly been an issue that was touched upon in the review is to the extent to which mechanisms like this and other sorts of other sorts of financial mechanisms might be used by regional councils in order to increase investment into ecosystem restoration it raises another question which is the anomaly of having pinus radiata and permanent forests when they really only last 80 to 90 years so she has a question about is it right that such trees would even be included in the emissions trading scheme as regarded as a permanent forest I don't know if Annabelle, it could be one for you I mean I think it's not for David The permanent forest category limiting that to forests which are made of native species or are being transitioned towards native species is certainly one policy change that might be made I recall it being one that we suggested in the Aotearoa Circle report Annabelle that is something that a change that could be made to the ETS in order to adjust that disadvantage that native forests have at the moment that they have access to that permanent forest category in a way that they presently don't have that unique advantage but yeah it also raises the issues that Matt Walsh was talking about and his forestry system New Zealand carbon farming that we are using that short life or shorter life of pine trees as a way to transition to natives over the long run whether the category includes that or not is another question which will need to be addressed by policy makers and I refer everyone who is interested in this to the previous webinar where that system is discussed. We did talk at some length about transition management from short term as short term as you can get in forestry for using exactly what Kevin is doing on his land using as a short term harvestable crop with a plan to transition and that probably is a beautiful moment for us to bring this to a conclusion and I would really like to throw back to Kevin and Waiharoa to give us some context we are so used in New Zealand to having such short term horizons but right at the beginning of the conversation Kevin you talked about trees and a forest that you expected to be continued to be harvested and lived in for your children and grandchildren and great-grandchildren I think you said 450 years tell us about that vision that you have because that seems like a lot of years by usual business planning standards so I guess it does sound a lot of years but the intent is still to look to help the future generations I don't think we can do much in the long term but we can plan for it and if we work towards doing something now like we're thinking more about the water quality we're thinking more about trees like nut trees fruit trees rungua trees to have all these these different options tako hi he he ne hona kia putakone paingana monga monga uri kei te heke mai kau kei hi he ne me haka toh hei mahi moni hei ahai hei paingana monga te tai awa hei paingana monga I just picking up from where Kevin has just been the Ngati Hina experience in forestry began a short period ago if you're flying into Keri Keri any day and you just before you land you will see the clear forest the pine forest that have just been clear that's 40 years of pine forest in Ngati Hina before that we had no pine and now the first harvest you can see it it's there and now we've got through the billion trees thing we have a partner in the crown to deal with what you're looking at or the replacement of that now from tonight's conversation it's really now given me a far better view of what we actually have we've got 80 years of transition because we've got a patient investor in the crown and now if we're really looking at this transition thing and all of the things that have been discussed this evening the four points Annabelle that you've raised just gives us a better sight as to what the outcomes might be if we can now focus our whole transition on the next 80 years while the crown is carrying the weight but the and this last 40 years Ngati Hina has watched trees grow on our lands on five and a half thousand hectares of Ngati Hina land and of that we only harvested 400 hectares for our benefit the rest of the trees were owned by somebody else and we have just watched it being tracked down this is our this was supposed to be our economic saving but the other 5000 hectares was tracked down by someone else and our shareholders have not had one cent dividend in 40 years and we were basically forced into forestry because our lands were said to be unproductive and here's something that's going to make them produce and they certainly did it said that we didn't see any of that economic benefit save 400 hectares and now you know everybody else Carla Halls and everybody else who grew the forest and pay it you know to be fair they paid us the lease for the land and all we did was lease for 40 years and then we paid all that in rates and what have you because we still own the land but so our experience when I was listening to all of this it just shapes my mind as to what is ahead of me as a trustee for those lands in the next 80 years I'm not going to be there to see the end result but I'm going to be there now to make sure that all of these things we talked about tonight are given why the conversation gets really much more in depth and I'm thankful I hooked up tonight because it's broadened my thinking well we're thankful but I'm going to do it for the forester as a trustee in advancing the Ngati Hinerpai so that's going to change we crushed 5000 hectares of bush basically to grow pines that's what we did to our estate in the last 40 years 80 years is not going to put it right but I think as Kevin has pointed out we can start a scheme that returns the balance now 80 years is not going to get us all the way down but hey while I've got a patient investor I'm going to certainly be milking the opportunity I'm not milking the government, milking the opportunity to do something that's going to be far more effective than the last 40 years Kia ora that was really interesting to hear and gosh we could do another whole episode on colonialism all over again when it comes to forestry because we continue to get it wrong with ecosystem services even that is questionable language this language around poor land or marginal land is a term that has been discussed on these webinars as well as inappropriate I hate that word but it's the wrong language to use about land so it could be returned to our beautiful Nahiri look we don't have time unfortunately to continue this kōrero but it's been really interesting and I'm really grateful for your time, for all of you David Annabelle, Waharoe and Kevin really interesting discussion so much more to learn Simon we've got tons of stuff happening on the chat so keep going and I'm grateful for you for all of you joining us tonight to talk about these really important matters for New Zealand so thank you for your time and thank you to our panellists


Both of these folks have a pretty extensive background, so I'm just going to cover some of it, introduce them, but before I do that, quick show of hands, how many people are doing threat hunting in memory, looking for hostile actors in memory, right? So it's a difficult problem. And so I'm really, really excited personally to hear this talk. This is an area that needs a whole lot of work to be done in it, and it's, you know, folks like Carlos and Marcos that are, you know, on the edge of providing this kind of content for us. So Marcos is a software architect at McAfee. He's leading the development of exploit prevention technology components, which are part of the company, McAfee's next generation flagship product called End Point Security. Marco also led the organization of the first ever B-Sites conference in Cordova, Argentina. Carlos is an experienced InfoSec analyst who drives strategic initiatives and provides thought leadership and insight regarding the ever-changing global landscape at Claro, America, Movil Offices in South America. He organized the one hack para los chicos loco security conference and is now working on organizing the first ever B-Sites conference in Cordova, Argentina. So great, great to have these folks come in and share their research with us. Give them a round of applause. Thank you all for being here and thank you for attending this call, this talk, and thank you Blue Team Villas for having us here. This talk is going to be about this project that we started like a year ago called Mem Hunter. For us, it was really a way to learn on new and past code injection techniques and process manipulation in general, and also it was a way for us to explore and have to cope up with a problem that we were having on the field, which was around doing this threat hunting process in memory at scale. So we will talk about that during the slide and we will talk about the problem that we are trying to solve. So this is the agenda for today. So probably we will skip the first slide and then the introduction part. Then we will jump into the why, the how, and the what part of this issue. So on the why, we will dive into why hunting in memory is important, at least from our perspective. I will leave some hints on that. Then on the how part of things, we will discuss on the how someone can go and hunt for this stuff in memory by looking at specific properties of the processes. And then on the what part of the agenda, we will discuss the tools. On this tool that we have created called Mem Hunter, we will discuss on the characteristics of the tool. And we will also talk about the current state of the tool and then the future. And we will wrap up everything with a demo, with two demos actually. Okay, about that. So, okay, did you want to? Hello, thank you for coming. I'm Carlos, he's Marcos. He is an InfoSeglover. He works in McAfee. He's a software architect. Sorry for my English. You're doing it great. Okay, we are beside Cordova Organizators. Okay, and I work in ARSEC. It's a startup of InfoSecurity, okay? Okay, yeah, thank you. Thank you, Carlos. So why hunting in memory? So, a couple of things here. So why hunting in memory these days, I mean hunting in memory is an important because of the shift that we haven't seen on the threat landscape. So the threat landscape has evolved over the last few years. Mainly, the attackers have mainly started to adopt new techniques, to adopt new things to evade the current detections. So they shifted their attacker trade craft from a purely failed base approach to a file-less base approach. So one friend or one aspect of this evolution is what we call the different vectors that they are using for that. So one of these vectors is what we call the process manipulation. So as part of the process manipulation, there are several things that attackers do in order to evade the current defenses. One of those manipulations are what is called the code injection, right? There is another type of process manipulation called defensivation. So we will touch on that during the presentation. What I wanted to mention here is that mainly because of this trend is what people work on the blue side of the house up to come up with the new ways to detect this stuff. And another thing that which is actually quite important is the fact that in the past these techniques, especially the code injection techniques, they used to be something that was only available for these big sponsor APT groups, mostly national state groups. And they know how to take advantage of this just to avoid being detected and being spotted on their intrusions. But nowadays that is not actually the case.  I mean, anyone can go to GitHub, for example, and grab the latest and greatest code injection and include it on their code. So accessing to these techniques are available to anyone right now. So that's why we need to start thinking and including ways to take this stuff on memory. So going back to the file list state that I just mentioned. So there are, I really like this diagram that was taken from a sans white paper. So the idea here is that from the diagram you can see where code injection came into play on the file list attack scenario. So you see that code injection is used as part of, I mean it's mostly used, these series of techniques are mostly used as stages on a stages attack. So, for example, in this scenario where we got a remote code execution attack where someone is executing or getting execution on our end point. An example of this is the WannaCry example, for example, where we have the SMB vulnerable driver and then by exploiting that vulnerability someone can get a code to execute the end point. And then they will most likely use, they will mostly trigger the second stage of that attack by injecting their malicious payload into the memory, the user's memory of a running process, a system process, most likely. So in the case of WannaCry, for example, they use a technique called QU user APC which allows them to execute code, to inject code into the context of ELSAs from a kernel space. So in that case, code injection was used as a second stage of an attack. And the most common attacks that we are seeing nowadays, which are mostly driven by download, we see that code injection is used as a second stage of the attack. So the attacker gain code execution through a Word document, for example, just by having the user to open a document with a macro. Then the macro will exercise some Win32 APIs and then the injection will happen and the attacker will be able to run code in the context of a different process. So that's where code injection is actually a thing nowadays. So yeah, so we know what these techniques are. We know how to catch them, actually. But why is that difficult to hunt for this stuff at scale? So the problem comes on the tools and frameworks that we have to hunt for this stuff.  You either go and buy an expensive EDR product that supports these techniques. There are several EDR products out there that either does a member inspection, which is the same thing that I'm doing with this tool, or a memory scanner. And they do, you know, a pattern matching on the memory of the different processes to look for IOCs and see if there is an injection going on. So you either have to go and do that, or you get the volatility and you get a full memory dump of the machine that you want to analyze and take that full memory dump into the volatility framework and run the different scanners that volatility have in order to detect for this stuff on that dump. The problem with that approach is that it doesn't scale. I mean, if you had to do that, you have to go to the machine that you think might contain some of something living in memory. You have to dump, you have to get a full memory dump of that machine. You have to graph that memory dump into a forensic environment and then analyze the stuff in there. The problem with that is that you cannot do that scale. You cannot do that every day on your organization, on any machine in your organization. So mainly because of that, we created this tool called Mem Hunter. So what Mem Hunter will do, so I'm just giving a brief spoiler because we are seeing that in detail in a moment. But what Mem Hunter will do is that it will perform what is called a memory inspection on every process on the endpoint and it will apply the same type of heuristics and an extra couple of more that detects for this stuff in memory and it will report that back to you. So through that, you can run this periodically either as a service or on demand and get the results of your entire organization at scale. So OK, so we just talked about the why. So now we will talk a bit about how we can hand for this stuff in memory. So on the how part, we will mention a bit. Sorry, we will do a quick overview on what the process manipulation is, what the properties of a process are affected by a process manipulation and a code injection techniques. And then we will also describe, we will also give you a few details on how a process is created on the Windows environment. So talking about the process manipulation. So process manipulation for me is an umbrella term that can be used for any type of technique used to compromise a legitimate process and have it to execute the malicious code. So you can do that either by performing a code injection through memory allocation or memory writing. You can do that by getting and forcing the process to execute something. Or you can do that through a mechanism that are available in the Windows environment to force a DLL to be loaded during the process start. So going into the Win32 process internals, the thing that I wanted you to take from here, I mean, we can spend hours talking about this. But the most important things for this talk is the fact that the Windows kernel is the one in charge of allocating the, I mean, when a process is started, the Windows kernel is the one in charge of creating what is called a E-process object that will take care of the different areas that that process container will have. Among those areas, there will be memories areas designated for the different threads that will run within that process. So every thread, which are, by the way, the ones that will be running code, I mean, the process itself is not running in code, it's just a thread, the ones that are running the code. So there will be a call stack designated for every thread. There will be also an area within the process internal called PEV, which is a process environment block that will contain information on the common line used for the process, some information about the properties of the image file. Yeah, and a couple of other things that we'll mention in a second. Then there will be areas that will hold information regarding the dynamic libraries that the process will load. Within those dynamic libraries, I wanted to mention that every library loaded within the Windows process will have, will follow what is called a PE format, which is a format described by Microsoft to load stuff in memory. So that is going to be important for one of the things that will be discussed in a second. So just to wrap up a couple of things that I just mentioned. So the process properties, the thread properties and the memory properties are the things that define the normal or standard behavior of a process. So, okay, so why am I mentioning this and why I put in so emphasis on this? It's because of the fact that we will use that as a way to detect anomalies in either the process properties, the thread properties, or the memory properties to, and we will use that to hunt for stuff in memory. So I'm giving three examples here as a bit of a spoiler. We will discuss this in a bit more detail in a second, but the idea is that, for example, as I mentioned, every piece of code that you run on a process have to run in a thread. So you can, you will expect, I mean, in a normal scenario that that thread will have to run from code that is actually backed by a file on disk.  Those threads have to run from code that they will be, that will be part of the main module, the main executable, or they will be part of a DLL within the, that was loaded by the process, right? So there might be scenarios where the process is not running, sorry, that the thread is not running from a code that is backed on disk. And those scenarios are mostly, not 100% of the cases, but are mostly caused by these side effects and the artifacts left by these code injection techniques. So whenever we found a thread whose start address is running from memory that is not backed by disk, we might say, okay, you know, this heuristic, because we call that heuristic, the heuristic might be telling us that there might be something suspicious on that thread that might require further attention. And that's what the tool will actually report. So the tool will basically flag those processes with anomalies for thread hunters to go and look in detail. Another potentially, another anomaly that we might end up using is the memory permissions for the base address of the threads. So the threads are supposed to be from memory regions that are marked as read execute, but there are code injections that left those memory regions marked as a read write execute. So that will cause one of our heuristics to fire, basically. Then in terms of memory properties, we can also look for, as I mentioned, memory regions with read write execute permissions. We can also look for all allocations. So whenever you allocate a piece of, allocate and commit a piece of virtual memory within the context of a process, there will be two metadata fields within that memory regions that will indicate the state of those, sorry, the protection, the state of that memory region, I mean, is that memory region is read write execute region or something else? So there are cases that techniques initially allocates the memory region with read write execute, and then called a Win32 API called virtual protect to move those memory regions back to read execute so it can look legit. But there is a flag within those memory regions to make that data that will still contain the initial allocation value. So by looking into the mismatch between those values is a way to determine if there have been a potential code injection in place. Then in terms of memory content, there are a couple of things that we can do here. I mean, one thing is just go and do, you know, the regular dam IOC match, which is effective but is very costly in terms of performance. So there are EDR vendors that, you know, have modules that are specialized on doing this. They are mostly running drivers that scan the memory of the process and looking for specific patterns and flag, you know, a threat event whenever something malicious is found. In our case, we were not able to do that. Again, mainly because of performance reason, my monitor is just a user space application. So we cannot afford, you know, just going and scanning the memory of the entire memory base of a process. So mainly because of that, what we are doing is something called the virtual query walk. So what basically we're doing is that we are walking the different memory regions of every process. And then in some cases, we are looking for, you know, just a few first bytes within those memory regions, looking for, you know, signs of a P file within that region, like looking for the MC header within those first few bytes. Or we look for, you know, associated strings left by attacker thread graph. But again, this is optimized just to look for a specific stuff and not for entire content of the memory region. Okay, so having said that, we will jump into two examples of both code injection and defensivation approaches. These examples are actually not quite new. They are being in the field for quite some time now. The first one is reflective DLL injection. So reflective DLL injection is a technique that got popularized a few, a couple of years back. It was created and released by a guy from Germany called Stephen Feuer. What this technique was to, I mean, the purpose of this technique was to allow mostly the people interested on this kind of approach to allow code in the context of a remote process just by using a DLL. So the idea is that you get the reflective DLL framework, you create the DLL, you include part of that framework within your code, compile your DLL, and then the result of that compilation is something that you can embed into your attacking process, or something that you can read from the file system if that is what you wanted to do. But the idea is that once you get that blow of data into the context of the attacking process, you will write that app into the victim process. Actually, sorry, you will allocate first, you know, read, write, execute a big chunk of memory in the context of a remote process, then you will write that down into the context of a remote process, and then you will spawn a thread, a new thread that will run out of that floating read, write, execute code. One of the biggest or the most well-known consumers of these techniques was Metesploy with this Meta interpreter payload. So initially, they used these to move the payload around processes using this technique to go in a pure file-less way. Nowadays, I think that they are using it as a kind of a fallback. I think that they start with a different technique, the Q-User APC one, and then use this as a fallback in case that the previous one fails. But yeah, but the important thing here is that the anomalies that these techniques will introduce within the context of the process is that after the techniques execute, you will run a new thread running from a floating code, right? So there will be a new thread that was not there before, and the base address of that thread will be a code memory region, mark as read, write, execute, which is not backed by a model on disk. Then if you look into the call stack of that thread, there will be stock frames that will, again, will be not backed by a symbol on one of the models on disk. And that basically means that, I mean, for this particular technique, that basically means that that thread was created out of shell code, that in the case of these techniques was used to bootstrap the malicious payload that you are using. So basically, the techniques simplifies that bootstrapping for you, so you are putting your regular DLL code, and the bootstrapping shell code will take care of mapping sections, resolving import, fixing up relocations, and a couple of extra things. But the idea is that after the execution happens, these three anomalies can be seen, I mean, we will be able to see these three anomalies in the process. Okay, so now jumping into a defense evasion example, the process Halloween one. So the idea here is that you want to evade, you know, the available endpoint protection stack, so you want to evade the AVs and the EDR, most likely on the endpoint. You want to, your malicious process to look as legit for these solutions, and yeah, and you want to use a legit process as a container for your malicious code. And this technique works by again, using legal Win32 APIs. So the idea is that you create a process in suspended state. Then you get the, I mean, when a process is created in suspended state, that process will not be assigned with any, you know, time, in the scaling time in the kernel, it will be just, you know, freeze, with just one single thread that will be also freeze, so nothing will happen. Then once you, the process is created in suspended state, you can get the execution context of that thread from the execution context and by also walking, you know, the memory of that process. You can, with those two inputs, you can determine which is the main module of that thread. And then you can call this API called NT and map view of section, which will end up unmapping, you know, the main module from the process. And then there are a couple of things that you can do at that point in time. There are more evasive ways of writing your malicious payload into that process. In this case, and just for simplification, I just mentioned that one of the possibilities that the attacker can do, can follow, is that they can call virtual.doc, again allocating a big chunk of read write execute memory. They can write, you know, the payload into that memory, and then they can redirect the execution context of the thread that is posed to this new memory region, and then they can resume the thread. So that will force the malicious, the host the process to run your code, but at the same time as no other thing has been modified, and the process just, we just force the victim process to run a different module. The process for the operating system and for EDR solutions, the process will look like, will look as legit. So the PV, yeah, most of the stuff on the process will not be touched. Yeah, so we will see that in a moment too. So in terms of anomalies, and in terms of ways to take this stuff, so most likely the best heuristic to take something like this will be to check for the P header fields of the main module on memory versus the P header fields of the counterpart on disk. So by checking that, you can detect if there is a mismatch, which should never happen, and if there is a mismatch, we can report that as something suspicious. So yeah. Okay, so we just talked about those two examples. We will just talk about the process properties and how we can detect stuff. We will now jump into the what part of the talk, which is around how to perform this at scale as part of our threat hunting process. And this is where we are introducing Mem Hunter. So this is a tool that we, I probably mentioned this already, but anyways, this is a tool that we started some time ago. And again, it was a way for us to explore on these techniques and ways to explore these capabilities. So Mem Hunter. Mem Hunter is a tool that deployed itself as a standalone binary. It will, once the tool is running, it will perform a series of inspection heuristics, which are the anomalies thing that I was just mentioning. So, and then whenever there is a finding, the tool will report that to the user. So the idea is that you have all these, this is the architecture of the tool, the idea is that you have all these different heuristics in the abstracted in this concept called Hunter Modules. So every Hunter is specialized of one specific heuristics. And then along with the Hunter, there is a part of a company in the tool in charge of doing the process context enumeration. There is a part of the tool in charge of doing the orchestration of the Hunters. And there is a part of the tool in charge of forgetting the forensic data. And something that I didn't quite mention is the fact that the tool can run either as a standalone service, which is mainly a way for the tool to get the Hunters to be driven by events. So we are using ETW to determine when the Hunters should be triggered. So for example, we are listening for kernel providers from ETW kernel providers to determine if there is a process got created, if a thread got created, if an image was load. So those kinds of things will draw, you know, some Hunters to run on the context of a process. So that's the real-time eventing way. And then you also have the point in time of standalone execution analysis, which is a thing that we are going to demo. So the idea here is that you get the tool, you get the binary of the tool, you run it with admin privilege and the tool will perform the process enumeration and it will perform, it will apply the heuristics over every process on the endpoint. Okay, so currently the tool support nine Hunter heuristics. So we will see that in the next slide. Along with the tool, I have also created as a way to exercise the different Hunter heuristics. I created this tool, separate tool called MInjector, which is basically a test tool, which have 15 code injection techniques. I'm probably going to include the new injection framework to add a couple of extra techniques. So there was a great talk yesterday on code injection in general, which they released a framework, which I can't remember the name, to be honest, sorry. But yeah, but anyways, that framework is great. I will start to use it. And then the tool will also generate some even logs. And it also supports some baseline, some exclusion, because as I mentioned, the tool will not give you data on which malware, which attacker tradecraft is running on the endpoint. It will just give you a hint that there is something suspicious on the endpoint. So you have to go and find yourself, you know what is going on. And that also means that the tool might end up reporting false positives. So for the false positive scenario, you have to have a way to exclude some processes. The processes that most likely are going to cause false positives are the process that use these techniques for legit purposes. Example of that is the .NET processes, the managed processes, which compile things on the fly. And the JIT compilers, there are also products from security vendors that use code injection as a way to hook into stuff, to monitor behavior and so on. So there might be some false positives. You have a exclusion way to baseline your environment. Okay, talking about the hunters. We have nine hunters, so we are running out of time for demo, so I will go really quick on this one. So the first one is a suspicious threat. It will look for the base star address and it will check for read write execution flag. Suspicious call stack, will look for symbols that are not backed. Suspicious memory regions, it will check for the first few bytes to look for signs of P models that was loaded or that currently being loaded and used. Suspicious base address is something that indicates that the main model is running from private commit and marked as read write execute memory regions. Suspicious pair is the thing that I just mentioned. Suspicious models, models associated with read write execute memory regions. Suspicious hollow models is a cross check between the P header field from the memory versus the counterpart on disk. Register persistent is just to look for stuff like this functionality from Windows to force a DLL to load into a remote process. And the last one, suspicious shellcode, is mainly to look for the well-known products from 86 and 864 shellcodes. So there are a good amount of shellcodes that start with the same set of opcodes. And this is something that I'm developing right now. So this is some evasions that have started to appear. I think it was last year, between last year and the year before the last one.  So the way to do that is to, again, to cross check information from the OS with the current things on the PAB. Okay, this is the eventing information and this will be later available for reference. The set of information, forensic information that the tool reports. And after that, we will jump into the demo. Okay, so Carlos here will help me with the demo. Thank you Carlos. Okay, so the idea, the idea, yeah, the idea is that we will look first at the, you know, the expected behavior of a process. So Carlos will open a notepad. Are you able to see? Yeah, so he will open notepad with a process hacker, which is a really convenient tool to look for, you know, the details and the property of a process. And within notepad, he will check for the running threads of the processes of that process. It will check for the call stack of those threads and he will also check for the memory regions currently located just to allow you to see that there are no memory regions with read write execute permissions. And after that, we will exercise the reflective DLL injection, the technique that we just mentioned. And we will come back again to the tool, to the process hacker tool. We will look for the anomalies and then we will run Mem Hunter to see the thing that reports. Okay, just a second guys. Okay, we'll switch computers. Okay, just a second. So we will use a Win10 RS4 machine for this testing. Okay, just one more second. There you go. Okay, so we have our environment over here. We will, as I mentioned, we will run notepad first. Then we will go and process hacker, we will check for the properties of notepad. We see that there are a bunch of threads running because of Windows. But the important thing is that there is this thread running out of the main executable image from notepad. If we open that thread, we can see the call stack. And the call stack, you see that all the symbols in the call stack are mapped to a file on disk, right? And then if we go and check the memory, we will see that there are, I mean, no memory region with read, write, execute. There are only read, either read, read, execute, or read, write. And there is also memory regions with copy and write, which is the thing that Microsoft used for his copy and write capabilities. Okay, so let's go ahead and execute an attack against notepad. So it's notepad is process six zero to zero. So we will, we will run this tool. So this is an M-injector tool, supports 15 techniques. I'm going to add a couple of more after DEF CON. So if we run the technique number five, which is reflective DLL injection, and then we ask the tool to run a payload that is part of the M-injector project called reflective payload. And then we target the PID of notepad, which is six zero, six zero to zero. And we run this, we'll get that this popup coming from notepad that indicates there is now code that was injected and this running out of notepad. And then if we go back to the project, so the process, sorry, and check on the threads area, we will see now that there is a new thread RTL use that I started, that supposed to start, that showing to start from RTL user thread start. And if we check on the call stack of that thread, we will see that there is now two symbols that are not backed by anything on this process hacker just showing the memory addresses of those symbols. And then on the memory area, we can check that there will be a read write, execute allocation that will contain the malicious payload, which is this private commit allocation. If we open the location, we will see the P header signs in here. Okay, so now if we run mem hunter, so let's go ahead and run mem hunter. So mem hunter, this is the output that you get from mem hunter, so we will apply a specific heuristic to mem hunter. The one that we're interested in is the suspicious thread. You don't have to apply any heuristic when you run this. In this case, we're just doing it for the sake of time. And then we will ask mem hunter to be verbose on his output. So mem hunter will run a bit, it will again enumerate the process, it will perform the virtual query walk on all the processes. And after that, it will report that there is something suspicious on nopad.dxc on this specific thread ID. And these are the details of that memory region. Okay, so that's demo number one. I don't know if that's the right word, I don't know. Okay, demo number two, again, is the defensivation example that we just mentioned. Demo number two, we are launching, let's close this nopad instance and we will use also nopad as a target, as a hosting process for our attack. So we are running technique number seven, which is process Halloween. We are pointing a M injector to use another payload, oh, sorry, another payload, which is in this case, is MSX payload, there you go. And then the target is going to be nopad again. Yeah, there you go. So the technique just executed, so we just hollow out the main memory of nopad. So if we check on nopad, the process looks pretty legit, looks as a sign process for Microsoft. It contains some threads, the thread contains a potentially valid coca-cola stack. I mean, there are no issues from a simple site. So we'll run mem hunter, but this time, we will use a different heuristic, a heuristic number four, that will perform the cross check between the P header field from the things on memory versus something on disk, on all the processes running on the endpoint, and there will be a mismatch on nopad.exe because of process Halloween. So mem hunter will flag that out. Okay, so that's it. Thank you very much for being here, for attending our call. There are some stickers about the tool on the tables. Yeah, thank you very much.


In sports news, the Nigeria Football Supporters Club has picked Senator Anthony Adefuie as the national patron of its club to lead, advise and support the association. This honour came at the backdrop of Senator Adefuie's contribution to the development of grassroot sports in Nigeria. The ceremony of this recognition which took place in Lagos had the supporters and loved ones of Senator Adefuie around. Our correspondent Paul George was there. It was a colourful moment as the Nigeria Football Supporters Club played their musical instruments, sang and danced to celebrate the acceptance of one of Nigeria's elder state men, Senator Anthony Adefuie as the club's grand patron. Adonning the Nigeria's national team's green and white regalia, a face, cap and muffler around his neck, Senator Adefuie appreciated the club's national chairman for the recognition. The Olugbo of Lagos excitedly shared his experience as a football fan. I'm happy that it's a means of recognition by the youth, by everybody, that we will always be there for them. Senator Adefuie, who is also a member of Lagos State Governor's Advisory Council, while recounting his time when he represented the country as an athlete, used the opportunity to advise the handlers of Nigeria's football to always hire a grade A coach if the country must get back to winning ways. When I was young, the only game I wasn't doing very well is football. I was doing better in sprinting, but I represented Nigeria in Kungu Brazzaville, running 880, 440. I also represented Nigeria in swimming. We used to have all those claimants, west route, west route, and so on and so forth. We won all our matches. The old world recognized us, if the coach is not right, forget it, bring all our international players back. They won't win any. The national chairman, Nigeria Football Supporters Club Reverend Dr. Sam Ikeya, praised the Olugbo of Lagos. He appreciates him for his unwavering support of sport. He, however, expressed confidence that the Super Eagles of Nigeria will lift the trophy at the African Cup of Nations with the association's support. We must have to follow your, I mean, our precedent, your profile, and to see what you have contributed as far as the nation is concerned. You don't follow somebody that cannot deliver. We have this confidence that with us behind them that come to the Nations Cup. No matter what the disappointment you have received so far, you know that is Nigeria's style. When we get to the Nations Cup, it will be a different ball game. I cannot assure you that Nigeria will not be disappointed that our darling Super Eagles and with the support of the Nigeria Football Supporters Club will perform and deliver. As the Super Eagles begin their quest in this year's Afghan, millions of Nigerians both home and abroad are hopeful for victory. Paul George, Plus TV News. Until you get notified about fresh news updates.


The Senate has passed the $2.17 trillion 20-23 supplementary appropriation bill recently sent to aid by President Borla Tinibu. The passage followed the adoption of the report of the harmonized seatings of both chambers of the bill as submitted by the Chairman of the Senate Committee on Appropriations, Senator Solomon Adiola. The key component of the budget includes $210 billion for wage award for civil servants, $105 billion for national security and defence, $300 billion for maintenance of bridges, especially the Co-bridge, and $400 billion for cash transfer to vulnerable households, $200 billion on narrower that will proceed in agricultural, labor, and equipment, and $10 billion for independent national electoral commission to conduct off-season elections. Recommendation. The Appropriation Committee considered the details provision of the bill and the impute received from the aid of benefitting MDAs as well as the leadership of the Correspondents of Committee in the Senate and recommend as follows. The authorisation of the issuance from the Consolidated Revenue Fund of the Federation, the aggregate sum of $2 trillion, $176 billion, $791,286.003. The Senate President Gutswill and Papua announced the approval of the supplementary budget after the majority of the Senate supported it through a voice vote. The Senate colleagues, a bill for an act to authorize the issuance from the Consolidated Revenue Fund of the Federation, of the total sum of $2 trillion, $176 billion, $791,286.003. Hello, hope you enjoyed the news, please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


What's up guys, today we're back with another epic video. Today we're opening a Prismatic God Box. These are from Japan. They're really incredible products. Rhyme Style's opened a couple of them and they look really cool. So I decided I'd buy one thanks to his peer pressure. So it's all his fault if we don't get anything good. But before that, the giveaway. I'll be giving away some God cards since we're gonna open up this box. Let's go ahead and hop into it. My camera is low on battery. So at least my face cam. So we're not trying to run out of battery here. So let's go ahead and cut this out and let's open it up real quick. Okay, there we go. I think that's like the whole seal. Is that little flap? So let's open it up. I think it tells you right away which God card you get. So we're about to see obelisk. Okay, that's cool. Obelisk is a really good one. And these are, as it says, Prismatic God Box.  Wow, look at this guys. It says, oh Yu-Gi-Oh. Yu-Gi-Oh. Okay, there's Yu-Gi-Oh. Wow, this looks really cool. So let's open this up in our tiny space. Oh my goodness, here we go. This is super heavy. What's in here? They give you not only these packs in this beautiful Prismatic Obelisk Detour Miner. I mean, that's already amazing.  And they actually give you screw downs. A screw down. So that is really super cool. I guess that's so you can put your God Card in there. Or like other card, obviously. Then they give you these absolutely amazing sleeves. Just look at those. Wow, those are incredible. And they give you some other cool sleeves. So that is some really cool accessories that come with this. And not only that, you get the actual God Card with the packs. So let's see if we can get this out of here without damaging anything. So let's go like that. All right, the special packs. We're gonna open this up because we're gonna grade it. So we're gonna go ahead and open it up. Probably keeping it sealed would not be a bad idea either. These boxes are actually kind of expensive for being like brand new. They just came out recently. Oh gosh. Okay. That was kind of violent. They just came out recently, but these boxes, I think I paid $500 with three of them total after shipping and stuff. So that was pretty expensive. They were less when they first came out, but then they kind of got bought out. Check that out. Ryan told me to buy them originally and I just didn't do it. And then I had to pay more because I didn't. So yeah, it was just kind of my fault, but that is a beautiful obelisk. The Tormentor, we now have five packs. I think you get an ultimate rare in all of them. And Rhymeside was saying that they might be mapped and he thinks they probably are, but we're gonna open them and see. I can't remember. I can't remember which one you can get an obelisk. I think it's either the Sphere mode or the Dark Magician. I can't remember if it, okay, there's the parallel rarity. It's either Wing Dragon of Frost Sphere mode or the, what am I saying, Dark Magician. Okay, that's cool, Blue Eyes 2. And it's the, they have the DB1 art for both Blue Eyes and Dark Magician. There's the Exchange of the Spirit, I think. And an obelisk. An obelisk, some sort of support card or something. Okay, next pack. So I think, I don't think there's any order. I think it's just random where the ultimate rare comes from. I can't remember all the rarities in here, but there's some cool stuff. So obviously you got the parallel rarity with the relinquish, that's pretty cool. That's definitely a good one. I don't know what that is. I'm not sure what that is. Or that. That's a, is that Neutron Blast? I don't know. Oh no, is this it? This is the obelisk support card. I think I saw Ryan get this one. So that is not what we're looking for. It is, okay, so look at these. These are ultimate rears. Look how, wow, those look amazing. Look how the light shines off them compared to this. Like, look at this. This one, it's like, eh. This one is like, you can straight up see the light. Like a beam. That is really cool. Okay, so I guess that's our ultimate rare. We're about to find out what else you can get. Obelisk the Tormenter, that's amazing. All right, next pack. Oh my gosh. This is, these packs are like weirdo. Well, you're probably supposed to open them the other way, but oh well. Ooh, Necroface, I know that one. I wonder if any of these cards are worth anything. Do you guys know these non-ultimate rears? What are these called? Millennium rears? There's our Relinquished Fusion. And some sort of Slyther card. That's cool, but I don't know what it is. Some sort of Slyther support card. Wait, okay, is there another way to open this? Yeah, there we go, that's how you do this. Open it like a nub. That's how I like to do it. Open it like a nub. All right. Oh no. These are violent if you don't open them the way they want you to. All right, that's Exodia incarnate or something like that, D-Fusion. Oh, I played with this. This is a Dark Magician card. I played with it yesterday actually. I was playing cards, guys. You would not believe it. Gold Star Copicus. Ooh, that's sweet. That's like an ultra rare, parallel rare or something. Blue Eyes? That's cool. And Final Pack. Oh no. See that? I pull it and then it just doesn't rip. Oh my goodness. Here we go again. Here we go again. Blast out by a tribute. Some sort of Silent Magician card. I can't remember what that's called. A two-yard Magician girl. And, ooh, ultra rare. That's a, that is the, what is he called? The Dragon Master Knight of some sort. But we got all spell cards in this one. So that's kind of not cool. We got to open another one. Next box. Let's try and get something better this time. We got like all spell cards. So spell cards are cool, but we're trying to get a cool monster. Besides our obelisk, we didn't really get anything crazy. Where did we put our obelisk by the, oh, he's under the box. What is this? Oh gosh. We put him under the box. That is not good. Another obelisk. Okay, so we got another obelisk. Let's take this out. We've got another obelisk. I'm probably gonna take him out and grade him as well, but for now we'll put him right there. Let's go with the packs. Let's see if we can open these the correct way, first of all, and then can we pull something good? There we go. That is how you open this pack. Ooh, monster-y born. I love that. There's so many monster-y born friends. That is some sort of Thousand Eyes card. The Silent Magician, Exodia. Is that our ultimate rare? No! Okay, we're about to have to open all three of these.  Come on, spell card. Okay, I'm getting frustrated here. We need something amazing. It looks so good too. It looks so good, but we're not pulling the big boys. I was hoping for, I guess it was Dark Magician or Sphere Mode, I don't know. If they're actually map, which I think they are. It seems like they are. Diffusion. Ooh, that's cool. This is called Raw the Immortal Phoenix or something like that. It's a good one. Raw the Immortal Phoenix. That is an ultra rare though, not an ultimate rare. So I don't know, can you get all the Ultras in Ultimate, how this works? So that would be a cool ultimate. Oh gosh. This is not good. There we go. There we go. This would be a cool Thousand Eyes to play in your Go Deck. You know, it's just a super rare, but maybe different. Here we go, come on. Ooh, Blue Eyes Ultimate. You can get this one as an ultimate rare. Rhyme Style got it in one of his boxes. That would be a really great one. That's still really cool as an ultra rare. Two more packs, two more packs. We gotta get something good. We gotta get something good. The Relinquish, Toon Table of Contents. Some really good cards in here. Oh, Blue Eyes Toon Dragon. The Sark. Oh, oh wait. Why does this look different? Is it just because it's an ultra rare, it's like more prominent? Wow, that looks really good. That Slyphur card looks really good. That's pretty awesome. All right, last pack. We do have one more box. I think we're about to open it after this. Hopefully it's not a novelist. Cause we already have two. Maybe Rhyme will trade one with me. Silent Magician, there's his card. Come on. There's the one we pulled in Collector Rare. So okay. Or not Collector Rare, Ultimate Rare. That's cool. All right, we're doing another box. Our final chance. Can we at least get a different promo? That is our goal. Not be an obelisk and then can we get a nice ultimate rare? That's the way to end this video. These were expensive, so can we get something good, please? Come on. All obelisks, are you kidding me? Unbelievable. All obelisk boxes. Can we at least get a good ultimate rare? Please. At least obelisk is my favorite God card. So that's a plus. But now we're gonna have to figure out to try to trade for one or something. Cause I don't really want to spend 500 more dollars to be on a Silent Swordsman. Hell Palmer. That's some Dart Magician card. Oh, thank goodness. I thought that was it. I was like, no, please, no. That's just an ultra rare. Okay, come on, come on. Come on. By the way, our 50K special will be coming up either tomorrow or the next day, I think. If everything goes according to plan. So make sure you guys subscribe and also join the membership if you guys want some exclusive content or to be in the Discord. There we go. Okay. That's our ultimate. We got the, what's he called? Raw the Immortal Phoenix or something? That's actually pretty good. I'm happy with that. It's a monster. It looks really good. I can handle this one. That's pretty good. That is pretty good. I will take that. Unfortunately, we got all obelisks and not the best alternate rares, but I will take that last one. That's pretty good. Pretty good card. Now let's see what we can finish off with. Since we know we don't have an ultimate, let's kind of go like this. Ooh, another one of these. This would be kind of a cool ultimate if it was just a monster. It would be a lot better. The blue eyes looks a little bit weird though. Like, I don't know. It kind of looks strange in that. I don't know what to deal with it. More than this. Oh yeah. Let me know if any of you guys have opened any of these. They're kind of hard to get now. I mean, even right after release, people are buying them like crazy. Okay, that's, I don't know what that is. Ooh. A lot of support cards in here. Not too many actual monsters, which is unfortunate. That's cool. Okay, last one. I'm glad we did get out Immortal Phoenix. That's cool. Or whatever you call it. Oh, we got a normal monster back there. What could it be? All right, last card. Help Palmer. This is our last chance at something epic. Here we go. Oh, sweet. See, this is the collector rare you can, you really won out of here. That's pretty cool. So I don't think they're, yeah, it looks like they have a certain number of cards in the packs for each one, but there's like a few different collector rares you can get. So you did get the Dark Magician Ultra Rare Collector's Rare. So that's pretty good, but it's not the actual Ultimate Rare. Then we got our three promos. Those are really cool, but all obelisk. That was not on purpose, by the way. We got some Ultra Rares. We got some cool stuff in there. So like any of these, I guess could be Ultimate Rare. And then these three Ultimate Rares. So we got the best one I think is this, just because it's a monster and it's raw. That's pretty cool. This guy looks cool, but he's a spell and just spells just for some reason aren't as cool sometimes unless they're like monster reborn. Something awesome. But oh well, that was not the best, but I would say it was still fun. If we pulled something huge, it would have been really cool, but maybe Brown Style will trade me at least one of his other God cards and hook me up because I have a million obelisk right now, but that was a lot of fun. I hope you guys enjoyed it. Make sure you guys liked the video if you did. And that's it for today. I'll see you guys later. Peace. I'm a Metal Hero. Dark Brite. Boom.