In the name of the Father and of the Son and of the Holy Spirit, Praise be God, the Father of our Lord Jesus Christ, the Father of mercies and the God of all consolation. He comforts us in all our afflictions and thus enables us to comfort those who are in trouble with the same consolation we have received from Him. My dear brothers and sisters, we continue to remember our brother Andres Sarabia. Last night we celebrated his life with many stories. Today we celebrate this Mass which we offer for the eternal rest of our dear brother Andy and that God will console his family and friends. That more leaders will step up for our community of San Antonio to continue to serve as he did. And so for that reason we will now bless the body of Andy with the holy water which recalls his baptism of which St. Paul writes, All of us who were baptized into Christ Jesus were baptized into his death. By baptism into his death we were buried together with him so that justice Christ was raised from the dead by the glory of the Father.  For if we have been united with him by likeness to his death, so shall we be united with him by likeness to his resurrection. And now we invite the family members to come forward to place the funeral Paul over the body of Andy that he will be clothed with white, that he will be clothed with a reminder of his baptism. On the day of his baptism Andy put on Christ. On the day of Christ coming, may he be clothed with glory. The crucifix is placed over through Christ our Lord. Amen. Please be seated and now we will listen to our readings from the Word of God. And our first reading will be proclaimed by Maria Tijerina, Hops Metro Leader from our Lady of Guadalupe. A reading from the Book of Wisdom. The souls of the just are in the hand of God and no torment shall touch them. They seem in the view of the foolish to be dead and their passing away was thought an affliction and they're going forth from us utter destruction. But they are in peace for if before men indeed they be punished yet is their whole pool of immortality.  As gold in the furnace he proved them and as their sacrificial offerings he took them to himself. In the time of their visitation they shall shine and shall dart about as sparks through stubble. They shall judge nations and rule over peoples and the Lord shall be their king forever. Those who trust in him shall understand truth and the faithful shall abide with him in love because grace and mercy are with his holy ones and his care is with his elect. The word of the Lord. Thanks be to God for the Responsorial Psalm we invite Mike Sadavia and his grandson. Who is my shepherd? There is nothing I shall want. The Lord is my shepherd. There is nothing I shall want. The Lord is my shepherd. I shall not want. Inverted pastures he gives me repose. Beside restful waters he leads me. He refreshes my soul. The Lord is my shepherd. There is nothing I shall want. He guides me in right paths for his namesake. Even though I walk in the dark valley I fear no evil. For you are at my side.  The Lord is my shepherd. There is nothing I shall want. You spread the table before me in the side of my foes.  My cup overflows. The Lord is my shepherd. There is nothing I shall want. Only goodness and kindness follow me all the days of my life. And I shall dwell in the house of the Lord for years to come. The Lord is my shepherd. There is nothing I shall want. Please stand for the Holy Gospel. Be with you. A reading from the Holy Gospel according to Matthew.  And all the nations will be assembled before him. He will separate them one from another. The shepherd separates the sheep from the goats. He will place the sheep on his right and the goats on his left. Then the king will say to those on his right, come, you who are blessed by my Father. In Herod the kingdom prepared for you from the foundation of the world. For I was hungry and you gave me food. I was thirsty and you gave me drink. A stranger and you welcomed me. Naked and you clothed me. Ill and cared for me. In prison and you visited me. Then the righteous will answer him and say, when did we see you hungry and feed you or thirsty and give you drink? When did we see you a stranger and welcome you or naked and clothed you? When did we see you ill or in prison and visit you?  And he will say to those on his left, depart from me, you accursed. Into the eternal fire prepared for the devil and his angels. For I was hungry and you gave me no food. I was thirsty and you gave me no drink. A stranger and you gave me no welcome.  Ill and in prison and you did not care for me. Then they will answer and say, Lord, when did we see you hungry or thirsty or a stranger or naked or ill or in prison and not minister to your needs? He will answer them, amen, I say to you, whatever you did not do for one of these leased ones, you did not do for me. These will go off to eternal punishment, but the righteous to eternal life. The Gospel of the Lord. When did we see you? Please be seated. Before we begin, I would like to recognize and be, in behalf of the family, the priests that are here with us today, Father Will Waters, Father Juan Carlos Tejada, Father Bill Collins, and of course, Father Pat Seitz, the pastor here of Holy Family. Thank you for your graciousness. And I would be remiss if I did not recognize the presence of our Mayor, Mayor Ron Nirenberg. We thank you for honoring us with your presence. You know that Andy voted one of the last things he did from his deathbed. The picture is out there, it's gone viral. No excuses to not vote. He did it on his deathbed. Of course, condolences to the family of our brother, Andy, to his wife Linda, children Michael Paul Frank, Michael Ledesma, Christopher Ledesma, his brother Raul, sisters Olympia, Beatrice, numerous grandchildren, and great grandchildren to all of you, family, friends, alike. We are united in our grief for losing such a great man. My name is Father Michael DeGirolemy, a retired priest of the Archdiocese of San Antonio, and I remain a leader with COPS Metro. Last night at the Wake Service, something amazing happened right here. We experienced a grace field filled evening of reunion, prayer, and profound remembrance guided by various speakers. Every one of you was awesome. I couldn't sleep last night remembering what had happened from the touching stories by children and grandchildren to remembrances of working for justice alongside Andy by organizers and COPS Metro leaders. We heard and we were touched by Andy's compassion for the sick and those who suffered the loss of a loved one. He'd always go to his funerals. He'd always there. He was a mentor to many of us, myself included, sharing generously his wisdom and I want to say his wit. Oh my God, was this guy witty. Who can forget the great jokes? A few were off color, but that was all right. I loved it for that. The laughter, the twinkle in his eye. Oh my God, engage with Andy Saravia. Wow. Talk about encuentro, talk about an encounter. Today my task is to connect us all with the spiritual side of Andy Saravia that motivated him to dedicate his life to the service of the poor and vulnerable by his study, his reading, but more importantly with his work with COPS in the formative years and later with COPS Metro, which by the way is still going 45 years later. You better believe it. We will never attend the funeral of COPS Metro. It's not going to happen over our dead bodies. I don't know what made me say that. You'll get your chance later, Mr. Cortez, please. When I was informed by Andy's wife Linda that Andy wanted to receive the sacrament of the sick, of course I was honored to be called. He wanted to receive the anointing with the holy oil. He knew the inn was nearing. I approached his bedside both as his priest and his co-worker with COPS Metro and all social causes. And also as his friend of 45 years, I've known him that long. Andy was a man of deep faith in God, the church and in humanity. Andy being the authentic human person he always was knew he was soon to meet his creator and sought to make his peace with the Lord. Relationships were always important to Andy and is there any more important relationship than our relationship to our maker, to our creator, with God, higher power, whatever you want to call him? There is something, someone greater than each one of us. And Andy knew that. He was never proud or haughty. In my view, Andy received the holy oils with great reverence and belief in God's compassion and forgiveness. Yes, he wanted forgiveness. He was honest enough to admit that we all have failings. Andy had failings. He wanted to make peace with God and I believe he did. Then Andy along with Linda and B. Cortez at that time and myself, then we began to tell the stories and oh my God, his mind was sharp as ever remembering some of the earliest actions. But we also felt the grace of God and relief that comes from an encounter with a mystery that is the presence of God. God was in that room with us. I truly believe that. All of us felt that Andy was also relieved by that sacrament. Of course I told him his sins were forgiven also by the sacrament. He got a two for one special with that sacrament. He appreciated hearing that. Now Andy took seriously the social teachings of the Catholic Church and oh by the way it's the best kept secret in the Catholic Church. CST, Catholic Social Teachings. You won't hear it preached very often in our Catholic parishes but it's there. It's part of the official teaching of the Catholic Church and that's why Bishops and even the Pope has blessed the efforts of Cops Metro. Remember the famous picture of Pope Archbishop Flores bringing to Pope Paul the Cops button and him blessing it? You all hear that? You tell that to your conservative Catholic friends and Pope Francis is with us too. I know I have no doubt in my mind and Sister Pearl can tell you more about that later. She's got an end with him. The family selected the Gospel read today. Get serious again. What a serious Gospel that is. The story of the last judgment that Andy has already faced and one day each of us will face. We will be judged on the last day on how we treated the least and the most vulnerable among us. Matthew 25, read it. Look it up. Take it to heart. I know Andy did. When I was hungry you gave me food. You know the rest. Andy embraced also what the Industrial Areas Foundation always taught that the use of power for the benefit of the disenfranchise and the powerless is a virtue. It's a godly act. I say that Andy was as Catholic as Pope Francis is by teaching and living his faith by loving his neighbor. I know he loved God but he did the other part especially well and especially visually to all of us to see. He loved his neighbor and you can't say you love God and not love your neighbor. Andy at one time was officially part of the Archdiocese of San Antonio as the diocesan director of the Catholic Campaign for Human Development. The annual collection that the bishops take up on programs for social justice. He recommended funding for social justice projects throughout the Archdiocese. We can say beyond a doubt that Andy Sadavia put into practice every day the Catholic faith that formed him and guided him throughout his life. He didn't talk religion or theology as much as Ernie Cortez but he did talk a lot about what he read and his faith. I think he liked priests most of us, not all. Only the ones that are here.  I'd like to turn those words back to Andy who tirelessly worked in the trenches among God's people and yes he smelled like the sheep because he got in there he rolled up his sleeves he showed people around he showed the drainage projects made to smell like the sheep. I was recently quoted in the newspaper that throughout his life Andy Sadavia worked for the poor and vulnerable and then I added that's what punched his ticket into heaven. I believe that. I'd like to conclude with the traditional prayer of the church for the deceased that made the soul of our brother Andy and made the souls of all the faithful departed through the mercy of God may he rest in peace. This is the right hand of the Father where he is perceived or he turns confident that God hears the voices of those who trust in the Lord we join our prayers to him. In baptism Andy received the light of Christ scatter the darkness now and leave him over the waters of death we pray to the Lord Lord hear our prayer our brother Andy was nourished at the table of the Savior welcome him into the halls of the heavenly banquet we pray to the Lord Lord hear our prayer many friends and members of our friend families have gone before us and await the kingdom grant them an everlasting home with your son we pray to the Lord Lord hear our prayer many people die by violence war and famine each day show your mercy to those who suffer so unjustly these sins against your love and gather them to the eternal kingdom of peace we pray to the Lord Lord hear our prayer those who trusted in the Lord now sleep in the Lord give refreshment rest and peace to all whose faith is known to you alone we pray to the Lord Lord hear our prayer the family and friends of Andy seek comfort and consolation heal their pain and dispel the darkness and doubt that come from grief we pray to the Lord Lord hear our prayer we are a symbol here in faith and confidence to pray for our brother Andy strengthen our hope so that we may live in the expectation of your son's coming we pray to the Lord Lord hear our prayer now in silence let us offer our own special prayers we pray to the Lord Lord hear our prayer Lord God giver of peace and healer of souls hear the prayers we offer you your people whose lives were purchased by the blood of the lamb forgive the sins of all who sleep in Christ and grant them a place in your kingdom in Christ our Lord amen please be seated blessed are you Lord God of all creation for through your goodness we have received this bread and this wine we offer you fruit of the vine and work of human hands these gifts will become for us the bread of life and our spiritual drink pray together sisters and brothers that this our sacrifice be pleasing to God the almighty Father Lord look with favor upon the gifts we offer on behalf of the soul of your servant Andy and purify him through your divine healing so that he may find rest in your love through Christ our Lord amen the Lord be with you lift up your hearts amen thanks to the Lord our God amen Father all powerful and ever living God we do well always and everywhere to give you thanks through Jesus Christ our Lord amen in him who rose from the dead our hope of resurrection dawn the sadness of death gives way to the bright promise of immortality Lord for your faithful people life is changed not ended with the body earthly dwelling lies in death we gain an everlasting dwelling place in heaven and so with all the choirs of angels we proclaim your glory and join in there on ending him of praise holy holy Hosanna in the highest blessed is he who comes in the name of the Lord Hosanna in the highest you may deal or be seated as you wish for the Eucharist you are indeed holy oh Lord the fount of all holiness make holy therefore these gifts we pray by sending down your spirit upon them like the dewfall so that they may become for us the body and blood of our Lord Jesus Christ at the time he was betrayed and entered willingly into his passion he took bread and giving thanks broke it and gave it to his disciple saying take this all of you and eat of it for this is my body which will be given up for you in a similar way when supper was ended he took the chalice and once more giving thanks he gave it to his disciple saying take this all of you and drink from it for this is the chalice of my blood the blood of the new and eternal covenant which will be poured out for you and for many for the forgiveness of sins do this in memory of me the mystery of faith we proclaim your death oh Lord and profess your resurrection until you come again therefore as we celebrate the memorial of his death and resurrection we offer you Lord the bread of life and the chalice of salvation giving thanks that you have held us worthy to be in your presence and minister to you humbly we pray the partaking of the body and blood of Christ we may be gathered into one the Holy Spirit Michael is auxiliary of all the clergy remember your servant Andy whom you have called today to this world to yourself glad that he was united with the death in his resurrection remember also our brothers and sisters who have promised even the hope of the resurrection all who have died in your mercy welcome to mention the light have mercy on us all we pray with the blessing of Mary mother God with all the sense of peace with all the ages through him and with him and in him oh God almighty Father in the unity of the Holy Spirit all glory and honor is yours forever and ever amen would everyone please stand and we invite you to extend your hand and pose around you as together we pray in the words that Jesus taught us our Father who are in heaven hallowed be thy name thy kingdom come thy will be done on earth as it is in heaven give us this day our daily bread and forgive us our trespasses as we forgive those who trespass against us and lead us not into temptation but deliver us from evil deliver us Lord we pray from every evil graciously grant peace in our days that by the help of your mercy we may be always free from sin and safe from all distress as we await the blessed hope and the coming of our Savior Jesus Christ for the kingdom, the power and the glory are yours now and forever Lord Jesus Christ who said to your apostles peace I leave you my peace I give you look not on our sins but on the faith of your church and graciously grant her peace and unity in accordance with your will who live and reign and ever the peace of the Lord be with you always let us offer each other the sign of peace we now prepare ourselves to receive Holy Communion Lamb of God you take away the sins of the world have mercy on us Lamb of God you take away the sins of the world have mercy on us Lamb of God you take away the sins of the world grant us peace behold the Lamb of God behold Him who takes away the sins of the world blessed are those called to the supper of the Lamb Lord I am not worthy that you should enter under my roof but only say the word and my soul shall be healed in order to have a first president you have to have a first organizer what a team Andy Salavia and Ernesto Cortes made back in the day so once again we welcome the first organizer of COPS which later became COPS Federal Ernesto Cortes I just want to make sure I hear me when I was asked to I was honored overcome with joy and gratitude and sadness of course for Andy's passing but then I was kind of overwhelmed because I was told first I had ten minutes then seven and now six and then five and I said how do I talk about a man who meant so much to me who meant so much to his community who meant so much to all of you and the people who are not here who have gone to their rest how do I talk about him it's a short period of time I know he would be angry with me if I took longer because I would always tell people and he would remind me that I would tell people that before Lincoln's Gettysburg Address it was a very famous war term by the name of Edward Everett we spoke for two and a half hours and to tell about the battle was well received, people applauded it Lincoln spoke for two and a half minutes nobody applauded no one remembers one word of what Everett said all of us remember every word of what Abraham Lincoln said so sometimes it's better to be short and incomplete so I'm going to make that ever because I'm hoping that what I say challenges all of us to think differently I had to rewrite my talk because when I heard the gospel story Matthew 25 I remembered how much that passage meant to both Andy and the cops because we spent a lot of time studying with Father John Linskins and one of the things he taught us was Matthew 25 and so you'll forgive me if I interpret it a little differently than the way it normally comes across Father Linskins taught us to read the Scripture in a very different way he said the way you got to read the Scripture is the way Cantim Plus does in El Padresito when he says and Jesus said and if he didn't, he should have and if he were here now this is what he would say so what El Padresito would say and what Father Linskins said was the way you have to read Matthew 25 is you have to understand that the Greek word for welcome was synagogue to take in welcoming somebody into your home it didn't mean welcoming a stranger into your home it meant welcoming someone into full participation in the life of that community because a synagogue was not just a house of worship it was a house of study of prayer but also of deliberation it's where people learn to be political where people learn how to understand their civic and social responsibilities not only to their neighbors but to their workers to their employers it had to do with all of the different facets of their social and economic life and if there was anything that I understood with how to be a citizen not just as a voter not just as a consumer or city services but as someone who is about the business of teaching and learning and full participation in the life of that particular community that was not meant to him Cox was his graduate school his university he never went to college he didn't have to he learned about politics he learned about the Tocqueville he learned about the Federalist Papers he used to teach the Federalist Papers to congregations all over San Antonio and he if anything was a man of incredible generosity of spirit but he particularly taught them and me because and he never asked the question am I supposed to do this he would say what is my job and he would say if I'm as the president supposed to do this I will do it just tell me what I'm supposed to do and it didn't matter what it took it didn't matter the time, the effort, the energy he was ready and if he didn't know how to do it he said well then teach me how to do it so he was constantly asking the question what do I need to learn what do I need to do who do I need to meet with where do I need to be which festival do I need to go to which meeting do I need to go to which presentation do I need to make he was there and not just for San Antonio because he also believed in the network when I went from Los Angeles to begin to build an organizing effort in Los Angeles unfortunately Christine Stevens who was then and I remember her having a big argument with the then head of the CCHD committee saying I'm sorry my mother died in the middle of this because they did not fund them so he was pro another group and he didn't want to fund us and so anyway and he was on the committee so I called up and he said what happened we didn't get funded he said well you didn't meet all the criteria I said to him a criteria you're not out there to study criteria you're there to get the organizing effort in Houston funded what do you think you're there for so he said okay so he went back and called me up two days later and said you just don't be okay master of checklist always systematically going through so he went through every other project and where they didn't get 5,000 he put that aside where they didn't get 10,000 he put that aside where they didn't get 3,000 he put that and he put together the full funding for the organizing effort in Houston so TMO Houston you wouldn't exist Houston leaders from TMO you wouldn't exist the best setup has not been there to do the hard work of making sure that the resources were there and then he said to me you know US never mind I did this because I love you but Andy as Pearl said last night had the capacity to also withdraw he understood the iron rule what he could do for anyone here she could do for them but occasionally it meant he had to step in we were meeting with the governor of the state of Texas where's our mayor you're not the only one who gets picked on okay we were meeting with the governor of the state of Texas Bill Clements I said wrong oh I'm sorry, Bill Clements okay good and I asked the leaders to meet with Mr. Clements in the back they thought I was asking them to meet with the Republican governor so anyway he came to the meeting and he was full of himself and the leaders were trying to pin him on getting money for property poor school districts that's what was up there trying to pin the governor and he wouldn't have it he wanted to give his campaign speech in the middle of the action he was talking all you want but we're not going to listen to you because you're not answering our question and Marin he was there and Clements responded he said you're saying you want a pot of money for your poor school districts that's what you want you'll get it the sponsoring committee before Christine was there and he did a wonderful presentation of cops but the story he chose to tell was a tie up action I remember some of the leaders from King of Glory coming up to me and said I don't think we're ready for that I really like this who said I don't think we're ready for that kind of action but they stayed in to their credit I don't know there's no best story he'll tell us so let me start for you my salty language one of the stories I most liked was when I was leaving cops and going to Los Angeles spent the night with me the evening with me so we went to an all night place not all night but you know I want a pot in the morning I'm digging a hole but my wife was there to make sure I was okay so she was Johnny on the spot anyway so in we're kind of reminiscing telling stories to each other what we meant to each other and it walks a guy who later ran for the city council and frankly opposed the organization at St. Timothy's took us on there I'm not going to mention his name but I'm not going to and so he comes up and he comes up to Annie and I and he says congratulations we've built a strong organization and then he gets drank a lot and so he just keeps drinking and drinking and drinking and then after he keeps drinking and drinking he says to Annie you're going to be in the toilet in two years your organization is going to be nothing because when he leaves okay it's going to be gone and Annie says to him we rehearsed many times before he says what do you mean and Nesto Cortez doesn't matter one bit he ain't and we're going to take it on and he did it several times Fred Lozano was an anchorman at WAI called they were doing a big story on cops and he called my home in one interview and I called Annie up and said I don't talk to him without your permission so he calls up Fred Lozano how would you feel if I called up your secretary without your permission because that's what you just did our head of the chamber of commerce after we did the tie up action he says I understand you're trying to get bees with a business community I called up Andy and I said get here and he comes from killer air force base come in there and says what do you mean if you want to talk unless you talk to me first okay I'm the president so he had that ability to understand the role of leadership and organizing you knew your job was to find other people and he developed the culture and I'm out of time so I don't know what to do now I wanted to say two things three actually about Andy there's a word I love in the scripture which is called or not the scripture it's a mid rush I think it's called being a Mitch and the story starts in the story of Moses where it says in the scripture Moses came out and saw an Egyptian overseer oppressing a Hebrew and he says he looked around and saw no one else around now I thought that meant there was nobody there but a rabbi told me that meant there was nobody there to act like a Mitch so Moses took on the role of being a Mitch which meant that you were a person of integrity of honor but most of all you could be relied upon you always had people's back you had your colleagues back they could count on you thick and thin and he was a Mitch and the evidence of that is the fact that we have so many organizers and leaders from all over the network here Arnie Graf my colleague who is the second organizer Christine Stevens who organized the 10th Cop Convent Pearl Street I live with my best I'm on the run Doug Greco Kathleen from Austin I don't know if you were working on the point but all of you and if I did not mention you please forgive me stand up and I'll mention because at 76 you are allowed some consideration but there are leaders here from El Baso there are leaders here from Dallas there are leaders here from Houston where are the leaders from the valley please there are leaders here from all over the IF Network and they are here to honor a man who was a Mitch I wanted to read two quotes so if you'll forgive me I'll take my leave and do it one quote comes from George Orwell Orwell had this capacity which I thought so suited Annie Orwell called it generous anger generous anger now the word anger comes from Norse work the root meaning is grief and he understood grief and he understood loss he understood grief loss and memory and we need to acquire, retrieve that quality of generous anger and Orwell defined that quality of generous anger as the capacity to take into consideration the situation of the people that you're angry with to know their context, their situation not to get ideological not to get swiped up in ideologies or self-righteousness but always maintain that capacity for generosity for consideration and Annie had that generous anger Orwell said he thinks of a picture of a man he's talking about dickens he is laughing with a touch of anger in his laughter but no triumph no malignancy it is the face of a man who is always fighting against something but who fights in the open and is not frightened the face of a man who is generously angry a free intelligence a type which hates all the smelly orthodoxies which now contend for ourselves and he was against orthodoxy against rigidity he was for people and what they thought about in jr. Caesar's play Shakespeare played jr. Caesar at the end of the play the last line Mark Anthony says over the dead body of Bruce this was the noblest Roman of them all he only in a general honest thought and common good to all made one of them his life was gentle his life was gentle and the elements so mixed in him that nature might stand up and say to all the world this was a man this was a man and he said may you go in peace we remember we remember you in that quality of generosity of anger which makes you the noblest Mexican of them all this was one of them thank you very much since this is a catholic church we have to have a few announcements no collection though thank you Father Pat there will be a reception immediately following this math over in the church hall so please come and join us and we want to have a joyous spirit as we leave the church and proceed on to the hall although our hearts are saddened we are also encouraged by all the words affirmation all the great stories and memories it's just been an unbelievable two days of remembering and also for us to re-energize ourselves because Cops Metro we have a lot more fights to do and we're going to be in there right? God bless us all so let us stand and let us pray Almighty God made this sacrifice purify the soul of your servant Andy who has departed from this world Grant that once delivered from his sins he may receive forgiveness and eternal rest through Christ our Lord Amen and now we ask Father Pat Sykes to offer the concluding rites receive his soul and receive the God of the Mortalement phase of God come to Andy they hasten to meet him's angels on the board and may Christ call him to take him to himself may the angels thank you to the bosom of Abraham receive his soul and receive the God of the mortal world eternal rest wrapping the Andy award and let our faithful live inside the body receive his soul and receive You will learn to commit the soul of Adam, your servant, and the sight of this world is now dead. In your sight, may He live forever. Forgive whatever sins He committed through human weakness, and your goodness, grant, and everlasting peace. We ask this through Christ our Lord. Amen. This mass is ended, but our celebration and our struggle to make this a better world continues. Let us now all go in peace. Amen. Amen. Oh, I'm going to go back to my home town. Will you go to a part of the religion? No. No, I'm not. We can barely think so much. I have to go. I have to get my doctor right here. This post, you're going to have to be up here and find your track of Jesus. The other folks will be there. You really want to go back to the reality? I don't know. I don't know. I don't know. I'm going to get my doctor right here. I'll get ready for work, something's hard. I'll go back to the Lord. I'll get ready for work. I'll get ready for work. I'll get ready for work. I'll get ready for work. I'll get ready for work. Thank you.


President of the United States. Well, welcome to all of you. It's an honor to greet such distinguished guests and friends here in the Indian Treaty Room. I recall with pleasure a dinner that then President-elect of the Hoover Institution Glenn Campbell and the Hoover Institution Board of Overseers gave my honor seven years ago. I'll be returning pretty soon for you. But I've been an honorary fellow at the Hoover Institution since 1975 and continue to be very proud of my close association with you. Many of the Hoover Institution staff have served my administration, including Martin Anderson, Richard Allen, Daryl Trent, John Razian, Rita Ricardo Campbell, and Glenn Campbell, just to name a few. But even more important, many of the ideas that we've been able to turn into reality during the last seven years have come from your distinguished scholars. A free society must be built on strength, not only the power of its national defense, but the power of its ideas. It's a tribute to you that many of the policies of my presidency have come from ideas of Hoover Institution scholars. In particular, I recall the publication produced under Glenn's direction during the 1980 campaign that made a major contribution to the formulation of my domestic and foreign policy programs. That book was, as you know, the United States in the 1980s. Not only did I and my administration study it, but so did Secretary General Gorbachev. And that's what the Soviet leader told Secretary of State George Shultz before our first summit meeting in Geneva. We have read this book and watched all its programs become adopted by the Reagan administration. The New York Times quoted Secretary Gorbachev as saying, the Hoover Institution's bold intellectual leadership has made it not only an institution with an internal international reputation, but also a national treasure. The work of its scholars and the priceless documents in its library and archives provide resources that are essential to meeting the policy challenges of this century. In those archives, that reminds me of what I might have done to cast slur on the dignity of the Hoover Institution. My state papers at the end of eight years as governor of California were delivered to the Hoover Institute. And I went over for the arrival there. And they had been packed away, of course, in those cardboard cartons that you get and can unfold and use for storage facilities and all. The pile was probably as long as the width of this room and as high or higher than the door height. We had been one box short. And right in the middle of that big display of cartons was a Seagram whiskey carton. I don't know how it got there. But we owe a special debt of gratitude to the wisdom and foresight of the man who founded the institution in 1919, former President Herbert Hoover. Today I'm sure you realize the importance of the work of the Hoover Institution to the debate on critical national issues. And I'm delighted that you have now, under Glenn's direction, undertaken a new project of major importance. Thinking about America, the United States in the 1990s, edited by two of your distinguished scholars, Annalise Anderson and Dennis Bark. I know it'll bring to bear on the policy debates of the next decade the best thinking of our country. And finally, I want to say a word about the leadership of your distinguished institution. While it is the scholars whose ideas are of such fundamental importance, it is the institution's director and his board of overseers who provide the vision and institutional guidance that make it all possible. No one has contributed more to the Hoover Institution than Glenn Campbell. Glenn's creative direction and firm leadership have given the United States a unique institution of which we're enormously proud. We owe him a tremendous debt of gratitude. So thanks to Glenn and thanks to all of you for what you've done for me and for our cause. That's really what it's all about. The cause of human freedom and our commitment that America will remain the land of freedom and opportunity that God intended her to be. You know, having mentioned Mr. Gorbachev as being the reader of some of your works, I had to try him out on some characteristics in our meetings. And in my first meeting, I didn't acknowledge to him that my hobby has become collecting stories that the citizens of the Soviet Union tell each other. Reveals they have a sense of humor, but it also reveals that they have a certain cynical attitude towards some things in their homeland. But I chose to tell him one story. Soviet made. It seems that as they tell it, an American and a Russian were arguing about their two countries and the American said, look, I can go in the Oval Office. I can pound the President's desk and say, Mr. President, I don't like the way you're running our country. And the Russian said, I can do that. The American said, you can. He said, I can go in the Kremlin. I can pound the General Secretary's desk and I can say, Mr. General Secretary, I don't like the way President Reagan's running his country. And he laughed. I didn't tell him the one and then I'll quit before I get going. I didn't tell him the more recent one that I had heard about the man walking in the street in the evening in Moscow and a soldier shouted to stop. He didn't stop and he started to run and the soldier shot him. And another man standing there said, why did you do that? And the soldier said, curfew. But he said, it isn't curfew yet. He said, I know, but he's a friend of mine. I know where he lives. He couldn't have made it. You know, if their government would get out of getting between us and the people over there, I think we could get along just great. Well.


This is what happens when the math on speaking doesn't really all add up. Yeah, I'm ready to do this. Let's do it. Do you want me to stand up or...? Oh, absolutely. Hey, you know what? You're the boss. This is up to a vote!  This is my science.  I thought I liked it. I liked it for a little bit.  No, no, you gotta get the rest of it, man. No, no, no. Do you guys want me to finish this? Oh, he's my nice friend. All right, science time. End of spanking.  We're going to do science now. All right? Yeah? Yeah? Oh, okay. Ow. Thank you. Anyone else? Oh, lord. Okay, science. So, I'm a Ph.D. student from Columbia University. And this is my research.  And this is terrible. Okay, so... The name of my talk is Stepping Pones, Adventurous and Full Spectrum Embedded Exploitation and Defense. So the defense part is really important. This is really what I want to talk to you guys about. And here's why. Oh, and by the way, the slides are not on the DVD. It's on our website and it's like 100 megs because unicorns are magical creatures which cannot be compressed at all. So sorry about that. And this is our typical talk. This is what I usually do. First, we say, hey, look, we find this bright, shiny thing that we want to play with. And be it a router, a car, or a phone, or a printer, whatever it is, we talk about our motivation for wanting to do this sort of thing. And then we spend a lot of time in failshack, figuring out all the different ways of not owning these devices. We fail when we fail. And after a while, we finally succeed. We find that one vulnerability. We built that one exploit that works. We're really excited. And we spend some time during the presentation talking about it. And then comes the bad news. The bad news is this thing is everywhere. The fix is really hard. This thing runs our lives and it could potentially have very big impact. That's terrible for the world. And then we feel bad for saying that. So we say, well, it's okay, actually. We have this thing called duct tape. So we're going to duct tape this thing up by unplugging it from the network. Or let's just not use it in the way that it's intended to. And hopefully your house won't fall down tomorrow. And then me, I usually have pictures of cats and things I find on Google Image Search like four o'clock in the morning for harmless copyright infringement. And during the last two minutes of the talk, we always have the slide that says, wouldn't it be great if we had a real solution? A solution that's not just duct tape that actually fixes the fundamental insecurities, the problems, the reasons why we have the problem that we present it on. And then we say, okay, goodbye, have a nice day. And we do it all over again. But the real solution is never really presented, usually. So I'm happy to say today we worked really hard to make this talk a little bit different. I'm going to spend about 47% of this talk on the offensive side of our work. You're going to see Poly-CC's malware propagation. And by that, I mean malware on embedded devices that propagate from one type of device to another like a printer to a phone, from a phone to a router and vice versa configuration. And then we're going to spend a lot of this time, as much time as I can, on the defensive technology that we've built at Columbia University that we're commercializing through a little company that is called Red Bulloon Security. The defense is called Software Symbiote and it's essentially the product of the five years of my PhD work you're about to see it live on stage in what amounts to basically your typical modern office. And then we're going to spend some time showing you pictures of unicorns that you can find on Google Image Search. So, human cast, this is my PhD advisor and co-founder of Red Bulloon Security, we haven't seen him since Black Hat. We don't know where he is. Michael Costello is a fantastically beautiful man, a designer by day and a scientist by night. This is Jadon Potteria, who is also a research scientist at Red Bulloon Security and here's me getting spanked on stage and such. And special guest appearance by my key drop tables who is the mayor of Pone Town, which is located between Quarth and New Jersey, so halfway between. And that's not all.  You may or may not see them on your desk, but we all use it in our modern offices. So we have the 2821 Cisco router. This is probably something you'll find in the closet somewhere, right? And you'll have one of my favorite phones, and the Cisco phone, right? The Cisco 7961. And today we're going to show you a zero day that we're going to drop at Black Hat, but we're going to show you here today. It's called the Cisco 8961, so this is a bright, new, shiny, sexy new Cisco phone that's almost twice as expensive, but it's really nice. It also has a zero day that's fun to talk about. And we're going to show you something on the 1841 Cisco router and we're going to talk very briefly about the work that we've done in the past. This is an image that we all know.  And Pontown is on the right side of the internet where Mikey Drafttable lives. So he doesn't really know anything about your internet. To him, this is a mystery because he can't really send any packets to recon through the firewall from outside in. This is how we always set things up. So this is what he does. He's going to make a fantastically impressive resume. And someone in your organization is going to be so compelled by this resume that they're going to print this out. And this is a vulnerability that we talked about a year and a half ago which has been patched by the vendor where a print job can change the entire firmware on the printer itself. And that's because you can pack firmware update files inside print jobs in the printer which has been patched in theory. But once you get onto the printer now he has a physical stepping point into your internet from the outside. And what he does is he will then out. So why am I talking about this vulnerability? It's been fixed. We talked about this a chaos two years ago. But it turns out we scanned IPv4 looking for publicly accessible vulnerable printer on the internet. And after 14 months after the virtual security patch was released by the vendor and I think they released something like three dozen patches for every single laser jet model they made, we found that only 7.5% of all the printers on the internet has been patched against this vulnerability. So if you find a zero day on something like Firefox or Chrome, you have maybe a week window where that vulnerability is actually useful. But on the embedded side this is absolutely not the case and it's because we don't have the same vulnerability that I found on this laser jet printer a year ago, year and a half ago, will still be something that your organization will probably be vulnerable to today. And that's just because people don't patch the firmware on the printers, it's difficult, it's cumbersome and nobody likes to do it. So with this vulnerability, what he's going to do is he's going to create a reverse IP tunnel out the firewall so that he can get command and control through this tunnel from outside, from the network to figure out what other embedded devices there are, and using what he knows about the vulnerabilities and exploits he has about those embedded devices, we're going to show how you can actually propagate through the network, compromising all of these embedded systems without ever touching a general purpose computer where you have host-based defense of any kind. So we've done a few of these, we looked at the printer, we looked at the router and we looked at some of the vulnerabilities, isn't really all that difficult and I have to put that in air quotes, I mean it's not easy, but you have the physical device, you have all the time in the world, you can take it apart, you can figure out how it works, so the idea was that, and this is the page I put in the first page of my candidacy document for Columbia, that my theory is that polyspecies malware propagation is certainly coming, we have the offensive one and own another one, but it turns out, you know, polyspecies malware propagation isn't just trivial, there are some challenges that has to be solved in order for this to really work in the real world, so my goal is again to own, let's say, the router and from there put malicious implants in every single one of these devices, embedded devices in the network and there's certainly some challenges and we're going to talk about the three that we really had to solve in order to get this to work. We have system machines, we have syscodes, we have HPs and we have vias, devices from different vendors, these are all proprietary devices, you're not going to get the source codes for any of this stuff, the hardware is obviously all specialized and on top of that, the architecture, we have MIPS, power PC, AVR, X86, all sorts of different ISAs and after that we have different operating systems, we have modified Linux, we have mystery operating systems that nobody really knows about, we have CNU that's kind of like Unix but not really and we have other things that are just complete mysteries, right? You know, look at the thing and say does this thing even have a kernel? Completely unknown in some cases. So what I want to say is take a step back, we're going to show you solutions to these problems, these challenges that we found for the offensive side, but really when you solve the offensive problem you're solving the dual of the technology software symbiote to apply this to build an offensive demo, so we're using the same type of technology for offense and defense in Yankat. So the very first challenge here is a generalized way of modifying binaries, right? So I mean once you have a device, how do I get the code that I want to run onto the thing in the first place, right? It's not like I can put, you know, install that EXE on a printer or a router, that's just not going to work, from a reverse analysis console that we presented here last year. I definitely recommend you check that out. We've been building on top of it and that seems to have worked quite well. So that challenge is more or less off for us. The next part gets a little tricky. And here is the generalized execution problem. So once you have modification you can put whatever binary you want in these devices. Now the question is what do you want to execute? And by execute I don't mean just single payload on environments that are vastly different. Things like Linux kernel on MIPS or VxWorks on ARM and have it all more or less do exactly the same thing without really a full understanding of the operating system at all, right? And I'm going to show you ways of doing that. Once you solve that there is an actually even trickier problem of getting input and output to these targets. So you have OS and hardware agnostic payload of some sort. How do you communicate to it? From this device without understanding how the network subsystem works, right? Typically you figure out, let's say, the Indis driver works this way. I'm going to hook the specific call and that's the way that I can see all the traffic that are coming in. But in operating systems that you really don't understand, this is very difficult. So let's talk about generalized execution first. Forget about everything you have ever learned about any operating system. That's why we have this black box that the memory is roughly organized in this way. You have some code and you have some data, dynamic data region, right? Somewhere in that dynamic data region you have what's generally referred to as IOMM, right? And inside this code it shouldn't surprise you, but embedded devices firmware is really bloated. It's got a whole bunch of code that really isn't necessary for the operation of that device. And by that, I mean, you know, debug strings, IGMP if you don't use that sort of thing, you're done in libraries that are linked in through the build process and what not. In fact, Mike and I looked at Cisco iOS and it turns out if we wanted to rip out BGP and the HTTP server, it looked like we were able to take out 40% of the iOS binary and still have that router come up and be fully functional. If you just didn't want to use the web server or BGP. So there's a lot of room to play with. And on the other hand, there are points inside the code that we know we have confidence, regardless of the operating system. And here's a really good example. The e-read instruction. Every time an exception comes up, the e-read instruction is called. So if you just map out all of the e-read instructions and hope that, we'll be guaranteed perpetual control of the CPU.  Popular functions that are called all the time, mem copy, et cetera. So put these two things together. We replace a dead code for a binary. This payload is capable of restoring state between itself and the host program. So think about this as a binary scheduler. We use some other dead code for dynamic memory region, stack, heap, scratch area. And the last thing we do is we hook a whole bunch of intercept points to guarantee that our payload is periodically invoked. And then that's really the solution to the generalized execution problem. You can compile the code for a list of the operating system that you're working inside. Now, how do we solve the input and output problem? And I'm going to say that we can actually take the solution from the generalized execution part of this and at least solve the generalized input problem. The output is still a bit more difficult. And this is what we do. The payload in this case that we choose to run is called the packet scrubber. We're doing an Easter hunt, essentially. We're going to put this piece of paper above the device, regardless of what the operating system is. We're going to hook a whole bunch of points that's going to guarantee that the packet scrubber will be hit periodically all the time. And as the device receives network traffic, packets are going to be copied into IO memory. And in that IO memory region, we're going to detect well-known patterns that we define ahead of time that we're just going to call command and control patterns. And as the device operates, we pick out and then we service them accordingly to our command and control scheme. And how do we get these patterns inside the IO memory range? It turns out it's really easy. Even if you send a malformed packet of some sort, as long as the device doesn't have a lot of hardware acceleration, the entire packet is usually copied into memory range of that device, and then the processor will analyze and decide whether it needs to discard it, quote unquote, or process it. And as long as the thing is copied into IO memory, we can send it through command and control through, let's say, an ICMP message, or we can send it through the content of a JPEG picture. As long as that is copied into IO memory, our packet scrubber will identify it. So take a step back and think, is this something that's specific to ARM? It's not. It'll work for MIPS. It'll work for AVR, X86, power PC, whatever architecture. Now, is this something that will only work for VX works? No. This is a little iOS, the Linux kernel inside a DSP program. This is really hardware and software agnostic. So for completeness, this is the command and control and the command and control acknowledgement packet that we defined for this demo. You have an envelope that starts with a predefined pattern, and in this case I use ACAC, because my initials, followed by some metadata, and then at the end we have magic pattern prefaced by how IO memory is manipulated. And inside that we have the command arguments, various payloads, and this is how both the offensive and defensive demo will work. You'll see in a little bit. So put that together. You have the packet scrubber running. You have CNC packets coming in and out of IO mem. And as these packets are hidden, we identify it, we service the command and control, and that's how it all works. And we have it working on MIPS, and I want to take a moment. We found out about Barnaby Jack a few days before making this presentation, and we were all super shocked. So we wanted to do something for him as a tribute in this presentation. So we've actually implemented the Barnaby function, and what the Barnaby function does is it takes arbitrary embedded devices as input, and it puts its face into the working memory of those devices. And we're not done. We made a modified Barnaby function Prime, which does exactly the same thing, but in a permanent way. So to show that not only can we do this through our command and control, we can actually affect real, permanent physical destruction of all these devices through our command and control. So here is a Cisco phone with Barnaby Jack's face right past the Linux loader. Here it is, physical destruction of Prime. So now I want to talk a little bit about how our demo array, iron the printer, owns the printer through this reverse IP tunnel or through this resume, establishes the reverse IP tunnel, sends command and control down to the printer to do recon. Recon will bring back active devices on the network. We're going to do a whole bunch of fingerprinting to figure out the devices you're actually looking at. And once we have, we figure out whether this is a Cisco router or an HP printer or a Cisco phone, et cetera. And using what we find there, we're going to find a control capability on all of these devices. And before we jump into the demo, I really have to say, I'm not allowed to say a lot about what we have done with Ivaia that's coming soon, but the JTagulator, I don't know if you guys saw the talk about it, is the super awesome sauce. This is the coolest piece of hardware I've seen in a while. If you see Joe, get him like a latte or something, but buy like ten of his boards. This is really cool. And his board made a brand. So now, without further ado, Michael is going to start writing the demo, the offensive demo. All right. I just want to say I really love this community. It's 1 o'clock, 1.30 now on a Sunday afternoon, the last day of the conference, and the room is packed. I mean, this is great. You should all give yourself a round of applause, please. And there's going to be a little bit, a very tiny bit of audience participation here.  All right. So we're going to Pone Town. Okay. So everything that we're doing here on stage right is Pone Town. So this is where we're going to put our offensive payloads, and then after that's done, then we're going to come to stage left over here and do defense. So I'm going to bring up my server. We've already sent our resume to the printer. It has been, it's rebooted, and it's going to build its reverse tunnel connection out through the firewall, out to where Mikey Drop Tables is living. So we've got our tunnel connected. So we can now bring up our offensive console and already we see that we have the printer in here. And so everything that we're going to be doing here, and all of you see this at the beginning, but every command that we're doing, or almost every command that we're doing is we're sending commands through the command and control tunnel to the system. So we're going to do the same thing, but we're going to do the same thing, and we're going to be instructed to do different things. And so what might be the first thing that we want to do. So we've got our printer, we know about this on the network, but we want to find, we want to do reconnaissance on the rest of the network. So we're going to do a SIN scan on the printer on port 23. And we're instructing the printer through the devices on the network. And right now we see we have a number of IP devices, and I apologize for the formatting for the screen size, but another thing that you're going to notice is that the printer now has a fingerprint. And this is a memory fingerprint. So when our root kit is on there, we can do a checksum over memory, and then use this fingerprint as a key into a database that we have pre-computed offline a bunch of information on these devices. And here we know that we have a 255DN running firmware from March of 2010. And this might be another good time to, or this might be a good time to note that this work that we're doing on the printer is nothing new. This is not a new exploit. This was presented at 28C3, print me if you dare. And there was an NDSS 2013 when firmware modifications attack paper. Please read that and watch that. We just were making the printer do a lot more work. So now the next thing that we want to do now that we have an idea of some devices on the network is that we want to find out a little bit more information. We have some layer 3 information and we want to get some layer 2 information because that's going to help us in the next stage of our attack. So we're going to ask the printer to give us an IP to MAC address mapping of these various devices, and then looking at the first six bytes of the MAC address we have a couple of Cisco's on here. And we also have one target on here, recon 4 which is the Cisco. For the purpose of the demo we know that this is an IP phone. So we're going to rename recon 4 to phone 2. And what we're going to do is we're going to try to SSH into this phone. And we're going to try to, because we know that the phone is going to be running on the network, we're going to try to log into the phone by guessing a username and a password. We're going to take advantage of a feature on these phones is that every single time you attempt to SSH into them, they ask their preconfigured TFTP server for an authorized keys file. So we can do key based authentication on this. What we're going to do though is instruct the printer to ARPSBOOF the phone, making it think that a device that we control and that's going to be the printer. So one of the things that the printer does in addition as part of the packet scrubber looking for these magic patterns of command and control packets is it looks for TFTP authorized keys request files and it already has in memory a nicely formed one packet TFTP response file of an authorized keys file. It just has to populate a couple of fields. Which key are we going to use, Mike? We're going to use a key that we built ourselves. So we would be able to use it. So we're going to poison phone 2 with the IP address of the TFTP server that we learned through reconnaissance. But first, before that, I need to bring up a proxy. I'm going to wait for the proxy already connected, very good. And we're going to so we're going to art poison it and do it again for good measure. So now Mike is going to SSH through the proxy through the printer to the phone and spoof the authorized keys file as it's being requested and then get console access to the phone from the internet through the printer. And if this works, we should get a shell login prompt and not an SSH password prompt. Yes. Wait, he's typing a super secret password. How do you know what the username and password is? Can you not just change that password? No, because if you change it then the checksum changes and the phone resets itself. And the password comes back to the way it was before.  Okay, so this we find out is a Cisco 8961. It's running 921 software. This is not the latest software on it. There has been a release or there will be forthcoming release that kind of puts epoxy and some of the holes on this but doesn't actually work today. But here we notice that this is a phone, this is a general purpose computer, this guy still looks like a phone that's running a Linux kernel on here. And we're not going to go over everything that we tried and failed to do to get root on this thing. We're going to cut right to the point. We found after looking at how the phone boots up that it uses NAND devices and one of the things that we noticed was just one of the devices. Does anybody see a problem with the permissions of this device? There you go. And we did this before seeing monks talk about NAND flash vulnerabilities so we could have done this in a lot more elegant way but he didn't send the slides before and we didn't know about it so we did this in the most monkey way possible. Yes, but if anybody didn't hear it MTD4 has world right permissions as an ordinary authenticated default non-privileged user, we could write to this device. In theory, right, but Mike, we don't have any tools to do that. We're going to have to compile it or download it. How are we going to do this? Actually, it's really convenient that Cisco had already packed for us a number of flash utilities so we could erase the device and find out if we could do that. Yeah, and there's not only flash erase and info but we also have a number of NAND tools. Wow, that's really useful. But okay, come on, this file system is going to be like megs and megs large. How are we going to ship it to the phone? How are we going to pack it? It sounds all very complicated. It really isn't. You can do all of this stuff offline and you could pack one file in a very small file system, fit into one 4K block and transfer it over the phone using TFTP. Which is also on the phone running and stuff. All the tools are there. So, there's the old day. When I found it, this was a little disappointing almost because we've gone from the CNU kernel, which is a proprietary thing that very people have looked at, to a much more secure environment, the Linux 2.6 kernel with all the security patches backdated to the thing. Yet owning this phone has become somehow easier. Something's wrong here. It's just human error, really. What would somebody want to pack into one of these files? Maybe a little root popping set UID root program. So, if we look at who I am now, I'm the fault. But I really don't type this slow. Everything's going over this proxy. We're root. So, that's all it took. You didn't even have to compile anything. You just log into the phone. You look around and build this 4K file system and there you go. You have it. And now we're going to switch over to our command and control demo. For good looks, you know, we promise that this is going to be a command and control infrastructure that, oh, by the way, I have to say, now that we're on a Linux operating system, we're home free. We can start doing all this stuff that we know how to do. So now going from a Linux phone to compromising the printer using the initial attack factor becomes all of a sudden very simple. Now we're going to load up all of the devices we have our command and control implanted on. And for good measures let's go 1841 router just to show that our command and control will work on phones, printers, and all sorts of different routers as well. So through the tunnel, the first thing we want to do is heartbeat all the devices, see if our root kit is listening. And of course we're also doing this again through the tunnel that the printers established. So a number of data gets back from it. Everything responds and says that we're here again with the memory fingerprints that we were able to do. So we have a bunch of info on these things pre-computed offline. So for instance, let's instead look at the 2021. And we see that we know that it's running MIPS 4 Big Endian. We could find the addresses of various functions. Here we've decided to redact it. So we've got lawyer phone and we couldn't show you any of the actual offsets, but they're there in our database. So now we can do read and write. So let's rock out the Barnaby function. Okay. So let's just go directly to reading and writing. So before running the Barnaby function, just so in case anybody does no typical Cisco router behavior, if you type in enable and you type in the password wrong three times, this is bad secrets and you're just a regular privileged user and if you do a show version, you just get to see the router is running. But if we run the Barnaby function this is doing a number of writes to memory. Let's do it on the 1841 as well. So now if we do enable bad secrets, but notice that the prompt has changed and if we do it as a privilege. That's not supposed to happen. Things are weird and terribly bad in these routers. Wait, that's not also we're going to do show version, right? Oh, look at that. We've got Barnaby's face in there. Ta-da. And it's in the 1841 as well. So we can do this on. And this is because all the command and control works the same way on different architectures, different operating systems. And we're just giving an arbitrary memory write command and we're writing it to the specific location. And the reason why we know the specific location of the string is because we actually have pre-computed this assembly of the specific iOS version that we found that we know this router running through the fingerprint that we've exfiltrated through the heartbeat. And we can do this at scale on all of the images from all the devices that we have under CNC. Let's do the defense demo. We're running a little bit short on time and as promised, I'm going to spend as much time as I can on the defensive side. So I want to say, well, okay, population in Pongtown without defense six. Terrible. Oh, another fun fact.  This thing can send about 15,000 packets per second, right? And it can send terrible things. It can just yack, yack, yack all day long. And it turns out if you want to DOS a 2821 router using a single printer, you can. You can peg it to 100 percent or 98 percent CPU utilization. And that's one printer. Imagine what I can do with two printers. And we'll show you that if we have some time, right? Wins all day. Okay, so now I want to show you the defense demo. And this is the thing that we're developing. This thing is called software symbiote. And it uses a lot of the same insight that you saw on the offensive side to develop dynamic firmware integrity attestation in arbitrary legacy embedded devices. We're showing you demos that run on ARM, on MIPS, on Cisco phones, on Cisco routers, and then on HP printers. This is really not something that, oh, and we require absolutely no vendor intellectual property. We take the binary that comes from the vendor. We require no source code. This is not a timing-based attestation method. This is not a static attestation method. This is not proof carrying code in any way or inline monitoring. This is something very new that is very flexible. And you're going to see a demo of this thing working right now on exactly the same hardware that you saw the offensive demo on. So we're going to get out of Pone Town and go somewhere else. And then as Mike is setting up, we're going to run through the first phone exploit that does memory modification. And we're going to bring up the symbiote alerting console that's going to show us dynamic updates to the check sums of the static regions of code inside all of these devices. So any piece of code that is modified within static code regions of these devices will be detected in approximately about 100 milliseconds of detection latency, depending on the speed of the CPU. So the routers will have 100 milliseconds or so. The phone actually has a much faster CPU, so we can actually detect it much, much faster. Okay, so we got in here. We added our routers in. Again, I apologize for the formatting. So right now we have the phone, the router. There's a printer at the bottom. We'll try to add that in individually at the end. But for right now we'll show you the phone and the routers. And so these are routers that are running our symbiote code. This is all work that's been funded by DARPA, IRPA, the DHS. All of these things are packed and funded by CFT. So thank you very much, Mudge, if you're in the audience or wherever you are. All right. So what we're going to do is we're going to go through exploits that we've demonstrated before, shown before. There's not much new here. So the first one, but what is new here is the symbiote, depending all of this stuff. So the first thing that we're going to try it on is the Cisco IP phone. We're going to SSH into SSH. And so the exploit that we're going to be showing here is the same one that we showed at 29C3 hacking Cisco phones. So if you want the details on that, please watch that video. You can find it on YouTube. And then the way that this demo works is that we have a file called PONBIN. What we do is we change the way that setUID responds so that we get root access. If you look over here, the Cisco XAM and the secure state is secure. But after we go to the phone and we run PONBIN, we can then log into the phone and we have root access. Again, please watch the video to see the details. But now we see that the secure state has changed the PON because the symbiote detected the change that we made in firmware. And the checks have changed. That's how we detected. And you can see the alarms coming periodically. We actually had to slow down the alarms coming from the demonstration. We had to slow down the refresh rate a little bit. And here we're just going to show the 2821 router because of the screen formatting. But we're not going to be demonstrating a Cisco IOS exploit today. Along with the symbiote, we made a small change to the show CDP neighbor command, which in addition to showing us our CDP neighbors, it also makes the memory modification change that was part of the Barnaby function to bypass enable authentication. So if we run it here, we could see that the router 2821 checks and it's changed state to PON as well. Let me see if I can bring up the printer quickly. To do the 2821? It's off the screen. It would be hard to see. What you're looking at here are functionally equivalent devices. But these are very unique devices in the sense that the phone and the printer and the routers you've seen are literally the only ones of their kind that actually has host-based defense in real time as the device is running that will allow you to have alerts that tell you whether the phone and the printer and the router has been exploited with approximately 100 millisecond latency. This is something that's never happened before. And you folks are well, the very first people to actually see something like this. And this is not something that we developed specifically for a specific model of a Cisco or a phone or something like that. This is something that you can see in a car. You can see in something that controls Predator drone or the Mars rover which also runs 3x works, by the way. The same operating system as the printer. So that is it. And with the printer that has a very small proof of concept symbiote running into it, we can use our command to control root kit that we demonstrated earlier in the demo. So we made a change in memory of the symbiote picked up on it. So that's it. That's our defensive demo. I just want to say, you know, so we've accepted host-based defense on desktop servers for a very long time now, right? And, you know, we haven't really started thinking about ways of seriously defending embedded systems against this type of attack. So I think that's one of the reasons why we've been defending embedded systems against this type of attack. So you've seen in the last few years that exploitation of these devices is no longer a myth, right? It's no longer that hard that people aren't looking at it. Now, hopefully you saw here that the polyspecies malware propagation part of this thing is also not a myth, right? You saw live on stage. You saw printer on the phone, right? And malicious implants on routers, on the defenses that we use every single day in our offices, right, in our defensive networks, et cetera. So we have a few more minutes. I'm going to take Q&A in the pool. So we're going to have some time for that, but before, can we run the DDoS, the Denial of Service demo? Who wants to see a printer peg a 2821 router? All right, let's do it. This is a lot of fun. So right now, Mike is going to send the Denial of Service attack command to the OSPF hello address in multicast. When the router sees that, it doesn't know what to do. It gets scared and the CPU goes all very high and bad things happen, right? Ta-da! So that's not good, right? You shouldn't have your router running at 98% CPU utilization. And this is all happening from a single printer. Imagine a printer and a phone. We'll show that next year. Okay, so that's our presentation. If you want to know more about Software Symbiote or our presentation, check out Red Balloon Security, we have all of the academic papers that discuss exactly how this works, the performance constraints, the security promises and limitations of our technology and some demo videos and of course the slide. I don't have time to take questions, but Q&A area in the pool, right? Yeah, about 30 minutes we'll pack up. We'll go to the pool. Thank you very much.