Welcome to the Asian Review. I'm your host Bill Sharp returning to host the show after a one-year hiatus doing research in Taiwan. During my year away, I met many interesting highly knowledgeable folks that I hope to invite onto the show for everyone's benefit. So be sure to stick with us and watch us every week on Monday afternoons. Today, my guest is one of those interesting highly knowledgeable folks. Attorney Ross Feinbold is Senior Advisor at DC International Advisory with offices in Hong Kong and Taiwan. He's a highly sought after commentator who will share his insight with us on contemporary politics in both Taiwan and Hong Kong. Mr. Feinbold is living in Asia for 22 years and is often interviewed in Mandarin Chinese, which he is quite comfortable in. Will the Trump administration show greater interest in Taiwan and Hong Kong than through the Obama administration? Obviously, we want to talk about this and about Taiwan President Tsai Ing-wen's call to President-elect Trump. Ross, welcome to Asian Review. Good afternoon. Okay. By the way, Mr. Feinbold is joining us from Hong Kong today. Well, let's get right into it. President Tsai Ing-wen's congratulatory call to President-elect Trump. What's your take on that? What's the impact? Well, clearly there's a desire by people who are going to staff the Trump administration to have a closer relationship between Taiwan and the United States. And there are several factors behind that. Most notably is a strong feeling that Taiwan is a fellow democracy. It's a country that generally respects human rights and shares many governing principles in common with the United States. And it should be treated as a normal country and as a friend of the United States. So some of the restrictions that have existed in the relationship between the United States and Taiwan, many people who are going to be working in the Trump administration feel very strongly that these restrictions on things like high-level visits between the government officials of the two countries, or weapon sales, etc., are completely unnecessary. And the United States should not be taking its instructions from China with how the United States should conduct relations with Taiwan. So on that basis, there will be significant changes under the Trump administration. Well, President Tsai's approval rating was suffering, to say the least. Do you think that her call to Trump helped her approval rating, or hurt it, or had no impact? Up or down? Well, now that it's several weeks after the teleconference with President-elect Trump at the time, it's clear that the approval rating continues to slide for Tsai Ing-wen. And most of that has to do more with her handling of domestic issues, more so than foreign policy issues. So there are a lot of ongoing debates in Taiwan about various domestic policy issues, economic policy issues, etc., and it's having a big impact on the approval rating of not just herself, but her governing team, the ministers in her cabinet, for example. And that's why her approval rating is falling. So there may have been a brief moment of approval rating increase and appreciation, and the public was impressed that Tsai's government was able to have this significant achievement with the incoming United States president. But I think it's also fair to say that a month later that has already dissipated, and the attention of Taiwan's public has returned to day-to-day economic issues. Interesting. Well, you're a close observer of events in Asia in general, but particularly Taiwan, Hong Kong, and China. So what kind of grade would you give Tsai Ing-wen on a scale of 1 to 100? Well, that's a really good question. Most of her ministers, when they've been asked this question by opposition members of parliament, have tended to give themselves very high ratings, between 90 and 100. So maybe I should second-press the view from the ministers in her own government. But there's some key points to keep in mind. Her government, her as a president and separately the members of the legislature that control the legislature from her party were elected overwhelmingly a year ago about this week. So they have a very strong mandate to govern. Sometimes it's very difficult to meet the expectations that the public had when they gave them such a strong mandate. So they have an overwhelming majority in the parliament, the legislative union. President Tsai was elected overwhelmingly against her two opponents in the presidential election. So public expectations are high, frankly. It could be very difficult to meet those expectations. And she started off with a huge amount of political capital, but obviously over time that will dissipate. And again, a lot of it has more to do with economic issues. And economic growth in Taiwan continues to be very sluggish. Do you think the Taiwan public is a little bit unfair in other words, it has such high expectations, it expects very complicated problems to be instantaneously solved? And on the point that you mentioned about instantaneous solutions, there are numerous television news channels in Taiwan. So it's a small country with a population of 23 million people, but there are close to 20 television news stations, newspapers, online media outlets. So all issues, all sides of the debate of a proposed policy, a vote in the parliament, get deciphered very rapidly and sometimes very heated views from both sides. So that also makes it very hard to achieve the expectations that the public set out. But there was a recent incident this week where there's a dispute over changes to Taiwan's labor law and over time pay. And both labor groups and employers are unhappy with the execution of this new law. And it's been frustrating for both labor and for employers as well as for the government. And President Xi basically said to the media, well, stop complaining to the government. I think labor and employers should work out the issues amongst themselves. We've set the policy and you guys should figure out the details. That may be a very reasonable view to take, however, it was not a popular statement with the public. Interesting response. China's reaction to the Trump call was, I think it's fair to say, predictably blustery. What are the reactions of other regional powers to this call? What's your sense? I mean, well, this is in the region who obviously watch what's going on quite closely. It goes to Taiwan's ability to establish stronger political trade or security relationships with other countries around either North East Asia, which would be Japan and Korea, or Southeast Asia, the ASEAN members, or with India. Right now we're in a period of great uncertainty because we don't know the level of engagement the Trump administration will have with Asia and how it will implement policies with regard to Asia. And most specifically, will it be confrontational on trade issues, which wouldn't just be a problem vis-a-vis bilateral relationships with China, but it could impact other countries in Asia as well. So countries around Asia are being very cautious in how they manage their relationships, both with the United States and with China. What does that mean for Taiwan and the teleconference between Taiwan and Trump? Well, countries in Asia are being very cautious. They're being very cautious right now about deepening their own engagement with Taiwan, until they see how the U.S.-China-Taiwan-Trilateral relationship plays itself out. So while we didn't see countries around Asia saying the call was a great thing and a very supportive of a closer U.S.-Taiwan relationship, they weren't necessarily critical, either with a few exceptions, notably Singapore, which has been very outspoken in recent weeks that the U.S. should maintain the one China policy. However, that's not going to influence the decisions of the Trump administration, but it may look good in front of China for Singapore to say that. Is Trump using Taiwan as a bargaining chip? We really don't know yet. He has said as much in public statements or immediate interviews. But again, a lot of the people who are going to be making Asia policy in the Trump administration, some of whom have yet to be appointed, so we don't even know who these people are. But again, I think it's a safe assumption that many of the people making Asia policy in the Trump administration will favor closer engagement with Taiwan. We don't know the extent of what that will be, but it's a safe assumption that there will be higher-level visits from Taiwan officials to Washington D.C. and from U.S. government officials to Taipei. It's a safe assumption that the U.S. is going to offer better military equipment for Taiwan to purchase. Whether or not Taiwan will make the budget available remains to be seen. But again, it's a safe assumption there will be a higher level of engagement between the United States and Taiwan, regardless of who staffs the Asia policymaking positions in the Trump administration. Interesting response. So we don't know whether Trump would throw Taiwan under the bus in order to get a better deal or trade deal from China. It's probably a little bit too early to tell. Absolutely too early to tell. And even though Trump has made statements indicating that he might treat Taiwan as a bargaining chip in trade negotiations with China, I mean you could see just from constructing that statement that we have a few issues that actually might be very unrelated. So yes, Trump is going to look to recalibrate the trade relationship with China. That could mean higher tariffs on Chinese goods or other actions that the United States could take either under domestic policy or within the WTO framework. Whether that can be linked to Taiwan issues though remains to be seen. So it might sound like some bluster right now but maybe that there's little likelihood that Taiwan would be thrown under the bus. Well that's good to hear. That's good to hear. Let's focus our attention now on Hong Kong and Mr. Fungold is today as we speak to him is in Hong Kong. How many days a week do you spend in Hong Kong? How many days a week do you spend in Taiwan? I travel back and forth constantly so on any given day I might be in one city or the other. Of course with the election and the new government in Taiwan over the last year I spent more time in Taiwan analyzing that. But we have an election upcoming here in Hong Kong this spring for the chief executive. Of course the big difference with Taiwan is the chief executive in Hong Kong is not popularly elected and that's what causes so much tension between the public and the voters in Hong Kong because their expectations for democracy have not been met. Okay so since you are looking at the upcoming Hong Kong election for the chief executive of the Hong Kong special administrative region what are your thoughts on this upcoming election? Well again the public's expectation for direct election this cycle was not met that led to a lot of protests in the last few years but they are going to proceed. They being the current government of Hong Kong which designed the policy and ultimately the authorities in Beijing. So the chief executive will be selected by a small group of prominent people who represent what Hong Kong calls functional constituencies such as different industry groups labor unions and the like and the expectation is it's going to be one of a small group of people who have senior level government experience. They may not all get along with each other they might have personal disagreements on various domestic policy issues such as public housing policy for example but ultimately they will be cooperative with Beijing and they will not look to set a policy course that would differ from what officials in Beijing want to see for Hong Kong. So in that sense there will be stability. On the other hand if their policies are too close to Beijing and don't meet public's expectations there will be return to tension in Hong Kong. So let me ask you a hardball question now. Is Hong Kong better off as a special administrative region of China or was it better off as a British crown colony? Or the other option which is increasingly discussed in Hong Kong although unlikely to become reality is an independence movement that now exists in Hong Kong. For Hong Kong separation from China. Obviously it's not going to happen. One clear distinguishing phenomenon over the last 20 years since the return of Hong Kong to Chinese control is that there is not a colonial government of officials from Britain making the significant decisions for the people of Hong Kong. So the decisions now are made by the people of Hong Kong and or officials in Beijing but at least it's not made by a country from very far away. Hong Kong people and companies for example have greater control over the course of Hong Kong as opposed to British officials or British companies having say over policy and and winning bids for public construction contracts and the like. So there is something to be said for Hong Kong no longer being a colony. Again though one of the great disappointments of the people of Hong Kong is that they do not directly elect their legislature or their chief executive. Unfortunately it seems very unlikely that there will be direct popular elections and in your term. Okay so um hello my name is Crystal let me tell you my talk show I'm all about health. It's healthy to talk about sex. It's healthy to talk about things that people don't talk about. It's healthy to discuss things that you think are unhealthy because you need to talk about it. So I welcome you to watch Quok Talk and engage in some provocative discussions on things that do relate to healthy issues and have a well balanced attitude in life. Join me. Aloha I'm Carl Campania host of Think Tech Hawaii's Movers, Shakers and Reformers. I hope you join us over the next several weeks as we take a deep dive into biofuels in Hawaii and explore the alternative fuels supply chain necessary for the local and global transition towards transportation fuel sustainability. Join us as we have good conversations with our farmers, our producers, our conversion technologies, our investors and our legislators as we try to achieve our transportation sustainability goals. See you soon. Welcome back to Asia Review. I'm your host Bill Sharp. My guest today as well as Fine Gold joining us via Skype from Hong Kong. Before the break we were talking about the upcoming election for the chief executive officer of the Hong Kong Special Administrative Region. We're also talking a bit about comparing Hong Kong as a British Crown colony versus its current status as a Special Administrative Region of the People's Republic of China. So we'd like to resume that line of questioning for our last 12 minutes or so. Welcome back Ross. Do you think there's more freedom in Hong Kong today than there was during the days of British rule? It's a very fair question and it's an issue that people in Hong Kong are struggling with. Clearly the ability to express one's views, to have public demonstrations, exists in Hong Kong at a greater level than across the border in China. And this is still the case and it's something that Hong Kong people value very dearly. There's a greater level of popular opinion reflected in public policy. So although it's not a fully direct election for legislators and chief executive, one could argue that the current electoral system for the legislative council and the chief executive does allow a greater level of public participation than existed under the colonial government. This is just a fact, but again as we were discussing in our earlier segment it doesn't achieve the public's expectation for a fully elected, by popular vote, legislative council or chief executive. The concern though is where do we go from here? So people can express their views relatively freely in Hong Kong. One could criticize government officials in Hong Kong. Again there's things you can't do across the border in China, but the clock is ticking. Hong Kong has 50 years to have its own system and after 50 years there's no guarantee. So the clock is ticking and between now and the next decades there will be small and subtle changes probably in a negative direction where people will become more constrained in their ability to speak out. The media might self-censor more than we see today in Hong Kong and these are certainly things to watch and frankly I think they're going to be people in the Trump administration and in the United States Congress who are going to be looking at this very closely. So not only are people in Congress and the Trump administration going to be looking at China's relationship with Taiwan, but they will be looking at China's relationship with Hong Kong as well. You know one thing that strikes me about Hong Kong is as I see it there's this great division between the older people in Hong Kong and the younger people, all those young people who are out participating in the umbrella movement, you know carrying out sleeping on the streets and that sort of thing. Pushing for what I would call a better, freer tomorrow versus the older people say well well wait a second you're getting in the way of business you're stopping business and I don't know those I have to admit personally the attitudes of the older people left me a little bit high and dry. What's your take on that? Is there does this form any kind of a polarization in Hong Kong society? It certainly does a bit. Keep in mind that older people in Hong Kong would have been witness to very momentous changes in events over the last few decades whether it was the handover or the period between when Britain and China agreed on the terms of the handover and when the handover actually occurred which was a period of great uncertainty because people weren't sure how the handover would work in practice or going back through the decades Hong Kong has faced various pressures such as influx of Vietnamese boat refugees or riots in the 60s instigated by China during the Cultural Revolution or going all the way back to the Japanese occupation during World War II. So older folks in Hong Kong have seen a lot of change and they might have a bias and a preference for stability and most notably economic stability. So when you say that their concern was the young people who are disrupting business it could be very understandable that that people are concerned about the economic stability which is what Hong Kong's prosperity is based on right it's based on historically it was manufacturing and services now it's more focused on services and trade facilitation and that's based on having a high level of stability here so it's understandable what the concern is but I think it's also fair to say that even older people do have a preference for direct elections of the political leadership in Hong Kong but the difference of opinion and clearly is how do we go about doing that and older folks are unlikely to sleep in the street as you mentioned which the umbrella protesters did in when they occupied parts of the downtown of Hong Kong for several months at the end of 2014 so clearly there's a disagreement on tactics the goal they might actually share interesting you know another issue has come up in just the last few weeks is this the impounding of the Singaporean military vehicles and in Hong Kong port as far as I know there still have not been released is that correct correct they have not been released and it's a source of extraordinary frustration for the government of Singapore the government of Hong Kong is clearly caught in the middle in a political issue between Singapore, China and Taiwan because these military vehicles were returning from a training exercise in Taiwan as some of your viewers may know Singapore and Singapore has conducted military exercises in Taiwan for about 40 years it's not something that China likes China repeatedly expresses its pleasure everyone knows it goes on it's not a secret but for China it was extremely frustrating when it became public news with these military vehicles being impounded in Hong Kong the customs authorities of Hong Kong and the government of Hong Kong they do have a legal basis for impounding the vehicles in the sense that the manifest did not clearly indicate that this kind of cargo was transiting Hong Kong and there was a technical violation of Hong Kong regulations in that regard but clearly we're now in a political dispute between Singapore and China hmm well um now you're familiar um with with events in Singapore I think as well as in Hong Kong and Taiwan because I know that you study Chinese for a period of time in Singapore um it seems that the relationship between Singapore and China is intensifying it's it's it's hitting some some bumps in the road what's what's your take on that oh there are three significant issues over the second half of 2016 that caused this bump in the road in the relationship uh although the precursor there should be to keep in mind that Singapore is one of the largest foreign investors in China there are hundreds of thousands of PRC nationals who live in Singapore so so the relationship is extremely tied in in economic and personal spheres but three significant events over the course of 2016 one is Singapore was a a champion very outspoken champion for the Trans-Pacific Partnership which China of course perceives as a trade agreement to contain China and bind Asian countries closer to the United States second issue was the South arbitration C arbitration award in favor of the Philippines where Singapore was very outspoken in saying China should respect the award China did not like Singapore taking such a strong view especially as Singapore is not even a claimant to one of the islands or any of the sea areas third issue was the seizure of these military vehicles in Hong Kong so China has a number of issues over which is very unhappy with how Singapore has approached it the problem for Singapore being much smaller economically militarily politically then China is how does it manage China's anger there's a very real risk that Singapore might have to overcompensate and for example they might have to make more strident statements about the one China policy they might have to make statements calling on the US not to increase its relationship with Taiwan or calling on other ASEAN members not to do that so there's this risk of overcompensation in how Singapore handles the fallout from these bumps in the road with its China relationship interesting now your your firm gives the investment advice to prospective investors in Taiwan and in Hong Kong so what's your general advice to a prospective investor comes in and say well I have I don't know 50 million dollars whatever the amount and I like to invest in Taiwan what would your general advice be and I realize you probably need to talk about a specific industry but just generally what would your advice be well uh whether it's Taiwan or several other markets around the country we're all looking closely at what the new Trump administration policies will be most of the markets in Asia like Taiwan are very export dependent so we'd want to look at companies that could benefit from Trump administration policies for example companies in the infrastructure space that could supply infrastructure equipment giving the expectation that the Trump administration will be will be working with Congress to pass a very large infrastructure spending bill there certainly companies in Taiwan or Singapore other places around the region that might benefit from that uh that's a good point that's a good point we're down to about a minute and a half here uh what about investment advice for Hong Kong well Hong Kong is a services center there are financial industry and other industries here that benefit from Hong Kong's role in services uh hospitality for example tourism around the region uh so when looking at Hong Kong we also should look at the services sector more which would be more important than we were looking at other other markets around the region but but again a lot of this still comes back to the Trump administration policy so if there are companies in Hong Kong that benefit from the China-US trade then we'd want to evaluate what are the potential risks what are the changes in the China-US relationship and how would that impact companies in Hong Kong that are players in the US-China trade good advice but we if we want to invest in Hong Kong or Taiwan we know to go to your firm DC advisory um well we're just about at the end here it's been great having you with us today uh is there any last comment that you might want to add well certainly going forward as Trump administration as the Trump administration makes changes to Asia policy it's obviously very relevant to your audience in Hawaii starting with the military uh military families but but there's a lot of unknown so certainly bear close watching and certainly people in Hawaii who are closest geographically to the Asia-Pacific region will factor into US-Asia relations so it's a fascinating time and it's a great time to know for people in Hawaii to be following these issues closely and I look forward to being on your program to be talking about these issues in the future well Ross thank you very much for joining us today it looks like we're just about out of time thank you for joining us and we'll be seeing you soon thank you


Well, welcome to the Hacking Malware talk that we're going to give here today. Oh, yeah. All right. I'm Val Smith. Some of you might know me. I'm a malware analyst. I do penetration testing, exploit development. I'm affiliated with Offensive Computing, which is part of what this talks about. I also do some work with the Metasploit team and Cult of the Dead Cow. And I'm Danny Quist, a security researcher, software developer, exploit developer and reverse engineer, and I'm affiliated with Offensive Computing. All right. Just real briefly, I want to, you know, give thanks to a couple other team members, Patrick Stock, H.D. Moore, Ty Bodele, Scott Miller, who's giving a talk here later, so if you get a chance, go see that, and, you know, tons of other people. So thanks to everybody. Okay. What we're going to talk about today, we're going to cover a few things. The first thing that we're going to talk about is malware and malware protections. We're going to lay some basic found work for you guys. Then we're going to talk about virtual machine detection. You may have heard of tools like Red Pill. We're going to expand upon that a little bit. Then we're going to go into exploiting some malware, and we use Metasploit to do that. Hopefully that will be interesting. And finally, we're going to finish up with explaining our Offensive Computing project and what that's all about. All right. So I'm going to jump right in. So basically, we look at malware like any other system, you know, an application operating system, it's got its own protections, its own security, and so its own vulnerabilities as well. You know, malware does lots of things to protect itself from analysis and from being removed. So we spent some time focusing on how to bypass these protections, and we're going to talk about that. Okay. So the main areas that we're going to cover in this talk, just to get the basics out of the way, are anti-virtual machine detection.  Malware also uses things like binary compression, make itself smaller, encoding to make it harder to disassemble, and anti-debugger technologies. We're going to touch on each of these areas to lay a groundwork. Okay. So we like evil things, so we're going to use evil to fight evil. All the same sorts of methods that you might use in exploit development, you know, software cracking, especially old school stuff, that's the kind of things that we use against malware. Disassemblers, packer detectors, debuggers, metasploit, of course, other cracking tools. So we're going to cover some of these areas. All right, Europe. Okay. So one of the first things that a piece of malware can do is look to see if it's in a virtual machine. This is actual disassembly from the Dasher variant.  And Dasher isn't all that wonderful. It does this elite net start and then grips for the VMware string. So all you have to do on this one, it's pretty easy to start. So it's just looking for the VMware services inside of here. All right. We've got a quick demo. So we have several movies to sort of demonstrate how this stuff works. So we're going to play them. Hopefully they don't look too bad on the big screen. So this first movie is going to demonstrate how this anti-virtual machine stuff works. And let me get that started for you. Okay. So we're going to open up the Dasher worm here in a tool called Bintax. It's just a string viewer. And we're going to look through here for strings that might help us figure out what this malware is doing. And basically, there's a little bit, but a lot of it's pretty much garbage. So that's not so good. We can't really tell what's going on. So the next thing to do, of course, is pop it up in Ida Pro, the reverse engineer's tool of choice, and see if there's any more information we can get from this malware. First thing's going to happen. We're going to get some errors in Ida Pro. This is a hint that has been protected in some way, packed, compressed, whatever. When it loads up, you'll see here, like in the names window up at the top right, typically there's functions and other stuff and down at the bottom of strings. There's pretty much nothing. So we're going to run this malware. We're in a VMware machine right now and see if we can tell what's going on. And you see the malware detected us and it's destroying itself. It'll just keep running command line windows until the virtual machine dies. So that's kind of rough for analysis. All right. So the more sophisticated methods for detecting virtual machine start using some of the proprietary protocols inside of the VMware driver interface. So from a user level program at ring three, you can actually set up the entire transaction as you would to do that. So in this assembly code here, we're setting up a VMXH operation, which is a special code to send to VMware on some other values. And we're actually using the get VMware version. We set it to the Vx port and then we do an in operation to read from that port. And basically, if something comes back there, then that's a VMware port. If something doesn't, then that triggers an exception. And so you'll see this a lot in samples of malware if you do analysis on them. Okay. Again, this is the virtual PC interface. This uses the emit series of calls, but it's basically the same thing. If these fail in any way, you're going to trigger an exception and go off to it. So virtual machines are important for the malware analysts because it's important to have some level of safety. You don't want to infect your root machine. Not that it doesn't happen. But there's a couple different or a few different types of virtual machines. The first one is a fully emulated instruction set. And this is where the instructions are translated dynamically on the fly from the host OS. These have a, you know, 100% it's being emulated. Things like box, it's really slow. That's because it's doing this one to one emulation. The next advance in virtual machines is somewhat emulated. And this is VMware's acceleration mode. So this is where some of the critical instructions are emulated by the VMware, but otherwise the entire operation of it is carried off on the raw hardware. The next set is hardware virtualization. Joanna Rutkowski gave a great talk about ideas about how malware could use that. And this is the Intel Vanderpool instruction set and AMD Pacific instruction set. And what these do is they actually have chip support inside of the CPU to handle the virtualization functions. Okay. So generic VM detection, there was an excellent paper outlining the problems implementing virtual machines on IA32 architectures by Robin and Irvine at USENIX 2000. And basically what they said is that there are some registers that have system-wide applicability. So you have the LDT, the local descriptor table, the GDT, global descriptor table, IDT, which is the interrupt descriptor table, and this is the technique used by Joanna's red pill, and also the machine status word. So any time a program is executing inside of VMware, these instructions and these register reads have to be emulated. And that's where we make our tool useful. So the thing about it is the Intel CPU was not originally designed for virtualization. It either must be emulated, these instructions, or it must be translated. And so this is all ring three or user-level code or signature generation. So to further on, to go to some of the techniques, see the evil theme in here? Cheap shot. Sorry. So the IDT technique, this is done by the red pill by Joanna Rakowska and the Scoopy Dew by Tobias Klein. This is just a simple signature match on the IDT register value. But the problem with the IDT is that being the interrupt descriptor table, each CPU has its own copy of the IDT. So if you're on a multiprocessor machine, the signature is not going to match. And so the question becomes, how does the ingenious malware developer come up with a way to understand all of the IDTs across all number of processors? And so the quick thing that you can discern from this is that if you are using the IDT method, you're going to fail one over in times for however many processors you have. The global descriptor table had similar results. It was effective in discovering this. The only thing that was useful was the LDT. You could see it across a parallel system, and it always had the same idea. And since it's used for accessing local data, it's all operating system dependent, but for our case in Windows, it worked quite nicely. So memory is addressed similarly on the context switch. The problem with the LDT method, as is pointed out when we made a rootkit.com post is that it fails on full emulation. So the trick to get around this, if you want to analyze a piece of malware that's only looking at the LDT is to disable emulation. But it turns out that there's another bug, and the machine status word is what we'll use to give the full idea. So here's our grand unified VMware fingering or VM fingering, our fingerprinting algorithm. So the first thing we do is we look at the easy LDT value and see if this matches our signature. If it does, and we say fine, we're in a virtual machine. The machine status word, or if we fail on that, we look at the machine status word. The high order bytes in the Intel specification says that this is undefined. And so inside of the Intel machine, it sets it, our actual Intel hardware, it sets it to a predefined value. But on VMware, there's a bug or at least an oversight that says that it or it doesn't clear that out, possibly for speed. So that's where we build up our signature detection. Okay, so we'll do a demo here. Make this bigger so people can see it. Okay, so I'm just going to run this VM detect tool. This looks at the LDT. It's set to all zeros, which is indicative of this. The machine status word, again, the higher bits are 8001, so we can mostly conclude that this is a native machine here. Over on a VMware system, we're in the VM detect tool. And we'll see that we're detecting a fully emulated virtual machine here. And so we're also running some of the other systems to look at it. So for the emulation method, if you're in VMware and you go to options and it's advanced here, this disable acceleration is the critical one, the critical flag to look at. And so again, this is a bit opposite from the actual demo, but if you run a VM detect on this too, we can see that the LDT has this 6040 value and the machine status word is set to the normal Intel thing. And that's because the root CPU is actually running that. So this is a virtual machine without emulation. Okay, so how do you defeat these VM techniques? The first one are in the case of the Dasher variant. It's just looking for that string in the list of running services, which says, I'm running the VMware tools. So all you have to do is net stop VMware tools and then you're done. The next method that you can use is to binary patch the malware basically just to knock over the VMware detection routines. So inside of here, we're actually finding the call and patching it over with the 0x90 or not. The other thing that you can do if you like to roll that way is that you can run natively or use some obscure VM. So as you can see, Danny is the brains behind the operation. I'm just the eye candy. We're a movie happy. So basically we're going to pop this thing open in Oli debug and look at it and try to get an idea of what's going on, how it's screwing over our VM. Then this is the Dasher worm that we were looking at earlier. So this isn't like an advanced Oli demo or anything. We basically consider Oli to be sort of like a machine Tivo. We like to be able to go forward and pause things and see what's going on. So what we did here is we opened Dasher. We advance it, we step through it a few times until we get to a point where we think something's going on and then we're searching down here in this window for potentially useful strings that could give us hints as to what to do about this. It's kind of hard to see in there. So I'm going to cut and paste it into Notepad. And then we'll search through there and you can see what's going on. Okay, basically there's tons of information in here. But we're looking for something that really triggers us off on the VMware self-destruct mechanism and how that works. So I'm going to fast forward just a little bit. Okay, you can see there's a batch file called virtual.bat. That's not needed to the system. That's something that's there since the malware started running. So we're going to go take a look at that and see what it does. Okay, so we found that file. It's indeed there. And you can look in here. It's just a batch file that says look at the net start services output, run find string and find VMware. This is a really lame way of doing this. That's why we're releasing the VMware detect that Danny was talking about. But you can see that's basically what malware people are doing. Most of the malware that's out there running around the wild uses these really simple techniques. Okay, so now that we know how it's detecting VMware, let's see if we can find what it does next. So we're going to do the same thing. We advance the stack a little bit. We're going to pop this open in Notepad and look for some more useful strings that can help us out. And more fast forwarding. You know, the other malware is more advanced. You might not be able to do this. Like we'll get into it a little bit more later. But it might detect all the debug and prevent you from doing this kind of thing. Almost there. All right, so you can see there's a really friendly batch file on the system now called f-off.bat. Definitely not something that we put there originally. So the malware had to create this. We're going to pop this open and see what this is going to do. Probably not something friendly. So it's basically just a go-to loop. Spawn a command shell over and over and over again. Till you fill up the memory, okay. So the next thing we got to do if we want to do some real analysis on this malware is get around its protection mechanism. The simplest way, I mean you can do some of the old school cracker stuff that Danny was talking about and knock it out or whatever. But if you don't really know what's going on, do the same thing it does. Look in the services strings for the VMware tool service and stop it. So we're going to stop that service. Now if you do a net start and look in the services list it's not going to be there anymore. So when the malware looks for it, it's not going to find it either. Then the next thing to do is to instrument your system with things like sysinternals, regmon, filemon, whatever. So you can see what the malware is doing to your system when you run it. You want to look at things like network ports, run a sniffer, all that sort of stuff. Fast forward just a little bit more. Okay, what we're doing here is filtering out known things in regmon. We're going to run it and you can see in the background all that stuff got populated. That's everything the worm does to our system now. So we're inside of VMware. We're able to analyze this malware that we weren't before and build up a model or a signature for what it's going to do and run a sniffer and take a look at that. Okay, so a couple of the other things besides VMware detection that malware does is binary compression. There's a lot of reasons for doing this. Smaller binaries takes less bandwidth. This is really important in worms so that they can propagate really quickly. Leave a smaller footprint on your system. Makes it harder to disassemble and analyze, figure out what's going on. There's tons of packers out there off the shelf that you can get. Lots of people write custom packers for their malware. The next thing is encryption, which is very much related. Basically, these things load a small decoder stub at the beginning of the binary or something like that and they either uncompressor or decrypt themselves before they execute. This doesn't give you a smaller footprint, but it makes it harder to reverse engineer or analyze what the binary is doing. There are some legitimate uses for this stuff like intellectual property protection, but I don't think anyone really takes that seriously because all of it can be broken. Okay, just gonna show a quick example of what that looks like. We love movies. All right, we're gonna take some botnet thing that we found out there and take a look at it. This one hasn't been protected with anything.  It's got denial service stuff going on. It's got IRC commands. So it's pretty easy to tell what's happening here. If you pop it open in IDA Pro, you're gonna see quite a bit of information that you can fully reverse engineer this bot. You look up there, there's functions in the top right, there's strings in the bottom. The assembly looks pretty good. It's easy to figure out what this is doing. And if you look at a call graph, it makes a lot of sense, it's really clear. So we're gonna protect this as one of the common packers called UPEX. This is a compressor and we're gonna compress the bot and then we're gonna do all these same steps again to see what changed and how it looks different. So you can see in here, most of the strings have disappeared. There's still a few here, but it's actually improved the protection of this piece of malware. When you look at it in IDA, you're gonna see a bunch of changes. The first being you're probably gonna have some errors, like trying to find the import address table, for example. And you can see there, there's a lot less functions. The strings are pretty much mangled. The call graph looks really interesting. Little less clear than the previous one. There you go, that's for comparison. Okay, but still it's not too bad. You can glean some information from this. All right, we're gonna get all hardcore and use morphine. It's written by a guy named Holy Father and this is an encryptor. So we're encrypting on top of this. And now when we pop it open, take a look at it. You know, there's even less strings, pretty much none, except for get proc address and load library. Those are really common in malware. You'll see those all the time. And IDA is gonna look really bizarre once we open this one up. Okay, no strings, basically nothing in the names window and a really confusing call graph. So that loop right there is probably indicative of the stub that unpacks or decompresses this whole thing. Okay, so a little Faustian picture there. How are we gonna defeat this stuff? Well, there's a lot of different ways. There's some basic ways, like you scan it with a detector and if you can detect what it's packed or compressed with, go out there and search around for an unpacker or an encryptor if it's available. A lot of times that they're not, so you need to unpack it yourself. There's a great tool called x86EMU by Chris Eagle. Highly recommend for doing this kind of thing. Of course IDA, Olly Debug. The best way for getting around these malware protections is to actually partially execute the malware and dump the region of memory where this process resides. Some processes don't stay memory resident, so this could be a little bit harder. You need to run like a debugger so you can pause it right before it exits or whatever. Okay, there's another video here. We'll just take a quick look at this. All right, so you can see we have some professional tools developed for this. These are three of sort of the top packer detectors, PID and P-Scan and a protection ID.  They have no idea what this is protected with. These tools based on like opcode sequence signature matching, which is okay, but a lot of these new packers and encryptors coming out are polymorphic, so it's different all the time. A lot of these demos are with real live malware that we get through our site, so these aren't contrived. These are actually, we're reverse engineering realm malware. Okay, so what we're gonna do here is pop this open in Olly Debug and we're gonna advance it through. We're gonna step through several instructions to try to get it to a certain point. There's way more complex techniques than this, but we just wanna get the basics out of the way. There's a tool called LordPE, which I like a lot. It's good for editing binaries. It's also good for dumping them. You can dump them in Olly Debug with a plug-in. So what we're gonna do here is we load it up in Olly Debug, which pause the malware process for us. We found it in LordPE and then we're gonna dump it. And then LordPE has a little tool to help fix up the binary and hopefully get some more import table information. All right, so previously we had this thing, the packers couldn't detect it. We couldn't find any strings. Pretty much was hard to figure out what was going on. Now that we've dumped it from memory, we can open it up in IDA and hopefully you'll see here. Yeah, all the functions are available. Strings are available, so you can start to see here.  We're gonna pop it up in the strings window because it's a little bit easier to see. I mean, the main point of reverse engineering malware is to find out what it is and what it's doing. And a lot of times you can figure that out. For example, these strings here, it's obviously a porn bot of some sort.  Okay, so the final kind of protection that we're gonna go over here is anti-debugger technology. People are getting really crazy with this. They're like, check summing their binary image and memory. But this is one of the simple methods. Windows actually provides an API call, which is useful to developers to detect if a debugger is attached to their process. This is just some basic code to show how this works. There's a lot of different ways to get around this. We actually did some cracker stuff and found this in a binary and jumped over it. OliDebug has a really helpful isDebugger present hiding plugin now. So that's one of the best ways to get around this. I don't think I'm gonna go into this video because this is pretty simple. You basically run OliDebug if you have the plugin installed and quit and click hide from isDebugger present. Okay, one of the other things that we did here is we disassembled the binary. We found the isDebugger present call in there and basically changed the jump so that we could get past it. You can see in there, basically if the debugger's present, it sends you to a you die now call. So a lot of malware will do that. It'll delete itself or similar to the VMware protection stuff. Okay, now we're gonna get to the cool stuff, hopefully. Exploiting malware vulnerabilities. Often malware writers don't care about quality or stability. They just wanna get it out to get famous or if they're trying to make money from identity theft. So they don't really write great code all the time. Which means that often the malware has vulnerabilities. A classic example of this is this thing called the AV serve FTP server. It's used in a lot of worms. Like I think the Sasser worm probably used it. So we took a look at this thing. Somebody out there wrote an exploit for it which was kind of hard to use. So we decided to use the awesome Metasploit and make it better. We unpacked this binary using the unpack methods we mentioned earlier and we started analyzing the disassembly. Inside here is a real basic buffer overflow in the port command of the FTP server. If you look up there basically it takes the port command from the user and whatever port the user feeds it, it sends it right to a stir copy with no checking. So you can send a port command of 500 days. Okay, Metasploit's great because you can write like one line exploits because the whole framework's there to handle everything for you. So that's basically what we did. Sometimes writing a Nile service attack for a piece of malware could be really helpful. If you own your network, for example, if a network gets compromised by one of these worms and you can't make it to all the machines to go cleaning them up, you could do like a broadcast Nile service attack which will kill the worm on everybody's machine but leave the host intact so people can keep working. So that's kind of the idea behind this what we're doing here. At the bottom in red you can see we developed a really simple request through the Metasploit framework to send a port command of 295 As. Okay, well that's pretty cool but just for bling's sake, we're gonna kick it up a notch and see if we can get a shell on this piece of malware. We used a classic SEH overwrite to do this and Metasploit framework to develop it in one line. Metasploit has a cool tool called MSFP Scan which can find return addresses and DLLs and things like that so we use that. There'll be a movie for this in just a second but I wanna cover the exploit line real quickly cause it's a little bit complicated.  The reason for this is because on this particular one memory gets corrupted and two copies of our shell code get created. The bottom one is destroyed and the top one's actually good so that's why we're jumping back and then some padding. So let's show the fancy video. All right, so the two black windows are SSH into a system running Metasploit. We're gonna open up this piece of malware in Windabug so that we can watch what happens when we send our exploit. You can see up there it dumps what DLLs are being imported into this malware FTP server so we were able to look at that to decide which one to pick to find an address. So we hit G, the malware's running, we're gonna go ahead and write our exploit real quick. This is the first version, the Denial service, just to get a feel for what's going on. So just for the heck of it, we're gonna send it 500 As and see what happens. So we send our exploit, sends a port command and you can see in Windabug the worm crashed and we own EIP. All right, so looking through memory just to get an idea of what's going on we can see all our As are in there, the port command's in there and we've basically taken over this piece of malware.  But we're gonna get a little more complex and write a real exploit for it. Okay, so like I said before, the port command, some padding, we're gonna do all that stuff. We actually just guessed completely on the first try and got it all right. Okay, we need to use the MSFP scan to find a suitable address to jump to and it's pretty easy.  This is a little endian so we gotta flip all the bits around. Punchline's coming, I promise. Okay, so this is the part where we're gonna put our shell code, we're gonna jump back 1,005 bytes and some padding at the end. But this shows really some of the power of Metasploit. I mean, you can write a pretty complex exploit in one line. Okay, so we're gonna load up our exploit if I can type it correctly and then we need to go ahead and start up the worm so that it has something to attack, close our debugger and sometimes you wanna make sure the worm's actually fully gone from your task list because things can hang around and cause problems. Okay, so the worm's right in the background, we're gonna type exploit, it's gonna send the FTP command and we got a shell. Okay. So it's just a different kind of concept, you know, fighting evil with evil, using all the same techniques that exploit developers use against malware, worms, Trojans, whatever. Okay, so now we're gonna introduce our website. Guess two of us can't stand here at the same time. Okay, so we can hack the malware, now what? What do we do with this? Basically we want access to more malware, we wanna make it more open. Right now the antivirus companies use the previous methods and others to build commercial products, but there are well-known deficiencies. There's the signature performance, amount of processing required on the computer, and they're intrusive, not very effective, and the performance isn't all that great. So, you know, personally I don't run AV protection because it gets in the way of other stuff I wanna do. So how is the AV market doing? There was a recent article that came out from OSERT saying that there's a 20% detection rate and looking at our database we roughly confirmed this using very unscientific methods. But this is, profit is their primary goal, and that's fine, we're not against that. But what we would like to do is have a lot of the AV companies collaborate with each other. So this 20% detection rate wasn't 20% of all the malware that was detected, it was each AV company detected a different 20%. So if they combined, then they would get more, you know, 60, 80%. And again, the behavior-based models are the new hotness, but if you start doing that, then you get into more performance problems. So what we say is that open analysis of malware and open sharing can only help the situation. So what's wrong with the current situation again? The field is very elitist. There are lots of vetted private mailing lists. If Paul Vick sees in the audience, he can tell you all he's got some ideas for a private or exchange system. But generally these are hoarded, and the idea of these collections becomes a commodity for all the AV companies. And so what also happens is that AV companies come up with a situation like the Nixom worm, or LoveSan, or I think every single AV vendor had a different name for it. So how do you come up with this? And MITRE's done some work on naming that, but it hasn't been well adopted. The other problem is that there's casts of researchers. You have to prove yourself to get into the field, and it prevents outside analysis. So if you've got a, hey, I got an idea and I need four gigs of malware, that doesn't really fit here. Learn the current situation. So academic analysis is limited without effort, and it's not attractive. If you're sitting with something on your network, and you need to know something about it, the information provided by these outside vendors isn't always complete, and it's hard to validate these results. So you wanna ask the questions, what can I do to stop this, and what is this thing doing? If it's targeted specifically for my company, I need to know right away. So what's our solution? Everyone gets the same access to malware. We do not vet. The only vetting we do is we check to see if your email skills are there, and you can click a link. And so all the analysis is done in an open manner. Other than requiring you to log in, everything is shared and available to you. We've got an online web forum, bulletin board type environment, and soon we're gonna have an auto decompiling wiki-styled environment. So our end goal is IDA for the web, but we'll see how that works out. The other thing that we're doing is auto scanning with a set of AV products. We've got a pretty good sampling of the UNIX scanners that are available. And there's a lot of these available already, but in this case, and there's, the theme with those is that you upload your malware, but you can't get what other people have uploaded. So we'd like to change that. Next thing is unpacking and decryption. This is an ongoing method. Right now it's pretty manual, so if somebody unpacks a malware, then we can go ahead and include that. So we're working on some automated methods, and we'll of course be sharing those as they come available. So we've got a little bit of criticism from this. If any of you read FundSec, you were witness this firsthand. So the first comment we got was, lack of a vetting process helps the bad guys. Well, what we're saying is that it helps the well-intentioned analysis, or it hurts them much more. So writing effective malware is hard, thankfully, but defending against it is harder. It's a lot of work to get into the reverse engineering field and that sort of thing. And if we come to it, AV is failing. It detects the known stuff, but the unknown stuff is what we're worried about. But there's other people that say, I don't care if you distribute your samples, open analysis is a bad thing. But open analysis is already available from Symantec, McAfee, and the good guys at Fsecure. So we say that this doesn't matter too much. So what we're looking for is a synergy between the access to the malware and getting that. So the other thing we'd like to see more of is that peer-reviewed publications tend to focus on malware performance rather than mitigation. People are starting to work on some automated methods to discover this, but for the most part, it's not there yet. So malware is poorly written. It's difficult to make it reliable and it's difficult to make it portable. But as soon as whoever's writing all this figures out test-driven development and that sort of thing, then they're gonna go crazy. The field will go crazy. All right, so this is how we're ruining the inner tubes. Tubes. Okay, so we're gonna talk about our automated malware analyzer. Basically what we've done is we put online a searchable web database. We run a number of checks on the malware, like file typing, multiple check sums because as we all know, the SMD5 sum's been broken. Packer detection with MSFP scan. Actually, HDMor did a few modifications of this tool so that we can feed it a Packer database and then it can scan a file for those opcode sequences. So thanks to him. We do multiple antivirus scan like he talked about, kind of like virus total. We gather portable executable information like the sections and headers and all that kind of stuff with a tool called the Pelt Project. We have a rudimentary auto disassembler and actually we've been talking to some people about how we can improve that so there'll be some cool stuff there soon. And then we have this massive binary archive of malware. We get strings disassembly to a wiki. This is just sort of a screenshot of our site so you can get an idea of what it looks like. We've got uploads, you can go up there if you have an executable or a DLL, you can upload it to our site. It'll auto analyze it about 30 seconds to a minute and then it'll give you some results back. All those results get put into our database so if you find something on your system you can search our database and get not only analysis but a copy of it in case you're looking for some specific worm. And then we also have this blog system where we can post really in-depth analysis. We tend to get a lot of the new stuff really quick so check there frequently for in-depth analysis. This is what the database output looks like so if you search for an MD5 sum or a particular malware name you're gonna see something that looks a little bit like this. Basically you know your check sums are at the top, what type of file, what type of packer, if any of the antivirus detect it and you can see here they didn't do so well. More constantly adding new antivirus tools as we get licenses for them. And then over on the right you can actually download a sample, it's compressed and password protected but the password's right there. You can get a text report with some of the more executable information in it disassembly and some strings. Okay so this is sort of the proof of concept idea here where the automated analysis is gonna go through an attempt to disassemble this and if it's successful it's gonna put it into a wiki so multiple people can log into the site and work on a piece of malware, add comments, et cetera. Just another view of this you can see here. You know a little piece of disassembly there or someone went in and added a comment. This isn't that cool yet but I think eventually as we work on it it'll be pretty useful. All right so I think we're gonna have some time for questions and answers here in a second but just to wrap up real quick what you just saw was an improved method of virtual machine detection. Some of the typical things that malware does to protect itself. Some kind of nifty exploits against malware and then our offensive computing project which we hope we can get more participation in. All right anybody got any questions? Yes we have root kits, Trojans, viruses, worms. We have about 32,000 pieces of malware in our database currently and tens more thousands waiting to be put in. Hold on one more time. Well it's different in the sense that it's pretty well organized, it's easy to find. We're getting a lot of support from the community to add new tools. Pretty soon our auto analysis will be really in depth and intensive and the question was how is this different from other virus bulletins? You know and basically the thing is just a lot of those are just collections of malware not so much analysis and it's not vetted. Anybody can join. Can you hear me? A lot of these AV vendors are claiming they're not using signatures as much, they're using heuristics and stuff and they can detect zero a day. Have you analyzed any of these vendors and seen if it really works? We haven't seen much success with that. I'll let Danny talk about it a little bit. Well I mean you can take a look at the 20% detection rate that they're getting and make your own conclusions from that. Thank you. Sure. Yeah one second. Any other questions? It must die. Okay there you go. Thank you very much.


So one thing that I will say about last night's debate is that Pete with a judge did not have a very good night And I say that not because I think that he face planted but because he needed a really strong Solid showing in order to hopefully overperform the polls in Nevada He needed to communicate to communities of color that he's sensitive to their needs He needed to demonstrate to voters that he's not this vapid corporate talking point thumb pointing machine And he didn't do that and one thing that's also clear is that the other candidates increasingly namely Bernie Sanders Amy Klobuchar Are fed up with Pete with a judge and he's just there's something about him that Listening to him speak like I have this visceral reaction He just gets on my nerves in a way that no other politician ever has and I think it's because he's just so fake everything is Scripted focus group driven and he's just a smug little elitist shit head I mean, I don't know how else to put it and even though ideologically speaking for what policies we know people to judge supports I think that I'd probably prefer Biden to him at this point because people did is just he's so he's so hollow like he stands for nothing and He is willing to take on whatever policy He'd become a Republican like that if it means he'd be able to get power So I mean I just I can't stand them and I think that that's a sentiment For most normal people and I try to ask individuals in my social circle who aren't as you know online as I am who don't follow Politics as closely about what they feel about people to judge and I kind of see the same thing They're like they there's just something about him that turns people off And I think it's because he's so fucking fake now He decided to be incredibly aggressive He went after Bernie Sanders more than he usually does tonight and all throughout the debate as people are On that stage dunking on Mike Bloomberg You have Pete little judges team putting out tweets about Bernie Sanders attacking Bernie Sanders And what he did on this stage was just disgusting He basically equated Bernie Sanders and Mike Bloomberg and made it seem as if they're equally evil I'll be it for different reasons But what I loved is that Bernie Sanders put him in his place and it was so great to watch We could wake up two weeks from today the day after Super Tuesday And the only candidates left standing will be Bernie Sanders and Mike Bloomberg the two most polarizing figures on this stage And most Americans don't see where they fit if they've got to choose between a Socialist who thinks that capitalism is the root of all evil and a billionaire who thinks that money ought to be the Root of all power. Let's put forward somebody who actually Lives and works in a middle-class neighborhood in an industrial Midwestern city. Let's put forward somebody who's actually a Democrat Look, we shouldn't have to choose between one candidate who wants to burn this party down and Another candidate who wants to buy this party out. We can do better If speaking to the needs and the pain of a long neglected Working class is polarizing. I think you got the wrong word What we are trying finally to do is to give a voice to people Who after 45 years of work are not making a nickel more than they did 45 years ago? We are giving a voice to people who are saying we are sick and tired of billionaires like mr. Bloomberg Seeing huge expansions of their wealth while a half a million people sleep out on the street tonight And that's what we are saying Pete is maybe it's a time for the working class of this country To have a little bit of power in Washington rather than your billionaire campaign My campaign is fueled by hundreds of thousands of contributors including 46 billionaires among the hundreds of thousands of contributors and We've got to unite this country to deal with these issues You're not the only one who cares about the working class most Americans believe we need to empower workers as a matter of fact You're the one who is at war with the Culinary Union right here in Las Vegas You have a dreamed of we have the support of unions all across the division I'm putting forward has the support of the American people we can actually deliver health care without taking it away from anyone We can actually empower workers and lift wages without further polarizing this country And we can build a movement without having legions of our supporters online and in person Yeah, so you're gonna get some extra rat emojis for that last comment you smug little rat-faced fucker This guy is just he's insufferable and that line about how we shouldn't have to choose between a candidate Who wants to burn this party down and a candidate who wants to buy the party out? He was so proud of that line that immediately after he said it his campaign tweeted out an image of his face with that quote Brilliant so brilliant Bernie wants to burn the party down So much that he's running to be the nominee and that he's literally part of Senate Democratic Party leadership Like who do you think you are?   He's a threat. He said on stage He knows that it could be Mike Bloomberg and Bernie Sanders Remaining after Super Tuesday. So do we really want that to be the case? I don't want Mike Bloomberg to be the last one standing But if we truly want to beat Donald Trump, don't you think that the most popular politician in America? Who you once claimed had courage should be the nominee? Someone who can excite young voters. I mean, I'm actually surprised that he was asked during this debate If he's out of touch with his own generation and the answer is yes The answer is yes because he doesn't represent what young people want He is painfully out of touch and if he were the nominee he would get so thoroughly destroyed by Donald Trump It wouldn't even be funny, but everything he said about Bernie I think that Bernie Sanders rebutted with the perfect response So Bernie Sanders said what we're saying Pete is maybe it's time for the working class of this country to have a little bit More power in Washington rather than your billionaire campaign contributors That was such a good burn and that's gonna land with people because guess what most Americans believe that there's too much money in politics They believe that rich people and elites have too much influence on our elections So every time Bernie Sanders calls that out You have less and less legitimacy So if you want to step to Bernie Sanders be prepared because you're gonna get punched Metaphorically of course now Buddha judge responded by saying our campaign is fueled by hundreds of thousands of contributors And Bernie chimed in and said including 46 billionaires So good so good now He also attacked Bernie Sanders because his supporters allegedly attacked the culinary union now I've talked about this on the show I don't know what attacks they're talking about is it mean tweets I don't know because I'm a very online person So if the culinary union put out some type of anti Medicare for all statement I would have seen it likely and pushed back, but they just claimed out of nowhere that Sanders supporters are harassing them Okay Well, if they're literally harassing you and doxing your members then I absolutely unequivocally condemned that But I have my doubts because it seems like when everyone in mainstream media and other Democrats are just suddenly condemning Bernie Bros. It just seems a little fake. It seems like it's a narrative It seems like it's a coordinated attack to take down the frontmatter.  Bernie has labor on his side and you have a lot of opportunists in this race Joe Biden, Elizabeth Warren and P. Buttigieg who are trying to jump on this issue to not just demonize Bernie Sanders But to make it seem as if they care about labor, right? They care about unions. They care about workers But that's false. Not a single union has endorsed Mayor Pete's Medicare for all who want it in spite of the fact That he claimed that it has majority support. No, it doesn't have majority support Medicare for all does Has there been a single poll done?  Like if you have insurance now, it will be replaced. You're not losing something But for him to say this it's just a bold-faced lie and this is why people don't like Mayor Pete This is why Millennials and Zoomers don't like Mayor Pete. It's because they see right through him He stands for nothing and he's just trying to win by all means necessary Even if it means demonizing someone who he you know said he supported now when it comes to the issue of health care I do have a clip for you because I've been saying for literally months now that when it comes to this portion of the debate Even though Bernie Sanders, I think has already persuaded Americans that Medicare for all is the way to go He's really, you know honed in on what he needs to say to convince people One thing that's lacking and it's severely lacking is that Bernie Sanders never ties The the industry the private health insurance industry and big pharma and the Contributions that they've given to the candidates on that stage So if you explain why Pete Buttigieg is saying I don't support Medicare for all any longer now I support Medicare for all who wants it and you explain that he's been bought off That is going to be a powerful powerful statement and it will register with every single voter and the rat will be exposed Well, guess what Bernie Sanders did that tonight and it was glorious somehow or another Canada can provide universal health care to all their people half the cost UK can do it France can do it Germany could all of Europe can do it Gee whiz, somehow or another we are the only major country on earth that can't do it Why is that and I'll tell you why it's because last year the health care industry made a hundred billion dollars in profits Pharmaceutical industry top six companies 69 billion dollars in profit and those CEO CEOs are Contributing to Pete's campaign and other campaigns up here. Let's clear this. So maybe Maybe it is finally time that we set as a nation and not there's enough the function of a rational Health care system is not to make the pharmaceutical industry and the drug companies rich It is to provide health care to all people as a human right now the privilege That is how you do it whenever we have this conversation I think that Bernie Sanders has already said everything that he needs to say and he's been so effective at You know fighting through the corporate propaganda these lies about people losing their insurance and it costing a hundred trillion dollars like all this bullshit This is what's missing. This is what was missing and now you have to say this every single time But be more specific next time a little bit of constructive criticism bring up the specific contributions bring up how these you know Billionaires in the health insurance industry are directly financing name them name at name signal name their contributors because that is how voters are going to see Why they're saying the way the things that they're saying about Medicare for all why Pete is specifically but this includes Amy and Joe Biden as well because we have private health insurance now like we don't like it.  It's like six thousand five hundred can't use that. Okay, so Yeah, this is what you need to do And I just love this because Bernie Sanders during this debate He trapped a rat and it was what we all wanted to see and frankly what we needed to see After weeks of this smug little fucker claiming that you know poll show He's the best to take on Donald Trump that he won Iowa.


For the Liberations on the floor of the New York State House of Assembly, it's a centred on aid for the state's government to rehabilitate roads across the state to enhance movement and social economic activities of the people. Our correspondent, John Alabe reports that this followed the adoption of two motions bartering on construction of some roads in the state. To be interested at 98% of the civil servants in this state lives around the edges. The economic value of that area has been really considered as almost nothing. It needs an urgent attention. We have to do something right now. People have been short of even going to the work. A lot of things have come to them which I don't really want to put on camera. But it is important right now for the government to move to that.


and what's beyond it has always fascinated humanity. From ancient times, we have been trying to decipher the mysteries of outer space. Every major culture of the ancient world had its own myths and legends about space. With the coming of modern science, many of these mysteries have been solved. Yet, we have miles to go. Meet Anamika, a young girl from the rural hinterlands of India. She has a dream. One day, she wants to reach out to the sky and beyond. Yes, she wants to become an astronaut and reach outer space. She wants to follow in the footsteps of her icon Kalpana Chawla. Kalpana Chawla. India's first woman in space was from her village in Haryana. If she can, why can't I? thinks Anamika. Indian space research has always been guided by the spirit of taking human civilization forward. Not for a sense of competition, neither a sense of pride. Space, besides everything else, is a developmental tool for us. A research dedicated to a better life and livelihood of human beings on Earth. India has got a very vibrant space program. Over the last four decades, we have achieved self-reliance in developing these technologies. We have our own capability to build the satellites, launch them with the rocket systems, what we have, and provide application programs based on the space technology. Although the seeds were sown much earlier, the real impetus of Indian space research started in 1972. To start with, the government of India set up the Space Commission and then the Department of Space. With time, the department spread its wings far and wide and started serving the nation through its organizations located across India. ISRO concentrates on three key areas. And these are the areas that lead to the growth of the nation. Year on year, the Indian economy is growing at the rate of almost 10% and fast reaching a double digit growth. Space research built the edifice on which the economy is standing today. What are the factors that lead to its growth? People need to communicate, learn and connect to the world. Space research ensures that a biosphere needs to understand itself well, know its topography and climate to maximize its potential. All this can be done effectively from space. I think we do need to invest in the future just as we have done in Antarctica up till now. And the reason being that the future for mankind does lie in space. Our resources on Earth are limited and therefore we must exploit all that is available, augment, supplement our resources which are finite and which are being used at an alarming rate. Today we have a nation of billion people to connect. We have a mission to fulfill, to use space technology to ensure a better life for the generations to come. Today when Anamika looks at the moon, it's no more just a fairytale land for her. It's a truth. A series of unanswered questions and she knows that she will find answers to at least some of them someday. The sky is not the limit for us, not anymore.


The purpose of this study was to examine the accuracy of data regarding drinking during pregnancy among American Indian and Alaska Native women. Researchers examined the methodology of previous studies which had focused on either higher risk populations or smaller geographical areas. They concluded that these studies had resulted in an incomplete and inaccurate picture of the overall prevalence of drinking during pregnancy among American Indian and Alaska Native women. This article was authored by Jessica D. Hansen, Michelle Sarge, and Deidre Butchwald.


So I just replaced the computer inside my arcade cabinet that I'm working on with an old Raspberry Pi that I haven't been using for a while and You know I installed Retro Pi which is working great except for when I was SSHing into it It was using bash and I'm using using zshell and I have all my Configurations for zshell setup, but if I change my default shell to zshell emulation station won't load So you have to have bash as your default shell or I guess I could probably figure out the configuration But that's not problem because I only want zshell when I'm SSHing in so what did I do to get it to work? If you run the tty command it will tell you what tty you're at as you can see I'm SSHed in here And I'm not at a real tty right because I'm SSHed in a real tty Would be if I was physically at the computer outside of a GUI now if I go into that bash our C file And we look down here at the end. I added Go all the way down to the end. I rang the tty command and I'm checking my tty one if not Export my shell as zshell and then launch zshell with the login option And that is how I was able to get zshell running when I SSH in But still have emulation station running and I didn't have to worry about Rewriting the config files for zshell to load emulation station the way it's supposed to run with bash thought this might be useful To some of you out there who are like me and are running emulation station with retro pi But prefer zshell over bash so or maybe you just have another situation I can't think of any other situation. I've never come across this before But if you need to keep your default shell as one shell But launch it as another one you SSH in this is how you would do it


My name is Brandon Burright and I'm a lineman. The hardest part about my job is being away from my family for an extended amount of time. Sometimes it's five days, sometimes it's eleven days, sometimes it might be three weeks. We wake up at 4.30 in the morning. Your wife and kids are in the bed at that time and sometimes you don't get off to after dark or even later. So they're in the bed by that time so if you talk to them it's very little throughout the day so it's hard to ever get to talk to your family or see them. The longest period of time I've been away from home on a job was 2005 Hurricane Katrina. I was going for over a month. It's about five weeks. The best part about being a lineman is the times it comes with difficult tasks and the feeling of accomplishment when you complete those tasks. When somebody shows us appreciation when we're out on a job storm and such it feels real good.


What's up everybody, it's Jason here for Jaspy's Case Breaks.com 2021 Impeccable Soccer One Box Break, random number block for Manchester United. Just sold out. This helps sell out. You pick your team at number eight break and again you're getting a piece of Manchester United for a fraction of the price. So again, these customers are not going to be entered into the Prism Soccer Promo or we're giving away a couple of boxes if you bought Team Straight Up, but this is a stuff and curry and $500 break credit promo. So again, if you bought spots in this R&B and the Chelsea R&B, you would have a shot to win a stuff and curry jersey and up to $500 in break credit. These are the breaks you have to sell out. This is the first one that we sold out. You got a couple more breaks and a lot of these guys are in single digits or about to be. So again guys, here's the dice roller, here's the customer name. You guys know how it works. Will and Rob, good luck. First number on the left side of the serial number dash. Remember all redemptions go to spot zero, any one-on-ones go to spot one. Any unnumbered cards will be randomized to one customer in one lot here in this break as well. So there you go. Roll it. Five out of five, ten times. Good luck. One, two, three, four, five, six, seven, eight, nine, ten. Ten times. Robert down to Robert. Five out of five, ten times. Ten times. One, two, three, four, five, six, seven, eight, nine, ten. Boom. Ten times. Ten times. Eight. Down to three. And again this was for the man, you, R and B. Ten, ten, ten. So Robert Ongo, you have eight, one, four, Will with six, five, Robert with two, seven, Will with nine, Rob, you have any unnumbered dimensions, zero and three. So guys, really appreciate it. Next up is the Arsenal, Manchester City, and Chelsea, R and B. And after that we'll start the break. Guys, good luck.