The T2 Tile project is building an indefinitely scalable computational stack. Follow our progress here on T Tuesday updates. So check it out. This is the beginning of the next T2 demo. It's the 2D printer or at least it's the first 2D printer demo. The little green thing is the object to be copied. It's passing the swap lines through their white and black rows. You can kind of see them. Copy line by line lead behind the children as the parent moves away. And in the very first generation, if you look close, there's a mutation.  I'm old.  But then, you know, the bigger picture, it seems to me is that getting perfect, you know, extremely high reliability copying is non-trivial. When you're doing this spatially distributed, you don't have, you know, at edges of memory. It's all happening in the same place. Whereas imperfect copying, which leads to evolution, is much easier to come by. So that's the motto for today. Evolution happens. So it's been two weeks. There's lots of news. Let's just get into it and see as fast as we can. We have two, well, we have two new recurring donors. I really didn't even think that was a thing. I mean, I knew it was a thing, but I didn't think it would be a thing for the foundation. Abhinav, who got a nerd number a while ago, has, you know, stepped up to recurring donation. And Brian, a guy from, that I knew from UNM days, took a bunch of classes with me. Did some of the, you know, early stuff with the Mobile Feast Machine has reappeared. It's a monthly donor. Hi, how you doing? Thank you. I know exactly how this is all going to work out, you know, it remains to be seen. But just the feeling of getting support from folks. Oh, and I haven't sent the emails, folks. So as far as getting your actual nerd number for you, Brian, it's just because, of course, I'm terrible. All right, moving on. Oh, yeah, I have been invited to give an invited talk at the eighth workshop on biological distributed algorithms. It's sometime in May, I think, not that far away. It's virtual. Invited by, you know, a friend and colleague who is, you know, on the committee for the workshop as often is the case. We talk about, you know, the old boys network or the just old people network. And there's a lot of truth to it, but that works true for me too. I mean, I would much rather work with friends. I work with people that I know. This is a little bit scary. I mean, biological distributed algorithms sounds a lot like living computation. And it is. But my understanding of, I haven't been to one of these is that, you know, it's biologists, real wet biologists or the spectrum of biologists at one end and computer scientists at the other. And then the computer scientists who are take part in this tend to be toward the more theoretical end of the spectrum. Pod-C principles of distributed computing is one of the big theoretical distributed computing conferences. Probably the biggest one, maybe as far as I know. And I'm not at the theory end of the computer science spectrum. I'm at the systems end of the computer science spectrum. So I don't know exactly how this is going to work out. We will find out. Stay tuned.   And this reminded me of a picture that I had taken way back in 2013 and posted on Google Plus. May it rest wherever all the Google apps that get tried and dumped go to rest. So I dredged it up and I reposted it as a reply to this. And since Joey's tweet did a 10,000 plus 10, I don't know, 20,000, lots of likes, I got a tailwind. And so this is it, robot trap. You know, I drove by this one day and it just struck me as funny. So I took a picture of it and, you know, it fits into the whole rule following frame of mind that we think robots would be that way. We don't really think robots would be that way. But that's the way to the traditional view of robots. And so then in addition to everything else that's happened over the last couple of weeks or not all of it, but the last week, particularly. I've been kind of keeping an eye on the notifications, watching the likes come in and so forth.  This was this was fun. This is more likes than I've ever seen. And as of this morning, it was like 395 likes. So I'm betting it's going to break 400.  And some of them liked and even retweeted some of the older stuff that I had done that was clearly in the living computation thing. So yeah, you know, me, the last person to get to it, of course, you know, the power of marketing. You got to get out there. Well, so I got out there a little bit. Yay. In that same spirit, last T Tuesday update 295, you know, with our club of 150 reporting in. Thanks, folks, on clicking in the YouTube comments is doing almost 200 views. It's number one in the last 10 videos on the T Tuesday updates. And so that's good for what it is. We'll see whether this one can match that as well. I kind of hate the fact that you're always competing with yourself and YouTube just keeps showing you how you're doing against yourself so that you cannot possibly win. Next week, next time the standards are going to be higher because of the success of this one. All of this video for both for the updates and the demos and all the grid recording and everything. We are running out of disk space. So we're shopping for a network attached storage. You know, if I was younger and more like I used to, I would be building one of these myself, you know, a little Linux box Raspberry Pi. Who knows what it is.  We have one of these synologies, a small one and it's been it's been fine. So we're looking at that. I'm thinking raid 10. I do not believe raid five, six. We have any raid proponents out there. What do you think I should do? And we have well, so there's the there's now two demos up on T2 demos. The third one on the evolution one that we saw a little bit here will be up neither today or tomorrow. Whenever I get through all of this and step by step, we now have some subscribers and so forth. Okay, yeah. One last point about YouTube. If anybody watches anything on YouTube, you've probably seen Neil deGrasse Tyson or the like in this ad. But you haven't seen this, you know, this is an ad on one of my videos. It's on the computer science, the history of computer science video, which, you know, I don't monetize and I don't really want into. I never really wanted to. I mean, I don't have enough traffic. They don't even this is a nice trick, right? I do not have an I have enough subscribers on the day back the channel, but I don't have enough watch time hours for YouTube to say I could be a partner in their advertising. But now, and this is a relatively recent change, although they pretended it wasn't a change. They are starting to put ads on videos of people that don't monetize like me. And so if the beginning of the video is like appropriate or whatever, they'll feel free to do this. I read about that a month or so ago, but I didn't really expect it to happen. So now I'm wondering, you know, do I need to make a new little intro bumper that we would put on it that would have stuff like this? You know, just a little montage. So to make the make my videos a little bit less advertiser friendly. You know, or am I supposed to relax? Am I supposed to say, yes, it's okay to try to make money, even though that's not what this project is about. And I always felt it was sort of a mark of honor that I wasn't trying to make money about it because I had a bigger purpose that the goal is to change society to change the computer science industry and not to make money for me. I start to wonder sometimes whether I'm going to have to try to make money in order to get anybody to take it seriously. But who knows? We'll see what happens. That did kind of aggravate me. All right, that's the news. Most of the time this week, I was yak shaving on the We Are Coders Hyperspace Lecture 2, which was supposed to be out in January of this year. And it's not out yet. But I'm going to declare that the next T Tuesday update, April 13th, is going to be this video. It'll be over on the Dave Ackley channel, but it's going to stand in as the next T Tuesday update. So it's now on the record. It has a specific date that it's got to happen. We are coders. You know, the idea is not just programming like programming regular computers, but also programming each other using natural language like English. Like it's happening right now. And if that means we are coders, that means we're also the machine if we're just exchanging programs with each other. So in order to understand the sort of We Are Coders Hyperspace point of view, we have to say, well, what kind of machine are we? What is the programming platform, the architecture that we are programming for when we are programming each other? And because the underlying hardware, the neurons and stuff are all extremely flexible.  We have optical illusions, all of this stuff that are limitations on our brain hardware. But still it's amazingly flexible so that you can implement many different kinds of virtual machines. And that fact that we have a choice about what kind of virtual machine to implement on our own wetware and on each other's wetware, each other's brain means that there's this opportunity to say, if we say, you know, let's shift our notion. If we shift our model of what kind of machine we are, that will shift what kind of programs we can run. It's like changing one virtual machine to another. The underlying hardware could run either virtual machine, but this virtual machine allows you to write these kind of programs. This kind of virtual machine allows you to write those kind of programs. So that's the idea. What kind of machine are we? The WeAreCoders approach says we are, we have four primitive operations. We can accept input from the world. We can perform steps, sequences. We can judge states of affairs, see whether we like them or not. And we can do things. We can make output. And this is us. Hyper subspace search and sequence limited. The sequencing I mentioned, the search, you know, all this, this is going to be the subject of the other video. But the limited is to threat to stress that number one, we have limitations and but number two, we are a corporation. Whatever else we are as a machine, we have to make a go of it. We have to keep the system running. And that is fundamental to everything about life and to everything about how we interpret programs that we are coming from other folks and so on. So input sequence, judge output, those four things. We have to keep putting ourselves. Don't forget them. We have to keep working on advertising them in a sense. We have to make them as simple as we possibly can. So I made a little symbol. It's got it's got a bunch of arrows, the input arrow. Where's my thing? Input coming into the center of the sequence. It goes around the arrow goes up around and comes back down the judgment arrow. Things are bad. Things are good. And the output arrow like that. So this I call the self image. This is the machine that we're a programming for it's a cartoon. It's an advertising slogan for it. It's a logo. And so yeah, so I made it and so here it is input sequence, judge negative judge positive and output.  And, you know, I've even I've even got some some couple little little one of these things printed up its shapeways and metal and stuff like that. So I've been living with the self image for a while here. And I like it pretty well. And I also said, you know, geez, this Prusament clear filament. And that's an example of it. It doesn't end up transparent because it's still 3D printed, but it lets light shine through. And I have this whole reel of these tiny little programmable multicolor LEDs. And I thought, hey, I could take a bunch of those LEDs, put them behind one of these transparent. Well, this is white, but one using the transparent filament, the clear filament and have, you know, animations of here's the input happening. Here's the sequence happening and so forth. So I decided to go for it, put a whole bunch of them around the thing and so on. So that's what I spent a lot of time about, which meant I'm back to hardware. It's been a long time, but I put together a quick schematic.  You just run three wires from one to the next to the next to the next to the next and put down a capacitor every solvent, maybe. And I took the 3D model for the self image and flattened it out and made it into a circuit board. Eventually I went back and I shrunk it and rounded it off so that the circuit board was a bit smaller than this thing. So hopefully it'll fit in behind and it'll all work out. And I laid out the pixels, the LEDs on it and did the traces and so forth. I sent it off to PCB Way, the place that I'm most comfortable with because I did, I used them for the teach you tile boards and they just marched through all the steps. Sautermask, routing, delivery ready, DHL and wham, here it is.  I had leftover credits at PCB Way because they give you these little, you know, bees, they call them. And that allowed me to actually get two of these Ratticebury Pi Picoes, tiny little, there's a picture of one. You know, they're not full Linux boxes and so forth, but who needs that for the purposes of drives and some LEDs. So I got a couple of these free thrown in the box. And I'm thinking of trying to figure out how to use that to drive the self image, the animated self image we'll see. And there it is. Indeed, it fits inside the footprint of the real thing. And I've been working on a controller, which I will spare you the details, but you know, so here it is for running the thing, saying we're doing input, we're doing sequence and so forth. So hopefully that ends up being good, but that's what it is. All right, I'm going to skip over most of this because it's nerdy. And, you know, basically it's, I, you know, while I was not looking on Twitter to see how many likes I've gotten while I was not hitting refresh to see where the circuit boards have been nailed to me yet. I was trying to implement this 2D printer that I mentioned last time and I am now on something like my fifth generation approach. And the one that's in the T2 demo that we saw at the beginning was generation three, I think, three, maybe it's four. And I've learned a ton and I'm really kind of excited about it, but it is pretty nerdy. So, you know, it's all just piles of text. I'm just going to skip through it because it's piles of text. I don't know what that was. So the basic idea, again, I took the, the, this thing called grass from a UNM computer science class project. I had a life project that I used to do called frog world that had grass and things that would eat it and so forth. And the grass grew in a particular rule to say, you know, as long as you don't have two neighbors, if you have, if you have only one neighbor, you can grow. So this one, everybody has two neighbors except the very tips in this particular case and I modified this grass so it can only get so big. So this thing doesn't grow any further, even though according to the original frog grass rules, it could grow until it had two neighbors. And I use that as the subject for the thing to be copied and it surrounds it with this plating and it uses it to measure the thing and it sends out a copy of the plate, the build plate for the 2D printer, which is basically saying trying to reserve space saying, you know, if I, I'm going to need to move the parent this far in order to leave a copy behind in the kid. And if that's not all empty, then things might go wrong. So it figures out how much space it needs and sends out the build, it builds the build plate and only once the build plate has been successfully constructed, does it actually start the copying process or at least that was what was supposed to happen. The version that's in the T2 demos still has some bugs, but again, the bugs are kind of interesting.  But Morris, the guy that wrote it, lost control of it before he finished debugging it. You know, he was trying really careful to, you know, these things are dangerous in principle. They, they have gain. They, they say, you know, show me a computer, just let me talk to it. I will use my hypnotic seance on it. Now all of a sudden you're enslaved to me and you start saying the magic seance to somebody else. So to think that we're going to end up with a perfect copy that hasn't got any bugs that won't cause evolution to happen. It seems kind of silly and I'm continuing to work. I think my fifth generation thing is going to, it's going to, it's the one that's going to actually get it right. We shall see what we shall see, but we're not there yet. And so there's some pictures of it after it's all gone wrong. I mean, if we look at this, you see several different shapes of squiggly grass is in there, even though it started from one piece of grass. So clearly something has changed. All right. And so that's, that's it basically.  I'm kind of excited about it. I think it really, you know, it's, I think it's really fascinating to look at. There's just so much stuff going on everywhere all over the place. So that's progress, I think. So in two weeks, not a T Tuesday update, but lecture two of the hyperspace Academy 101 introduction to classical hyperspace hypersubspaces. We'll see how it goes. And then I will be back for a regular T Tuesday update two weeks after that. We are closing in, by the way, on T Tuesday 3 100, which will be the 100th episode. And according to, you know, the visa con and all the stuff on the internet. And I'm supposed to be good at this after doing 100 of them. What do you think? How are we doing? I hope you're okay. Things are going all right here. I finally got my first shot. Well, finally, I was lucky enough to get my first shot of the virus, the vaccine for the virus. Step by step. Hope you're doing well. See you in a couple of weeks.


Thanks All right So we were hustling and stressing because of the because we have a Diablo font and it was not working So this is why we switched lap lap top last minute and like we really want the thing to be themed properly And so for you to enjoy this this thing this is quite an adventure that we're gonna we're gonna talk about today Disclaimer, there's a lot of nerdy dance in there There's a lot of tongue-in-cheek references to Dungeon and Dragons Those who don't know. I'm sorry those who do will enjoy it We were inspired by stranger things last year obviously which made it very popular bring it to the forefront, but also the movie Dungeon and Dragons honor among thieves that was out in March when we were doing the CFP obviously And I am a big Dungeon and Dragon player, but so we thought we could pull it off. Thank you We thought we could pull it off because it was in the mainstream, right? It is trendy, but I we're gonna end the pop culture reference here. It's gonna be like the more og Dungeon and Dragons stuff So I'm Oliver. I'm a cybersecurity security research director at go secure and and I'm Andrea I'm I have a PhD in criminology and I also work as a cybersecurity researcher at go secure So I'm interested in the criminal behavior and decision-making Thank you So today's quest. All right, so our agenda if you want we're gonna talk about RDP interception We're gonna like we you need to understand what's possible and how it can be done and what tools we used But this is not the core focus of this presentation We were then gonna dive into attacker classes. So like barbarians and thieves and stuff like that We we summarize over a hundred and ninety million evidence and then is basically a log line.  We're gonna cover today so pretty dark themed and stuff like that custom art made by a friend from Montreal and Let's go. So Why RDP? Why Olivier? Are you so Insane about RDP not giving up after four years still at it It's because it's targeted by humans I've ran like SSH and telnet honeypots for four years and these are attacked by Scripts and and you know malware automated stuff. There's not like the The the richness the human behind the keyboard aspect when we started doing RDP research I expected automated malware. I expected butts, but this is not what happened what happened was a lot of Human interactions and so this is why it's a very interesting and really ripe for research ripe for intelligence collection But Olivier you keep talking about RDP. What is RDP? Okay? I'm like way too into this. Sorry So this is the on the left hand side. This is the MSTSC client So basically RDP is you know remote desktop protocol So it is a client that allow you to connect to a remote computer and then interact with it Graphically so you have the display you have the keyboard you have the mouse you have sound and The clipboard and files can be shared via RDP. So so we are on the same page We understand this is what's what it what this is about now The attack that are done. What allows us to study RDP at this level is because of a tool called Pi RDP I have stickers in my bag if you want of the logo made by the same guy who made the art for this talk It is a interception engine so it can Intercept everything record everything and you can temper with the RDP and you can watch after the fact after Everything is collected. You can look at the the capture that we're done So everything we present today was powered by or enabled by Pi RDP now Let's take our crystal ball and take a look at what it looks like what the the tool looks like All right, so here This is a this is our tool. So it's the Pi RDP player So this is what we see when we analyze the sessions So when it will start in a second you'll see the screen of the attacker and everything that's going on on it and then you'll see the mouse movement on the With the little yellow dot and then here you'll see everything that goes through the clipboard and the keyboard so everything that it types or Or a copy paste and at the beginning of the session like here You see the host and the domain they use to connect and the credential they use also So it starts So right here we seen the clipboard the first thing we still is a is our IP address It's the the last thing a copy paste basically here We see the attacker type and we see everything like and even here it will change the The credits to enter the session and even if we don't see on the screen we see it on the clipboard Capture what's interesting here is that the attacker paste his C drive directly on our our system so we can Basically steal everything And here is proceeds with with with his activity, which is using XM read So it's basically a surveillance camera for Windows system So the the way we deployed this we deployed this in the cloud And we exposed only the pirate EP system You can see in this diagram that we carefully fire walled with OG castles our system But so the windows system it was not exposed directly You had to go through the intercept the RDP interception engine in order to reach it This is what we want to convey here. That is important And if you want to learn more about pirate EP since this talk is not about pirate EP There's a ton of references out there ton of blog posts ton of stuff and the guy who first wrote pirate EP as an intern working with me is even here Emilio shout out to Emilio Gonzalez and So you can see his talks his blog posts and his presentations about it But now we collected data with it and let's talk about that. So welcome to the Dungeon Adventures. Sorry about that So what we have is we collected events for over three years a 190 million events as I said earlier. This is like 21 million net ntlm v2 hashes because we support NLA network level attenuation We have like 2500 successful logins. Okay, I'm gonna give you an insight our password is admin So two hundred two thousand people figure that out We and then we collected via that four hundred and seventy eight files and more than 2300 valid captures that we could replay See the keyboard the clipboard mouse movement all of that stuff Some of those sessions are related right the attacker might connect to our system more than once for example And there's a couple of evidence that we can That we can observe to make to group them So the first one would be like if they change the password and then come back on our system with this password So we know it's the same person or when there's a continuity of activities throughout the different sessions So those are all evidence that that we use to group them and when we group the that the final that I said that we have we have 95 different attackers or group of attackers so the So the for from the two point three thousand session there's 455 session with some content so that they actually connect to the server and open the system But they are not all interesting because sometimes they just connect and disconnect so So over that there's 339 session of interest that we analyze and this is what we are presenting today If we take a look at the indicator of the MITRE attack framework, this is what we get So there's a lot of resource hijacking system network configuration discovery Active scanning including scanning IP blocks and wordless scanning So basically what you see the most is is a reconnaissance and in discovery So let's see what are the different profile of behavior that we see on our on our sessions So this is our party. There's five different profile and we will see and we still them One by one. Yeah, one by one. So maybe you didn't notice it Already, but this one is the ranger and he's stealthy you'll understand why so The ranger will explore all the folder of the computer and or check the network and host performance characteristics They run reconnaissance to program or script And or they can also run this reconnaissance just by clicking their way through like opening the task manager looking at the CPU performance and then Googling our IP address and they do not perform any other meaningful action on our sessions, so they just run reconnaissance. So we We hypothesize that they might be evaluating the system for other to use or to use later I'll show you a ranger in action. So Here yeah, it started. So here it will paste two binaries on the desktop to run So those are a red script that are ready to just grab the information of the system So he runs the first one and then Run the second one He copies the information of the computer and we can and we steal that on to the clipboard And then before leaving he just he will erase all his traces and leave. Okay So this is a typical ranger in action The second character is the teeth The teeth will monetize their the rdp access in many different ways So they will the tool they use will be like proxy where monetizing browsers Monetizing browsers that participate in the pay-to-serve schemes After that, there's a crypto miner Android emulator to do fraud. So all kind of different things to monetize the access and And I'll show you two examples. So the first one here the person is using truck monetizer, which is a residential proxy enabler We'll connect to his account And and then you can see so they use it to pass third-party Traffic through our system and then get paid for doing so so you see the amount of money that he is doing with our session Which is not a lot by the way There is second example of a Tiffin action will be this one that use a crypto miner called xm rig So he launched a crypto miner Connect to his wallet With his creds and everything he choose Bitcoin gold to mine and At the bottom use the local ash rate and the effective ash rate that goes on during during that he can conduct any other activity at the same time and Any tool so the Third third character is the barbarian The barbarian you'll understand by by the name of the character that the they use a large area of tools to brute force their way Into more computers they compromise other system by using working by working with with IP addresses username list of of passwords and And here is the barbarian in action. So here The person is using mass scan GUI more particularly so there's an interface Easier to to use Here they enter the RDP the RDP port 3 3 8 9 And choose the country that they want to to target In this case Vietnam Launch the attack and it's as easy as the fourth character is The wizard the wizard is my favorite one because they are the most skillful one They use the RDP access as a portal to connect to other computers So the secure their identity their identity via a jump over compromised host So they are the one who showed the highest level of skills and I'll show you in this session right now So they are on our RDP session and then they connect to another session through our system and So you see that in Our session the wizard is file-less. They do not require you to install any code or script the within the target system instead the the attacker use Uses tools that are already present in the environment and in this case, it's RDP So you see that there's a session opened here and on which NL brute is Open so they launch an attack using a brute force Tool and here we see that they use a ghost user we will come back to this So it's connected to a tool they use to enter other RDP session So and we will talk about it in a second So he is monitoring his NL brute activities on two other Pi RDP session true true to other party session So this makes it far more difficult to detect especially if they are get if the organization or leveraging Traditional security tools that will search for known malware script or file They can stay there forever before being flagged basically and they leave no artifacts behind And the last character I said that the wizard was my favorite my favorite one, but this one is my favorite one So the Bard the Bard in Dungeon and Dragon I don't want to start a debate here, but in Dungeon and Dragon It's sometime considered as the small contributor or the annoying team player So here in this case there the bars has no apparent hacking skills Okay, so they will use our system to Make basic Google search to watch porn and to download movies, etc So we think that they might have Bought their access to someone else that compromise the computer for them And just for the laugh. I need to show you a Bard's a Bard in action So here we see basic Google search about the strongest virus ever And he will you know look for information about that read a bit on that I just translate what is going on on this page basically just information about very The strongest virus here another virus script It looks around but like it doesn't it doesn't last very long.   It's hard. Why porn? So there's some country with internet censorship And the censorship include ban on pornography So so they might and and also they often block for VPNs and and other other tools So they might use our RDP access just to go around those those ban so if we look at the Different the number of RDP session associated with each profile. This is what we get So you see a lot of barbarian a lot of Rangers and after that thieves Bard wizard and the the profile are not mutually exclusive They can like they can perform they might intertwine This is what we get when we observe the this mix so a ranger might also Do barbarian actions so yeah What about the weaponry Olivier? Yes, yes. Yes, so we did build some Kind of a character sheets for the weapons because I'm a geek in Dungeon and Dragon fans. So here we go the xdidzik RDP patch is a Ranger tool so it is what we saw earlier that created the ghost user account So it's basically a turnkey gooey tool that creates an admin account and allow you to patch RDP patch RDP in a specific way in a sense that it will allow desktop versions of the operating system to have concurrent sessions which is not allowed usually you need like a Specific license or you need a server type system But this will enable that meaning that the computer can be used While it's used legitimately and and the patch is actually very well done It's a different binary that is embedded in the xdidzik tool and it survives OS updates and stuff like that like it's a really clever tool So we see this as a persistent mechanism has a high detection ratio on VT because it's super packed But the xdidzik group was taken down, but the the tools still exist and are still available Next up we're gonna talk about and it brought social Andrea mentioned it earlier and it brought is the the RDP brute-forcing tool It is a super effective one if we have pen testers or red teamers here This stuff is better than you know Hydra or net and map, but I wouldn't run it on a system Besides the VM again super packed the versions that you can download online are like cracked and or probably backdoored It has a relatively high VT detection ratio. However The some of the samples that I've seen are undetected by crowdstrike, e-set, f-secure, Casper's key for instance. So the detection ratio is still high like 15 to 62 But the 15 are like all AI stuff that probably has a lot of false positive The guy who wrote it got arrested and extradited to the US early February So we will probably not see updates for a short while So the next up is mass scan GUI a tool used by barbarians. It is like a you know rapper around Robert Graham's is mass scan very effective internet scanner But it dumps it down so that anyone can use it and you can choose a country So it has like pre-filled configuration in it if you want to target a specific country What's something that didn't realize because we have a lot of instinct about attackers right because we do that We research, you know that for threats and we read a lot of blocks But one thing that surprised me is the pivoting capabilities of the barbarians So when they compromise a specific system, they go after nearby networks or the whole internet But for instance our stuff was in AWS and so we feel that when they realize it's in the AWS They're happy because they're like oh, maybe some organization white listed AWS ranges And so they scan the whole internet like super triggered So we think that this is some of the stuff that they do and it allows them to reach Stuff that wasn't reachable before or via other compromise infrastructure So that the tool like math mask and GUI kind of is important for them to penetrate into deeper networks and more networks The next one is a weird one silver bullet it's a Burp like pen web application security tool if you want but the comparison with burp fell short really quickly Because it's proxy first so in burp you use one proxy and then you you know you do your tests and stuff like that But this is like give me a hundred of proxies. So clearly this is about credential stuffing You know popular services like PayPal Gmail and Netflix or whatever it comes with pre-made configuration kits a whole scripting language It is super talked about on telegram. They are channels dedicated to share configurations. So it's a very Big tool for people who compromises online accounts clearly little very little legitimate use But but it's distributed on github and they Talk about it Openly on github and this is from the github page and they say like this is for scraping parsing data Automated pen testing uses selenium or whatever, but look at this Like if we check the tabs that are in there It's like top-level tab proxies where you provide hundreds of proxies that you want to use second tab Word lists, I mean what pen tests tool would expose Word list as a first-class component in your in your tool, right? And then you have like captures Bypass you have OCR so character recognition you have cloud flare bypass built into the configurations So clearly again little legitimate use or or you know It's shady as a really shady now on there on their website On their website they they even like drop the language about automated been test. They Basically say like it's illegal, but it's they talk about credential stuffing.  No, we're credential stuffing tool, right?  Oh, sorry about that So moving on to the next thing We have the windows defender remove script So a lot of defender bypass technology was used and it's interesting to describe Especially this one because it has a zero virus total detection rate But so it's a wrapper around Install went weeks, which is considered a legitimate Package it allows you to change the Microsoft's OS can be customized by auto unattended stuff, right?  So Windows still works afterwards But so this is pretty crazy because it is basically legitimate software However, I want to say it doesn't work on Windows 11 even with temporary protection removed So we've seen this work on Windows Server 2016 Haven't tested more than that because I was, you know busy creating nice sheets cards for For the the attack tools, but so it It could like, you know become obsolete with time, but it is effective today another one that I wanted to talk about is D control or defender control and this one is Shared online as a freeware from a super shady site. It is super packed Has a high VT ratio and I think they're not gonna update it But so this tool is used by the luckiest Russian ransomware group like we know it's linked through them So we know that it is used by ransomware groups out there. It has been So it disables defender and unload the driver So it's it's effective doesn't require reboot whereas the other tool does require reboot But it's been super well documented by the DFI our report. So if you guys want to detect this I think we even provide Sigma rules and stuff like that. So I would advise you check that and Last but not least is gamadine mailer. So this is Turn key noob friendly fishing tool so it can be used for spear fishing But also spam so it does their whole spectrum of email flaws have a templating engine and all that stuff it we yeah It is basically making it possible for people to To send, you know good emails and whatnot But we we think that IP reputation of compromised system is probably what attracts people to deploy tools like this in Honeypots so that they are able to send their spam It is not detected by like crowdstrike e-set f secure Casper ski Microsoft So it has a like a low detection ratio and we know it's not but then again like all of the samples I shared in the IOC I provided I uploaded all of them on VT So they will probably the detection ratio will probably increase hopefully so it's gonna We're gonna be good when it detect this very soon There is a lot more tooling and our aim is to document them via our blog and As you know, some of them don't need documentation, but some of them do and share, you know hashes and Sigma rules for detection So if we take this list that we just saw in all the tools that we present and we classified them by objective This is what we get so a lot of scanning and attack Then there's enabler tool that they use all the time monetization download communication by communication I refer a more precise precisely to telegram So they use telegram to communicate but also to transfer files. We see that a lot So let's go back to our crystal ball I wanted we wanted to show you in some interesting observation that we saw during our research So first the attacker might work in team. Okay here. We see the person Downloading nl brute While in the on the clipboard we see appear. I'll translate it right now. Why did you delete all application with a bloke broken heart? so Downloading the tools again. They were there on on a session a previous session But then he has to download again and then communicate with someone else to show His disappointment or hurt disappointment After that, there's some attacker who do not speak English and that might be Funny sometimes so here The person is playing around with some credit card on Google ad and Then a pending approval message appears and the person has no clue what's going on so copies it goes into Google Translate and Then even go choose the exact language the person speak so really you cannot beat this level of attribution so Arabic here and There's we have a couple of sessions with person there with people who do not speak English who look like they do not speak English or at least their their basic language their Principal language is not English and when we we analyze those sessions So it's 45 session in which we are sure of the attribution of the language, which is not all the data set But this is what we get so Arabic first and then Farsi or Persian Cyrillic Vietnamese and Chinese and the last video we wanted to show you is How great our tool is to collect intelligence? So here the person is connecting to their telegram account So they will enter their their cell phone number their phone number Obviously, they could they could use burning phone, right? But but here we could When we look at the IP address it corresponds to Algeria And then like their password of course that we can still to the clipboard and And and then once they connect to their telegram we can see all the chat room in which there's some illegal stuff going on So to start an investigation that's it's a lot of information of useful information What about the end game? Yes We're now at the near the end of the presentation so it's time for experience points of course and looped right But so I'm still going to spend some time trying to really convey why the level of enthusiasm I want you guys to leave with around like RDP research and interception So this is how we deployed our environments. We made The windows machines like the box in the middle. We made it We made sure to stream the logs to a message queue as as quick as we can in order for it to be destroyable So we really like don't like to give free infrastructure to bad guys So when we have like anything that is, you know Misuse we will destroy the infrastructure because it's faster to destroy than to investigate But this means that we in order not to lose evidence We needed to have something streaming to our stuff, right? So all open source stuff, but like Streaming logs to rabbit MQ are syncing binary artifacts to object storage And then we we are slurping these for inside an elastic where we query it via Jupiter Our studio as well So some our language code for like Latin class analysis and stuff like that and then good old Excel because it's just fast You know, but but after a million records or events Excel just blows up So you need the Python cool kids tools We everything was deployed using docker compose and then the infrastructure was terraformed And we were recreating like destroying the honeypots and recreating them so that we get fresh bad guys using GitLab CI CD automation Now what we talked about today is the rangers right on the left. They are the largest group and Clearly the ones that we want to go after next right We're gonna increase the deception that we do and make sure that we understand what they are after because they're the big group and They open the path to others then there's the bar of questionable technical skills and appetite as Andrean showed you earlier We saw that thieves thieves for me represent what cyber crime is about and this is a takeaway I think important for for our industry They are about monetizing everything They are not after your organization necessarily like most of cyber crime is like that Right, of course there are spies and state actors and stuff like that, but there's a ton of cyber crime out there That is just opportunistic The wizard are the scariest group in my opinion and Andrean's opinion because they are doing the living of the land stuff They like like leave no artifacts Really are really stealthy and and the barbarians last but not least their digits brute force They're way around as I was saying earlier like compromising new infrastructure and and and the and it is successful unfortunately now researchers like RDP is right for attacker study I It attracts humans not scripts, so it's super cool to do For blue team like are we have a repository called malware IOC on our our github the link is at the end of the slide deck It's in the slide deck that is shared on the DEF CON servers already You can consume the IOC's but we also want you to try to roll out your own traps You can do it externally you can do it internally internally This is like a low false positive rate alarm system But you make you must make sure that you have the proper alerting in place What's cool about the Doing that is the video captures talk so well to management This is not a sequence of lugs that you know people don't understand. This is like he did this He was after that like directly show it in your face the the the attacker, right? So this is why it's powerful For law enforcement, we want you to go after the ransomware groups This needs to end right we are really in a I mean ransomware groups are like the exploit kits of the of the 2010 something like that like we need to fix that problem and the reason why our DP interception is relevant in that context it's because When they like they use compromised infrastructure a lot of RDP compromised infrastructure When you look at the metadata like law enforcement would do in lawful contexts You will have like SMTP out to office 365 SMTP out to Google But what does that tell you you have no victim information you have nothing right? If you lawfully intercept the RDP you see them write the emails that they send you can go after the victims It's a very effective way to to build a case quickly in my mind So like I'm giving this open source for free so that you can change the world and fix this shit I'm really passionate about that by the way. Sorry Yeah, I guess this leads well into the if the attacker fear getting caught You know they will slow down and this is what this is about it might sound as Irresponsible what we're doing, but it is not because we're there for the good game and we're trying to solve the world's problem or one of them So one more thing, you know Apple style PIDP is open source and we released Three days ago our FQ binary parsing tool. So this FQ is like the JQ for binary files So with this you can you know do analysis at scale on captures that you have So yeah, it's out there if you want to contribute to it We would appreciate it and with that we are done folks You've been you've been generous. You've been amazing. Thank you so much Yeah, we have time for questions. I think do we do we take questions? Five minutes five minutes. All right. Yeah, so I don't know how questions work, but yeah Do people yell or are the microphones? So there's a microphone in the back But if you're willing to yell yell and I'll repeat the question the question is how am I getting around Amazon's abuse policies? They I I told them I'm doing this type of research So all the cloud provider I open a support ticket which I screen-shotted which I printed which I tattooed on me saying I'm gonna do this and Amazon I never got anything from them zero But at the same time if you break broad You you you piss your customers, so I understand they're not doing it, right? And I'm not doing hypervisor level. We're not doing hypervisor level attacks or whatever. It's just RDP So yeah, and it all comes from one IP if you think about it, right? But they know they're not blocking outbound and and yeah So no no harm and it's for research and I am affiliated with a security organization So maybe if you do this under your own name, you could have problems, but I didn't face any Good question by the way this. Oh, I was censored right there. I asked are you working for Amazon? Okay, all right Any other question? Yes, you want to take that. So the question is how long did we did the Collection for how long so the data were collected Over three years, but like the system was not always up. So it's because it wasn't development, right? So it but it's three years of data on and off other questions Yes So he asked for an overview of the FQ tool. So, you know, JQ the it's a like Linter pretifier and a query tool that is using like CSS selectors for JSON stuff So it's basically the same thing using in a very similar language So for binary files like PE's or p-caps or stuff that people provided support. It's really nice So if you if you've used zero one zero editor template Their own they have their own language which allows you to dive into binary files. It's very similar But in a in a scripting way So like like t-shark is for p-caps basically so with this you can say so our when you pass RDP capture in it. It's see it's seen as an array of events So these are and they have types. So there is client information mouse You know display and stuff like that So you could say I want the keyboard events if they match this characteristics list list them out and so for this this is why we could do stuff that we could have like We we want to find credentials in general and then we could provide a list of of Restrictions and so we would get out only that so if you're doing binary Research on any binary stuff at scale like thousands of files and stuff like that super interesting Yes, how big is How big is a file you want to take it? Okay, so because you saw like the large file So we went after like size first But so what's interesting is that if you don't do a lot they're gonna be small the Window is tiled and then compressed but if for example you watch porn not that I encourage that I've never done it myself But it is gonna be huge because you're sending a ton of tiles and the windows cannot cash any of it but if you're using explorer that exe and Like with stuff that windows knows really well and can cash then they are small at some point She was going after the large one and it was I thought that like the large one would be the most interesting one or the longer session and it was only porn So I was like One week of born. I was like I cannot believe I did a PhD to watch porn Born at work, which I had to clear by to HR by the way. I was like she's gonna watch porn But it's research Yeah, but the second week of analysis. It was way better like it's not Yeah, it really depends what they do on the session But they're not so large files and I said I also said like if you're not okay with this We'll find someone else like well, it's not mandatory Cleared myself out of a problem. Yes So the question is what did people worry were people able to identify that we were a honeypot? What's your feeling about this like to to realize that it's fake? Oh so yeah, I There's not much of them realizing anything because of course they like they they connect to their own personal emails and things like that So obviously they do not know but there was one guy at one point one guy or girl at one point that just make a runner a little reconnaissance and then Open the notepad and then write lol and disconnect So I was like, oh, maybe he knows but we are not sure about that Yeah, we're done. Thank you folks. Thank you. It was nice been super generous


behind the scenes. Just hard to understand it without having someone break it down in English, plain English. So we have this test, actually, at Tech Safari, which is that my 16-year-old brother has to understand it and read it before we publish anything, just so anyone can get it. OK. And I've read most of it. And it's very easy to understand. You make it seem fun, which is a good thing, because many people think, when you think of tech, you think, ah, this is too complicated. And it has its own people, you know? So it's good that we're changing the perception around technology, because it's hard to stay with us. So now, when you talk about tech startups in Africa, give us an overview. How are we doing as tech startups in Africa? We're at an interesting time. We're at a very interesting time. So I feel like we're at the end of the beginning, in some ways. So we've just had this big, you know, there was kind of not much activity until 2020. And then in 2020, 2019, 2020, a lot of people started investing from around the world into African companies. And that was really interesting. We had all these new companies come out, a lot of new founders come out, a lot of really cool ideas.  It's harder to raise capital. We're in a different economic climate. But I think we have this amazing few years of just new founders and new ideas and new people who now want to be a part of tech in Africa. So it's a really exciting time. I think it's a good time to be building. It's a good time to be building in Africa. But there's this thing that has been happening, especially in Kenya, when we talk about funding and how startups are doing. Now, give an example of this one startup, Twiga. And they recently laid off 33% of its workforce. And that's even after getting this Hasla funding in Kenya. They got around, I think it's $300 million from Northrop, which was supposed to help. But they're still laying off several layoffs before that. So why are we in this situation? Yeah, and Twiga's one, there's many others. There's a company called Sandy, which also recently shut down or is in the process of being bought. There's a lot more companies like that. I think we're going to see more of that, to be honest. So it's kind of like two years ago, there was a lot of money that came into startups across Africa, across Kenya, across Nigeria. And then there was a lot of demand for those companies to grow at all costs. So it was like, hey, just like, go make money. But people didn't really think about how much they were spending when they went to grow. And so companies like this, where they were spending a lot of money to grow the number of users or the number of customers, they didn't think about how much they were spending. And they ended up spending too much. And now they're in a position where they're like, oh, wow, we're out of money. We need to cut the team. We need to scale things back. And you'll see, Twiga also, they've also changed what they're doing now. And they pivoted again to another idea. They're trying to figure it out. So I think there's been a lot of money coming in, but not a lot of responsibility. And this is kind of, I think it's a bit of a lesson too. If you're ever building something, you don't need a lot of money to make something good work. You can start small, build slowly, and build something that's sustainable. And those startups are doing very well. So the problem mostly was lack of mismanagement of the money that they had initially. So if they probably used the money well, then they would still be, they would be at a better place than they are currently. I'd say so. And I'd also say, part of its mismanagement, the other part is just the time.  There's more money out there. Today, there's not much money out there, so. You can have changed a little bit. It's switched up, yeah. Okay, so what does the startup need to do now? Because you've said that now is the time, good ground for creators to come on board. So what does one need to do now in this time? To build a startup from scratch, or to keep going? Yeah, from scratch mostly. Yeah, so I think it starts with like, what are you trying to do? Like what's the problem you're solving? Ultimately startups exist because they solve problems or make life easier and better for us. Like Airbnb exists because it was solving the problem of like having to book a hotel all the time and having to go log in and make a booking and having this old system. So I mean, it's thinking about like, where do you find the hardest problems? Is there a problem you think you can solve with tech or with a new idea? And then how do you build that in a way that's like, that where you can just test things out? I think it's awesome that we have a lot of founders have these kind of like weekend projects or like nighttime projects that they work on, which is cool ideas they're tinkering with. And sometimes they'll find something that actually really fits and there's demand for. All right, so the thing, the main thing here is if you want to build something, look for a problem that's there or a way that you'll ease in the lives of people, then that will probably work out well for you. Yeah, totally. It's always like, if you fix a problem, customers will come and you'll have this, we call it product market fit. Have you heard of that term? No, not really. Okay, so it's like, it's like when you have so much demand for your doing that you can't take it. Like you're like, oh wow, I'm out of like all these pairs of shoes I'm trying to sell because everyone wants it. That's when you know you're onto something and founders build on top of that sense of product market fit. So create a good demand. Now about funding for startups that are just coming up, it's a major problem. It's a, most startups come and complain about finding funding. So how can they best to get funding if they need it or how can they operate without funding if possible? Yeah, I mean, the idea is that you're also a business, right? So when you start a business, you want there to be money coming in to pay for things too. So it's, in a lot of cases, if you're established, you want to be thinking about, hey, how do I grow my revenue so I can pay my bills, like pay for costs? So that's also important. I think if you're a new startup, there's a lot of places to find your first 50,000, 100,000 dollars in funding if you have a clear product and some traction, a lot of accelerators that help you do that and help you grow relatively quickly. But I think where the trouble is, is when you're a big guy like Twig up, you're not looking for like one million, two million, you're looking for like 30 million US dollars. Exactly, with money. It's a lot of money, right? And there's not much money going around now. And if you don't have good, like, say revenue or fundamentals, me, let's say I'm an investor, I don't really want to invest in that. And so there's a disconnect there, where these growth companies really need to sort of out and have like strong fundamentals. Okay, and can you elaborate for us on an example of a startup that, you know, is addressing specific market gaps and is doing quite well? Yeah, sure, okay. So actually good coincidence. I was in the office of a startup yesterday. I'll give you two, is that cool? Yeah, sure. Cool, so one was Cellulant. I think we're all kind of familiar with Cellulant or Ting by Cellulant. So Cellulant, yeah. Give us more details. So they're a payment processor. So if you go to buy a ticket, like say you buy a ticket from Nairobi to Mombasa on Jambo Jet, they will process that payment for you. And that sounds really easy, but actually processing payments is so hard. It's a lot of work. It's so hard. You need like licenses, you need to set up accounts everywhere. And so Cellulant was one of the first companies that let you accept payments within Pesa. In Kenya, and so that's how they grew. And they're doing really well. Like they have like clear demand for their products. They've been around for a while now and they're just growing across Kenya, solving the problem of accepting payments because that's actually really hard. Oh, okay. So that's the fast, what's the other one? So there's another one I was spending time with yesterday called Letta, and they're a logistics platform.  These guys built the software that helps the companies that do that track their writers and give you updates, but also more importantly, help those companies move stuff from A to B as efficiently as possible and like maximize how much they have in their trucks. And that's a big deal. A lot of companies spend, when you buy a product, about 50% of that product, whatever it is, is just the logistics costs. It's not the actual product. Okay. So they help companies cut that cost down. Wow, interesting. So they've made life easier and that's what you were saying when you come up with startups, you create something that will solve a problem or you'll help one or the other. Tell us what sort of ecosystem or what sort of conducive environment does a country need to create for startups to thrive and which country has really had this or really has this enabling startups? Interesting. Yeah, that's a really good question. I think first and foremost, you need like policy that allows for startups to thrive. And I think that looks like having startup acts are helpful having like free movement of talent. You know, like when you're building the best products on the continent, you want talent from around the continent. True. You want talent from Nigeria, from like Zambia, from like Rwanda to be able to move here freely. Stuff like that's important. It sounds boring, but it's actually important to building an ecosystem. And then it's like, how do you get all these global players and other players from around the world invested and interested? I think Rwanda has done this really well. They have this beautiful co-working space called Norskin, Kid Gali House. And it's this like really nice space just for entrepreneurs. And their goal is to have 1,000 entrepreneurs working from there in Kid Gali. And they have all these new accelerators and funds that are setting up shop in Rwanda because the government's saying, hey, we'll help you invest in these companies if you come here. So I think it's like bringing a lot of them over, like intentional about building the startup ecosystem. Okay. And I've really seen Rwanda coming up very fast. Kenya, I think Kenya, we are number three in terms of, in Africa, people who have the most startups. I think the first one in South Africa, then Nigeria and then Kenya. But do you see, how do you see us doing in terms of comparing us to Rwanda, how they've created that system? How are we doing Kenya compared to Rwanda? Yeah, I think there's potential. I think there's talk of more happening in the startup space in terms of policy. I would say like in East Africa, like Kenya's the powerhouse when it comes to tech and startups. And everyone, even if you're operating a company in Rwanda, generally CEOs and founders will move to Nairobi because they need to expand here. Rwanda's too small. Yeah. So yeah, I think we might be ranked third, but I think this is the most accessible and funny ecosystem to build in. So if you're building here, you're in the right place. Then you're in the right place. All right, what role does the government play in terms of we have seen how they can create good policies, but how do they hinder startups from thriving also? Yeah, so that's a good question. I think things like government or policy or just even having bureaucracy where you have officials who are cracking down on startups and making it harder for them to expand or to launch in different countries makes it hard. I don't know too many specific examples, but I do know that there are some countries where it's just really hard to start building anything because setting up the company is really difficult. It's hard to register a company. The authorities will ask you a lot of questions. They'll ask for all these statements just to begin and that makes it hard. Yeah, so I think those sort of things hinder the ecosystem. I think it's also the responsibility of big startups like a twigger or like a wassoko or whichever company to work with government and to build that relationship. And that should be going two ways. I think startups should be working closely. Government should be working closely with startups as well. Because I mean, it's a faster way to solve problems. Yeah, the consonants problems, right? Okay, makes a lot of sense. And for a startup that someone who wants to start a startup, I like key skills that they need to have for them to come up with, you know, sustain the startup initiative or something. Yeah, definitely, definitely, definitely. What are some of those? So everyone has ideas, but like you need to be good at execution, which means getting things done. So I think the best found is, I also invest in startups. So like I have to think about this a lot, like am I investing in the right person? And I think the best founders really have a bias towards action. They just do things. Like they don't ask for permission. They just go build it and they launch it and it's like they'll have an idea and they'll do something about it the next day. So I think that's the first one. The second is that as a founder, you're really building, it's really like you're building relationships with a lot of people, your customers, your partners, your investors, people who you hire. So you need to be good at like communicating with people, building networks, building relationships. That's important too. You can't build in your room the whole time.  You need to be very happy. Yeah, great relationships. All right, makes sense. And you know, for startups, not all are into tech, but is there an upper hand for people who have embraced technology with creation? Yeah, yeah, yeah. Like not all startups, some startups are boring. Like they're like, we're just gonna do an insurance company but do it like way faster and for, you know, supply chain or something. That's not that exciting, right? And you don't need, yeah, I mean, yeah. So all the startups are very high tech and they use AI or like they're on blockchain or whatever. I think it helps to have that and eventually if you wanna grow quickly, you need tech. Like you need tech to help you scale. But they're easy things to learn. Like I'm not technical at all. I have never written like a line of code but I've been able to build really cool products with teams because we found the right person to do that. Aha, collaborating. So it's good to have someone who's taking in your team so that they help you at least get ahead. All right, for you as an investor because you said you invested in a lot of startups, what do you look out for just so that a startup would know what an investor looks out for? Nice, you can put my email in this too. So like, you know, I hit me with that. You did? Yeah, so I'm always looking for like, I always think about the founder, the person. If you think about it like when you think, when you look at companies like, I mean, we're talking about Apple before like Steve Jobs or like Uber, Travis, CaliCanis or Airbnb or like Mark Zuckerberg, all these people have been led, all these companies have been great but they've been led by single people. And it's been the strength of that person figuring out what works that has like caused it to succeed. So I always think about who's the right person to trust with this money to go and build something big. Cause even if the first thing isn't, most of the time you build something and like you think it's the best but it's not. And then the next thing you build is like a bit better. Usually the fourth or fifth thing you build is like amazing. So you need to trust the person to get that, yeah. All right, all right. And that, is there, okay, four, four pitchers, is there something that if they're looking for investors, how should they pitch? Is there a good way or something that you would advise them to do? Yeah, I think like a good way to, like the best way to pitch is by doing the work and like building the thing. It's like, it's actually like, it's interesting. A lot of people go and pitch you their idea or like where they're at and it's like, okay, what have you done so far? And it's like, we have a product but we haven't launched it yet. It's like, well, if you show that you're doing, you're working towards it. And you can show your traction as you grow. Like, hey, we just tested this thing out. Hey, we just got our first hundred customers. That's really, to me as an investor, that's a lot more exciting than someone pitching me with an idea. It's kind of like, do you know the analogy? Like if someone is like waves you down and asking for like a ride somewhere because their car's broken down, you probably will like drive past. Hopefully not, but like you're more likely to drive past. But if they start pushing that car. Ah, you're more inclined to help. And founders need to do a lot more of that. Okay, all right, nice. And now, are there particular trends or how do I put it? Are there some innovative business models and strategies being employed by tech startups to address local market needs? Good question. Yeah, there's a lot. Just trying to think like, what a good example might be. I think that there's a growing amount of things we can now do with AI, which becomes interesting. So I think even the companies I've invested in are starting to incorporate AI into how they build things. Let's say there's a company that helps guest houses monetize and get more bookings in. So you want to stay at a nice guest house, you book through their platform. Now they can help, this is actually a company called Tripitaka here in Kenya. Now they're gonna start helping companies launch websites in like minutes through AI.  I don't think it's this far along, but this is the ambition and it will just generate that. And that's really cool, having that simplicity. Wow, interesting, yeah. And some tech giants like Google are also pushing for that. I've seen that they have an accelerator program for African startups and they want them to use AI to solve local challenges. So AI is really coming in strong. It is. Now finally, before we close this up, where do you see tech startups in Africa in the next few years? How are we going? I think we're gonna have, to be honest, I think in the short term it won't be great. There's gonna be a lot of Ls, like a lot of companies will fail because in the short term, like big companies too. But in the long term, we're gonna have some really, really impressive companies that will really change how things operate on the continent. I think we're seeing a few of those start to come up now. So in a few years, I'm very optimistic. So we're not doing bad. As much as companies are closing and they're laying off people, it's still the journey and we're heading towards something later. And also just to heads up, like 90% of startups that begin fail. So it's normal. Like what's happening at like a lot of these companies or them shutting down, totally normal. That's like, that's the rule of thumb. Like it's probability, most of them fail. They have to fail for Astros vaccine at some point. Exactly. Because the 10% will be big, right? Okay. What advice would you give to a startup, a founder who's just come up with an idea who wants to implement it, not sure how to go, where to go, what to do, who to bring in. So what advice would you give to a startup? Yeah. I think it's just do it, just get into it and start building. And it doesn't matter if you're doing the perfect thing, but just start doing something and build momentum. And you'll figure it out. I think if you're someone who is proactive and thinks about the direction of what they're building, you'll probably figure it out. Also everything you need to build that thing is on the internet. You don't need money to do it. You probably don't need to hire anyone to do it. You can start building the most basic version of what you need online. And some of our biggest companies were built on no-code websites that are free and they're billion-dollar companies still. So you don't need a lot of money to get started. Okay, so start with what you have, where you are. I had forgotten to ask this question. I have to ask it. Are there specific areas which have a lot of potential compared to others like fintech? If someone wants to start something, are there specific areas that would do well as compared to others? Yeah, so if you think about our startup story, even looking, like I'll use the US as an example, before eBay could really take off, they needed PayPal. So that tells you before online commerce could be big, you needed payments. So fintech's actually important. Before you can move an Amazon delivery from the warehouse to your house, you need strong logistics. So there's a lot of base stuff that still needs to be built for the rest to be built on top. So I'd be thinking what's a really fundamental problem that everyone struggles with that I can fix? Not like, you know, how do I make your food order get to your house faster? That's not really important. Like you want to think about the baseline stuff that are building blocks for the rest of the companies to build on top of. Okay, good advice. Thank you very much, Kalo. Where can people get you on your social media and how can they subscribe to your newsletter and everything, this is your camera. Oh, cool. So my newsletter is called Tech Safari. So tech, T-E-C-H, Safari, S-A-F-A-R-I dot I-O is the newsletter. And then everything's kind of on there. There's ways to follow me on there. I'm on Twitter at Caleb Maru, C-A-L-E-B-M-A-R-U on Twitter. All right, thank you very much, Kalo. Thanks for having me. It's great, it's getting the insights. I'm sure that one founder there has gotten some things that they can implement. All right, so welcome. This has been Sport and Tech. We've been discussing tech startups in Africa with Caleb Maru. Hope you've enjoyed it. We're going to take a short break and then we'll be back with some entertainment interviews. Stick with us.


I always really like to watch when an out-of-touch pundit is shocked with information from the pores and the pheasants that they weren't necessarily privy to. So someone who was at the protests as a journalist and a professor let them know how a lot of these young people feel about Joe Biden and they were absolutely blown away to learn that young people aren't very enthusiastic about Joe Biden. What impact do you foresee their movement having on the election? Yeah, I spend a lot of time at protests, especially with the youth. I've been there from a personal reason, but also from an academic reason as well. I ask people there, you know, what are you going to do in November? Why are you here? What are you going to do in November? And they say, I'm not going to show up because Bernie is not on the ticket. And I think that this highlights a bigger point, you know, which is that even though we had this Democratic National Convention that was meant to unify a party, the DNC did not bring in the youth, you know? And I think they need to do a better job of giving folks who have legitimate concerns about the direction of this country and their own interactions with institutions, including law enforcement, right, to be viewed, to be seen, to be heard and to be included in the plot. We're going to leave it there. Nazita, let your body. Thank you. I don't understand why they don't understand why young people are not excited about Joe Biden. And this is the same individual who said he has no empathy for young people. He refuses to support Medicare for all during a pandemic. And when protesters all in unison say, defund the police, what does he say? No, I'm going to increase funding for police stations. Like, why would you think young people are excited? Like, I don't understand how you're failing to see why young people aren't enthusiastic about Joe Biden. Like, did you think that would change? We knew that Joe Biden had a problem with young voters during the primaries. Did you think that would change because he's the nominee?  Getting young people to the polls in the first place in and of itself is a challenge. Why would that just change all of a sudden? You guys told us Joe Biden is the most delectable. MSNBC pushed this narrative repeatedly all during the primaries. So now you're shocked that the person who you pushed forward all of a sudden isn't winning over hearts and minds. Like, what did you expect? I don't get it. How are you confused? I don't understand why you don't understand. As I said, it just these people are so insufferable. So she said, I spent a lot of time at the protests. Especially with the youth. And a lot of people she asked had said, I'm not going to show up because Bernie's not on the ticket. Now, when she said that, one of the anchors actually said, wow. And she also said that the DNC convention was meant to unify the party, but the DNC did not bring in the youth. This is the sense that I get from like MSNBC liberals and centrists. They thought that like once Joe Biden announced his running mate, a young woman, a young woman of color and, you know, Kamala Harris, you know, that would ignite the spark and get young people excited about Joe Biden, except young people care about policy. Who is Kamala? She is the top cop in California who laughed about the prospect of legal weed and locked up lots of people of color. Do you think that young people of color don't know about this? Now, if she had a change of heart, great. But I mean, she's still terrible. She voted against even a 10% cut to the military budget. She moved away from Medicare for all as soon as she got any pressure. Why would you think that a running mate is going to ignite the spark? They just don't get it. But I mean, look, if you don't get it, that's fine. You're in DC. You're in that bubble. We're all in our own echo chambers, but there's something that you can do if you genuinely want to understand what's happening. You can bring on more leftist voices. How often do we see MSNBC bring on left wing people? It's rare. It's very rare on Meet the Press with Chuck Todd. He brings on right wing panels all the time to talk about issues related to looting and rioting and Black Lives Matter. Like, how is that supposed to solve anything? One of the most popular shows on MSNBC is a show hosted by a Republican, Joe Scarborough. I just, they don't understand it and they don't want to understand because if they did want to understand it, they would bring on different voices. Now, I just discovered a YouTube channel about a month ago called All Gas, No Breaks, where this guy goes around the country and just interviews people and he doesn't necessarily like interject any commentary himself. He just gives people a microphone and lets them talk. And there was a portion of the last video he put out that stood out to me where he asked some Portland protesters what they thought of Joe Biden and how excited they were. And you can tell even like, by the way he framed this question, he already knew what the answer was going to be. Now, on a scale of one to ten, how stoked are you guys about presidential candidate Joe Biden? Zero.   So do you guys plan to vote for Trump instead? I'm going to vote for anarchy. That was interesting. Now, unless those people are, you know, some sort of psychopathic pizza gate conspiracy theorists, either they were joking or referring most likely to the creepy videos of Joe Biden touching young girls and women in general. That's probably what they were referring to.  Who isn't? Now, those people in that video, like, I don't believe they are your average representative of people at the protests. But what I do think they represent is a common sentiment that you're going to find within people who are protesting, because I mean, a lot of people who have been worried about police brutality and who have supported the Black Lives Matter movement who are in the streets constantly. Like now that Joe Biden is the nominee and he's talking about increasing funding for police and he's remaining defiant, they probably feel like I have no choice now. Now I have to do rioting because I mean, Joe Biden is not going to do any fundamental changes. He said nothing will fundamentally change if I'm president.  I have to protest. I have to take to the streets. So I mean, if you ask people there, they're probably going to say, no, I'm not very excited about Joe Biden. That's what the MSNBC anchor who was interviewed said. And, you know, you can tell that that's what that interviewer in the All Gas No Breaks video expected because he said on a scale from zero to 10, how excited are you for Joe Biden? And he was really sarcastic, like you can hear it in his voice and he doesn't usually like inject his own commentary into these videos. But you just like, you know, young people aren't excited about Joe Biden. But the thing is that there's still a lot of time before the election. He can change that. He can unequivocally support at least one bold policy, Medicare for all. Legal weed. And I've said even before, like he doesn't even have to take it that far. He doesn't even have to promote a new policy. He could take one of his existing policies and just talk about it nonstop. Like, I believe he supports a $15 minimum wage. Why haven't we heard you talking about the minimum wage? You adopted some elements of Bernie's climate change plan. How are you not talking about this?  I mean, it's just how could you be confused at this point? Joe Biden had this enthusiasm problem before. And the media still pushed him anyway, or anyone but Bernie.  The only problem is that MSNBC's rich pundits, they don't have to really worry about the worst of what Donald Trump has to offer because they're shielded regardless of who's president. But, you know, their propaganda has led us to this situation. And now they're pretending like it's so shocking that young people aren't excited about Joe Biden.  Maybe you should have thought about that before you pushed him as the most electable candidate.


Okay, am I making noise? All right, I was in and out of this thing twice this morning. It just seemed like the clearest thing to do for me anyway. But it's still, it didn't feel smooth and easy. I did it, where are my charts? Here I am. Basically, I just took, I tried to go out for the one minute low with the spread, it was a little slippery, but I got in here about 130, 140. And from there, it just, as soon as it dropped, it took that big drop, I took it off. I didn't like the spread. I actually did try and re-entered, thinking it was gonna do some nice things, but we just don't know. And to me, this just looks like a great big question mark right now. You know, I feel like this could do anything. Good and bad. So I am, I'm done with it for now. But really just a simple play. As soon as we took out this low, I was all over it. And didn't bet heavily. As far as other things happening in the market, I didn't catch the market long. I already have swings out there that took advantage of some of that. Some of those targets already hit too. So like I apparently had some in the cues of my swing trade and I took it off. But as far as WH, yeah, WH had Koala, you're right. This was not a comfort play. Not like our friend Hal yesterday, which pretty much did what it was supposed to do. So, you know, and I guess it's a low at the moment. So we'll see what this does. But no great insight on this one for me.


Okay, where's everybody at though? Are those your feet? Are they here? Hello feet! I'm fast as hell boy! Good, we're here with the one and only Mike and Mike! It's not TikTok bro! We're not doing the TikTok video! Hey bro, that's all I got, honestly. I do that for everything. He really does now. Here, like in the toilet, like it's all the way over there. Can I hear what's going on? That's how you do it man. Alright you guys, well today we are playing dreams. It's been a while since we've played this game. Since it released, we were all on it. We wanted to go like full ride, like play this game, like left and right, but we just never did, right? And then you lost it. I lost it, I thought my nephews borrowed it and they took it and I don't know, I couldn't find it, I asked them if they had it. I found it in my closet, short story, long story short. Long story short, he tried to blame his little nephews. And then he had it all alone. They always take my stuff man. Alright you guys, well we found some Thomas games on this. Dude, it has everything on here. You can think of a character, name it right now in the comments, drop it, EXE, whatever. What character? What character do you want us to look for? Because they have it all, they have it all here. Everything you can think of. Alright, so today moving forward, we are specifically finding out Thomas EXE games as you can see here. We found Thomas the Slender Engine Reboot. Look at this man, so why is he even built like that? Probably not usable to look like that.  Alright man, well let's get it, you ready? Let's go, let's get it. Oh, okay, responding already? I already see him. Dude, he's right there. Excuse me sir? Are you lost? Are you lost sir? Bro, why do you look like that though? Is that blood from your nose? Wait, you stopped? That's not the smoke you got, you didn't want to smoke my boy. Oh my god. Excuse me sir. Okay, you guys on the- Make it to the top. He killed you? I got smacked bro. Alright, let's run to the top of the mountain. Maybe there's something safe up there. What is that? Let's get closer. Don't tell me that is Squidward. It looked like Squidward bro. What is Squidward? Squidward's hopes and dreams. Oh, he's crying too. Dude, what the heck? Wait, look at him bro, I want to see it. This is so sad. Squidward man, it's okay. Follow your dreams, don't give up buddy. Everybody follow your dreams, man. Follow your dreams, but that's Squidward.  He's pretty bad at music. What's that?  I guess so. Oh, snap. Should I jump? Go. Oh wait, do we see a path? Maybe there's another easter egg. Oh wait, I don't think so. Oh, wait, ooh. There's like more maps from what we've seen earlier. Er. Erly. Er. Ooh, Shesh 17, let's get it. An easter egg to Shesh 17. Oh, they got Shesh 17 on here? So we have to find the easter egg. Like that should be our little mission. Ooh. Okay, where's everybody at though? Are those your feet? Right here? Hello feet. I'm fast as a boy. Trash bag? No, sorry. It's to stop the trains. Okay, dude, can I go in here without being attacked?  Could you put me on my body? Oh, he's staring at me. Oh, he's right there. Thomas, Lander. Oh, what is that? That's Thomas. Thomas used to be a boy. Then they turned him into a tank train. My boy? Really? Yeah, my boy. That's what Shesh 17 is about. Dude. It tells you. I should have watched all those videos. You should have watched all those videos, bro. Oh man, he's stuck. Look, he's staring at him like if it's his son or something. Oh. Okay, what else do we got? We got Shesh 17. We got Sir Top Hand Hats House. Let's go visit him. Dude, this is epic. Hit try one, bro. All right, let's go. Try it out, try it out. This rich? Yeah. All right, here we go, baby. Get it, get it. Oh, is there like a turbo? Oh, no, no, no. Sadly, there isn't. All right, let's go. Just walk down the street. That's Lenderman. I mean, Siren Head a third? No, it's just a tree. Where? That is not a Siren Head, but it's a tree. All right, let's see. Let's try to walk around here. Go to the fire. It's kind of cold out there. It's kind of cold, man. He's right there. Hey, bro. Your house is on fire, bro. No, that's Top Hand's house. He's dead. Top Hand? He lived his house on fire. I came to visit Top Hand and look at him. Oh my God. He's being cooked like that. That's a fire. Oh, get out of here. You ain't exist in Top Hand, no. Oh, it's Lenderman, bro. You got that fresh cut. Excuse me, excuse me, excuse me. Oh, broken ankles. Go on the fire, bro. Go on the fire. Go on the fire, bro. He'll never catch me in the fire. Wait, wait. Can you go in the house? Try to go in the house. Oh, I am in it.  Oh, I know what happened, bro. What? It's because I just dropped my mixtape. Oh, all right. Is that heat? Is that heat? Oh, maybe I can make him go in the fire. I don't think you can. Oh, come here. You're dead, bro. You're not burning? Try to go in the house, bro. Super serve. Oh my God. It doesn't give up, huh? All the doors shut. Never mind. You can't go in that. Open the door. Open the door. Hey, he got me, bro. All right. There was no Easter egg. Sadly, we were roaming around. Well, Mikey was roaming around and I was thinking it's laid, but he's letting Thomas. All right. The next one is Muffle Mountain. I think that's when we joined in at first, right? Yeah, I think it is. All right. Oh, let's go to Steamworks. Let's check that out. Oh, look at this guy. He looks fancy. He looks like he got a little fit on and everything. Got that drip. All right. Oh, a huge chainsaw, bro. Oh, this one looks way more cooler than the other one. Yeah, this is legit. Yo. Oh my gosh. Who is that, Mikey? Name that train. Bro, that's Steamboat. That's Steamboat. According to Mikey, ladies and gentlemen. Oh my God. What are you saying? You look like this. Who's this, Mikey? Bro, that's obviously Wilbert. My boy. All right. You got that right. I try not to even be his name. He's like the owner. All right. Let's go in here. I don't even know this guy's name, to be honest. Number 16. I named him. Oh, bro. Come on, man. Number 16 in the NBA. Number 16 in the NBA. I don't know. I was going to give him that name. Don't ask me questions like this. All right. Let's go in here. Oh, that's who you have. How are you doing? Oh my God. He's chasing me. How does he have a chainsaw? Oh my God. Can we go up here? Yeah. Bro, it's a trap. You can't even go up there. It's a trap. Okay, I see a ladder right here. Let's go over here. Go, go, go. Go. Oh my God. I missed a ladder. Oh my God. Oh, you can't. Go. You can't. This is a real lie. How do you put a ladder that you can't climb on? This is a phony, man. So maybe you can go around the building? I think this is it. I don't think you can go around. I like it, though. I like the little map with the trains. Yeah, that looks cool. I mean, look at this, bro. Oh my God. You got blood keeping on his eyes. Whoa. Look at me. Oh. Oh. Oh. Oh. Oh. Oh. Okay, now that's on your map. Are you sure? Yeah. Yeah. There we go, down the hole. Hey, it looked like it had potential. I feel like you could go up there. I feel like you can, but you can't climb. Maybe you don't got to parkour. Parkour. Parkour. Bro, I can't. Maybe ask little Willie. Hey. What's his name? My boy. Hey, Willie. My boy. No. I'm trying to ask you how do you get up there? Nah, you can't. Yeah, it wouldn't let us dirty. Yeah, you can't climb up there, sadly, ladies and gentlemen. I guess just take me away. Take me. Oh my God.  What are you doing? What are you doing? Willie's can't even do his job right. Come on. I don't know what I'm calling him, Willie, but. Hey, bro. Are you really kissing, bro? All right, I guess.  Hey, Willie. Oh, wait. Oh, I thought that was the tire head.  All right. All right. Get away from me, weirdo. No means no. Leave me alone. That would kind of come from this guy. He's harassing me. All right. I guess that is it. This one was cool. I liked the map, but I just didn't like that. It was kind of small. That was the only downside. That was the only downside. It couldn't really go anywhere. Right whatever, man. We still got like three, four more maps. Look at this. Oh my God. We got four more. Shit. Oh, this one looks, you see. Oh, here try this one. Oh, let's go. I guess not all of them have Easter eggs, unless the Easter eggs are like... I can always get the snow ones. I can always get the snow ones. Let's go. Powers. Is anybody here? I need some hot cocoa. Some hot... Oh, that's on fire. Some hot cocoa. Oh, Tiddment. Oh, I heard something. It's like they can't open the doors and stuff. Oh, there's an open door. Oh, let's go. Oh, man. I guess they abandoned this place. Let's go inside. I'm pretty cold, man. Oh. Where's the door open? Was it in clothes? Yeah, it was. Hello? What the heck? Chupati muneña? Michotaso? All right. That was cold. Okay. They got some coal here. Maybe I could start a fire. Oh, yeah. Oh, it is right there in the middle. I saw him. Right there. My boy right in the middle. Excuse me, sir. I'm kind of cold. Do you have a sliver? Then he's going to make a sweater out of your skin. And he's going to wear it. Thomas, what happened to all the trains? Maybe he doesn't. Okay. So it says, Thomas Gottse, Gottse. Peter Griffin. Peter Griffin. Henry III. Henry III. Henry III. Henry III. Oh. Wait. Did I say Gordon Ramsay? Gordon Price. Oh. That's where a train's one through five. Oh, good. Look at the run. Look at the run. Oh, you saw how he slashes. Oh, my gosh. Oh. Excuse me. Excuse me. Those are like trains one through five or six. How many? It's not like the names in the order. Okay. Let's see.  Anything else here? I guess there is no Easter egg on. I don't know. I don't think all of them might be. Excuse me, sir. Is there any Easter eggs? Look at him. Look at him. Look at him.   Look at him. Look at him. Hey, you're slow, boy. Boy, get faster, boy. Wait, what is that? What? Dude, that popped out of nowhere. If you are reading. Read it, read it, read it, read it. If you are reading, I'm going into hiding. I'm at the Misty Island with Bash and Dash and Ferdinand. I'm already altered, but I'm not evil. And the same goes for Bash and Dash and Ferdinand, but they're not evil. I'm safe in Misty Island. Totally Turner is a tram engine. Oh. Tim Turner? Tim Turner? Tim Turner. With a burner? Tim the Tim the Tim the Turner. All right, I guess that was the Easter egg. Yeah, that was... It was just a message that he left behind for us. All right, that was cool. I don't know, so far the best one, which one did these the best ones so far? I liked the... I liked the first one because they had Squidward in it. No, that was the third one. It was the Muffle Lantern. Yeah, that was pretty cool. Oh, look. Is that SCP-96? Extras Easter Egg? Let's do that one. Let's do that one. All right, next we move on to Dieselworks. Dieselworks. Diesel, put him in work. Oh. Uh-oh. Oh. What? It's like... It's probably like a flood. Yeah. It's right there. I like how they just stand there. Hello? I left... Diesel? Everything. We didn't... Oh, you see that? Is that... Dude, they have the... Oh! Dude, he gutted them. He gutted them. Look at that. I'm trying to move a little close, but not too close where he won't attack me. That's a fire thumb now, right there. Ah! It feels like we're playing Slendy Tuggies, huh? Yeah. That's it, my boy! That's all you got?  Where's Tommy's Tuggies? Oh, let's go in here. Oh, it's scary in here. Okay, let's go back here. Oh. Oh, there's more. All right. Where's the back here? Who's out here? There's... Oh, you could go up here. Oh, there we go. That's what I'm talking about. How are we talking? I feel like I'm going to get jump scared. Yeah. Oh, what is that? Oh, it's just a fire. Just some traps on fire. Oh, Lord, it's a fire. Oh, that's good. Okay, guess that's it. Oh, man. Come on. Is he turned over the way? Oh, he's turned over the way. You died from that. Come on. You got weak knees, bro. That'd be me looking. Okay, guess that's it. Maybe the easter egg will pop out. Oh, they're still scared of me. Yeah, it's because it's loud. It's just like the sound effects blast out loud. I was hoping maybe there'd be like a hit of message like on the other one. Guess not. Well, there's scratches on the wall on this. It's probably hands scratching it up. Like as he passes by. Each scratch is like each person he killed. Oh, my gosh. That's a lot of people, man. Oh. All right, you guys. Well, I was trying to look for an easter egg and I couldn't find anything sadly. I guess we just got too excited with the first easter egg when we were hoping we'd find an easter egg on each map. That was the best one. Well, no. It doesn't work that way, sadly. Oh, no. Oh, my gosh. I almost trapped me. I don't know how I didn't die. All right, you guys. Well, those were some Thomas CXC. I know there's plenty of more. There's plenty of more maps for us to go check. There's like five more. Four, five total with the easter egg. You guys wanted to do the rest of the maps. You know what to do, man. Smash like, drop a comment. Comment more if you want more. Of these videos and we would gladly do them for you guys. Do it. All right, you guys. Well, we'll see you in the next video. Thank you all for watching and if you want to say anything, Mike, before we get out. Go and subscribe to our other channels and subscribe to this one and hit the notification bell also and tell us what other games you want us to check out and we'll do it, all right? Yeah. Peace. Peace.