Let's get started. Welcome back on this lovely Wednesday. All right, let's see me here if everybody can hear OK. Good to see you all. Randy, good to see you all, everybody on YouTube. Michael, good to see you all on the Cyber Group Room. Excellent, all right. So I've got a couple of stocks that are moving pretty decent. Held a lot better than yesterday. Yesterday was horrible. You know what? I really struck out yesterday. For a Tuesday, I thought I'd do better. But a couple of mistakes I did make. I got into a couple of bad trades. Things went down against me. The only stock that really helped me out, which I'm going to talk about a little bit, is the United Airlines. Was it? That was the only thing that really got to help this out on that stock right there. There was a really nice short on this stock right here. You can see how that thing just literally had a really nice trend. I got in pretty late over here. Hold on a second. Right around here. And then, because right around 10 o'clock, we were jumping into other stocks that were moving. But airlines obviously were the big news. And I should have watched this stock earlier. I know they were talking about it, that they took a really big hit on their earnings, something like that. So we'll take a look back at it and check it out. There were a couple of other stocks out there also that were there. But honestly, I really not talk about it. It was just not. I got to make back today. Well, not I. I got to do the best I can to make back. Listen, good traders lose money all the time. And you got to remember, losing is not a bad thing. As long as you learn from it and you don't blow up your account, you did good. I always tell you guys, when I first got started, I told you this story a while ago, for cyber traders, you know that by being a student of mine. A long time ago, one of the biggest lessons I've learned is that I once had a stock take advantage of me. It was called Netscape. And stock went from like 60 down to 40 in one day. I tried to get a dead cat bounce, make a long story short. I was up about $1,500 on the day. It was when I was just starting out. I had a really good day. My goal was making about $500 a day when I first started. I was almost like three months into the job, got into this trade. Back then there was fractions. There wasn't even decimals within three clicks to stock every tick, every little tick. Today it's a penny, right? Back then it was 25 cents. Lost 750 like that, like a jerk, got back into the trade, started trading like an animal, lost everything. Like I said, make a long story short, paid $20 a ticket, did 120 tickets that day, spent close to about $3,000 in commission charges, lost the $1,500 I made, ended up being down $5,655. I would never forget that day, almost about $10,000 for someone that was just trying to make 500 a day down $10,000. Well, guess what? Most people be out of business that day. I got suspended at my job for a week to teach me a lesson, came back, guess what? At the end of the month, ended up being positive. I made it back little by little and I was taught how to do that. And that's the good thing about a trader. You know what? If you can, you know, when you're up, remember you're always gonna meet the people on the way down, right? But the question is, could you come back and get back up again where you fell? That's how you know you're a very good trader. And a lot of people don't know how to do that and that's why everyone who's here also part of the Cybertree University. Because remember, our goal is, we don't teach you how to make money, we teach you how to stop losing it and that's what you gotta focus on. So anyway, a couple of stocks that I'm moving this morning, we're gonna keep an eye on it. I got a couple of them here. We got this BBIG that's moving this morning. You can see that one right here that's got a pretty decent move. I was hopping over here on the level four. I'm not really seeing that much right there. You could see that we had a couple of orders out here. There's a guy right here, about 8,000 shares, around 250, 244, actually the exact. He pulled his order, he lowered it. Looks like he had a little bit of a sling shot there. Very slow stock, nice little level one stock, nice beginner stock, it's had a terrible stock, but that one's not that bad. That one I thought was pretty decent. We'll keep an eye on that. OCGN is another one that's doing probably the best out of them all. It's not even up a lot. It's only up about 20%, but look how pretty that chart is. Gorgeous little chart. Just started moving on eight o'clock.  I had the, hold on, where am I? Here we go, there we go. All right, so I'll pre-market watch list. I'm just gonna bring this back and put it in the chat room and put it in there. That was actually one of the stocks earlier this morning and you could see it there. You could see also, I have it listed on the YouTube. It's actually that little post right there. That stock was obviously, we found that this morning, if you jumped in around eight o'clock, when we saw it, it was nice, had a nice trend. I kinda liked it because we had this big little bar pop right around 7 a.m. So stock from six to right, 660, that's not bad. That's not bad. You know, nice spread, a level one tier size, hopping over here on level four. Just showing what we got here. The issue we got right now, there's a big seller at 670. Big iceberg order. You could see it's been out there. Not terribly long, but it just came out there just now. The 56,000 shares, but the stock had a nice little push. I didn't see any big orders. This guy got filled right here around 650. Kinda really stapled it. Why may that stock do what it had to do? But that was so far probably the nicest stock so far this morning. And listen, stock trader already 9.8 million shares. You know what's so funny? There's a lot of you out there that trade and still today don't understand why you can't get trade in pre-market. And once again, it all comes down to who's your broker and who trained you. But this is where we make most of our money. Another nice stock that's moving to this morning, very cheap little stock, ATHE. You know, there's not a crazy amount of iceberg orders out there. I got 100,000 share buyers sitting there at a buck 40 right now. But what I can see, that's basically right here. But you know what? Up 22%, cheap little stock, level one stock. Some of you remember we trade the stock in August. This thing went from two to five dollars. So when some of you look at this stock, they're like, fast, it's not really moving. I mean, like, why can't we look at something else that's got more action? Trust me, we trade the stock and it could move if it wants to. So keep a close eye on it. But it does gonna take a lot to move it because there is, you know, listen, stock already trade 12 million shares. Didn't move that much. I'm not trying to, you know, reverse my words here. But the stock, if you remember, it did trade millions of millions of shares, hundreds of millions. And if it does kick up again, we could get some good volatility. WPT is another really good one this morning. A little bit more on the riskier side, a little bit more volatile. That's the issue about this one. Looking over here on my level four, you know, I saw a couple of iceberg orders come up around 19. There's a guy right now for about 28,000 or around 1850, which is pretty much here. You can see it looks like, yeah, he's still probably out there. Now you might see that as a support level. I don't look at support levels. I look at buyers and I look at sellers. There's no real seller out here. So a lot of orders getting filled, but let's see how this thing opens up going into close. But if you look at the long-term chart, stock looks pretty good, breaking the 52 week high. There was a couple of the cheap ones out here that not really moving substantially. This INPT, you know, 13% up about a buck 20, not a terrible stock.  I'm level one stock I wanna throw in the B list is the WLMS that also, I kinda liked it because it's not up a lot. It's got some decent volume, not crazy, but you know, the stock took a little bit of a correction in the last couple of days. But if you look at the long-term chart, stock has obviously done pretty well, going from a buck 50 to $4. Now remember, the goal is everyone is this. We're here to make money. That's about it. You know, don't ask me why or who or where. Listen, this is really where it all comes about. Follow the money, make your days pay, and call it a day. That's all you have to do. Now, that pretty much does it. I mean, listen, a lot of airlines, I was watching them earlier, they're trying to make a little bit of comeback, but they're obviously not looking too well. I got out of all my airlines, so you guys should probably know that. I told you that a while ago. I got out of everything, actually. I got out of everything. I told you this yesterday, my swing trades, I'm doing better on my day trades than my swing trades, and my swing trades, I don't know. I'm just seeing, like, I'm not really seeing that big of a trend on certain things. I see more things backing off. I think I just told you, told you about that. What else we got? Yeah, Apple also is on it.  But I'll be really careful. Another thing too, I know a lot of us are also looking at the cryptocurrency stocks. Very, very cautious about coin, okay? If coin starts going past 310, then you have a big issue. I told, this stock, I mean, listen, it went all at 440. I can't believe that. I actually triggered this stock. And I bought it at 425. I bought, was it, what was the high? I bought it at 420, and I sold it at 424.  Am I a moron? God, I got out of it, because that day dropped all the way down to about 300. I would have been crushed. But the thing is you couldn't short it. That was the issue. But the thing just kept going up. It went from 380. And when the IP opened up, I mean, it ran all the way to almost 430.  But the stock is starting to go down. A lot of you were a little concerned. And I know I got a couple of emails. A lot of you are looking at the blockchain stocks like Mara and Riot. Listen, I've been saying this for a long time. If the United States starts getting into with this new administration, they start getting in there and say they want to regulate. And I can't blame them because the banks control everything. And the last thing banks want to do, I don't know if you know this, banks make their money from currency. They make money when you transfer money from Italy, I mean, from Europe to US, to Canada, to Mexico. That's how they make their money. The last thing they want to do is have somebody start getting rid of that currency and starting and going there. And not only that, but I think a lot of you are starting to realize too, the reason why crypto currencies, I mean, crypto's been doing well is because inflation. You can't print more money. You can't print more cryptocurrency, crypto. But you can print more money, so. But they start regulating it, you know, which I was saying about almost a year ago, probably even longer than that. And obviously I was dead wrong, you know? But they didn't find it as a threat back then. But now they're starting to see that, you know what, they might look into it. And they do that, you could have an issue with these cryptocurrency stocks, okay? Because I'm telling you, once they start regulating stuff and government starts getting in the way, that's why you're gonna have a big issue. And I don't think anybody wants to be caught in that. So be very careful on these stocks. I know some of them on your short list are pretty cool. But I would keep an eye on Marit hitting some major support levels around this $3 price range. I'm just glad that I was long and I got out of them. I've been out of them for a while. And I made money on one and I lost money on my second because I basically, you know what people average down? What I like to do sometimes, I like to average it up. Meaning if I like it, I'll buy more. And if I like it, I'll buy more. But the last one I did, I lost money. But I think I kind of, I still made money, but not as much as I just stick with my first position. Cause I thought it was going up, but this thing started coming out pretty hard. So be very, very careful on these crypto stocks. But always remember, keep an eye on lumber. All right, I talked about that yesterday. So lumber stocks obviously have been very active. All right guys, so that pretty much does it. I know some of you guys are talking about Netflix. I had Netflix there this morning. You know, we're not trading Netflix. I just threw it on there so you guys could see that the 800 pound gorilla in the room like Netflix like Netflix bound about 44 points took a huge hit from 550 to 500. So listen, here's another thing I want to point out to you. Netflix hasn't gone anywhere since July. Look at that chart. It really is going to 550, it's going back to 500. Going back to 550 is going back to 500 until it breaks out, which obviously that's not really a good sign when it gaps down that low. Unless you get it, if it recoups a lot of it back today, that's not really a good sign. Okay, really not. But I guess the new wave is going to be the lumber. All right, so we got wood right here. Look at that. We got a little bit of a push right here. Wood's going to make a new time high. I'll probably just gap up right there. Keep an eye on that. All right guys, so listen, don't forget today, we have class today for all you golden platinum students. Josh is going to be doing class today at 1030. Josh, what are you going to be talking about? You're going to be talking about opening clothes, identifying the smart money before it begins to trade and get a better sense of the whole thing about entries and exits, which is everyone's biggest problem. Okay, so look forward to seeing all of you. And if you want to know how to get into that class, talk to Education Advisor at Cybertrain University to tell you a little bit about it. And if you're watching YouTube Facebook Live, if you want to get into our trading room, enjoy us for a whole week live in the trading room with commentary, just like us and friend us. And $9, if you're not happy, we'll give it back to you at the end of the week. The worst thing that could happen is you learn something. All right everybody, good luck, happy trading and we'll see you back here at 2.30. And students, we'll start commentary once the market opens up about 15 minutes. So go get ready and we'll be here when the market opens. Good luck everyone and be safe.


Labour Party's presidential candidate Peter Obie says he will secure and unite the country where every citizen will be proud. Obie, who spoke while flagging of his presidential campaign in the North, said that they started the campaign in Kaduna because it is the capital of the Northern region. Hello, hope you enjoyed the news, please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Good evening, everybody. Welcome to the Private Property Farming Podcast. My name is Mbali Noakor, your host every Tuesdays and Thursdays at 8 p.m. It's great to see you once again. And we've got another exciting show lined up for this evening. But before I get into our guests, I must mention that we are running a competition leading to our 100th episode. Today is episode 97. And every Tuesdays and Thursdays, right here on the Farming Podcast, I will be announcing two winners based on our campaign that we're running. So check our social media pages. It's called Know Your Crop. So basically what you need to do is tell us about the crop that you're growing and give us one or two interesting things about your crop. And you can stand a chance to win 500 grand cash prize every week here on the Private Property Farming Podcast channel. So every Tuesdays and Thursdays, I will announce two winners. And this evening, we do have two winners. And what you need to do in order to claim your prize to the people I'm about to announce right now is that you need to comment right here, live onto the show, about just say anything interesting. It could be to our guests, ask our guests a question, like, share, or comment, based on our discussion. And just tell us about maybe your crop even. So the more information, the merrier. So you just, all you have to do to claim your prize is just pretty much comment right here on the live show. The team behind the scenes will look out for your comment and that's how you claim your prize. So I just want to start off by naming the two winners today. So our Facebook winner is called Josiah Fadival. And we have Twitter, a Twitter winner who goes by the tagline Anna in, or Anna Marigotsi. So Anna Marigotsi and Josiah Fadival. Please, if you can comment live onto the show to claim your 500 grand cash prize, that'll be fantastic. Or just comment with the hashtag Know Your Crop, hashtag private property, hashtag private property farming podcast. I think that is sufficient enough. Or you can ask our guests anything based on our topic this evening. So to Josiah and to Anna, please make sure that you comment to get your 500 grand cash prize at the end of tonight's show. So let's get right into it. Today we're speaking to Devin Wells as well as Henning Glopper. These are both the co-founders of Zuni Wagyu which is quite an interesting business. It's about beef farming. And I like the term Wagyu which little explained shortly but gentlemen, thank you for coming onto the show. Tell us about Zuni Wagyu. And how are you doing? I forgot to ask. Barley, thank you so much for having us. Firstly, we really appreciate the opportunity and we look forward to the chat. My name's Devin Wells and this is Henning Glopper. And we're from Zuni Wagyu. We're actually quite a young business. Or us too. The company was only registered in the beginning of this year. It is a generational business. We have taken over from our dads. Our dads are actually best friends. A long story short, so Henning's family moved on to the Eastern Cape from Johannesburg in 2006 next door to us and our family became best friends and since then a friendship has then emerged into a partnership. So we've actually, we come from two different farming backgrounds. We used to farm with ordinary Angus cattle and we used to have a beef stud, an Angus stud, and Henke used to have a commercial stud. So we combine now, we combine the genetics of our past with our Wagyu of the future or of the present. So we, our Henning's dad went to Australia in 2010. They went to Australia in 2010 and had the his first Wagyu experience. And then when he came back, our families decided that we should maybe start farming with Wagyu together. And in 2014, both farms merged together and we started, they started the business Zuni Wagyu. The reason why it is called Zuni Wagyu is because we farm in the Zuni Valley, quite close to Alexandria, about 80 kilometers east of Port Elizabeth. And we've actually, we both quit our jobs last year and moved back to the farm this year to take over the business and onwards and upwards from so forth, yeah. So essentially our fathers are responsible for raising the cattle. And then once it's gone to the abattoir from there, we take over the reins and we've got a deep owning facility on the farm. So we've got control of the entire value chain almost. And then from there, we send our Wagyu literally across the country to wherever you are. Wow. Wow, it sounds amazing, guys. Tell me, what were you doing before that? Devon, you said you quit your jobs. So what were you doing? Penny, what were you doing as well before Zuni Wagyu? I studied agricultural economics at university and then went away to work, came back and did my postgraduate teaching certificate. And I was a teacher, a geography teacher for two years last year and the year before. But I've always had a passion for farming, always had a passion for beef and me and Hennan decided largely, we're actually driving in the bucky on the farm, one of our farm holidays on the holidays in the farm. And we both just had a conversation like what do you really wanna do one day? And we both just said we really have a passion for meat and we have a passion for the wild factor in beef. And we really wanna be that wild factor in South Africa. So that's where our deal started. And then eventually we just decided, you know, this is something that we have to do. Yeah. Interesting, Penny, what were you doing? I was head of operations at a company called Freedom of Movement. For, since that started, yeah, I was actually one of their first employees and grew with the business and obviously a small business growing into quite a large retail business. I gained quite a lot of experience, especially in the logistics side of things. And that's kind of where both of us said, well, who's family at his dad, that's this amazing talent of deboning wagyu caucuses because you cut it slightly different to normal beef. And I've also got the logistics and retail experience to kind of take a product online and to market. So we said, why don't we combine it? Because I think that's quite an interesting talk order is that the fact that due to COVID, you can now order any, a good quality wagyu steak and have it delivered to your door. We previously saw everything as I think, we're a little bit nervous to buy things online. And we're not asking them to buy meat online. But I mean, we've done over two and a half thousand shipments and then very successful, no big major faults there. So yeah, gentlemen, just to get into the technicalities of this, right? Because I'm hearing you saying beef and I'm hearing you saying wagyu in like in different terms, right? So is it safe to say that wagyu is beef or wagyu is a specific type of meat? So wagyu is a breed that originated in Japan. Just to give you a little history lesson quickly. So in Japan, they were used as track deer. So they were used to pull plows and to pull carts. So they have a wagyu carcass or a wagyu animal has an overdeveloped forequarter and a smaller hand quarter. That's one of the reasons why you get so many different cuts out of a wagyu carcass and you would have an ordinary beef carcass. So wagyu actually means our cattle in Japanese. So in other words, it means Japanese cow or Japanese cattle. Okay. And is the wagyu cattle best grown in South Africa or are the other breeds that surpass wagyu, for example? Well, we obviously wagyu farmers. So we're always going to tell you that wagyu beef is going to be the best. But to be quite honest, wagyu beef, there isn't really much that comes close to our we feel personally. Obviously the main difference is the quality of the fat and the fat content within the meat itself. So there's a term marbling. I don't know if you've heard of the word marbling before. So marbling is inter-muscular fact within the muscles. So that's what makes wagyu different to ordinary beef is the fact that they have fat stored on the inside of their muscles. In Japan, very cold, obviously the animals not only had to store fat on the outside to survive, but also had to store fat on the inside of their muscles. And obviously fat is energy as well. And in order for them to produce enough energy, they had to store fat on the inside of their muscles.   All right, so let's get into both your roles because you said the parents are primarily involved in the primary production. Henning, you're head of operations. Just tell us about what your portfolio within Zuni Wagyu entails. So essentially, Devon and I also kind of split our roles as in our parents raise a cattle and they send it to the abattoir. And then Devon is responsible to raise, to debone the carcass, and then cut it up obviously into different steaks. I'm from the moment it leaves the meat room, I'm responsible. So what we do is obviously we're selling a luxury product. It's not been around the bush, it is more expensive than normal beef. It is really the money worth, in our opinion. What's nice is that there's so many others, lesser known cuts that people are now starting to explore. So from the moment it leaves, we've obviously got polystyrene cooler boxes and then an outer box, which we packaged it in. So with tissue papers, we try to sell a story here and kind of give people this entire experience like the box opening of it. So from there, we then give you on that evening, once it's sent out, we give you estimated time of arrival. We then coordinate with the client the entire time to make sure that they're available at that time. And then obviously once we have delivery, we then go and check in with the client to make sure that they're happy at the end of the day. Happy client, happy life, I guess. Yeah, so your focus, Henning, is definitely from business to consumer, right? What made you decide to focus directly on the consumer and not go wholesale and sell in bulk? That's an interesting question. So COVID definitely, as I mentioned earlier, played in our favor in the sense of people want to have a good piece of steak at home and we, one of the only companies that can offer them, I mean, we've sent to, from literally, as they've mentioned, 80 kilometers east of P, we've sent to La Palale, we've sent to Tricard, we've sent to Richards Bay, we've sent to Sutherland. We're a little bit nervous sometimes, but we always get it there successfully. So we ensure that it stays cold for four days, but we get delivery at 10.2. Where everyone's focused on keeping the cold chain in the sense of keeping the vehicle cold, we then rather let's focus on the inside of the box. There's a lot of people that ask us how we do it. And I think we're crazy as well. Yeah, a lot of people thought we were crazy last year when we said that we want to do this, but I mean, we've done two and a half thousand shipments and it's really been, we've had three issues. One was due to the Durban rides. The other one was a missed delivery and the other one was, we had a new gun here and unfortunately didn't take the box. So it's all things that were a little bit out of control, but three out of two and a thousand is quite a good rate. Absolutely. And I mean, with any startup, with any business, you're always going to have mistakes. I mean, there are companies that have been around for 50 or 100 years and are still trying to get it right because the consumer at the end of the day constantly evolves. David, you're head of marketing as well as deboning.  So from the deboning process, are you thinking of the consumer first and then you're deciding how to package it so that the consumer can consume the product? Yeah, so we actually focus on obviously our website based on our retail customer, but we actually do specified orders as well. So people ask us for specific things. So some of the products that you see on our websites, we actually tailor to the individual customer as well. So there are people that are asking us to do certain things every day. What happens is the animals leave either our farm or Henning's farm and they are transported to an abattoir in Graemstad. The animals are then slaughtered or harvested in Graemstad and then they are graded at the abattoir as well because we need to obviously have an external grading system in order for us to keep track and gather data about our beef which is a completely different conversation on itself then gets transported back to the farm where it then arrives in an ordinary caucus would be transported in quarters but a wagyu caucus weighs between 500 and 550 kilograms where in comparison an ordinary beef caucus weighs between 320 and 380 kilograms. So it's a lot heavier. So we actually don't transport the animal in quarters. It's actually sometimes in five or six pieces because they also have to do the grading between the fifth and the sixth rip. For us to measure the iron muscle or the fat content within the ribeye in order for us to have the marbling score per se. So the meat then comes into the deboning facility. It is then cut into certain primals. As we mentioned earlier as well the four quarters they have an open available four quarters. So there are a lot of different cuts that some people might have never heard of. So like the flat iron that comes out of the blade or the denver that sits below the chuck or the chuck eye that's above the ribeye between the chuck or the neck and the ribeye. Rib steak so it's a short rib of the animal so the pork belly of beef you'd say. So there's a lot of different cuts then we actually then obviously have to make sure that we're very accurate with our cutting process because it's an expensive product.  So we are very fortunate to have quite a good team that work with us in the deboning facility as well. And we really focus on attention to detail and then after that obviously focus on making sure that the clients are happy. And then once that product has then been put into the package Henling takes charge and then it gets sent to the customer. Yeah, still with you Devin. Then customers can sometimes disappoint and people would say the economy is not doing so well. I'm a vegetable farmer and I know that having supplied to retailers and some wholesalers businesses will tell you that the number of the footprint of people walking in stores, nevermind online has slightly dropped because the average income in the household has slightly dropped. So with your strategy as a Zuni focusing on more on consumers how do you manage the demand versus the supply? Are there times having been around for a year now? Are there times where there's too much meat from the avatar and you just don't and there are less customers buying? Do you find where you kind of like maybe we need to expand it a little bit more to a bulk buyer because the individual customer is not buying and like you said, it is a premium product. So I suppose it doesn't come cheap. And there's so much technicalities in what you were just explaining Devin around the processing of it. So how do you manage the supply and the demand especially in an economic climate that we're faced in with a premium or a luxury product? And will that push you or pull you rather to maybe focus on the bulk buyer slash wholesale slash retail client? Obviously with an expensive product or a luxury product you've got a certain target market or a certain LSM that you're trying to target. So they're obviously trying to create small pockets in certain areas or in certain clientele in order for us to be able to or not even get rid of but sell all of our products. But our strategy per se has actually been to try and focus our trim products on the wholesale market and then try and focus our promos and our stakes where we obviously add a market to that quite a proportion of market to that. The reason being that obviously let's take a caucus that weighs 500 kilograms. People don't, people think that if you have a caucus that weighs 500 kilograms you're gonna have 600 or 400 kilograms of steak. They don't realize that there's bones, there's fat, there's trimmings, there's this wastage, there's sinews, there's so much in that caucus that you can't actually sell at a premium price. So we've actually made the joke plenty of times that we actually just glorified patty salesmen. Because we have a sustainable model where we need to make sure that we have to sell all of our trimmings before we can sell our steak. So out of a beef caucus that weighs 500 kilograms you get about between 220 and 250 kilograms of trimming.  So for us to sell 20 or 30 kilograms of steaks we have to sell 250 kilograms of trim. So that's where we try to focus on our bulk sales being our wholesale market. So we're in all the Hudson's in the country so our burger is actually on the menu and all eight Hudson's in South Africa. We've now started a slow rollout with cattle baron as well. And then obviously we try and focus on getting our trim through the wholesale market and then we make sure that we keep our clients, steak clients happy per se. So we've got restaurants that are often on the menu for a constant supply of rebar or sirloin or flat iron or steak cuts to sell in the restaurant. And we actually just tell them, very sorry but we can't help you because we don't have enough supply. So that's where the question is we don't have enough animals to be able to scale it at this moment. So that's one of the issues that we actually have. I think that's the interesting touching point that David wants to touch on is that Wagyu is this new buzzword in the meat industry and people also used to, I mean, before this year I would walk into a small web and buy a ribeye steak and not think about the entire rest of the product. And with this whole new buzz that's going around Wagyu is at the end of the day, if it carries on creasing like this demand, there's not gonna be enough supply in the country because what's also very different about Wagyu is that you don't raise it for one year or 18 months like an overclock because it's literally three years. So what that means is the carrying capacity on your farm also divides by three.  So we try and do have like slow, natural marbling. When you see marbling, you need to try and look for small, thin veins of fat instead of big coarse pieces of fat. That's almost like a little bit of a forced marbling if I can put it that way. So yeah, that's where, yeah. Well, I guess perfection and premium takes time, hey? Before I get to my next question, which is directed at you, Henning, I just wanna encourage at NAM or at Marigotzi to comment on tonight's live so that you could claim a 500 grand cash prize as well as Josiah Farival to claim your 500 cash prize for our Know Your Crop competition. If this live ends and you haven't said anything, unfortunately, you will forfeit your prize. So please comment on tonight's live, say anything, hashtag Know Your Crop, hashtag private property, hashtag wag you, which is part of our discussion this evening. Going back to you, Henning. So how has the online sales been since you started? I mean, you mentioned a very interesting stat, 2,000 plus orders, and the fact that you also come from your previous job or employment also dealt with a bit of online sales, et cetera. So how's this type of business different to your average retail sales because now we're dealing with meat and hey, it's wagging. Like you said, it's quite premium. Yeah, so at the end of the day, we are still selling a fresh product as I mentioned earlier. South African consumers in general have been very wary to purchase things online, which is understandable. A lot of things can go wrong in a career process. It's a very difficult thing to monitor, but overall the response has really been amazing. And I think short of that, our clients, we've picked up data that 70% of the clients who placed the order first time round actually placed the second or third order. And that's a very positive sign that our systems are working so that people start to realize, hey, it is actually really easy for me to get this awesome product delivered to their door. Another challenge that we also kind of found is that if you cook wag, you're slightly different to normal steaks.  And then to go into more depth, cuts like Denver or Flatiron is a more dense muscle. So it takes about one and a half times longer to cook it, to cook the steak of the same size. So what we did to kind of counter that is we add cooking guidelines and instructions into the package because at the end of the day, buying wag is, it's got a high price and it's gonna be a daunting cost. We're like, okay, I really don't want to mess this up. So that we kind of baby and like grew in them into being, okay, it is actually easy. And this is the hot tops and guidelines. Wow. Yeah. They're hungry already. And I think that's a fantastic thing that you've added there because you just hear waggy and I kind of like want to order now, but I want to make sure that I'm cooking it right so that it doesn't taste awful. Because the way Devin explained the deep owning process and the fat and the this and the percentage, you're kind of like, geez, I never thought meat would be that complicated. So yeah, so I think it's such a genius idea to actually add recipe instructions or cooking instructions. And maybe I'll ask this question to Devin, it could be an opportunity here, but have you considered maybe partnering with other online, other online fresh produce delivery company?  So let's say a bachelor was ordering and he doesn't know how to cook, would you look at partnering with like a you cook, for example, to add your waggy beef and have your recipe in there for greater partnerships and expansions? We're always obviously always looking to partner with the online platforms. And we actually are farm direct, we actually started working with farm direct. So we obviously, I think the most important thing here is that we need to make sure that we're working with other people in order to grow waggy as a whole in South Africa. We obviously trying our best in order to create a good product, a Zuni Wagyu brand, but inevitably all producers in South Africa are under the same brand being waggy. So we obviously try and make sure that we always try and uplift the name of Wagyu per se. And if there's anyone that's on that same, on that same wavelength or on that same sort of course in order to improve the quality of not only of Wagyu, but of beef in South Africa, which Wagyu is per se, it is a better quality beef than ordinary beef. So we work with other smaller platforms as well. Sorry, getting back to your question, I've got a little bit sidetracked. There's smaller platforms that we do work with than the weeklies of the fillet lady in Cape Town, Bay Meat Market, also based in Cape Town. So we slowly but surely creating a web and creative positive relationships and good relationships with other suppliers in order to help ourselves and to help them as well. Yeah, and I suppose you can never also grow too quickly because you have to manage the supply and demand and also the fact that the growing process or the raising cattle process that Henning mentioned that you raise the cattle for about three years. So you obviously need to manage, but it's great to know that you work with farm animals because we actually had them on to the podcast. I think it was last month. So it's nice to know that farmers are working with platforms such as these. So gentlemen, as we close off our conversation today, I just wanna find out, so what's the next step for Zuni Wagyu? Have you guys discussed in terms of where do you guys see yourself in the next two to five years? I mean, there could be people watching this podcast that are outside South African are thinking, damn, I'm hungry, I want a bit of that Wagyu. So someone could be ordering online right now. So which are the inner prospects of delivering maybe like to neighboring countries, Swaziland, Lesotho, Zambia, Namibia, you know, is that a possibility? So I think it's quite interesting. Internationally, there's a big demand for Wagyu. It's growing faster than the demand for Wagyu in South Africa almost. And I mean, in Australia, China had a bit of a trade agreement fight. So now the entire China is looking for quality Wagyu to be exported out of countries and into it, where we kind of try and keeping like our best product and ensuring that we always deliver. But we are actually actively looking into specifically Africa. I think there's an amazing target market and it's actually the tourism industry and it really is an awesome opportunity. So we are actively looking at that further in the local community. We are looking at possibly opening small niche butcheries and things like that. A little bit of a different spin to your average butchery. I think in general, no offense to any meat farmers, but the entire meat industry is dull and boring and we're trying to put this new young, fresh energy into it so that people realize, okay, cool, there is actually a little bit of a different spin on it. One thing that we do, which not a lot of people actually do and it's been quite successful is tasting events. So we're actually doing one tomorrow evening for Brian Havana. We did one two weeks ago for Sivan Gezi. So we go and we run through eight different cuts and we obviously talk about the cuts and go into detail what they do. And actually it's similar to some of the concept to wine and ask people, okay, what tasting notes do you taste out of this? And what we always do is we take all of the stakes from one cog and we explain to people that like how awesome it is that interesting it is that you get such different taste profiles and flavors out of just simply different cuts from the same animal. And that's also a new little bit of a different spin where we actually, obviously when COVID allows it, go to people's houses and then present it and do a whole run through of all the different cuts that we do. Yeah. Wow, thank you so much for your time gentlemen. This was such a fantastic conversation. And geez, I know that we'll see a lot of Zuni much more as well. And maybe just please share your website details so that people know where to find you. So do I go to Farm Direct or go directly to Zuni and maybe just spell out Zuni so that people know where to find you? Of course. So they are always welcome to purchase the Farm Direct platform or any other platform but our own website is Zuni YU that's Z-U-N-E-Y-W-A-G-Y-U.com. All of the information run through there, our information and all of our contact details on there. And by all means please call us, ask us questions. We like, because we're trying to educate the consumer here to understand what Wagyu is because once again it is a luxury product to kind of give them. And hang large to chat. He loves to chat about me, that's it. That's fantastic. It shows that he's passionate about his product. He's passionate about his business. And I mean, that's what's gonna make the sale at the end of the day.  So yeah, it's great to see the passion both your gentlemen faces. And I'm sure your parents must be part of you in how you've pivoted the business and really focused on this secondary and tertiary part of the business. Thank you very much, I appreciate it. It's a pleasure, thank you so much. That was Devin and Henny, both from Zuni Wagyu. And they were telling us about their business, Zuni Wagyu. Wagyu is a beef premium product. Please go onto their website. I won't try butcher how Henny's spelled that, but if you missed today's live, just go towards the end, check out their website and order directly. And what I liked about Henny, what he said is that he's always willing to understand the consumer's perspective. So please buy their products and also give them feedback because I think that's what's gonna make them great at the end of the day. So yeah, here's the spelling. So it's Zuni Z-U-N-E-Y Wagyu.com Order and they are delivering throughout South Africa and also you can get their products on Farm Direct SA if you are a regular to shop on that platform. And I must congratulate both our winners, they've commented, they've claimed their prize. So congratulations to you. Please continue to follow our campaign, know your crop. And I will see you next week Tuesday at 8 p.m. with another fantastic guest. That's it for me tonight. Goodbye.


Hi everyone, thanks for attending. My name is Jonathan and the topic of my talk is going to be about the dark side of Winsock, which is essentially all the under the hood functionality that you have inside Winsock, inside the Windows TCP AP stack, which unfortunately, even though it's there and it's publicly available, it is somewhat undocumented and the only people to really use it are the bad guys, namely people who want to do rootkits, who want to do spyware, et cetera, et cetera. Now I find myself somewhat inclined to start with the preamble here. This is not some type of vulnerability issue or not some type of any, you know, zero day exploit, so if any of you are expecting that, it's probably not the right place to be. What this is, however, is a discussion on functionality which, like I said, is in there and is mostly, well mostly the only really good uses as you'll see are the insidious ones, namely the ones that aren't really designed to happen, things such as usurping connections, rerouting connections, connection monitoring, et cetera, et cetera. Now it is assumed that you guys have had some experience with Winsock before. How many of you have actually coded in Windows for Winsock? Okay, well, okay, so as I was, you know, I kind of suspected that, so we'll start with a brief intro that kind of has a nomenclature and kind of has like the basic terminology, so those of you who are fairly new to this will be able to sort of like keep afloat and then we'll get into the code. Now the code itself that I'll be demonstrating is all fully annotated, you've got that on the CD. On the CD you have a PDF of my talk which, contrary to other PDFs, it's not just the slides, it's also the notes pages. So you'll be able to have the full source code, everything is there. Furthermore, my demo which I'm going to run shortly is based on a public demo which is Intel's and Microsoft code, so it's like fully open source and nothing too new there. So we start with the introduction and some of you may already know this and I'm actually hoping most of you know this, but it's just sort of like the basic terms we'll be using. So as you all know, IP communications are usually based over what's known as sockets. Sockets were something that essentially are meant to abstract sort of like what you'd have with file descriptors, only in this case it would be network descriptors. The idea is fairly simple, the application would open a socket and would just send and receive data as it would with any other file descriptor. This could be using receive, send calls, et cetera, et cetera. And you'd also have some other APIs which are essentially get peer and get adder info and so forth which are meant to be socket specific and to enhance these descriptors so as to accommodate all types of TCP and UDP based needs. Now the application itself is somewhat agnostic in the sense that for it is just another file descriptor. Those of you who may have some UNIX background know that sockets and file descriptors and UNIX are one and the same pretty much. So you can, you know, you have the very same API. In Windows what happens is that you have the Winsock which I'll be describing shortly which takes the sockets just a bit further and gets you a lot of added functionality. Now the important thing to emphasize is that the application would read and write just with any other file descriptor. So what would happen essentially is that all the fragmentation and capsulation and getting the IP header and the TCP header UDP whatever it is is basically handled transparently by the OS which is really good news for a lot of application developers because they just work transparently and just don't care about whatever IP issues or TCP and so forth issues that might arise. Now what I'm going to demonstrate to you works with pretty much all sockets of all types. It works with TCP UDP raw sockets as well in case Microsoft hasn't crippled them completely in service back to and also IPv6 sockets which is really nifty. Now the way it works is that Microsoft took the BSD model which is your average libc type socket with all the rich API and adapted it into something known as Winsock which is basically Windows sockets. This went through several versions and revisions. We started with Winsock 1.x which you're not going to see anyway because it's mostly like for Windows 3.11 and so forth. And Winsock 2 is basically your baseline today. That is to say it's present in Windows NT, it's present in Windows 2K, 20.03, etc. and of course your XP. Now the major important issue with Winsock is that the migration from 1.x to 2.x added a host of new features. We're not going to be discussing those new features length but some of you may know that it provides for asynchronous calls and various function callbacks which is really good if you're working in a multi-threaded environment and so forth. It works with overlapped IO namely getting more than one process to listen on the same socket and this is going to be the topic of our talk here. It provides something known as an LSP architecture which is the layered service provider. This is going to be a very key and instrumental term for us as this is essentially the core of the talk. This service provider interface is essentially giving you the architecture to hook any Winsock call by any process aside from certain system processes which bypass Winsock. We'll get into that in a second. But essentially any Winsock functionality you wish, it can be anything from a get host by name through of course sending and receiving in sockets and so forth. Everything is pretty much hijackable in the sense that this is pretty much the equivalent of set Windows hook that you'd have for general Windows API functions only specific for the Windows platforms. Now this is really, really useful and we're going to be talking about some of the legitimate uses which as you'll see there's quite a few legitimate uses. However, we'll also see that the really important uses are those that are so to speak less useful for the good guys and mostly sort of like the covert or the black hat oriented uses. Now it's also important to say that like I said this has been out there for about seven years now pretty much. My first encounter with that was like 1998 or so and it's really frightening to see that all this functionality is there. It's under the hood so your applications are fully agnostic. They have no idea that this functionality is there and yet some of the spyware developers and other such application developers can pretty much inject whatever functionality they want and the application is none the wiser. So getting into detail here, this little illustration here shows you pretty much what the Windows networking architecture is all about. Some of you may find this a bit familiar for those of you who aren't. I'll just run a brief sort of like review of this. So looking at this from several levels of abstraction here, oops wait a sec that's Microsoft PowerPoint running balled on me. So looking at this from several layers of abstraction, we can see the hardware down below. Now no matter what hardware type you're using, whether you're using a wireless network or a wired ethernet or even a modem, pretty much all your Winsau calls will eventually be rerouted over the hardware in a sort of device independent manner. The miracle that does this is something called the end disk driver which is the network driver interface specification. That's sort of like an abstract driver for any type of interface. In Unix terms some of you may be aware of the if config and the interface configuration. So it's pretty much a port of the same idea in Windows terms. And the end disk is essentially an abstract driver that works with pretty much all types of communication devices. These can be modems, these can be ethernet cards, etc. Following that we have the TDI which is a transport driver interface. That acts somewhat like a bridge in the sense that you have calls from user space going into kernel space through this TDI layer. Now in user space you mostly have either Winsock 2 for 99% of the applications or something known as NetBT which is the NetBios over TCPAP transport. Some of you who might be familiar with a backslash backslash server, the SMV or CIFS notation, that's pretty much it. So aside from the workstation and server service, which are core components of Windows, pretty much any other application would go through Winsock. And that of course is what makes this all the more attractive to us. Now as the applications go through Winsock they are pretty much, you know, they all work over the same API which is the application programming interface. And that is the API that you link with Winsock or WS2 underscore 32.dll and it gets you the functionality of the send receive and as well as a host of WSA calls, namely WSA AsyncSelect and others to name a few. So you have all types of applications. They can be your browser, your FTP, naturally your IMs probably go over that as well, IRC, etc. Now this is sort of like the application type view that most programmers are familiar with. However, as it turns out, this is only half the picture. So if we try and look deeper, we see that we have this Winsock API layer, which is again the top interface, but we also see that we have a Winsock SPI layer, which is a bottom interface that is meant for what Microsoft defines as service providers. Now the term service provider like I said is a key idea because service providers are essentially either hardware types, namely, you know, your network cards, etc, etc. Or they could be software types as in software type drivers, which are mostly user mode drivers. Now this is really important since it gives you the full functionality of packet inspection and whatever you want, but at the socket level. So essentially from an OSI model perspective, we're working at layer 5, which is really quite the improvement over other types of sniffers and root kits, which generally operate at a lower level and thus confine you to a packet view. So here you can actually hijack a socket and not really wonder as to whatever the breakdown of the packets is because it doesn't really matter. Now essentially these providers are one of two classes. You have the transport providers, which as the name would imply, work with the data transport itself, namely the TCP and UDP transfers, etc. And you have the namespace providers which work with all the, you know, get host by name, etc. Namely if you want to look up any type of address, that address can be a NetBIOS name. It can be an SMB name, a CIFS name, etc. And this would imply of course that you need a mechanism to abstract that. And this is exactly what the namespace providers are all about. I'm going to focus on the transport providers because they are of course the next year ones in the sense that they actually get you to see some real data. Now as the illustration also shows, all the providers would share the same API, the same top API, which is what I see here what I mark here as a transport SPI, that is the Transport Service Provider Interface. So whatever provider you're using, essentially all these providers must work pretty much the same way. Now Winsock providers cannot normally be listed by applications, or at least they can be, but only if the application is actually aware of it. Microsoft has as part of the platform SDK, which is part of the Visual Studio Distributions, they have something known as an sporder.exe, which is a small executable meant to show you the service provider order of course, and also it comes with a small DLL called sporder.dll. Sporder.dll is a DLL that we'll discuss shortly. It actually has the ability to not only show you the service providers, but actually shuffle them around as you see fit. And this type of shuffling around is exactly the hooking functionality. So going on to see a slight demo of what the service providers are like, so auto-complete is not cooperating. So you have the sporder.exe, which shows you all the available service providers here. Now my display is particularly cluttered due to the fact that I have VMware here, which is pretty much all those globally unique identifiers that you can see here, as well as another VPN solution which opens up a sort of like a virtual interface. But the core providers that you're likely to see are the ones you see here. There's one for the infrared which is ERDA, there's one for basic TCPIP, there's one for UDPIP, there's one for raw sockets, and there's two of them for RSVP. RSVP is a quality of service protocol which is generally supported but never really used by Windows. Now going into one of these you can see that they essentially give you the complete information on the service provider, namely which DLL is actually the one that provides the functionality, as well as a bunch of service flags, provider ID which is a globally unique identifier, etc. The important stuff here that some of you programmers might recognize are the address family, the hex value too, meaning AFI net, there's also the socket type which is a SOC stream, and there's a protocol number which is 6, 6 of course for TCP, and naturally you'd have 17 or hex 11 for UDP. And so the way that works is at any time an application would request a type of socket to be created which would be a SOC stream, rather an AFI net SOC stream and a TCP essentially, a TCP socket. What would happen here is that this call would be redirected over to MSWSOC.DLL where WinSOC or the WS232 DLL is actually acting like a multiplexer. That is to say that it is one main interface under which you can have all types of various providers. Now again, this would normally be the case with your average Windows and the more interfaces you have and the more applications you have, the more of those providers you're likely to see. As for the name resolution providers, these are the namespace providers, you have your basic TCPIP which is an interface to the DNS client service, you have NTDS which is of course Active Directory and you have network location awareness which is something that again Microsoft supports but never really works. So you have all those and now comes the important part. The important part is that you can have over these service providers you can have a functionality that enables you to chain your own providers. That is to say not just add a provider and by doing so you're going to have to essentially make the application aware of that provider but you can pretty much hook your providers and install something known as a provider chain which is really an amazing idea. Now the original plan behind that was to support all types of nice uses. Nice such as transparent encryption, such as quality of service, etc. But the way that works is that most applications don't really use that functionality and so it's just left there but not really used in everyday terms. Now the beauty of it is that you can chain any number of providers and you can chain them in pretty much any order you want. That is to say that if you want to provide some encryption functionality for example or reroute everything, all types of data transparently over SSL or SSH or whatever other tunnel you want, you can pretty much install your provider and then bump it to the top of the stack. So any other application using the stack would essentially get directed to your provider first and your provider would do whatever you want and then follow down the chain, essentially progressing the API calls down the chain. Any questions thus far? Okay. So the way it works is that your Winsock, the DLL itself, has several functions which are exported. I'm going to try this the dump in demo a bit clearer here so we'll be able to see the... So what I'm doing now is I'm setting up the visual studio command in my environment so I can show you the dump in command and the way dump in works is, as some of you may know, it gives you the DLL and shows you all the exported functions or the imported functions and so forth. So what I'm going to do now is essentially look for an exported function list of Winsock and focus on the specific service provider interface. To do that what we'll do is just do dump in slash export, get the name WS232 and since essentially Winsock exports like on average about 100 and something functions, I'm going to use the command line utility of grep to isolate only those important ones. So looking at that you can see that you have these particular WSC functions. Now again those of you who might be working with Winsock on a daily basis know that Winsock usually exports to WSAs which are for the Winsock API. WSCs you see here are essentially all about the service provider interface and so forth. Now there's too many functions here to actually go over but the ones of interest are essentially install provider and deinstall provider which enables you to of course set your own LSP or remove your LSP as well as install namespace and for some weird reason it's uninstall namespace. Hinting that maybe this API was not really meant to be used because it's not really standardized in that sense as an uninstall and not deinstall. Now all of these are also fully documented as part of the MSDN but it's the kind of MSDN documentation that resides on like the fourth CD that nobody ever gets to because it's like so obscure in the back. Now as it so happens these functions are readily exportable and you can use them to do your own type of work as I'll show briefly in a demo. Now this SP order DLL is an additional DLL that as I said works for rewriting the service provider order and as the example here shows this is a dumb bin of the SP order DLL and you have right namespace provider, sorry right provider order and right namespace order which essentially enable you to shuffle around as I've stated and put your provider just in its right location. Now a lot of spyware aware applications like adware and all types of anti spyware essentially look for that DLL and if that DLL is present on your operating system then it's bad news. Then they normally flag it as spyware and so forth. Probably the best example of that was CASA the file sharing utility that has SP order.dll bundled in. So when you install CASA you have this DLL somewhere on your system. Another interesting application to use this type of DLL is Google desktop. I don't know how many of you use Google desktop but Google desktop has probably its niftiest feature is that after you install it whenever you go into Google.com you suddenly get your own desktop there. You have like the ability to search Google or to search your own desktop from the very same web page. Now obviously that kind of functionality would imply that Google has a mechanism in your machine that can intercept the calls to Google.com and sort of like rewrite the page content on the fly. That is exactly the functionality that I'm describing here. Namely by installing their own provider and putting it in your machine they can intercept the calls to Google but they can of course do whatever they want. That is to say that if they're not really playing by the rules they can do a lot of other stuff as well with your machine. But then I'm happy to see that not too many people use Google desktop here because that's kind of like shady. Anyways, so going over that probably the most interesting API call would be the WSC enum protocols which would be the API call that one would use as a setup to install their own provider. This much like all the other WSC enum functions will enable you to sort of like go over the protocols that are already in place and provide for an enumeration of them. An enumeration in our case would be a pointer to an array of protocol infrastructures. Now you have a fully annotated example on the PDF in the PDF so I won't really go into that. But the idea is fairly simple. Anybody can call this function and see what service providers are already there. In many ways this is pretty much the only mitigation against this type of attack. However most applications don't really use that and if anything they would use the counter part of this call which would be the WSA enum protocols. And the difference between the A and the C is that the C can get all the protocols whereas the A gets only the top layer ones. So if you're using yours in a chain essentially you can remain hidden which is of course bad news. So going over that we have the enum protocols just to see which protocols are there and we naturally want to build our own service provider. Now using a service provider is really fun. It's really easy too because as a baseline you have the Microsoft supply demo. So I happen to have this demo right here and I'm going to work with the actual Microsoft code. Due to copyright restrictions I haven't really bundled it or put it in a targe easy for you guys to use but it's fairly simple to just get this code from the MSDN and just work and do the same modifications that I did right here. So looking through that code the DLL main would be a good point to start. So launching visual studio just so we can see this type of DLL then our service provider is just going to be another DLL. So essentially it has to follow the very same conventions that is to say it has to start with the DLL main and the DLL main would work as pretty much all DLL mains work that is whenever an application would hook to us and would call us we would get the DLL process attached as the DW reason. So the way that works is whenever a process attaches I add this little addition here which essentially doesn't do much. What it does is it just opens up a file name. It readies a file name here with an S print F composed of SOC debug as a prefix and the current process ID embedded in there. The reason I do that is because once I'll do that and of course run my applications you'll see that each application as it uses WinSOC will generate this type of file on the root of the C drive and what it does here is that it just opens the files and pops a message box and you will be able to see that message box. That message box and any type of code that I run here is run in the context of the calling process. So while this is a somewhat innocuous example and just you know only for demonstration purposes I'll print out a lot of stuff. If I really wanted to I could do whatever I wanted here. Essentially I could load additional DLLs as the comment says. I could decide that this particular process should not access a stack and so forth. Now to make matters even easier for the spyware people this type of functionality can also be injected in the WSP startup call. The WSP startup which is shown right here in the slide so WSP startup is essentially the counterpart to WSA startup. Those of you who may have been working with Windows know that each Windows application as it starts as it launches its WinSOC functionality has to start off by calling this function the WSA startup and what it does is that it requests a certain WinSOC version and request certain capabilities. Now the beauty of it is that most programmers just call WSA startup check the return value and naturally everything is just okay. However these programmers are unaware that this essentially would call the WSP startup which is our code. So in RLSP what we're going to do is essentially implement a WSP startup which will have our very own code in there. Now looking at WSP startup you can see that it has five parameters as opposed to WSA which has of course fewer parameters. The parameters of interest here are specifically the three last ones. We have the in parameter protocol info which states what type of functionality the application expects namely are we expected to perform TCP or UDP or any type of other service. We further have something known as the up call table which is by far the most useful parameter here which will enable us to have an array of essentially it's a pointer to an array of functions and these functions are the already installed providers. So that means that if I want to hook for example send or receive I don't really have to think about how I would implement send or receive but rather I would implement them my own and sort of like a stub function and later on just go on to call the up call table. And the example will demonstrate that shortly. Finally we have the only out parameter here of interest the other one's really not interesting the LPWSP data is really not interesting but the LP PROC table here is our procedure call table and that is essentially a pointer to all our functions. So whatever functions you choose to implement you can pretty much set in this big structure there and just call WSP startup and returning from the call you would pretty much produce your procedure table and you'd be guaranteed that your applications your rather sorry procedures would be called. Now those of you who may have been working in the UNIX and Linux environment would know that in order to achieve that in Linux you'd pretty much need to have any type of a kernel module inside the Linux kernel for example or any type of streams interface in Solaris which would of course be a lot of hassle but when it comes to Windows all this is pretty much transparent to you. So looking over the SPI CPP which is the main file that has all the functions let's just go over WSP startup briefly and you'll see that what Intel and Microsoft do here this is again their demo is that they simply implement this WSP startup call. The important thing here would be after initializing their own internal structure would be number one to save the WinSoc 2 upcall table that is to say save the actual implementations that are already out there because we're going to need to call them as sort of a pass through and once that's done they do a lot of other startup code and so forth and they get to the important portion of populating the procedure table. So the procedure table is a structure and it's as simple as it can get because you'd have a structure of function pointers and all you have to do is just hook your function pointer to the corresponding functionality that you want and so once that's done you can hook all those calls. Now just looking at one of those calls say for example WSP receive which would be the counter part of the WSA receive and so forth. Okay so looking through that at some point we'll get there. Yeah okay there it is. So this is the WSP receive function which is again guaranteed to be called prior to the application actually getting any data. So if Google for example wants to rewrite the content this is exactly the function they'll hook. Now again I won't go over the numerous parameters here. The parameters of interest are obviously the socket in question and a long pointer to the buffers. This would be an array of input buffers and since we're passing an array by reference we also have to piggyback the third parameter which is the count of buffers namely what is the size of said array and so what I do in my little demo is do a fairly simple function here which would just go on and write to the debug file that it's intercepted a receive and would simply go over the buffer. It's going over the entire array there and simply printing out the buffers. Now as far as a demo is concerned this is really not the type of graphical pyrotechnic demo you'd imagine because it also will accept a lot of binary data. However it does illustrate the point that the data can be intercepted and can be of course modified. If you want to you can pretty much have any type of modification of those LP buffers and you can inject your own buffers you can put your data you can log the data and so forth. I of course chose just to log the data. Now naturally you do the same thing for WSP send and a host of other functions but that goes without anything. So we have our DLL and now the next place would be the next step sorry would be to insert it. Okay somehow get Winsock to recognize our service provider as a valid service provider. Now bear in mind that this is something that has to be done outside the DLL because your DLL can only intercept certain functions but it cannot install itself. However in order to install it we have another call which is how you see install provider. This is a fairly simple call where all you have to do is provide a globally unique identifier which is of course easy to just whip up for yourself. And you'd set up your own DLL path and the type of protocols you support that's all it takes. Now your example should have actually I'll go to my source code here just to demonstrate how simple it is. So all you have to do is have a small executable file like say this inst lsp which again is a verbatim copy of the Intel one. I didn't really do anything here because this is the same generic code that would work with any service provider and so what it does here is that it has a little function called install my provider wherein I populate the provider info like so I populate a lot of stuff. You'll also notice a nice little flag here called PFL hidden which is this flag right here which is a really nice flag because this actually tells Winsock if anybody wants to enumerate this provider from the API level keep it hidden. Which you know I don't really get the actual intended use of that but whatever. Now there's also another interesting copy here which is security scheme which enables you to have your own type of security for your provider blah blah blah most of the time you just do protocol none. So essentially I populate this provider and I of course register it as a protocol provider for TCP and once that's done is all I have to do is just call this WC install provider and provide the name of LSP DLL. This is assumed to be in Windows system which would be a problem if you're not in admin but then again you're gonna have to be in admin to run this anyway. But you can also specify a full path here if you really want to and so I load the protocol info through the pointer and once that's done I pretty much guaranteed that my provider will be installed there. Now let's go ahead and try and install that provider and see exactly what happens. Now you'll notice that I already took the liberty of placing that little DLL here that DLL is as compact as 81K. Actually 80K or so. And the thing is once that DLL is in place all I have to do is call the INST LSP executable to do the rest. Now before I do that I want to fire up Regmon. Regmon is a tool by SysInternals which I'm sure most of you know and that enables us to hook all types of registry calls and the important thing here is that all this type of functionality of installing providers or de-installing providers is essentially all registry based. So if you really want to bypass this type of DLL with enumerating the provider order and so forth or installing your own providers all you have to do is directly access the registry which is of course fairly simple. So what I'm going to do now is I'm going to launch Regmon and naturally all is silent because my process hasn't started yet. And now I'm going to run this INST LSP and as I do you can see that it's scanning the all providers and then going on to install my provider on top of all the rest. Now again since this is a rather crew demo I didn't really go to any pains of just looking for the right providers. I just said go ahead and install it over all the providers but it's fairly simple to just decide that you want a very specific provider. Now you can also see that there's a lot of registry action here and specifically all the registry action is focused on one specific branch which is HKEY local machine system, current control set services and Winsock 2. So firing up RegEdit just to see what you'll see and so already in my favorites you'll see that Winsock 2 parameters has the namespace catalog which is for the namespace providers and the protocol catalog which is for the transport providers. Now again Microsoft is inconsistent. They don't really call the things by the same name all the time but that's beside the point here. So under the namespaces you have all types of catalog entries and as you can see you have the same catalog entries that we could have seen under the SP order executable, namely the NTDS, the plain TCPIP and so forth. And when it comes to the protocol catalog here everything gets really messy because one would think that you'd get these nice type of keys and values but here you only have a packed catalog item which is a blob of binary data that if you go into you'll actually see makes a lot of sense. This is a protocol info structure that has been overlaid into the registry as raw binary data. Now you'll also note that once I put in my layered service provider the number of providers here has risen from the 30 something that it should be to around 57 because that's where my mind is hooking. So with all that in mind the stage is set and I can now run any application of my choice as I'll shortly do and you'll see that as the applications run I'll get a nice little message box and I'll get a full log of whatever. Any questions thus far? Yeah. Well no that would go with the namespaces provider with the TCPIP one which I'm not really discussing how to hook that. If you really wanted to you could also hook the loop back address as well so as people would go ahead and try to resolve and get the 127.001 because it's in your host file but then the application would get that first. So you'd be able to actually rewrite the result of the NSLOOKUP or whatever DNS packet should have been there and you'd be able to just put in any address of your own which is of course very nice for our purposes. Furthermore the Google desktop would then have to connect to the loop back interface and that would be a transport type action and you'd be able to to get the connect. You'd be able to hook the connect call and see a connect to 127.001 to whatever port Google is using and of course redirect it. So simply providing your workaround wouldn't really work because this functionality is actually stronger than that. Any other questions? Yeah. Say what? Oh you can't. So the question is say I want to put in my own provider. How can I ensure that my provider is the top most? In two words you can't because any provider that gets installed after you can pretty much rewrite the stack as they see fit. So you'd have the protocol chain. You think you're there first but the whole beauty of this mechanism is that it's so transparent that at any other point in time somebody can get ahead and jump in front of you and hook you as well. So that's of course good news or bad news depending on your perspective here. Yeah but that's not to guarantee that somebody else some other application starting up after you they could enumerate the order as well and they could rewrite the order as they see fit. So essentially this is somewhat of a limbo in the sense that you have a given order but the enum protocols will only provide you with a snapshot of the current order and no guarantee of any other application coming after you. You cannot decide you want to be the top most protocol in the chain and that's it. Further when any other protocol gets bumped in you wouldn't know. You have no indication whatsoever as to your position. Yeah you'd still be, well again okay so right okay so the question is would I still be hooked and the answer is yes and no because yes I would be hooked in the sense that I'd have my own place in the protocol chain. I don't mind the fish. I'll have my own place in the protocol chain yes but if any other top most provider would want to hold that call in the chain and not propagate it not play by the rules they'd be able to intercept it and essentially block it. So as I place my own provider I can either choose to go ahead and forward the call or I can say no I want to handle the call and I don't want to propagate it further. You can change the providers at any time okay using the order order the WSP right provider and so forth you can pretty much redo the whole ordering as you wish because all it changes is some internal structure in Winsock so oh yeah of course of course but then again there's no guarantee that you will be called again because again let's assume for a sake that I have my own custom provider and I want to make sure that nobody gets on top of me so assuming whoever gets on top of me does forward the call further yes I will be called but if that somebody takes the express route and just you know decides to bypass whatever other calls then essentially my provider would still be there but would never be called. Yeah the order is in the registry and of course an enum protocols would work as well. You could enum the protocol so as to get it in a nice little array but the order is right here okay this is pretty much the order I mean you can pretty much see that that the key names are the ordinals so it doesn't get to the root by sis internals I'm not familiar with the specific one but I can tell you that a lot of other root kit detectors don't really go that far. Now it's important to just define the terms here. This is perfect user mode action this is not a root kit in the sense of like a kernel mode root kit because that would be hijacking tcpip.sis itself and that you know that there's nothing that can be done against that but the beauty of it is that this is full user mode and in that sense it's a lot easier not to mention you can code sloppy and not risk a blue screen of death which is of course a nice little added benefit there.  Yeah just you know yahoo's a bit slow. Okay now you'll notice this is a really nice effect that I get the message box in the context of the yahoo process so I get their window class which is a nice not really nice but purple whatever okay and so this is connecting and everything is cool and nice you can also see that it's hooking another call and whatever they'll just let it run and you know ditto for messenger so if I'll just run here run messenger yahoo whatever yahoo you can whatever that's a student of mine just regard that okay so again so I can run that with messenger and so forth and all these sock debug files are right here so let's just go over the 1148 one that again this is very crude so I get a lot of seemingly junk looking data this junk looking data is all types of either GZ compressed HTTP data or all sorts of binary data such as images and so forth if I scroll down I should be able to see some HTTP request right here okay so this is the get of header tab.gif and naturally you get all types of this for example is a PNG you can pretty much see the header here that's a dead giveaway as well as a bunch of others etc etc the HTTP replies and so forth now again I want to emphasize one thing this again as a demo is not as half as fancy as it can be because with a little if there I could have simply rerouted Mozilla to some other site or I could have modified whatever Mozilla was displaying now another disclaimer here is that HTTPS type connections are unaffected by that fortunately there are other ways to hook HTTPS which are beyond my scope here but I'm just saying that if you do use HTTPS you're fine however when it comes to all types of other functionality messenger email whatever everything is pretty much in the clear okay any questions yeah yeah with NetBT you can although it's well again that let's define NetBT if the process that runs the NetBT request has launched after you have put in your provider then yes you can and if you get your provider into the Windows startup then yes you can okay however some functionality you still won't get namely the WinSoc bypass functionality that sometimes a server service does okay in order to gain efficiency it doesn't go through a user mode DLL because it doesn't make sense you know okay so you can hijack some of the functionality although not all any other questions yeah no zone alarm actually as far as I know go into the TDI this is what McAfee does though McAfee the personal firewall does do they do do that so but again this is kind of like a kind of like a paradox in the sense that you know it's absurd because if McAfee uses that and I can pretty much intercept their calls and get on top or reroute them to the bottom then it's really useless any further questions because I'm getting the sort of like new style so yeah right there okay the question is if I'm intercepting a WSP receive if I'm intercepting an SSL socket would it be encrypted or not and yes it would be encrypted because I'm essentially getting it as it came on the network so this enables you to play middleman but only middleman you know post SSL or post encryption which is as I've stated the proper worker on the proper mitigation to that would be to always use SSL and so forth however bear in mind that nothing is preventing the application from also you know trying to forge certificates and do any type of D sniff type man in the middle which would work here okay so just to conclude before I'm kicked out violently okay so that was the demo the lesson to be learned the thing you need to carry home from this is that no matter what you do no matter how you code your application the beauty of windsock is in transparency however this is a double-edged sword because obviously as transparent as it is it enables attackers to subvert either client sockets, server sockets or whatever now it's also important to emphasize that this was originally intended for good uses namely implementing an application type firewall application layer firewall we mentioned McAfee and of course we saw where that got um transparently add encryption this was well before the days of IPsec we're talking about 98 before IPsec was a fully robust protocol as it is now and nowadays IPsec is handled of course at the current level, enforced quality of service support new protocols this is also another nifty functionality you can essentially support IPv6 by it although it's supported already you can support IPv9 you can support pretty much any other custom protocol over raw socket and patch content on the fly which like I said Google desktop actually do whether it's a legitimate use or an illegitimate use remains to be seen however the much better chaotic uses would be to patch content on the fly in the illegitimate sense and again we're talking about rewriting webpages rewriting IMs doing a lot of other nifty stuff which I will not disclose here um obtained connection statistics URLs etc etc most of the spyware applications do exactly that they put themselves in so as to gather your statistics this was what the CASA spyware did eavesdropping on any type of connection but again non SSL ones and uh rewriting connections that is just hijacking the sockets which is really an amazing thing because an application opens a socket and calls connect and once it does that then you know the worst that can happen it's gonna call get peer adder but you can reroute connect and you can also reroute get peer adder so you know whatever the application thinks it's doing whatever wherever it's actually thinking that it's connecting to it has no real significance here because you can do whatever you want with it so uh all that in mind the demo like I said is part of the platform SDK you're welcome to drop a line to this address right here and if you need you know the demo with the actual explanation on what I did where I did and so forth then it will be supplied of course any further questions okay


Hello everybody, E here. Welcome back to another episode of 31 Days of Hollow Wind, but first, a word from our sponsor. Hey, you there. Do you like Space Horror? How about battling corporate evil in a post-climate change future? Why not add a huge dollop of spies, telepaths, and more sci-fi horror than you can shake an ice moon at, and pick up Last Light, the first episode of the epic new pulp sci-fi series, The Sunset Chronicles. Horror supremo Steve Stredd said of the first season of The Sunset Chronicles, Stevenson writes the characters lean and true, making for some fantastically done action sequences, all the while retaining that claustrophobic feeling you need with outer space-based books. I had a blast and I think you will too. So, if you like pulse quickening action, blood-soaked science fiction, revelations, and revolutions, you'll love this first episode in Paul Stevenson's Sunset Chronicles, the new monthly sci-fi horror serial from the author of the best-selling Blood on the Motorway Saga. Pick up the first episode for free at all good bookstores and the evil ones too. Many thanks to Paul Stevenson for sponsoring this episode. Now on to the review. Okay, so today we are talking about the Death of Jane Lawrence by Caitlin Starling. This is an absolutely fantastic cover and I love the way it ties into the book, especially this zero, we'll call it here, or this circle. I hope that was intended. So right off the bat, there is, I mentioned the zero because it's mentioned the number zero and its validity is mentioned many times throughout the book. So I'm thinking that was important here. I don't know, I'll have to ask Caitlin. Just let you know, I consider the author a friend, but anyone who knows me knows that I am far more critical of my friends than I am strangers. So I don't feel that that has made any bias here, formed any bias, however you want to say it. I'm a huge fan of the Luminous Dead, her first novel, and I love the novella Yellow Jezemine with both I've reviewed here on the channel. This one, I went out and bought this brand new from Books a Million, paid full price for it. I don't even have a discount card. As soon as I saw it, I knew I had to grab it to support her work. Absolutely fantastic author and a great human being. She signed with St. Martin's Press for this book, so it's a pretty big deal. I believe, I can't remember who did. The Luminous Dead wasn't a small press, but I think Yellow Jezemine was. Yellow Jezemine is a beautiful book. I have it packed away. It was one of my both books were on my best of list for 2020, even though I read Luminous Dead early early in the year. But anyways, let's talk about the book. This book follows Jane Lawrence, who reminds me so much of my friend Sarah Frost. Sarah, if you happen to see this, I think you'd love this. The character is very analytical, very straightforward, honest to a fault, an amazingly in-depth portrait of this woman and her idiosyncrasies. She ends up meeting a man and they get married, even though it is alluded to that he might not be interested. It's not really alluded to that he's not interested in consummating the marriage. He's not interested in them living together. He's going to stay at a place called Lindridge Hall. Well, and the man's a doctor and his name's Augustine, by the way. And August, well, Jane is going to be sleeping at the surgery that Augustine runs and he spends every night at Lindridge Hall. There's a reason for all of this. In fact, that was my favorite part of the book is finding out the little reasons for everything, everything that's going on with him, everything he does, and how Jane's idiosyncrasies, like I said, tie into the development of the book. And the number zero and its validity, as I said, is a very important theme of the book. This, this is the first gothic romance. I guess I'm going to call it that.   There is romance, but stuff actually happens. And I think that's the most important thing for me.  I loved every single character in the story. They all suited a purpose. I hope I'm going to say this right, but I especially love Dr. Nazamiyev. This is also an alternate, I guess, alternate reality, because instead of Britain, the place is called Breltane. And instead of Russia, it's Ruskin. So there's little things like that. None of the places actually exist. But the most fascinating part here is the stuff that does actually happen, the stuff that keeps you turning the pages. I first picked up the book just to check it out when I got it home from my shopping trip. And I just wanted to read the first page, see what the writing was like. And all of a sudden I was 16 pages deep. I just had to read it. Even though I didn't really have time to fit it in, I'm super glad that I did. It's one of my favorite reads of the year. And I think it is Starling's best work. It is okay. So here's my pitch for you. It has magic. It has ghosts. It has creatures. It has blood. It has gore. It has action. This book has everything.  Science fiction, fantasy, horror, romance. It has everything. And all of Caitlyn's books have had that. But this one especially, I think, like I said, it's her best work. I am so glad that she found a publisher for this one. You know, a big publisher that was willing to do a hard cover because the book is absolutely gorgeous. I mean, it's just beautiful. And I almost didn't want to read this copy because it was so nice. I almost got the e-book, but I probably wouldn't finish the e-book. Y'all know I don't like that format. But anyways, I blew through this book. I was reading anywhere from 50 to 70 pages a day. And that's a lot for me. I know it seems like I read a lot faster and a lot more than I do, but really, you know, I don't. I just have a lot of time during the day. I was reading Tim Meyers' Malignant Summer along with that. I was doing 20 pages a day just to get, you know, and anyways, let me not talk about that book. That review is coming soon. Probably Friday. I don't know when this one is going up, but this is the last week. I don't have a few more videos to shoot. Anywho, so this book, I really, really do hope it finds love and finds a home in all of your guys' hearts and your bookshelves. I feel this book is special. I don't know how else to put it. I was intrigued and engaged and fascinated the entire way through. And that just happens so rarely for me nowadays. You know, it might happen maybe five times a year at most. But with this one, man, it kept me locked in. And I absolutely loved it. Will it be my number one for the year? Who knows? I still have some other books to get through. But right now, it's way, way up there. But have you read The Death of Jane Lawrence by Caitlin Starling? If you have, let me know down there in the doobly-doo whether or not you loved it, whether or not you hated it, whether or not you felt meh about it, especially if you hated it. I would love to talk to someone who did not like this book because I want to know why. I couldn't find any faults, and maybe you did. But yeah, that's everything. Leave your comments down there. Let me know what you thought of the book. But until next time, I have been E, you have been U. This has been another episode of 31 Days of Halloween. I'll talk to you guys later. Bye-bye!


Hi I'm Pam Thorburn and I'm a ski cross athlete and this is why CrossFit will help you with your skiing. So CrossFit is a really great way to help you with your strength and that's really important to help with all your key skiing movements. We work a lot in flexibility in CrossFit which will really benefit your skiing because the more flexible you are the less risk of injury you will have. CrossFit is also great in helping you improve your agility. Agility is really important in skiing because it helps you with the changing terrain and it helps you react quicker, you're more nimble on your feet and also helps you push your skiing. CrossFit is amazing for conditioning, it helps you build endurance and it helps you overcome that midweek slump and for me it really helps me push harder and go for longer. CrossFit really helps my mental game because I know I'm physically strong and it just gives me one less thing to worry about when I'm on the hill ready to race and I can be confident in what I'm doing.