On March the 6th, the first UK death from coronavirus was reported. By March the 12th, when Boris Johnson gave his first big press conference flanked by Patrick Vallance and Chris Whitty, that number had only risen to 10. However, by this point, there were over 1000 people who had already died from the disease in Italy, and Britain's lackadaisical approach to the pandemic put it out of step with most of its neighbours. To justify their relaxed approach, the government had cited behavioural science and the concept of herd immunity. The day after that press conference, myself and Aaron Bostani acquainted ourselves with the theory's guiding government policy and assessed whether Boris Johnson's government were making a terrible mistake. We've done what can be done to contain this disease and this has brought us valuable time, but it's now a global pandemic and the number of cases will rise sharply. Indeed the true number of cases is higher, perhaps much higher than the number of cases we have so far confirmed with tests. And I've got to be clear, we've all got to be clear, this is the worst public health crisis for a generation. Some people compare it to seasonal flu, alas that is not right. Owing to the lack of immunity, this disease is more dangerous and it's going to spread further. And I must level with you, level with the British public, more families, many more families are going to lose loved ones before their time. But as we've said over the last few weeks, we have a clear plan that we are now working through and we're now getting on to the next phase in that plan because this is now not just an attempt to contain the disease as far as possible but to delay its spread and thereby minimise the suffering. From tomorrow, if you have coronavirus symptoms, however mild, either a new continuous cough or a high temperature, then you should stay at home for at least seven days to protect others and help slow the spread. That was Boris Johnson at a press conference yesterday. When I watched that actually, I mean I'm not particularly reassured whenever Boris Johnson tells me anything but it was I think a political master's stroke that every time Boris Johnson comes out at the moment, he's flanked by the government's chief medical officer and the government's chief science officer because then whenever there's a difficult question, he can pass it on to them and it seems like, oh actually maybe we are being led by scientifically driven evidence-based people. Which is definitely the impression they're trying to give. Actually the press conference was quite explanatory in ways. I think the problem was that over the next 12 to 24 hours it seemed like, oh actually maybe there would have been some tougher questions that the journalist there should have asked when it became apparent that maybe whilst what they were suggesting in the short term sounded plausible, it wasn't necessarily enough. I mean we should get up now actually what the, so what it means that we're now in delay phase is that some new measures are being implemented which weren't implemented before and they are that as you heard Boris Johnson say there that if you've got a continuous cough or a fever you should now self isolate for seven days. And also they're advising those aged 70 or over not to go on cruises and advising against international school trips. Now my response and I think many people's response was like aren't people doing that already? Like I would have been quite surprised if up to yesterday there were still 70 year olds with a mild fever going on a cruise ship given that seems to be the most common place to incubate and spread this disease. I mean are people still going abroad? I mean I just find that kind of weird. Something that's undeniable is that the government aren't denying this is that their response is kind of out of step with most other countries who are in a similar situation to us who have a similar level of cases. Ireland for example has fewer cases than us per the population and they've already closed schools for example. And the government are being very explicit in the fact that they are taking a more relaxed approach to shutting stuff down and a couple of the justifications for that and we can look at now. So one of them is behavioural science. So it's this idea, it is a bit sort of like the kind of stuff that gets put in books at airports. So it's this idea that you might think that a policy will do this thing but actually counter-intuitively it could have the opposite effect.  I mean David Halpern wrote a book called Nudge which is like airport reading, free economics kind of stuff. Exactly, and as we mentioned on Wednesday show the Nudge unit was created in 2010 to advise David Cameron it was part of his big society so it was the idea that the state doesn't have to do that much to achieve social policy outcomes. What it has to do is little things, little things to try and nudge people which is why it's called nudge in the right direction and big things that the Nudge unit is famous for is sending out text messages to say you need to do your tax return. It actually works for me. That does make me do my tax return on time but protecting the population from an epidemic is kind of different from trying to get people to return their tax forms on time. They also do that thing where you put like a bee in a urinal and then people don't mess and they piss on the bee. Because they're aiming, yeah. That's a nudge. Yeah, so that's the kind of... We're talking about different levels of seriousness and the costs of if it fails are slightly bigger in this case. Well, no, but they would say, look, you know, every year the economy spends £150 million on cleaning toilets and that could be saved through this tiny, you know, behavioral change. Yeah, I mean, obviously I think I've got no problem with them putting bees and spiders in urinals. Which means that you target your piss but I don't necessarily think that should be qualification for then managing. That is honestly one of the most famous examples. I'm not sort of saying that to be a little nudge unit. The other... We'll go through behavioral science or those aspects of it in a bit more detail. Also, the other one is epidemiology and this is I think the more serious argument which is to say that if you have a lockdown, so what other countries are doing is, you know, trying to have quite serious social distancing measures already to try and stop people catching the disease from people who have it, especially people who have it and don't know they have it. What the government are saying is that actually we don't want to stop everyone getting the disease because we need enough people to get the disease enough young, healthy people to get the disease that society develops some herd immunity. I want to stick with the behavioral science first. This is the idea that if you take what seem like obviously good measures, it could have unintended consequences. So someone who explained this this morning was the chief scientist Sir Patrick Valance on Radio 4. He was asked, you know, if other countries are canceling huge sporting events, if, you know, as you said, you know, the chief scientist said yesterday there might be 10,000 people in the population that have coronavirus and don't know, or I mean 500 or so people know they've got it. So it could be 10,000 people who have it. So say if we know that this many people have coronavirus, why are we encouraging people to go into these big spaces and hang out together when Ireland, when France are not doing that, when they've canceled it? Sir Patrick Valance said is that actually, look, if you cancel the rugby match, which is outdoors, so there is some chance that people will catch it, but you know, it's better that they're outdoors, they would watch it in the pub. And if they're watching it in a pub, you've got a closed space, you've got a warm, closed space. It's like lots of, lots of capacity for passing on the illness.  Then you think for five seconds, you're like, well, what if you just canceled the match? People are going to still watch the match in pubs as well. Well, yeah. Exactly. What do people do before they go to a rugby match? They go to the pub. What do they do afterwards? They go to the pub. And how do they get there and back on incredibly packed trains or buses or whatever. So. And when you go into the stadium, you're patted down, etc. Yeah. And to be honest, a lot of, when I hear them talk about these, you know, these behavioral science, oh, but if you did this, something else would happen. It does sound a bit weak. If you, if you tell people not to go into school, then people won't be able to work in the health service because they'll be looking after their kids. Well, there's an easy fix to that. What if you say school will only be open for people who work, for the children of people who do essential jobs and then you tell everyone else that they can stay off work. I think that's wise. I mean, it's sort of like that's a simple fix. So instead of saying, we're not going to close the schools because then healthcare workers might have to take time off work. So we're just not going to do it. We're just not going to bother at all. If you said, okay, well, that is a genuine problem. We should accept that. Yeah. So logistics workers, social care workers. Yeah. So what should you do? You should say school is only for people whose parents do essential jobs and everyone who's not doing the essential job is welcome to miss work and stay home and look after their kids. So that's the behavioral science has, but it's saying that the reason Britain are doing things differently to other countries is because we are better at behavioral science than them. So whilst France might think they're doing a smart thing in terms of banning sporting events, actually the French people are just going to gather in pubs and give it to themselves there. I mean, Belgium have banned pubs being open. So I don't think it's a particularly strong argument. The other argument the government are making is about epidemiology. It's a study of the spread of diseases and in particular herd immunity. So what they're saying is if we shut down society too early, if we lock people in their homes, then by the time when we let them out, because not many people will have ever had the disease and not many people will have become immune to it, then at that point you'll get a second epidemic, just as big as the potential first one and maybe next winter, so sort of in an unideal time. It's quite a complex idea and the best I've seen it explained was yesterday on Newsnight by Professor Graham Madley. So he's a professor of infectious disease modelling at the London School of Hygiene and Tropical Medicine and academic chair of the Scientific Pandemic Influenza Group on modelling. So a guy with many credentials to his name. This virus is going to be with us for a long time. We're going to have an epidemic and then it will become endemic and join in with all the other coronaviruses that we all have all the time but don't notice. We're going to have to generate what we call herd immunity. So that's a situation where the majority of the population are immune to the infection. And the only way of developing that in the absence of a vaccine is for the majority of the population to become infected. Ideally, if I could, what I would like to do is to put all the more vulnerable people into the north of Scotland and keep them there, everybody else into Kent and have a nice big epidemic in Kent so that everyone becomes immune and then we can put people back together again. But we can't do that. So what we're going to have to try and do, my dear, is some kind of manage this acquisition of herd immunity and minimize the exposure of people who are vulnerable. Clearly a very intelligent guy. And the point he's making is that, you know, what we want to happen to damage or to limit the deaths that happen from coronavirus and to limit, you know, the government seem to be quite concerned about inconvenience or economic damage. We'll talk about that later as well. The second one is for all the... to develop herd immunity by enough young, healthy people getting it and then recovering from it and then being immune from it that, you know, society becomes, as a collective, less liable to epidemics. But the problem is one that you don't want everyone... even though you ultimately want a large proportion of the healthy population to get it, you don't want them all to get it at the same time because that could overwhelm the health system if the disease does become serious. The other problem, and I think this is the major one, is that he has sort of... this seems to be the model guiding the government. But even though the government can't do what he has hypothetically suggested, which is to put all the older people in the north of Scotland and all the younger people in Kent to share the coronavirus around there, they don't seem to have done... obviously they can't do that, but they don't seem to have done anything really to separate younger people who they don't seem to mind at all. So, you know, they haven't suggested how they are going to... I mean, how certain are we that people don't get coronavirus twice? From what I've read, they seem fairly confident. I mean, it would be insane for them to have developed this whole policy system if they didn't have some confidence about that. The claims are... its mutations are very slow, etc. So there's not very many concerns about that. But, I mean, again, if there was a mutated version, could that compromise somebody's immune system if they'd had the other variant, etc.?  So, as I was saying, because we're not epidemiologists, we're going to be talking about the various debates that people are having to know about this year. Yeah, we're synthesizing the information. We're journalists. And as far as I can tell, there aren't any big dog credible scientists saying, our big concern with this strategy is that actually people maybe can get coronavirus twice, three times, four times.  They've just said it's potentially riskier than it would need to be. So, we're just synthesizing information. We're going to go to now someone who is a genuine expert. So this is... he was on Newsnight last night, very intelligent fellow. Anthony Costello. He is an ex-director of the World Health Organization. And he's not so sure about this strategy. He's not sure about the government strategy to let all the young people get coronavirus so that we develop some sort of herd immunity. Unlike other countries, the UK strategy aims to build herd immunity by allowing the steady spread of COVID-19. The government argue it will block a second peak in several months' time. Here are eight questions about this herd immunity strategy. One, will it impair efforts to restrict the immediate epidemic and cause more infections and deaths in the near term? Evidence suggests people shed virus early, and those without symptoms may cause substantial spread. This argues for policies against mass gatherings for school closures and for strict national and local measures for social distancing. Two, he's saying, will it weaken containment systems, testing, screening, radiography, isolation? China built a robust nationwide system of mobilised community workers for identifying cases, promptly isolating contacts and treating vulnerable people promptly to contain the outbreak. Three, does coronavirus cause strong herd immunity or is it like flu where new strains emerge each year needing repeated vaccines? We have to learn much about COV immune responses. That's actually referring to what you were talking about, Aaron. So he is saying that we don't know enough that you couldn't develop a slightly different strain of coronavirus. And then whilst we're, you know, all immune to the current strain of COVID-19, you get COVID-19. I know it's not how it works, but COVID-19.5, and then you're able to get that. I mean, the point is if 40% of the global population gets it, statistically, it's quite likely there's going to be a mutation, surely. I know they're saying it mutates very slowly. You get degrees of mutation and different sort of velocities, et cetera, with regards to different viruses. But I mean, 40% of 7.5 billion people get it. There's going to be mutations, presumably. Yeah. Well, I mean, I'd say the main argument there is that and I think his conclusion we'll get to in a moment is that even we don't know at the moment, right? And we don't have a high degree of certainty and so why take this incredibly high risk strategy? Four, he says, doesn't this herd immunity strategy conflict with WHO policy, World Health Organization policy? After the announcements of this being a pandemic, Dr. Tedros, director general of the WHO said the idea that countries should shift from containment to mitigation is wrong and dangerous.  We'll just try and make it as least disastrous as possible. Wait, so repeat that line again. The idea that countries should shift from containment to mitigation is wrong and dangerous. From containment to mitigation, the thing is, you know, we had the Harvard professor of epidemiology, Mark Lipsitch, said that 40% to 70% of the global population is going to get it in the mid-medium term in the next couple of years. That's been repeated by Frowler and Angela Merkel, you know, probably the most sober, serious, honest politician amongst the major European politicians. So I mean, how do you contain that? I understand the containment strategy in so much as you only have so much healthcare capacity, so many hospital beds, so you don't want to overburden that system all in one go. But in terms of actually containing the virus so that not many people get it, I mean, I don't see how that, or are they sort of insinuating there that it can be contained until there's a vaccine within the next 12 to 18 months or what? Do we shut down the global economy for 18 months? Well, so I suppose that's what the stories are refusing to do effectively, right? They don't want to shut down the economy to minimize deaths. The WHO have been very, if you read their reports, they've been very complimentary about how China and Taiwan and South Korea have dealt with it. And they've dealt with it by saying, we just need to stop this virus dead and take quite serious action to make sure that doesn't happen. Pour tons and tons of resources in it. You had, I think, 40,000 people went from different regions of China to work in Wuhan. So you had a mobilization of resources which is completely unheard of in the European countries, which is why they were quite effective at stopping the spread. And that does just give people more time to understand what's going on. No, I get that. But the second Wuhan goes back to business as usual, let's say in two months and then you have tourists there and you have the spread of infection, you have social institutions at schools, workplaces open again, it's going to happen all over again. Well, that's the government's argument. Can I just say, I'm not saying I agree with the government, but it might be that, you know, maybe in terms of, if you're, from a utilitarian perspective, you want to absolutely minimize deaths, you say, look, we're just going to have to shut down society for 12 months, 18 months until there's a vaccination. I get that. But the WHO, by attacking, or people who are disagreeing, people in positions of power and knowledge with regards to the healthcare profession, disagreeing with the government. That seems to be their implicit argument, but nobody's actually saying that. Well, so it's next week, kind of answer to you, which is helpful. So he says, shouldn't we wait to see the China situation? They've contained the epidemic after seven weeks of intense national effort. Will their strength and systems not contain outbreaks quickly? What is their herd immunity? So he's saying, look, potentially it will be the case that China get a second burst of it. And maybe next time around, they'll have to go for a strategy which looks like what the government's current strategy is. But why would we not wait to see? Which kind of makes sense to me. Number six, without an all out national mobilization plan for social distancing, are the UK government behavioral and NUD strategies really evidence-based to flatten the peak or simply based on models? And on the precautionary principle, shouldn't we go all out to snuff this UK epidemic out with national mobilization at all levels using all possible preventative measures, whether evidence is strong, uncertain, or weak and worry about herd immunity when we have more evidence? Can we freeze that for a sec? The question would be, isn't there an opportunity cost? If you're deploying those kinds of resources, if you're shutting down parts of the economy to such an extent that you can do that, to what extent are healthcare workers? We've got 4 million people in this country waiting for operations. We've got people who've got cancer, onset cancer, and they need to have that cancer removed. We've got elderly people who need just care. They need to be looked after and cleaned and visited, etc. So you might have people who are suicidal. They have mental healthcare workers who need to see it, etc. So there's an opportunity cost. If you deploy all these human resources into this one thing, do you see what I'm saying? Again, why is there not that sort of conversation? This is where I worry, actually, because what you're saying is we could make a decision as a society that we're willing to take the risk and we're willing to take the risk because the economic costs and the costs not related to coronavirus of implementing a shutdown would be too high, so we might as well risk a few people's lives. There's two alternatives. That's one of them. The other one is that you literally shut down the running of the modern economy, which means under the neoliberalism society, basically people don't leave their houses. You only have absolutely critically important jobs carrying on, etc. And then you say, well, we're just going to wait for a vaccine in 12 to 18 months. And yeah, we're going to take a contraction of GDP by 25, 35%. Those to me seem the two things you do. I'd say there's a middle ground, right? So a middle ground would be that this is like Tijuana doing or even what Italy is doing in a way is so you implement quite extreme social distancing measures and then you could in a graduated way bring life back to normal and see how it goes. So if you implement social distancing measures at this point, then potentially you could say, well, we were never confining health workers to their homes anyway. We were never confining a bunch of people who work in essential services to their homes. Then sort of like, if it seems like you've got it under control, then you let this part of the economy start again.  So you're fairly confident that you're not going to get that overwhelming spike. That may be the case, but like I said, the government is saying, we'll take this as Boris Johnson so charmingly puts it on the chin. That's not a known solution. It seems to me there are two quite plausible solutions with high sort of degrees of certainty as to what they would mean. So the government's sort of sort of conclusion here is, things will carry on maybe two to four hundred thousand people will die. That's what they're doing. And then you could say, look, you know what? We want to keep deaths down to fifty thousand or below. This is what we're going to do with the economy. This thing in the middle, it might work. It might not work. You'll have economic contraction. Then you go back to life to normal. Then you have economic contraction again. I mean, but the government haven't been honest about saying that what we're willing to accept is two hundred to four thousand. That's what I mean. People die because they're saying that if you just keep having wave after wave after wave, the older people will die. But what they haven't suggested is how they're going to separate the old people, et cetera, et cetera. We'll just go to the final one and then I want to go to a graph. So the final tweet, vaccines are a safer way to develop herd immunity without the risks associated with the disease itself. Is it ethical to adopt a policy that threatens immediate casualties on the basis of an uncertain future benefit? And I want to go out this graph because this graph was again on news night. They said they got it from the Lancet. I think this really just helps you understand all the different theories. So we've got the red graph or the red line, sorry. It's showing you on the Y axis, you've got cases being reported on the X axis, you've got months since transmission established. So this red line, that's showing if you get exponential growth and the virus gets out of control and 60% of society get it all at one time. Obviously, you don't want that because health services get overwhelmed. So this is an opportunity to protect older and more vulnerable citizens. We should also know it's not just older people, it's also people with disabilities or people with suppressed immune systems. If it all happens that quickly, there's no time to protect the vulnerable fundamentally. The main concern with the red line is that loads of people die. In the red phase, people aren't being isolated, so that's the whole point. We could just decide that we're going to let it continue. All the young and healthy people who are the people who form can continue with a few sniffles and a bit of a cough. Some people barely notice they've got it.  So that would be the sort of ultimate neoliberal capitalist we value capital and we value wealth over everything else. That's what you do. You wouldn't have any controls whatsoever. The green option is to say you slow it down. You slow down the spread. Ultimately, again, you're looking at 60-70% of the population getting it before they develop herd immunity. You slow it down with measures like social isolation and then that means that the health service is never overwhelmed. You have the chance to sort of separate older people and more vulnerable people from the ill population and then you limit casualties. That's the green one. The blue one, this is what the government is saying they want to avoid. In a few cases, that's when you have absolute lockdown. So you have absolute lockdown. Cases go down to zero. But then because you can't lock people in their homes forever, you have to let them out again. At the moment you let them out, there is still coronavirus around even because some people still have it in the community or because there's still a global pandemic going on. And then because no one's got herd immunity, you then get another epidemic situation. So the point being that all those months that you spent lockdown were pointless. So disagreements about the government response are fundamentally the government say they're on the green line and they're avoiding the blue line, which is what they say countries like Taiwan who've had a more shut down system of doing. But then what people like, I've forgotten his name already, Anthony Costello, so he was the guy who was the next director of the World Health Organization. What they're saying is actually this is fine in theory, but what the government have implemented would actually put us on the red line because he's saying if you've got 10,000 people who currently have coronavirus in this country and you're not really doing anything to separate anyone, then you are very close to getting to this completely overwhelming outbreak. So he's saying the government are putting us or the government are definitely risking putting us on the red line and given that, you know, if you're looking at this graph and you say what's the best outcome, the green line? What's the worst outcome is the red line? So then you thought you'd aim somewhere between the green line and the blue line and the British government seem to be aiming somewhere between the green line and the red line. So can I ask you, given that their voter base is older voters, why would they be front-loading several hundred thousand deaths almost on purpose? Yeah, so that's what seems very... I mean, there's Chris Giles, I think from the FT was tweeting precisely that. He was saying like, even if hypothetically this makes sense, there's a sort of time lag. So it could be that in two years we look back at the government policy and say, oh, that was kind of clever because we had more deaths in spring 2020, France had more deaths in spring 2021. But the point is, and this is what Chris Giles, this is I think economics editor at the Financial Times, he was saying that if we have a period where, because France is in lockdown, they have 500 deaths in April and because we don't have lockdown, we have 2,000 deaths in UK, then the government are going to struggle to continue with that particular policy, right? So there is a concert, so you're right, front-loading the deaths could be a big problem. A strategic comms nightmare. Look, I'll be like, look, tell the telling the political editor of the Daily Mail that we'll be giving it six months. More deaths now for less deaths later, it's never been a particularly good slogan, especially when the whole idea that there's going to be less deaths later is somewhat disputed.


All right, we are live, as I say. OK, thank you for that introduction. So it's awesome to be here at Soda. So I guess I should clarify. I'm nominally the faculty advisor of Soda, and I do almost nothing. And it's not just because I'm lazy. It's because that Soda is such an amazing organization that they have become 100% self-sufficient. Like, they don't need my input. They probably don't want my input, because they already have awesome ideas and awesome events. So I love being the advisor for multiple reasons. A, because they're awesome, and B, because they're completely self-sufficient. So this is a fantastic organization. If you join them, go to their events, Soda rocks. So for those that don't know me, the science of every intro. So I'm Adam Mukai. I'm an assistant professor here in Sinti. I've been here for four years now. And a little bit about my background. So I did an equivalent of a 4 plus 1 that we have here. I did a UC Santa Barbara, so undergrad plus a master's. While I was there, I got hooked up with some security research and competed in capture the flag competitions. And then after that, I said I probably had some of you seniors in the audience graduating seniors. Only a few? Wow, you guys are going to be around for a while. So yeah, so I said I'm done with academia. I cannot wait to get out of here, go get it.  I'm going to go make tons of money. I had a software developer position at Microsoft in Seattle, where I was a full-time software developer. And I loved it, but I realized while I was there that I kept working on my research project part-time that what I really loved was research, doing something new. So I went back. I left Microsoft after a year, went back to UC Santa Barbara, and did their PhD program afterwards. I came here. And so, oh, thanks. Thank you. I appreciate that. I think I made the right choice, too. So now I'd also like to introduce my co-host for this event, Will Gibbs. Will, stand up. So you want to introduce yourself? Oh, sure.  Maybe. Or the group workshop, I don't know. I think in terms of the classes, sorry. The group, OK. Hello, group workshop slash class. I'm Will Gibbs. I'm the president of Pone Devils. Unlike Soda, Adam helps us out a lot, which I really appreciate. That's a very necessary thing to do. Not that we necessarily, I don't know. I'm going to use the microphone. I'm not speaking to it, but not to those who have been here. OK. Yeah, so I'm the president of Pone Devils. I guess I'll give a brief introduction to Pone Devils. Yeah, all right, cool. Sure. So basically, we're a club that participates in, capture the fly competition, CTS. And we help you guys get up to speed as well. So in our meetings, we work together and also teach you guys how to exploit these binaries, how to basically break them to either get a shell or get some sort of access or leak from some system somewhere. Yeah, that's basically what we do. Cool. So I'll say something about another freshman in here who feel like maybe they know nothing or are completely overwhelmed and maybe even into juniors, seniors, slash above. Yes, we've all been there. We all start at the beginning, right? So Will started completely at the beginning. So he was a freshman who came to interview me as part of the Grand Challenge Scholar, Grant. GCSB. Yeah, GCSB. I never can remember the order of those words. And he interviewed me as a freshman, didn't know anything. And just at the end, he's like, I really want to get interested in security. Do you know of anything that's like that here? And I was like, well, I have this super informal hacking group called the Pone Devils. We meet weekly, blah, blah, blah, blah. I send him all the stuff. He comes, starts attending our meetings. And within a semester or two, he was, I think, after about a year, he came to me and was like, we should be a real student club, not just this informal group. And so he, along with the other students, drafted a constitution, elected a leader, which was Will. And he's been running it ever since. So he started literally where a lot of you are from no security knowledge, not no knowledge at all, but no security knowledge. And he's now the president of the club helping me with this workshop. So this could be you, freshman. And he'll graduate at some point. So I need more people. Sorry. And the other thing that Will didn't mention, so we do meet Tuesdays and Thursdays for about two hours going over and improving our security skills so they compete in usually the catch of the flag competitions, range from anywhere from eight hours to 48-hour competitions. And some notable results that I can brag about, because I'm the advisor, is the undergrad. So we had a completely undergrad team playing this seesaw CTF. And they got 30th out of 240 teams. And in August last year, we competed in this ASIS CTF, which was super fun, where altogether grads, undergrads, me. We were 24th out of 590, which was the second place US team. So we're moving on up. We're learning and getting better. So what we want to do in this workshop, I want to illuminate how code is actually compiled and executed. And unlike a lot of what I'm used to in a classroom, I don't just want to stand up here and talk, although clearly you can see I've already been doing that. It's going to be hands-on. So get your laptops out or get your code tablet, maybe.  Find a buddy if you don't have access to a laptop so you can pair attack and pair learn about these things. And we're going to look at really what it takes. We're going to look at the most common security vulnerability in binaries called buffer overflows. But to do that, we actually need to understand things. And before we get to those two things, we're going to talk about before we get started, avoiding jail. Does anyone want to be in jail? Hope no. I mean, if you want to be, there's very easy ways to do that. So I'm not going to tell you how. You're smart people in this room. You can find your way to jail if you desperately want to. Avoiding jail. So I'm going to teach you some security stuff. And it's going to be very easy to be like, oh, I should start testing my knowledge out on all these other systems. But we don't want you to do that. And I don't want anyone in my classes or a workshop that I lead to go out and do bad stuff and be like, oh, well, Professor Dupé said that this was totally fine. He taught me how to do this. And I can always point to the slide and be like, actually, I told them how to not do illegal things. So you get to do bad stuff in CTFs. Yes. So capital flags are great because they basically people let you hack their systems. So that's why they're super fun. So don't do anything illegal. In a hacking context, this means never hack into a site or a system that you don't have permission. So let's say you're testing some stuff out and you find that there's a, you find some security vulnerability in a program running on your laptop. Can you test that? Yes. It's OK. You guys can talk. It's like a, you know. Because you don't own the program? Or you do not own the source code to the virtual? Interesting. I think there's a thing. It depends kind of on your license of how you've got that software. But most of those, I believe, are not enforceable. We don't do it like this. And we'll actually be doing hacking where you don't necessarily need the source code. We'll hop off. So is it legal or is it put you in jail? Why not? It's your computer and your program, right? So you bought the program, presumably, right? You purchased, you paid money for this copy of this program. It's running on your machine. And you're giving yourself permission to break into it. Now, if I find a vulnerability in a program and I notice that somebody in here is running it on their laptop, and I launch and exploit against their program running on their laptop, is that legal? No. No, why not? What's the difference? Yes. So it's OK to look for it. I would phrase it differently. I'd say you can use them with permission. So if you have the permission of the owner of the system, so if you tell me I can use it, then I can use it. And I wouldn't if I was smart, I'd want to get that in writing or something, right? In case anything bad happens. But hacking into your system is definitely legal. So this is the key point. If you don't have permission, don't do it. So don't hack into a site or a system that you don't own. Anything running locally, you can go to town on. You can download all the open source software you want, set it up, configure it on your local machine, and you are good to go. Also applies to the web. Don't try to hack random websites. That's also bad. OK, everyone could nod so I can get a yes. Don't go to jail, please. I won't visit you. Sorry, first your bubble. OK. So what is security when we say security? What do we mean when we say vulnerability? Private information, private? So keeping private information private? Yeah. So there's actually an interesting caveat there of who decides what data should or should not be kept private, right? So you probably have data that you want to be kept private. Would you agree with that statement? Or do you? Yes, I hope so.  But I'd say that's unlikely. So we want to keep things private that we want. And if you think of government level, they have nuclear launch codes. They have the position of military bases or military troops. Those are things they want to keep secret. So we call that confidentiality. Is that the only thing that we care about in security? Accuracy of records. Accuracy. What do you mean?  Yeah, so think about maybe your bank account balance. So you probably do want to keep that necessarily secret. You don't want to tell everyone what that value is. But you'd be really upset if somebody took that value and changed it to zero unless it was in negatives. But if it magically got changed to zero in their database somehow, and now they say you have no money, that's a huge problem, right? So we think about that as integrity. So the integrity of the data. Is there anything else? Is that the only things that are important? Ooh, why is that important? Who cares about that? Well, if I can't access what's in there. Right, so if I, let's say I'm about to use an ATM and somebody else either takes down the bank so I can't withdraw my money, right? That could be an attack against security. So these are the three. It's super easy to remember, CIA, confidentiality, integrity, availability. So these are the things when we think about the security of an application, these are the things that we're concerned about. All right, enough talking. Let's have some fun. So I created a server on Amazon and I have accounts for all of you each individually. So the awesome PONDET will helpers are going to distribute accounts. So it's gonna use an SSH. So there will be an SSH band. It'll be something like soda dash blank. These are names, one, two, three, four, whatever. At, it should be, I think I'm Adam D. at the Hack Soda, is that what I called it? Yeah, hacksoda.adamdupay.com. Awesome. I don't know. Yeah, that would be good. You've taught this a lot. So yeah, raise your hand if you're happy to help. I want everyone to get access here. Yes, this is too close. That was a way. Are these good passwords? No. Why not? No special characters, just random text. Is it random text? No, it's obvious, bad, bad. Yeah, so it's not even random. All lowercase. All lowercase, yeah. Just with this event, right? So I just made all of these. I actually made 450 accounts just in case you never know what we're going to show up. Anybody else need that? If you need an account, raise your hand. Leave it like this. Go ahead. We shouldn't say it. It's hard to get one. It's a good password, and we shouldn't say it. Sign it. And it's nine digits. Yeah, but it's, well, that's true. All right, can everybody get in and get on to the server? Here are some of you. Maybe it was because everyone was trying to log in. Is it working? Yeah. OK, good. Some of it doesn't work. Things happen. Well, why, I guess. Can you log in? I guess it's the first one. I always do. OK, that's OK. No, no, your password is the second part after the username. Just to remind you of your username, password. Pretty good. I can count everyone who's logged in. What do you think we have? It's not. It's not a normal password. I appreciate that. The V4. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yes. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. You have to do that, so they're going to vote. They're going to select the SSH, and they're going to vote. It probably has something to do with it. Oh, wait. You have to be at the U.S. State of America. Oh, I got to be at the U.S. State of America. Are you going to put the code on here? I may try to turn this into a Docker image, too, but if you bug me, if you send me an email bugging about it, I'll probably do it. Here's an essay like that. Let's do this. We're going to vote. Do you want me to turn it over? It's 1.22. 1.22. Okay, so first they request. So this is a shared resource. We're all using the same system. So they're the attacks are super lame, don't do it. And I have prevention mechanisms in here, hopefully, so you can't take down the system, but please refrain from doing so if you can't. Anybody not on the system who wants to be? There's about 70 of you. I can find this stuff out. 71 people on the server. Good? All right, let's move on. So, where's... Oh, will sound like someone. Good. So, how do you be an elite hacker? Watch the movie Hackers. Watching movies will not help you. Yeah? No, go to hacker.com and randomly typing. The media will tell you you just type random things in and somehow things break, or you make a really cool visualization by passing firewalls, which also doesn't work. Brian, you said something. What did you say? Think like a hacker. Yeah, that's part of it. So how do you think like a hacker? How do you think like a hacker? Break stuff. It's part of it. I didn't think of it like... Has anyone ever got locked out of their house or apartment? What's the first thing you do? You look for a way to break into your own apartment or house, right? And it's probably something you've never done before in your life up to that point, because why would you ever think about breaking into your own apartment? Right? I don't know about you, but I started valuating like, okay, which windows are probably open? Are there any windows on the first floor that are open that I can just pop the screen off and then get open?  So that's kind of the mindset you need to have in security when you're thinking about these things. That's part of the hacker mindset, is thinking about things and thinking about how can I break it? How can I make it do something that it was never supposed to do? That's part of it. So that's definitely part of what you need. What else do you need? Tools. Tools. I'd say no. You can... Yes and no is probably the answer. Yes, in the sense that... Yes, you need to know what the tools are. There are what they do. Know in the sense that being able to use tools alone is lame. So there's actually a term for that in the hacker community called a script kitty, which is somebody who just knows how to use a tool to cause havoc and damage. So what your goal should be... So this is a person who you give them some exploit script and they can run it against the system and maybe even get access, which is kind of cool. But what's really cool is to be the person to write that script or to be the person to write the tools that you use. And that's... So how do you get to that level? You have to learn how it works. You have to learn how it works. I can't possibly stress this enough. Security is really just all about knowledge. Like there's nothing... Computers are not magic. Has anybody ever told you that before? Maybe CPUs are. I still don't fully understand. I mean, I can draw a switch diagram or whatever, but how those electrons all move around and it still works. But in a computing system, from the software up, so from basically the assembly that the CPU executes, you need to fully understand all of that information. And that's really what it means when somebody calls you like a weak hacker. It's not just because you can do cool stuff. It's because you know how things work to the level that you can make them do what you want to do. Have you seen the movie The Matrix? Like Neo. You're going to be at that level where you can control things. You can control The Matrix. You can see The Matrix code in front of you when you're looking at a binary. And I'm not making this stuff up, but it's not easy. You don't just wake up one day and have mad, awesome hacking skills. You have to put in time and effort to understand how things work. But when you do that, I firmly believe anyone can be a weak hacker. Like all it takes is knowledge. So you all have that inside of you. I'm fired up now. What was that? I'm fired up now. Good. That was a good dip. So let's hack. Okay. So in the vein of knowledge, what happens... So has everyone coded a C program before? Most people? So what happens? So you write your C code. You want it to execute by the CPU. What happens next? Has anybody... There are some seniors in here. Have you ever got any of these questions on an interview?  Telling everything that happens. It's actually a really good question because it's almost infinite in what you can get and what you can do. Keep press, interrupt, driver operating system to the lookup and then you have DNS and all kinds of stuff, right? So it's a similar thing that we're talking about here. So you write a C code. We've all done it. We're all guilty of writing C. And then what? You compile it. What does that mean? A binary. How do you compile it? These aren't trick questions, by the way. Just so we're clear. I'm not trying to trick anybody up. What was it? A GCC. You use a compiler like GCC. How does that work? What is its job? What does it do? Convert C code to assembly level. So to turn C code into assembly, why does it do that? So that the CPU can understand. Your CPU, your processor, right? You've all seen a chip. It doesn't know anything about C. It couldn't care less about C. It doesn't understand C. All it understands is actually, well, ones and zeros, but you program that CPU by an assembly language. So you need a tool to translate from C code to assembly language. And then what? So what is your compiler output? What was that? What's an elf binary? Like, it's a small binary? I'm sorry. Can I understand? Is that a linkable format? Executable or linkable format? Something like that. So besides the name, what actually is an elf? See, this is when we start digging deep. This is what I'm talking about. This is that knowledge of what actually happens. What is every single step that happens until that code actually executes? It's like tagged in it, like symbolic. It's tagged that are going to be resolved by the linker. Yes. So it kind of depends on exactly what elf, if you have an executable format or the linkable format, executable is ready to go. But basically the way I think about it is that an elf binary is the assembly code. So it's the translation of your C code to assembly, which has then been translated basically to hexadecimal to raw bytes. And then that's essentially a file on your disk with some metadata to tell, including symbols and all these other kind of things, to actually allow the operating system to execute the program. So you've done that. So let's actually, you want to compile some stuff. So you probably can't type this, so don't worry about typing this either. I don't remember my password, so I'm just going to use my superpowers. So inside each of your home directories on this server, there are various C code. I think. It's just going to work. So you use GCC, and I'll be honest, your GCC is lying to you. So let's do calling convention.c. So you can compile it. And what does it output? A.out. What is A.out? How do we figure out what A.out is? What is .out? .out means nothing. So one thing you have to abandon when you use a Linux system, file extensions are meaningless, 100% meaningless. On a Windows system, this would be .exe, which has a very specific meaning and means that it can be executed. On Linux, it doesn't matter at all. So how do we figure out what kind of file this is? Use the file command. Yes. So file is a command. So the question then is how does Linux know, if I just said extensions don't matter, how does it know what things to execute? And that is an L file. Metadata. So yeah, there's actually a sequence of magic bytes in most file formats to specify exactly what type of file it is. So I don't know. Did anybody else run a file? This is working. I see. It's because you didn't re-log in. You didn't re-run batch. I don't know my password and I don't want everyone to. Just do .exe. Oh, okay. I can do it. It's my... Yeah, it's this... You can do .exe. There we go. All right. I have to figure out why. Let's see this alias. Slide debugging, folks. Oh, it doesn't work on sudo. I should use bashrc. Just sudo dash. That doesn't have all the other options. It's going to be super annoying. Do you need those? Dately. All right. Yeah, so real quick, the big... You have to turn it on. Again, I don't know how to use microphones. So the big GCC command, we're taking some liberties as an introduction. It just turns off some security features that might be more difficult to navigate around for an introduction to this stuff. So we're just trying to give you guys a basic platform to start on. Keep pumping. What? So you're still... Oh, no. You guys really don't want that. What's your setting? Go. See? There we go. All right. Just to make sure everybody compiled their stuff, right? Nobody's having problems, right? Perfect. And then you're in file on 8.0. Good. The correct words. Okay. We have an ELF 32-bit LSB executable. So basically, file is reading and parsing those metric bytes to figure out that it's an ELF file and then it's parsing the ELF file format to extract all of this metadata that's contained within that one file. So it's telling us that it's a 32-bit program, which is actually pretty important, right? We want to know is it a 64-bit or a 32-bit program? It is other things. Talked about linking. It's dynamically linked, which means it's using libraries that are going to be loaded at runtime. It... What are some of the interesting things? The not stripped of the end is kind of interesting because that means that somebody mentioned symbols that are in the ELF file format. So that means those symbols are still there. So how do I view... How do I peek into this binary and view the assembly code? Disassemble it. Disassemble it. So you use GDB to debug it and get the code that way. What else? Object down. What was that? Object down? Object down. Yeah, so there's a tool, object down, which is a great tool. The other thing I'm going to highly, highly rep is using a manual. So this is what... I think... I think there's some students from my 545 class that are super sick of me telling them to read the manual for everything and probably also people in the Pundails group because I appreciated that three times today. But the manual is your source of all information. If you're like, hi, I don't... I don't know how this object down tool works that Adam talked about.  Every single option, links to other things that you can look up more information on. You can even search. So... It's a VI-like interface, right? Yes. Yeah, so you can use... So for you crazy VI people, you can use slash to start searching. Maybe... So you want to know how do I disassemble? Maybe you could spell it correctly first. So you can see that the dash... lowercase t is disassembled and dash capital D is the disassemble all. So that sounds promising. So let's do object down dash capital D a dot out. What's going to happen next? What? It doesn't matter. Maybe the less because we want to look at it, right? It's a lot of output. So how do we know what are we looking for in here? Because there's a lot of output. How do we know how to find what we want? Main. Main, let's look for main. We can search for main. There's actually a lot of mains. So there's a lot of other magic that you eventually need to know about. About how does actually the main function... So you're all used to writing a main function in a C program in order to have that be the first thing that your program executes. Right? I hate to burst your bubble, but that's not the first thing that executes. So there's a whole bunch of other things that actually happen first in terms of lib C and the linkers and all this kind of fun stuff. So that's why there's this underscore underscore lib C underscore start underscore main. But if you keep going, you will get to main. So then what is this stuff? Like what are we looking at here? 86 instructions. Yes, so this is not... When you learn assembly, you guys learn MIPS, right? Yeah, MIPS. So some things do use MIPS. So it's useful to learn MIPS. But every single laptop in here is running x86 or x8664. What are your phones running? ARM. ARM? Yeah, so that's another one you have to learn. So actually, that can be very annoying as a security person that you have to learn all these different assembly languages. I think you would agree. Very much so. Yes. I remember one big CTF we got there and it turns out everything was in ARM and I was like, I spent like the next 48 hours reading manuals and doing all that stuff. But it's much better to prepare in advance. Cool. Okay, so how do we interpret this output? So we set it to x86 code. So is this 80483CB and x86 instruction? What is it the address of? So what's the middle column here? Up? Well, yes and no, I could say. Is it the address of the instruction? The middle one? Oh, so on the left, what about in the middle? What's this 55? Yeah, the hex representation of the opcode pushEDP, right? So on the right is the decoded instruction. So a hex value of 55, if the CPU sees that at where the current instruction pointer is pointing, that means pushEDP. And 89EF, these are not things you have to memorize though, so this is something I should say now. So when I said knowledge, it does not include compiling things from team memory, yes. So that 55 is the hex representation of the actual, like the ones and zeroes of the instruction, the entire instruction. Yes, exactly. So, and specifically on the left, we have the address where basically part of the metadata in the ELF header says when you load this program into memory, make sure that location 80483CB is the hex value 55. And make sure that it address 80483CC are the two hex values 89 and then E5. And you can actually verify this yourself in the fact that all of these memory addresses, the delta there is exactly the size of each of these instructions. Just to clarify it by size of instruction, the instruction size is not 55. Each of these is a single byte and so in case you guys didn't know, it's a representative byte. And if you look on the address side, what he was pointing to before the location of the instruction, that is four bytes long and that's why it's a 32 bit ELF binary. So what are the range, so how many addresses can you reference in a 32 bit program? Two to the 32, right? You can go from zero all the way up to, well, FF, FF, FF, FF. What about a 64 bit system? Yeah, a lot more. So that's actually the important thing to remember. The key difference between these different architectures is the size of pointers. A pointer is essentially an address in memory and we know that a memory address can be four bytes or 32 bits. Yeah, that was a good point. Cool. Yeah, so each of these is eight bits or one single byte in the middle and these are the actual values there. Cool. Anything else I'm missing? Because that was good. I think that's not all good. Cool. I mean, it's not going to hit ourselves. So we are going to play the game. I like games. I like prizes except for the prize of knowledge. Knowledge. So if you run the score command, whoa, I did not test this with 450 people. That does work. Okay. You are all at level one, which is the first level. I guess you've cracked level zero, so good for you to be logged onto the system. Me versus the Soda world. Okay. So the idea is we have, in var challenge, we have a series of levels, level one, level two, level three, level four. So what's inside the level two directory? Twenty dollars for the first person that tells me in the next two minutes. What's the question? What's inside the directory? Slash var slash challenge slash level two. Maybe. Da, good try. That was a good try. Level two executable? No. What's the size of the level two executable inside of the level two directory? And I have twenty dollars down there. I'm good for you. One more minute. I'll be upset if somebody's ultimate at the end of the time. I knew that was a risk, but... All right, time's up. You all lose. Sorry. That's tough. I can't win all the time. Yeah. Plus, yeah. I knew somebody would get it, but... All right. So why couldn't you find out? No permissions. What? Permissions. What are permissions? Nonsense. Access control, garbage, shiverish. Specifically, what's the technical reason why you could not list the files? So, A, do you know that a directory exists called var challenge level two? Yes. Why do you know that and not know the contents of the directory var challenge level two? We can run the list command on the challenge, the parent directory of level two. Yeah. So it all comes down to how access control permission. So this is how I can all give you access to this server and verify that you're not going to... Well, not verify, but I have some assurance that you're not going to completely crash and hose my server. Or let's say there's a Bitcoin wallet under var... Don't look at me like that. So let's say there was one in var home atom D, right? But I let all of you monsters onto my machine. And so what am I... What's my... So I'm relying on the permission system of Linux to enforce the fact that I say that nobody can view my home directory. So my home directory, if you go home atom D, you'll see that... So you've got to look at the dot directory, and the way... Well, okay, let's go back to var challenge. So the reason why we can do this is because var challenge... So we have to look at the permissions on the left-hand side of ls-la. So ls-la, that l is to list all files, including ones that start with dot. Is that right? Yes. So long. l is long to list this output. l is the other way, and a is to list all files. Yes, there's actually a reason behind those things. So who owns the var challenge directory? Group. So the... What is this? One, two, three. The third column is the owner of the folder, and the fourth column is the group owner of the... So if you're on the id command, which is a good command to know, this tells you who are you. Actually, there is also who am I, but id is much more information. So id says that I am user id AdamD, and because it's an operating system who would refer to people by actual names. Computers hate strings and names. I just want to refer to people by numbers. So I'm number 1002 according to the operating system, and I'm in group id AdamD, and I'm also in the groups AdamD and level 1. So can you tell me what's inside for no money? What's inside the var challenge level 1 directory? So how can you see this and not level 2? Because the permissions of the level 1 directory... So if you were the challenge user, you can list... So the challenge user owns all of level 1, level 2, level 3, level 4. If you become a challenge user, you can see into these directories because they are readable, rival, and executable by the challenge user. Where are we going to exactly what they mean? The dash is basically empty. So this means that the level 1 user is readable and executable, which means you can list the files there, but you can't go and create a new file in that directory. Go ahead and try it. You can't do it. You shouldn't be able to.  And the last three dashes mean everyone else on the system. So if you're not the user, you're not the group, you are effectively everyone else. So then when we do ls-la var challenge level 1, so how do we actually become level 2? How do we get to that beautiful level 2 group? One gets what we want. What was that? You tricked the one executable into somehow using the... Yeah, so, okay, a slight detour. But when I run ls-la, what user is that running as? So every process on a Unixy system is running as a user. So when I run ls, who is it running as? It's running as Adam D. If you're curious, you can run htop, I think, but I restricted it again so you can only see your own process running. I think I'm at the boot of a new one, because I don't think I can become pseudo in there without the password. Yeah, see, I don't have the password. Yeah, yeah, just a second. I just want to show them their stuff. So I can run this as pseudo. So you can see, let's see, who's my favorite? So, see, somebody, Soda132 is running vi, looking at probably the one binary. And you can see that it's running as user Soda-132. But I'm not going to get super into it, but there are things that the operating system wants to do. For instance, what's a good example?  But an administrator may want to create a program for you to, let's say, change what shell you're using when you log in from bash to something else. So you can easily do that with the CHSH program, which, if we look at it, is that user bin CHSH. And what this does, just a very quick overview, is this is going to add the user. One of the things it does is edit the etc-p-a-s-s-w-d file. So if you can actually look at this, there's a lot of you. All of your shells are bin-bashed. If you wanted to change that, you run the CHSH program, input your password, and it will alter. So can I edit the etc-password file? Right, because I'm not root. Only root can write to this file. But if I run CHSH, I can change that file. How come?  That this bit, the odor execute bit has an s instead of an x, which means that binary is set UID, which means when it executes, it's running as root. So I can show you this. I run a user bin CHSH, and then in another terminal, I can ship, ah, stop doing stuff. Oh, no, stop. Somebody's looking at a man page. They're looking for binary points. Awesome. So you can see the CHSH is running as root, even though I ran the program. And that's why the CHSH program can edit the etc-password file. So that's like regression. Now when we look at the level one folder, what is this one binary? Yeah, so it's not set UID on the user. There's no s on the execute bit for the user, but there is an s for the group for level two, which means when this program executes, it executes with the permissions of group two. And so what your goal is to do, essentially what you need to do is to trick this executable to add you to the group level two. Because that's kind of annoying, I made a program called LEET, which you can run. You can run it now. It's not going to do anything because you don't have a group ID. But if you trick level one into executing this LEET, user local bin LEET, then you will get to level two. So do it. You know what level one's code is? Yeah, I gave this C code. So look at it. That's what was up here. Let's walk around. Oh, I do want to mention real quick that just for these challenges, something that might be obvious to some people, but wasn't really obvious to me when I started, was that always trying to identify what your goal is with the challenge. Like in this case, our goal is going to be to set the UID, to call whatever set UID or LEET in this case, and try and get ourselves to the level two group. And I kind of try and work backwards from there to see what could possibly get me there. And that always helps me out. Just a bit of advice. If you're reading the C code, you don't know what a function does. Yes, use the man page. You can get so good you can actually, I know this is shocking, not use the internet and Google when you're coding. I know. Also guys, I'm here to help. So if you guys need help, just ask. We're going to get it in right now. This is not just running a wall. So happy to have the answers. So that's it. Thank you. Thank you. So, the cases of the race and the rules are challenging. The level one is right. There's three rules. The one is probably the right one. And so, I think it depends on the ideas that you don't get to try and see what we can do to get ourselves to the level two group. And because we have the level two group, the level two is not exactly right, but because we have the level two group, if you wouldn't use the program right, then you would see that the rest is set for the level two. So this program, I think it's worth asking. So if you somehow get this problem, then I'll send you an idea. Sorry, if you can get this problem to the level two. Then it would actually be a little bit of a challenge. And then the answer is, you know, where you are trying to get the level two. So, that's it. I love what you're talking about. What's the, what's the, so, is there any questions? I'm just trying to get the questions right. I'm just trying to get the questions right. Oh, you have a question? Okay, I'll get it all. I'm going to choose the other team. It seems pretty much a deal. Well, you can get it as a challenge. I'll get it all. Let's do it the way I know. This is very easy. I think I already know how to come up with it. Okay. I'll try to possibly do it. Yeah, I don't know. Anything else?  So, but I think you can pretty much guess what comes around. Because you're level one. Yeah. So, things that have been in one time. So, talk about, right, you see how it has been. Yeah. Oh. Oh, yeah. Sorry. Okay. Okay. Okay. Okay. I'm going to show you. I'm going to show you. Okay. Well, I'm going to show you. I'm going to show you. Okay. Okay. Okay. That's because your bash, the process that you logged in in, doesn't have that view. So you need to either log in again or you can run a bash. That's a good point. So when you do break the level, if you're trying to go on a level 2, you need to usually log out or log back in. Because if you run ID, you'll see that you don't have the level 2 permission to log back in. But if you're in score, you'll see that you broke the level and you got it. That's a good point. You don't have to worry about logging out. This is shelter. I'm going to sit down. Thanks. It can't be true. Can I do that? Yeah. Oh, no. Oh, no. No. I think that you just made a call. I can make it sound like it's public. I just wanted to make it sound like it's public. I'm going to sit down. I'm going to sit down. I'm going to sit down. I'm going to sit down. Okay, so in the meantime, can you make it sound like it's public? No. I could personally press this button. Yes, that's better. Now, right, and then press this button. Yeah, it's public. Okay. If you could, do this again. You have a popsicle of that, okay. Now, let's get down. And I guess, you know, I, uh, I think it might be much worse than I thought it would be, but I'm not sure how much I can do. I don't know. So I'll be in the top of the show. I don't know. I don't know. I don't know. Oh, wait. I can't get it out of here. Oh, you just do the beat. It's a nice thing, because otherwise, the guy himself will be very annoying. Yeah. Okay, I got it.  You think they may really have to take out what's going to happen? I guess you don't know what they're doing with this. Okay, is everybody solved level one?  So, I'm going to spoil it. You just need to do slash var, slash challenge, slash level one, slash one, and then what do you pass in as the parameter? Oh, you can't see the projector? Is that a problem? You have to leave. So, what do you pass in as the parameter? The path to lead. The path to lead. So, user, slash user, slash bin, local, or user local bin. What is it, lead? I'm the wrong user. I guess so. Yay! And now I'm the last one in level two, great. So, it's ordered by time. I actually, as many of you know, I can't check out var challenge level two yet because I need to basically log out and log back in, which is not going to be good. Okay, so now I can finally look at that. Okay, so to understand what level two is, we need a very brief introduction to my beautiful drawings and to the stack, yes, I know some of you. This is bringing back bad memories. Okay, so first we need to look at our, I'm going to look at our calling convention dot c, which I already compiled. Okay, let's look at this function, call e. So we're going to look at this and we are going to draw what's happening. So first off, we're going to talk about the stack. So the stack, as we will draw it, starts with all f's at the top and grows down. So when we push things onto the stack, it's going to go down and when we pop things off, it's going to go up. Stack is your standard stack data structure, but the stack itself in your process is a part of memory. So let's say your stack pointer is here at, maybe that's too low. So let's go through. Once this function call e starts executing, what's this first instruction here? What's push EVP mean? Push the base pointer. So EVP is a register. The important thing to remember is the CPU only has registers in memory. It has nothing else. There's no such thing as variables. It's all just hex, which is actually kind of nice when we think about it, because all these abstractions go away. So when we push EVP, that means there must be some value. We'll call it the saved base pointer or save EVP of whoever called us. So the first thing that we do is put saved EVP on the stack and now the stack pointer points here. And then we move the stack pointer into the base pointer. So we have, now we're setting up our new variables ESP, EVP. We're going to do some stuff. We're going to skip over this part. And we're going to get to the end where now we do pop EVP. So what is a pop EVP going to do with the stack pointer points here? Yeah, move the stack pointer up one and put whatever's in save EVP in this memory location into the base pointer address. Does it change this value on the stack? Does it zero this out? No. No, why would it do that? That's an insane optimization, right? Because it's going to reuse it later on. We just popped it, right? That's basically garbage. And now it's going to return. What's a RET instruction?  How does it know how to go back? Not the base pointer. Because the base pointer, this saved the base pointer was already, so we have a base pointer so use for function frames. We'll go to that in a second. Yeah. Does it stop the return address? The return address. So in this, what actually we missed a step here before we actually started executing this function, the stack here looked like this, and actually we cheat up here, we can see that there's this value of 0xA on the stack, above that 0x28. And we have this call instruction to call 80483BB. What are the semantics of the call instruction? Semantics, these are the things that you actually don't even know what the bytecode version of call is. What we need to know is what does that actually mean? What actually happens semantically to the processor and the memory when the CPU executes a call instruction? It's going to jump. So it's going to change. EIP is our instruction pointer in x86. So that points to the current instruction. And basically it says, set the instruction pointer equal to 80483BB and that's how call least starts executing. What else happens? Push onto the stack, the next address to be executed. So in this case it's 80483DA is the instruction after the call instruction. So it's going to push 0x80483DA. So the stack pointer points to here. We then go up here, we do push EVP. All this stuff happens. We then pop EVP. The stack is going to be in exactly the same place right before the return instruction. So then what happens with the return instruction? What are the semantics of a return instruction? Go back to the caller because it has no idea what the caller is. The CPU only knows registers and memory. Yes, change the instruction pointer to whatever, it's basically a pop-VIP. So take wherever the stack is currently pointing, take that value, those 4 bytes, put them in the instruction pointer and start executing from there. So what will happen is the stack pointer will increase, it's going to point to here and then it's going to start executing right here. So this is your crash course in buffer overflows. So let's create a function that, when it's executing, so we'll change this call e function to have some arbitrary amount of value on the stack and let's say there's a buffer located here at, this is the base pointer, EVP, buffer is at EVP minus 10x. And the stack pointer is going to point all the way down here. So, how are buffers in C? Anybody written code in C with a buffer? Yes. What buffer means character array? Character array, also called a buffer, known by many names. So character bracket, the size and then the name of the variable. So what prevents you from writing 100 bytes into a character array of size 50? Can you do it in Java? No. Why not? Why is it strongly sized? It's close. The runtime checks. The runtime checks, every single array access in Java checks, is this access within the bounds? Is it greater than zero and is it less than the size? Whereas in C, there's nothing that prevents that. All you have are pointers to memory. And so there's nothing stopping you, even if this buffer is supposed to be size 10 on the stack. If you copy something of size 100, what's going to happen is the CPU is just going to start writing bytes into memory, overwriting bytes. And then what happens if it overwrites this saved instruction pointer on the stack? It doesn't know that it can address it. When we finally get to that return instruction in the program, that will crash the program because it's going to try to access some random bytes. What if we are incredibly clever, and we've written some, what we'll call shell code, some code, and we've injected it into the process. So rather than random bytes here, we have bytes that get us a shell. So as you can maybe see, I had 100 slides prepared. Our shell code is actually going to be very similar to what we wanted. It's going to call execve-bin-sh to get a shell. So bin-sh is called the shell program. What we want to do is get a shell because that shell has those setUID permissions that we talked about in the beginning. So we can create using assembly some super cool shell code that has no null and no new lines, which will do that. And if we get that shell code, copy it into the process and then change this instruction, the saved instruction pointer on the stack to point to wherever this memory location is, where the start of that shell code is, we can start executing code there. So basically the next series of levels walk you through this. So you can see that 2C actually already has the shell code in there. So I've written that that shell code works. There is some address. You're trying to execute that shell code. So you want to execute this shell code, which exists on the stack. So this is simulating the first part of a buffer overflow where you have shell code on the stack and you need to figure out what set of address that goes in there. You have 10 minutes. Do level 2. You can do it. I know you can. We'll all walk around. I'd like to go out to the side of the bunker.   I'm running off to the other corner. There you go. Thing was amazing about this. So thank you. Thank you. I can't do it. I can't do it. I was like general, we don't want to go on that. So it could happen. Yeah. So in that address, you know we need to put uh, yeah, we'll sort of we'll sort of like, um, and then, uh, and then, But in much more detail, what distance you have is probably more fun by this point. I forgot how to use this. Yeah. Yeah. So, y'all, yeah, there are...  But, yeah, we don't record our meetings. Go ahead. Oh, yeah. That's a little bit... Actually... I think... Some of them, please. But, yeah. If you don't know, go see them. Come to the meeting. Come to me also. To the drama studio. And then we'll have a discussion. Oh, are you not in set? What is this? What is this? What is this? So, what is this? What is this? Oh, you want to... This is less than I expected. We want only us. Okay. Barbara. Okay. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Barbara. Well, what's with David's probably just he was working while he was performing today and he's also been working with us today. So that's how you combine your past function and the function and see that I didn't connect you to your perfect oriented sense of mind. So I'm going to get you to afford it to the center people.  Thank you. Thanks. No, that's not 60. No, it's not 60. No, it's not 60. Yeah, I'll take it some resources to be on the site and show you real quick the tools we have. Actually, the packing is pretty good there. So this kind of action actually has a lot of material is going to cover. Okay. No, these aren't done yet. Okay. Eventually we'll add more stuff here. Yeah, this goes over a lot of things. Absolutely. You do. So I found out that I put 60 Q in left. I think I'm going to put it in the right. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Okay. Alright, folks. We are reaching the end of our time together here. We will be kicked out very, very soon. Before you go so I want to say a couple of things. A, Thanks for coming B, what was I going to say? Yes. was that keep this up for like a week over spring break or something it's like so you can play with it I'll take it down in about a week also if you bug me about it I'll try to release the source code I'll also upload this video so if you want to go back to anything you can go back to it the other thing that'll really help you with this so my website is Ponevils.com it's super difficult to remember and not only does it have information about us the club but it has a super awesome how to hack section that will put together based on this material which has basically literally everything I was going to cover in my slides in a much better form online that you can read and understand your own pace. There are fun buttons to click. Including a workable x86 stack in JavaScript which is actually I'll tell you because you're all computer nerds this is actually not just an animation this is JavaScript code that is interpreting these these x86 instructions and executing it as if it was a stack. Is that true can I look at this and show them? I mean yeah you can. I mean if I show them this yeah so as Adam's doing that the website the front page will allow you to join our mailing list and our Slack and it'll tell you will I email all the meeting times whatever we meet we have free food there you can if you want to learn more stuff before coming to the meetings you can come look at the website and come to the meeting and tell me how terribly it was written. So this is that calling convention example so you can walk through this and see exactly what's happening I should have just brought this up. I don't know why I decided to do anything else. That can walk you through everything so like I said earlier all the resources are out there there's not only this obviously we're plugging our own stuff there's lots of resources out there you know enough knowledge now to be dangerous and Googleable so you know what to do before buffer overflows smashing the stack and thanks and thanks again to Soda for hosting this event with us I alright one last thing so give a round of applause to Dr. DeVay and as you guys leave we have one last treat for you we have a lot of the Google gift cards left over from one of our previous events so as you walk out we have stickers Google gift cards for Google web services that they'll be handing out it's limited to per person if you already got one of the previous event you can leave to your account but they will be handing them out on the way out.


And I tend to be loud, and I also tend to talk really fast, so I'm sorry. The trade-off is you get to stare at my amazing sweater vest all day, so I'm really doubly excited about that one. Slide show. So my name is Angela O'Conia. I work for the Santa Clara City Library. And I am really excited to be here today, because when they said, you should come speak at Futures, I said, okay, what do you want me to talk about? And they're like, inappropriateness. And I said, yes, inappropriateness in librarians, please sign me up. What are we going to do? So I was like, okay, well, I guess I can talk to you today about gambling, about booze, about parties, and then I'm going to be really naughty and talk to you about how to do it in your library. So I was in this interview, and they asked me this question. They said, how do you reach out to the 20 to 30 demographic? Why do we interview? That's a terrible question. Unnamed library never asked that question in an interview, because it's such a big thing. I mean, we have this whole Futures thing about 20 to 30-year-olds, and you're going to spring that on me in an interview. What am I going to do?  And then I realized, you know what, I've actually, I've done that before. And so the story that I began to tell them is the same story that I'm going to tell you. It started with this grant. So before I was like this super fabulous, amazing librarian, I was a super fancy, really amazing grant coordinator for our library system. Then I had to run other people's grants, and I was taking this class from Patricia Wong at San Jose State, and it was about grant writing. So the first thing you do is you look at your community. What do you need? What do you need to, what's the community need? And I said, well, you know, we have a great jobs program, we have great kids programs, we're starting these STEM programs, and San Francisco has this like whole sustainability thing, and I was like, that's what we don't have. We're like really into making bread and making jam and doing all these really cool things, but there's no hub for it.  The library. And everyone was like, that's a great idea. We should make pickles at the library. You should get this grant. We should make pickles at the library. And I said, yes. And so what I wanted to do is I wanted to get dirty. So all these programs, I was like, we're not having someone come in and speak. You know what we're going to do? Put your hands in some dough and put your hands on a chicken. I want you to touch out some bees, very gently touch some bees. And I want you to like learn. And we have this problem, I think, as libraries is we're going to talk at you. I'm going to talk at you about things, and then you go home and maybe you'll do it. And I said, no, we are going to learn and we're going to get dirty. So it was super successful. People came, people came in their 20s. So I was like, I'm so awesome. And you know, we did this one program. I say that a lot. Please enjoy. We did this one program and it was one of the only ones where we were talking at you. And we were doing beer brewing. And I was like, OK, this is awesome. And my speaker was super flaky. You guys never had an issue with that, I'm sure. And our speaker was like, OK, you know, we didn't know if we were having it or not. He wouldn't respond to emails. Like three days before he's like, OK, it's going to be an eight hour event and I'm going to bring this brew kettle and we're going to brew beer and I was like, no, it'll be an hour because you didn't get back to us and you're just going to talk. And it wasn't brewing beer. It was a brew kettle requires fire.  So they're like, no, too short of a time frame. But what I realized we held this beer brewing course and half of the people who came were from this little website called Meetup. And I was like, anybody here in Meetup? Right? Yeah. And I was like, this is awesome. I'm going to go to Meetup and I'm going to start pimping library programs because this is the audience I want. And so I go on and I'm like, I'm a library. I'm awesome. And they're like, we don't want you here. I said, well, but I'm really great. I have free stuff. It's really cool to meet your demographics. They're like, no, this is people to people, not like library programs and then you poach our people. And I was like, but I want to poach your people. I have really great programs. And so it didn't work out. But I always kept in mind this idea of Meetup and the things that they could do. By the way, you'll notice this woman's shirt says, I drink coffee. I drink whiskey. On a scale of one to America, how free are you tonight? And would you like to come to a party? So I work at this branch. You've met my boss. She's a little crazy. Her name's Cheryl. And she said, we're going to have an 80s prom. And everyone's going to dress up. And we're going to be really excited. And I have all these Meetup groups. And I was like, Meetup, you don't say. And it's going to be a great time. It's going to be after hours. And we're like, yes. And they came back. And the Meetup group said, no, we don't want to come. You don't have booze. And we said, we'll get booze. Come, we'll get booze. And so we reached out to our friend's group. And we said, you have booze. Come. And they said, yes, we will come. And we will make money because we'll sell drinks for $5. And it's a donation. It goes to the library. And we said, yes. This is amazing. And we rocked out the night. We had 110 people that came. It was after hours. They were 20 to 30 years old. And I was like, we've succeeded. They were 21. They were all 21. I wasn't even 21. So we're riding this super high. We're like, we're awesome. And we sat in this planning meeting. We had started to theme things out. So August was like hot August arts. And September was cooking. And October came up. And I was like, October Fest. Yes. This is what my life has been building up to. This is the highlight of my day. We're going to do October Fest. And we're like, yes. And then we high-fived. And we were like really excited. We're like, we're going to do booze programs. And 20-year-olds will come. And we will take over the library world. And we said, yes. And I did this like, I'm going to go run over to my desk and start sending emails. Her desk is like two feet away. So it was a really short run. It's the most exercise I'd gotten that week. So I went to my desk. And I started typing this email. And I was like, who am I going to send this to? Who do I want to come? And I was like, you know what? I like drinking. I like drinking vodka. And I like drinking whiskey. And you know who sells some good stuff? St. George Spirits in Alameda. Yes. And I typed up this email. And I was really excited because I'm riding this high. And I said, dear St. George, my name is Angela. I'm a librarian. Please come to my library. P.S., bring booze. And I'm a teen librarian too. So I should mention that. And I went. And I sit in the teen room for two hours a day. And I sat. And I came back. And St. George responded, we would love to come to your library. L-O-V-E capital letters. And I was like, yes. And they were like, well, bring booze. Just talk to your nonprofit friends group. And it'll be like a thing in a fundraiser. And we'll give you money. And I was like, yes. And I did this dance. And I jicked my way into my boss's office. And I said, I am wonderful. St. George spirits is coming. And they're coming for free. And it's going to be great because we're going to do a tasting. And then we're going to do, I do this a lot, I said, we're going to do a cocktail hour afterwards. And it's going to be wonderful because 20-year-olds and 30-year-olds and 40-year-olds and 60-year-olds, everyone will enjoy this will be great. I said, please tell the friends, this is the day I want to do it. And she said, yes. I said, yes. And we high-fived again because we're really into high-fiving. And she came back to me the next day. And she said, I talked to the friends. And I was like, yes. And she said, they don't want to do it. And I said, no. I said, my dreams. All of the things, all of the things I wanted to do, all of the things I wanted to accomplish. And I said, why would they say such a thing? Friends groups are supportive. Friends groups are supportive. They want to help me. She said, no, they're really worried about liability. They don't want these small. They don't think they're going to generate enough income from it. And I was like, no, but they're supporting the library. And they came to prom. And they were really great. She's like, yeah, you're not going to convince them. The board has ruled against you. I was really sad. I was like, well, this is going to be very fun. And so I was writing this thing for futures, which was more embarrassing because I wrote the first part of futures when I was really excited. And then I was like, now I've got to go to futures and sit next to the friend's library lady who let her group do alcohol. And that wasn't a slip up. And I was like really sad because I was going to be this total failure talking at futures about how I didn't get alcohol to my alcohol related program. So then I'm like, wait, I just need a nonprofit group. They'll sign my ABC license. I'll trick some poor unsuspecting nonprofit group to come to the library.  And I said, you have a nonprofit board. Please go to the mothers of your board and tell them that we should have alcohol at the library. This is a great idea. Surprisingly, they said no. And I was crushed again. This is just a story of my dreams falling apart. So at the same time we'd been working on this program, anybody read Roller Girl by Victoria Jameson? One person raised their hands. Good job, librarians. It's really awesome. It's a graphic novel. And we're going to have this program. We don't just do book talks. We do book talks with a twist. So it's about this girl who joins Roller Derby and it's really empowering. It's about a young girl. And I was like, you know what we should do? We should definitely bring our local Roller Girls. My boss and I were like, yeah, but we should also do a Roller Derby in the parking lot. And we were like, yes, we are awesome. We can't have alcohol, but we're awesome.  Silicon Valley Roller Girls are 20 to 30 year olds with tattoos that support young girls and empowering things, but have been turned down so long. So I shot this email to Documental. She signs all her emails mental. So it's like the best correspondence. My Roller Derby name is Book Life, in case you're interested. So I was like, dear mental, this is Book Life. You know, hey, here's this thing. I want to do this series of four alcohol related programs. St. George's Spirits. I want to do a whiskey tasting. I want to do a 1920s murder mystery bash after hours. I want to do a wine and paint night for our Dilt-Only Arts Ladies Club. It's like this much money. What do you think? I mean, you would keep all the money. And she responded and she said, yes. And I did the dance of 1,000 dances and I screamed at my desk. This nice man with his five. I acknowledge you, sir. And then I ignore you. I am telling a story of booze. So then I got really excited because I was like, yes. And this is the screen that I prepared where I was really sad. And I was like, where do we go? Because here's the thing about libraries. You know where 20 to 30 year olds don't want to go on a Friday night? They don't want to go to the library. And it's just a real sad truth of what we do. How do I get them to come to the library at a nighttime program, especially if they don't have kids? How do you get single, ready to mingle people to come? And how do you get them to think about the library as a place that isn't just books? Because that's what we struggle with and that's what we fight is this misconception that we're boring places. And that's not true. We're like this really great hub for the community where a place where people can go and they can hang out. And guess what? At my library, you can drink. So, the thing is my friends group wasn't super supportive. But you know who was my library director?  But she was super supportive. Of course, I always pitch these ideas. I go in with like a bottle of red wine and a cheese plate and I said, let's talk about a program. And surprisingly, she's always really amenable. And you know, my drug boss, Cheryl, was like, these are really great programs. This is what we need in the library. And so I had this really great support structure but I didn't have any way to make it happen. And it was through all these other partnerships that it happened. And there's this really big misconception. Alcohol is naughty. Now, if you've never drank before, maybe that's an opinion, but a lot of us drink and a lot of us don't wanna go out to a loud bar but maybe we do wanna hang out in a creative atmosphere and maybe we do wanna sip on a cocktail. So, even though that's okay for us personally, people don't want that at their libraries because it's naughty. And it's not, it's really exciting. So, the Silicon Valley Roller Girls were so excited to come. They were so excited that they've had more volunteers for this event than some of their other nonprofit events. So I think I have like 30 roller girls who are like, we're gonna help a lot. Don't worry about it. I was like, yes, at least you're coming. And they said, we're so excited to partner with you. These are actually the cocktail glasses they made for the St. George event. The Leaf is my library logo. Silicon Valley Roller Girls, they didn't, they said, hey, we're making glasses. We're gonna sell them at the event. So it all goes to the nonprofit. Do you want your logo on it? Duh. And I called some people up and I said, these glasses are awesome. And they said, but do we wanna be associated with alcohol? And I said, yes, these are amazing. And we have an art and wine festival this week. The city's logos slapped all over wine glasses. What's your problem? And so they were these enthusiastic partners. And I was like, this is great, we're really awesome. So it's kind of this idea that we can break out of this mold. That if you persevere hard enough, if you're really excited, if you decide that you're gonna stumble, I think the title of my program was like hipsters, hurdles, all that kind of stuff. If you wanna bring gambling. I started this year a fantasy football program. It's considered gambling, right? People aren't putting money down, but they're winning a prize, they're being competitive. Booze, alcohol programs, parties, 80s prom, murder mystery, all these sinful things. It's like, it's up to us as librarians to kind of break this mold and say, our libraries can be whatever we want because we think we're reaching a need. My program is next Tuesday, by the way, if you wanna come, it's next Tuesday, register on eventbrite.com. I have 76 people signed up. I have a meetup group with 35 people on it, and we haven't even media blitzed it yet. That was just word of mouth. So, look at these, look at hurdles. One, I'm really happy that I didn't have to give the worst presentation next to a super supportive friends group. But also, look at them and think about what you can do and think about this demographic in a brand new way. That's it.