Good morning everyone. Firstly, I want to apologize for my French accent. I am a PhD student in the University of Toulouse. My research is about late iron age habitat identified as the current era of Toulouse. It concentrates mainly on the relationships between domestic and specialized activity space. In this session, I will present a guest study, what that we put into Christian iron age settlement pattern and ways of dealing with them. In the current era of Toulouse, archaeology revealed two main centres of late iron age occupation. J. Toulouse and Saint-Roch. Their separality by 5 km array is one from the other. Both are characterized by the identity of archaeological remains. Ancient texts refer to a city named Toulouse, which was the main agglomeration of the Velkaet Tectosagy. It's a galactrive evoked for events going as far back as the 200th century BC. Muching was paid on debattique which one of the two sites, Veytoulouse and Saint-Roch, could be identified with the capital Toulouse. The question of the status of the settlement and the nature of the relationships has been easily discussed and led to the formulation of several hypotheses. Two phases could be at the outline. The first one corresponds to the pre-romance period but begins at the end of the third century BC. This phase is characterized by two large main centres by farms and specialised arrears. The second phase starts at 100 BC. It is characterized by the persistence of farms and the only one main settlement paid Toulouse while in Saint-Roch only few tries of occupation persist. This restructuration probably is a consequence of Roman intervention in 106 BC during the war against the Simplic and the Toton. Indeed, textual evidence referred to Tectosagy, fighting alongside the invader captured by the Roman army and to the further stacks of the city sentry by the Roman. This defeat means for the Volcay-Tectosage a loss of their political autonomy and statue of a light room. As we could see, settlement in the region of Toulouse evolved from the complexe towards the more simple, with two main settlements observed during the first period while the structure of the second phase may be considered more classic with only one centre. For the first phase, the most widespread hypothesis provides to explain this complex settlement but then are the following. A model of political and symbolic domination of Viet Toulouse over Saint-Roch with an elite presence at Viet Toulouse. Viet Toulouse is the opidum and the capital of the Volcay-Tectosage while Saint-Roch is only an area of activity dependent of Viet Toulouse. Over hypothesis, several agglomeration exist but the main centre is located in Saint-Roch because of its economic predominance explained by its topographical position. In this model, the economic and political domination is exercised by Saint-Roch over Viet Toulouse. Sorry, I have a problem. From a topographical point of view these two settlements are very different. Saint-Roch is a lowland settlement while Viet Toulouse is a hilltop settlement position which ensure a natural defensive position. Both settlements are very close to the Galron river with the proximity permitted exchange towards the Atlantic. Both these are not equally now from an archaeological point of view. All rescue excavations have permit the discovery of 100 water routes each site. This well gives us a general vision of the extent of occupation. This has a main and almost the only structure preserved with the exception of a few pits and post-holes. However, they reflect very indirectly reality because the material found in it is clearly not in situ. The study of the content nevertheless reveals a considerable amount of vestiges of domestic construction and specialized activity all parallel together. The era excavated from the beginning of the 21 century as part of preventive ecology rely on urban development projects allow for the first time to characterize domestic building. Most of the construction was built on local materials such as maul and wood. To address issues related to the possibility with the possible air-key or complementary of these both sites I have concentrated on the special distribution of activity marker. During the first phase material relative to domestic work such as mining, weaving and spinning or material linked to the domestic life like dishes show that domestic activity are spread over the entire extension of both sites. In some era domestic and specialized space are intimate linked in the urban map as you can see in yellow to Saint-Roch and in blue for Olivier II. However, at Saint-Roch in some places an organization by area of activity appears. During the second phase the situation not differ really from the one that will be observed. Saint-Roch is set up toward HCBC within the habitat. We can suppose blacksmiths live and work in the same place. This proximity reveals a certain permeability of the activities between domestic and craft sphere. From 75 BC a specialist aura with pottery kind develops on the margin of the habitat. On the Sydney often solely to the two main aura of occupation pottery kind now for the first period. It may be assumed that this activity is moving and is annexed to way to lose in the second period. During the second phase we can observe that this process of polarization of domestic and specialist activity observed in the first period continues. However, we can see images of Angikwa district highway to lose. Another criteria important is trade. Reused as construction material after wine consumption is found in large quantity on all sites in to lose. Demonstrating the importance of to lose in trade and consumption of Mediterranean products. These sheets of importation are also well represented in particular the one of Italian tradition but also of Iberian ceramic and Guay ceramic of the Catalan coast. These two types of material are present on both seats and faces. It can be observed that aura which concentrates most of the imported sheets are reduced. These aura are also the ones that have delivered the most dance number of domestic remains. The material culture reflects the diversity of geographical origins of the inhabitants and exogenous culinary practices. It informs us as much on the relation that tectosage maintain with the neighbor as we have the possibility of Iberian inhabitants as they lose on some rock. No difference appear between the both sides from this point of view. Another feature common to both seats is the presence of a rare artifact in southern gold, stylusis, used for writing and accounting. It's finding substance sites where the center of a large network of trade but also of information. Stylusis are present in both periods. The distribution map of Iberian imported sheets and stylusis are quite similar. Maybe it reflects aura occupied by trader. Finally, I concentrated on the structuration of spaces. Durant la première phase, l'urbanisme en both sites reste initialement très libre. Mais après le 143 BC à l'aventure, des plantes régulaires de l'urbanisation matérialisées par les déchets et les rues qui définissent les blocs de la maison ont été identifiés. L'orientation de cette structure va continuer durant la seconde période et disparaît le contexte historique à la fin de la seconde période. Pour conclure, la catégorie est une constante préoccupation des élèves. La conception de la Méditerranée de la ville avec un seul centre est présente dans notre main. Nous devons considérer le cas de Toulouse. A la première phase, l'extension de la organisation mérite de la question de la division de fonctions politiques, économiques et religieuses entre les deux étalements. Je crois que la question de l'observation est cruciale. D'ailleurs, par l'observation de la capitale de Volcaire de Tectosagie, nous avons le sentiment d'une centrale d'occupation avec Toulouse, la capitale, tout le fonction comme vous pouvez le voir sur la map. Mais le centre est organisé organisé selon un pattern polynucleur qui semble fonctionner comme une sorte d'entité polycentrale centrale. Avec plusieurs centres d'occupation géographiquement séparatisées mais liées par l'interconnection de leurs fonctions plutôt qu'un centre séparatiste. La deuxième phase est plus classique avec une sorte de réorganisation plus proche de la modélisation méditerranique avec des politiques économiques et du centre culturel comme un sens romain.


Our next caller is Andrew from Iowa. What's up, Andrew? How can we help you? Not much. Originally, I was going to call in and talk about, I like to, I've always liked to run. I've always liked to lift. I know, especially listening to your recent podcast, when you're on the Mark Bell podcast, I really know I need to like cut back on the running. Um, so I need to focus on the lifting. I think I've always been a little skittish about my running or about my lifting is because I have, I have an ostomy, kind of similar to a person. I think you guys interviewed recently who had had the hernia. So it's going to be something similar. I have Crohn's disease. I know nutrition kind of plays a part in that. I'm just kind of would like to pick your guys's brain. See if you've guys trained anybody who has an ostomy. I mean, I squat, I deadlift, I wear a lifting belt, um, probably more often than not because of that abdominal surgery. And just really wanted your guys's thoughts on that. Yeah. Um, so I have, and, uh, really, you have to just monitor your intensity. And this, this by the way, it's true for any, you said you have Crohn's. So any autoimmune issue can get flared up. If stress or, you know, overtraining becomes present. Like you push yourself too hard. You probably, you can increase your risk of getting more flare ups because of course that's inflammation, right? It's chronic inflammation. It'll contribute to what you have before. So really just monitor the intensity and treat exercise like practice. So don't go to the gym to work out, but rather go to the gym to practice exercises. This will serve you well longterm. So that's the thing that I would really focus on. As far as diet is concerned, I'm sure you've probably been talked to till, you know, your, your ears are bleeding about all the different ways you can work, you know, eat and how you should avoid certain foods where the most success I've had with clients who've had kind of these, you know, gastro inflammatory type disorders, whether it be Crohn's or even other types of issues like colitis carbohydrate specific diet. I'm sure you've heard about this, but I've had clients with good success. Here's the, the issue.  I think I can kind of squeeze in a little bit of, you know, more bread or I can have a little bit of candy and then boom, you get a flare up and then it takes months to get it to come back and under control or you have to get on medication. So it's exercise, really focus on practice, keep the intensity moderate and then diet. You have a different motivation than a lot of people who are just trying to get leaner and whatnot. You got to be very consistent with staying away from the foods that tend to cause you problems extremely consistent because even if you eat them and you notice no immediate issues, it's oftentimes setting you up for issues in the near future. Andrew, are you currently strength training right now? And if you are, what does it look like? Yeah, right now I'm training, you know, trying to do full body at least three, four times a week. At one point I was lifting and running, you know, six days a week. The running was just killing me, absolutely draining me. I was always a big fan. If you guys remember the Bill Phillips body for life program. That's how I got, that's how I got into working out and I just always have leaned, leaned heavily on that. I know, you know, having three kids working. I can't do it all. I know, and plus I kind of realized that I'll never get those gains or aesthetics if I keep running as much as I did.  But yeah, I have a home gym at home. Pretty nice little setup from the pandemic and a workout, you know, two, three times a week. Yeah, are you, are you pretty good about switching up like phasing the workouts? I mean, have you ever followed any of our maps programs? Are you familiar on how we periodize the programs or do you do any of that yourself or do you kind of follow? No, I've been following you guys for the past couple of months, still learning the different maps programs, what that's all about, and just really getting into it. Yeah, I would love to see you follow like maps anabolic. I think maps anabolic two days, it has an option of two or three days a week. If you're if you're scaling back on the running and you're not doing that, I think three days a week is is perfectly fine and doable. If you're still we're going to integrate running in there, I'd probably scale you back to two times a week and follow that routine. And I would even start in the pre phase first and then move into the phase one after that, even though I know you have some background, that type of programming I think would be ideal for your I would go look to be more specific two days a week of full body strength training and then two or three 10 to 15 minute walks every single day. That's it. So two or three walks after you eat breakfast lunch and dinner that actually helps with digestion helps reduce inflammation perfect for you and it gives you that extra activity which is healthy two days a week of full body resistance training and then if you want to do any more mobility work. That's what I would do.  If you do that consistently, I think you will see your body progress on a pretty consistent basis. Consistency is a key and frequency and to kind of overcome you know maybe some of the hesitancy towards lifting weights that you don't have to go in there and in you know try to try to you know add load every single time and really increase intensity really just like practice you know these movements and keep consistent with infrequent you're going to get the gains as a result of just doing it more often. Perfect and I know with me yet it's that it's that diet component. I have to the way my body structure that I have to stay on a almost paleo diet works well for me and as soon as I introduce more cars in there I swell up like a balloon. Yeah, yeah, are you familiar with the carbohydrate specific diet? I am not. Oh, yeah, look that up. Look that up. They've had a lot of success with people with Crohn's so and it's kind of similar to what you're probably already doing. So I'd look that up and your and just see how you feel but that's the biggest thing man. That's what it's called carbohydrate specific diet. Yeah, and I've had look I have a God son who's got really bad Crohn's. I have my own gut issues at one point. I thought might maybe I had that. Luckily, I don't I've worked with clients who've had colitis and Crohn's and boy. I'll tell you it man. The consistency is everything with this like and I know how hard it is because it's like you're doing well. Wow. My body feels good. I don't have any signs of Crohn's. Inflammations down. Everything looks good. Then you have like one cookie or one thing that's off the thing and then you're like I feel good. No, it didn't affect me. Let me try a little bit again. It did affect you and it's this cumulative effect and then what happens? I'm sure you've experienced this as you push it, push it, push it. Boom. You get a flare up and then it takes you a while.  I mean, this what you're saying right now. I know we're talking about Crohn's but I mean, I experienced this with my psoriasis exactly that same thing and I do it to myself all time. Oh my God. I'm doing so good. Allow some ice cream in there. I don't I can get away with one two. Oh, third time. Now I'm fucked.  She's oh good. I've eliminated sugar. Everything's good. I'm fine. Oh, I had some candy the other day. I was totally fine. Have some more a little bit more and then it boom. It comes and so that's I think that's a mistake. A lot of people make that have autoimmune is you do a really good job of dieting. You're feeling really good. You go back to trying some of the things that were what you what were offenders before and then you don't see anything. And so you think, oh, well, maybe it's not that or maybe I can have that more often and then it ends up flaring up. Yep. Yep. Yep. Yep. No, absolutely. I was thought I was feeling better. The medication was working started changing my diet and then boom. Next thing I know I'm in the hospital. They will move my colon and I think I learned my lesson. Yeah. No, I'd say that's that's a tough situation. But yeah, do it now and you should be okay. And I'm assuming the medication they put you on was a very strong immune suppressing drug. Very strong. Yes. Yeah. And Andrew, I'm going to have Doug send over maps and a ball for free to you. So he's going to shoot that over to you. Awesome. Thank you so much guys. No problem. Awesome. Yeah. The drugs that they put people like this on are they're like chemo drugs, chemotherapy and they attack. They are and they'll attack your immune system to suppress this reaction. But what you look at the side effects of these drugs increases your risk of cancer and other things down in the future. They're really kind of a last resort and I know I'm sure I'm talking to somebody right now who's listening was like, man, you don't know how hard it is like I like I totally get it but you don't have normally we communicate flexibility with people when you're in a situation like this. You don't have any. You don't have the luxury of that kind of as you can see he had to have this is the conversation. This is the conversation I have with my sister with endometriosis because how awful that is for her. You have to become almost like neurotic with it. Like, yeah, like it's like it's your religion. Like I can't eat that. I have to eat this particular way.


Greetings everybody, good morning, good afternoon, good evening, based on wherever you are, welcome to my talk on modern red team tradecraft. I'd like to start off by thanking you all for viewing my talk and also a huge thank you to the brilliant team behind Defcon Red Team Village for putting together over 200 hours of content on red teaming. So massive props to Omar and the team. All right, quick introduction. I'm a senior consultant at Mandiant. My job involves simulating an adversary, otherwise known as red teaming or purple teaming. I also keep a keen eye out on tradecraft and the tactics, techniques and procedures used by the most sophisticated threat actors out there. I'm first time Defcon speaker, so yay. And you can reach out to me on Twitter at Sajal underscore Thomas. Most importantly, the opinions in this talk are mine and not my employers. Quick disclaimer here. Right, so the agenda for today is going to be a range of topics. We are going to cover why help offense to begin with.  We'll talk about how offense informs defense.  Lastly, we'll cover how someone can get into red teaming and also how the modern red teamer needs to evolve and skill up in order to adequately simulate some of the sophisticated adversaries out there. At the end, we'll open up the floor for questions on the discord server. So please feel free to leave questions during the course of the talk as well as right at the end. All right, so the big question is why help offense in the first place, why spend time and energy in improving a team that merely serves the purpose of keeping you on your toes. So before we get into that, let's quickly rewind the clock to the peak of the Cold War era to draw some inspiration from clandestine intelligence and counterintelligence operations. So what you're looking at is the glorious 812 reconnaissance plane. This was built by Lockheed back in the 60s. And the purpose of this plane was to collect intelligence on the ground by flying through certain sensitive areas. And the main objective of this plane was reconnaissance and surveillance. And this plane was also known as the Ark Angel. And also in declassified documents, it was called the ox cart plane. And thanks to all the declassified documents, we now know a lot more about this plane and about how the United States had to keep it hidden from the Soviets spying eyes. So the Area 51 personnel that was operating on this plane and Area 51 was the hangar where the plane was being developed and tested. The personnel there soon realized that they would need to keep the plane hidden from Soviet spy satellites who in return would be capturing images of the plane from up above. So in order to hide it, they would quickly scoot it into a building as soon as they would learn that a spy satellite was about to enter into the Area 51 airspace. And TD Barnes, a former hypersonic flight specialist, used to say that if a plane happened to be out in the open, when the satellite was coming over the horizon, they would quickly scoot it into a building. And he would say that the entire hangar would look like a parking lot. He said that it would look like after all the cars have left, you can still see how many were parked there in infrared because of the difference in the ground temperatures. So as you can see, all the A-12 planes parked in the hangar with the shadows that they left behind on the ground. So the difference in the temperatures and the heat signatures on the ground where they were parked were naturally much different to the heat signatures of the entire hangar. And so it turned out that even with all the laborious hooting and scooting of the planes in and out of buildings, the U.S. spies learned that the Soviets had managed to get their hands on a drawing of the A-12 plane. And they assumed that they got it via the infrared satellites. So in order to thwart these infrared satellites, the Area 51 crew began constructing fake planes out of cardboard and other mundane materials in order to cast misleading shadows for Soviet spy satellites to keep pondering over. And we also know now that sometimes the hangar staff would fire up heaters near these imaginary engine locations to make it appear as if the planes had just landed. And so as red teamers and as professionals who are trying to simulate an apex adversary, what are the lessons here for us? The lessons here are that every apex adversary knows which action leaves what trace behind. And by knowing this, by knowing which signals are exposed to defenders, adversaries can mislead observers in the opposite direction.  So that was one of the lessons that I gathered from this story. And the other one is that when stealth becomes a necessity and on the other hand, if it affects the pace of the operation, then what do you do? Do you give up stealth and expose yourself or do you continue to remain stealthy but not move in the direction of your objectives? This is a question that every red team operator has faced or will face at some point in every operation. But we can conclude that having a formidable adversary to practice against does keep you on your toes and knowing every action and every signal that you leave behind does help you understand how you can improve yourself and by improving yourself how you can improve the blue team, which is the defense. So back in 2013 Lockheed Martin announced the SR-72 and they announced it with this huge slogan saying speed is the new stealth. And they said that the plane goes so fast that it's going to be invisible to radars and it's going to be undetectable in the air. But from a red team operator's point of view, is speed really the new stealth? Now there's a line of thought among red team operators that going in and getting out very quickly is something that's boastworthy. I myself am victim to this. I have boasted many a times that I got DA on day one and I completed the subjective and bad objective within a few days and that was it. But truly does this impact really help the defense achieve their goals or does this help the defense to get better themselves or does spending a lot more time and remaining undetected demonstrate more impact to the blue team? Now the defense of tech has set a new precedent. There's a lot of behavioral analysis and baselining what is normal on an endpoint or network. And what happens is that anything that goes beyond that normal or anything that comes off as an anomaly immediately generates an alert. And so allow me to share a war story of mine where I performed a Kerberos attack and I pulled 30 service account Kerberos TGS tickets within a few seconds because that's the default action when you perform any sort of Kerberos attack straight out of the box. Whether it's via Rubyus or whether you use the PowerShell script power view by picking invoke Kerberos, the default is that it will just Kerberos every single service ticket that's in the active directory. So what happened is that defenders were watching for quantity of requests and they were watching that quantity in the given time frame that I generated all those service ticket requests and they picked up this anomaly and unfortunately that was the end of my foothold. So this is from the blog by at debug privilege on Twitter. It's a blog on hunting for tactics techniques and procedures using Azure Sentinel. And what debug privilege talks about is that how requesting a huge number of Kerberos service tickets counts as an upset failure because if you if you were to look at the data from 30 days and establish a baseline of service ticket requests. I'm sorry Kerberos service account ticket requests, then you can you can have a very informed idea about how many requests or how many Kerberos tickets are requested per user per day. And then you can set a threshold and anything that goes above that threshold can just be deemed suspicious. So to conclude, maybe speed is not the new stealth for red team operations and maybe boasting about speed may not be the right approach to demonstrate impact. Okay, so let's talk about certain red team implant design considerations that will help you achieve your objectives and also simulate a sophisticated adversary. Keep in mind that we are going to be talking about red team implants alone. We're not we're not going to pick apart any of the implants used by APT actors. Right, so let's say you want to start from scratch and you do not want to rely on a commercial or open source tool. What are the few considerations you want to take into account to achieve this goal? So typically this would depend entirely on what kind of adversary you're simulating. If you if you want to simulate an APT group, then you would want to focus a lot more on stealth. Whereas if you were simulating a criminal or ransomware group, then you naturally want to spend a lot more time on speed and you don't spend more time on making your implant. able to infect a lot more variety of hosts. So you would not want to restrict it to only a certain operating system, for example, because you want to deploy it at scale. So some of the considerations that you would take into account would be to pick a language, pick a structure of your toolkit, to pick a strategy to execute your post exploitation capability because you don't want to, you don't want to have your entire implant with all the post exploitation capability in it. And we're going to talk about why in the next slide. And for inspiration, the first thing you can do is to look at the release notes of Cobalt Strike, because there's a lot to learn from the evolution of Cobalt Strike's beacon in the past few years. So my personal recommendation would be to write and see your C++ because this gives you the freedom and flexibility to interact with the native Windows 32 API, also known as Win32 API. And the structure that you would want to implement would be to write modular libraries for each post exploitation capability. So each capability should be a separate module. So if you want a key log, then your key logger should be a separate capability and that capability should be a separate library. So not only is this easier to maintain an upgrade, but there's an object benefit here, like I was mentioning in the previous slide, that if the key logging module gets burned, then at least the rest of your modules remain safe. So you're not just deploying your implant with all the capabilities in it and injecting it into the memory of your victim. What you want to do ideally is to have separate modules for all your different capabilities and then use them as per your need. And you also want to decide how to approach injecting your capabilities. So there are two major options here. One is the fork and run option which Cobalt Strike uses as well. So this approach is essentially creating a sacrificial process and injecting your capability into it, letting it complete and then closing the process and filling the process. So that is one option. The other option is to inline execute into your own process. So the process that you're running under, the process which your implant is running under, you inject your capability into this very same process and you let the job complete. Now there are caveats for both. The fork and run is actually a lot less stealthy and I'll explain why in the next few slides. And the inline execute option is much more stealthy but it runs the risk of destabilizing your implant process. So my personal recommendation is that if you have processes or if you have capabilities that you want to run over a long period of time, then you pick the fork and run option and if there are smaller capabilities or capabilities that run for a much shorter time frame, then you just inline execute them into your own process. Also Cobalt Strike has this feature which is a newly launched feature called the ability to make beacon object files. I'm not going to get into the details of how that works but essentially beacon object files now allow you to inline execute capabilities into your own process instead of the typical fork and run. So this is a move that promotes stealth but also like I mentioned there are some caveats to that. So you're operating in memory and that's perfect, that's what you want, you don't want to touch disk. All that is great but that doesn't mean that you will remain undetected. In memory it doesn't mean undetectable. Subty also known as Casey Smith once tweeted and in typical Subty fashion deleted his tweet about the three pillars of endpoint detection and response where he said that there are three things that form the pillars of EDR and the three pillars are parent-child process relationships, command line arguments and network connections made by processes. Now this makes a lot of sense from an EDR point of view and from a red teamers point of view if we were to bake these evasions into the implant design then we can have a sufficiently upset safe and still the implant. Now thanks to Will's talk at Wild West Hacking Fest we already have the evasions for the first two pillars and the last one is something we can actually do manually or we can program that logic into our implant in order to pick processes that are typically known to make network connections and use them if we want to make certain network connections inside the network or egressing from the network. So when a process launches, EDR solutions check for anomalies. So the typical examples include Word.exe spawning PowerShell.exe and then for command line arguments the typical detection for that is looking for suspicious parameters like PowerShell-execution-policy and proc-dump-m-helsaster-exec-accept-eula and the network connections are of course fairly straightforward. If you see if EDR sees explorer.exe making connections to the internet then this is naturally something that's going to come across as suspicious. So these are some of the ways that EDR performs the very basic detections. Now let's quickly talk about parent process spoofing. This isn't a new technique. This was blogged by DDA Stevens almost 11 years ago and in order to understand how parent process spoofing works let's first look at the very basics. Let's look at the Win32 API call to create a process and what this looks like is a function called create process A with certain parameters and the parameter that we are interested here is the LP startup info A parameter. So we want to make LP startup info 0.2 an extended startup info struct called startup info xA the struct startup info xA contains an attribute list called LP attribute list and the attribute list can be updated using the function update drop thread attribute. So as you can see the LP value parameter can specify which parent process you want to choose for the process that you create. So LP value will be a pointer to the handle to the process which you want to spoof as the parent as you can see in the image below. And this is proof of concept code from XPN also known as Adam Chester. You can observe the update drop thread attribute function which takes ampersand p handle as the argument and that in itself is the handle to an open process call to the specific process ID that we pick. Right, so the second vision technique talks about spoofing command line arguments. As I mentioned previously, EDR looks at this quite closely. There are many such examples. I mentioned Procmon which dumps the LSAS family. Certain other examples also include WMIC OS get slash format with a web URL pointing to an XSL style sheet which is also known as squibbley2 which was an attack discovered by Casey Smith a while back. And in order to evade this detection mechanism what we would do is we would first create a process, suspend its state, change the command line parameters in the memory to something harmless and then resume the process. But in order to do that we first need to understand what process environment block is also known as PEB. Now a PEB is mapped inside the process's workflow memory. It contains information about the process such as loaded modules, command line arguments used and other such information related to the process. And like I had mentioned the few steps involved in this process would be to create a process in the suspended state and then get the address of the PEB using the anti-query information process function call. This is something that tools like processhacker also do and that is how XPN took inspiration in order to do this. And what you do next is you replace the command line arguments stored in the PEB using write process memory and then you just resume the memory. So when you see it, when you see the logs what you'll see is the harmless parameters are logged and not the ones that you started the process with. So POC code yet again by Adam Chester. As you can see the spoof parameters right at the bottom but you start with reading the PEB from the target process using the read process memory call right at the top of the image and then you get the process parameters from the PEB using read process memory yet again and using the handle to the process and you replace the suspicious parameters with something harmless using write process memory and pointing to the PEB. The other interesting feature lets you prevent third-party DLLs from injecting into the process space of your implant. If you will recall in September 2018 Chrome 69 started this feature where it began blocking third-party software from injecting into the Chrome's process space. They did this to enhance the stability of Chrome and this feature gave inspiration to Rafael Marj creator of Cobalt Strike to bake this into Cobalt Strike's payload which is called beacon. And for those of you familiar with beacon you know that this is something we can achieve by using the block DLLs command and what block DLLs essentially does under the hood is that it creates a process with an attribute that disallows any third-party DLLs from injecting into the spawn processes. So think fork and run processes of beacon for its post exploitation and the block DLLs feature combined with it. So any new process you create in order to inject capability into it you can also set this feature into it so that it prevents any third-party DLLs from injecting into your sacrificial post exploitation processes. The caveat here of course is that only Microsoft signed DLLs can inject into these processes anything that's not signed by Microsoft cannot and also we can also use arbitrary code guard which uses a process mitigation policy to achieve similar results. So looking at the code you'll see the familiar update prop thread attribute function call yet again. What is happening here is that the create process function call is used along with the startup info x a struct which we talked about earlier and in this case this struct contains the mitigation policy which prevents non Microsoft signed DLLs from being injected. So when you observe this process you'll see that there's a mitigation policy set which will specify signature restricted to Microsoft only. Of course as everything sophisticated the level of sophistication of your activity will give away your intent. If your protected processes are something that are not normal to the environment that you're operating in then it is going to stick out like a sore thumb. So the best advice here is of course to blend in by enumerating the mitigation policies on all the processes that are running and then act accordingly. So for every apex adversary it's very important for you to know your toolkit and has a teaming advances and becomes more mature. This becomes more and more important because knowing what your toolkit does under the hood is absolutely essential. Now going back to our initial point every action by an attacker leaves a trace behind for for an attacker to reach a certain level of sophistication it is crucial to understand each action and its detection. This often means for a team operator this means that the fewer processes you create the stealthier this would be the image on the right is. Is actually a screenshot of Rafael Mudge's excellent nine part video series on retina operations. I'm going to touch upon that in the very last section of the stock. But what you see here is every action and every detection risk that is tied to it from a system on perspective. So you can see red is naturally more expensive and by expensive we mean risky. And the ones that stick out here are the creator mode thread calls the process create calls and process access. So process access includes everything from injection to hash down to any mimicettes and all the green ones are relatively safe. These are actions so file create is a very safe option. It's not something that's going to ring alarm bells all over because this is something that happens on every end point and you can possibly have alerts set for that because you'd you'd have a huge ton of false positives. Process termination is also safe. Time stopping stomping. I'm sorry is surprisingly a safe activity. Right. So at every stage of a retina operation you will be required to make an informed decision about whether your action is going to generate an alert or get blocked and based on that you will then decide how you want to proceed with achieving your objectives. So the caveat here is that actions that are loud aren't necessarily always blocked or caught straight off the bat. And Rafael sums this up very well when he says that observable does not mean observed. So the strategy is to blend in with the legitimate host and network activity. This is something that Rafael terms as session prepping. And what he means by that is that you observe the endpoint and its behavior and mergers it. My personal recommendation is that you may have to change up your session prepping based on the kind of activity you want to perform or the kind of post exploitation capability that you want to perform. And to give you an example for something like a network reconnaissance you will want to appear as a process that frequently makes a lot of network connections internally. So here what I would do is I would try to observe every single process that's making internal network connections and try to masquerade as one of them. And also bypassing the three pillars of EDR will only help your initial foothold. They'll only get you so far. What you do after that whether you stay hidden is entirely on the operator. Disabling logging instrumentation is also something that's gaining a fair amount of popularity these days. It's not something that a third party red team typically does. Why is that? It's because you're testing your customers blue team at the end of the day. And if they agree to disabling login then naturally we have a few options in terms of some of the new ETW bypasses that have come to light. And some of the Sysmon invasions and unloading of Sysmon that have been blocked about in the past few years. So these are some of the options we have but again this is not something we typically do on red team engagements. So coming back to the point about blending in your first step should always be to enumerate the running processes and their parent child relationships. Once you have a decent idea of what's running you pick a parent and a child relationship of a process that you want to masquerade as and you configure it on your implant. So this is something that you should have the option to do on the fly and not something that you have to hard code and just stick with for the rest of the engagement. Because like I said this is something that you may want to change based on the activity that you perform. Some common examples that you will see on the end points will be browser parent process. Now internet explorer used to have it with one parent process called iexplore.exe and then all the tabs that you subsequently open would also show up as child processes of that one parent process iexplore.exe. There are other such examples one of them is jusked.exe and juscheck.exe. These are the Java updater parent child processes and both of these are good options in order to blend in because they typically make network connections to the internet. So like I was mentioning internet explorer running on an end point would look something like this where there is one parent process and then the tabs that are open to show up as child processes of iexplore.exe. Another quick note about rubius. When you're performing kerblost I'm sorry not a note about rubius but about kerblosting in general. This is something that I'm going to bring up once again when we talk about how offense informs defense because it's like I mentioned it's something that very often tends to give us a lot of success in terms of domain privilege escalation. So a quick note about that I would recommend not pulling all the tickets at once. As you know I learned this the hard way because I pulled all the service tickets at once and that led to a detection and an alert and an incident and subsequently my foothold was isolated. So an effective strategy here would be to find the service account set with the earliest password set. So naturally these service accounts have the password last set attribute on their domain object and that is something you can query. And the great thing about rubius is that you can now do that with a flag called stats. So you just need to do rubius.exe kerblost slash stats and it will give you the encryption types as well as the password last set year along with the number of service accounts that had its password last set in that year. And then once you get this information what I would do is that I would then start pulling tickets from the oldest to newest and if the oldest cracks then brilliant. If it doesn't then I move on to the more recent one and then consequently progress to the more latest password last set dates. So as I mentioned previously when performing internal network req on a sense you would want to appear as a process that frequently makes internal network req connections. A good trick here is to replicate the client's host as a VM as closely as possible and then test all your actions and observe activity from a blue team's perspective. And you can use sysmon for this all day because it's free and you can also use Swift on securities sysmon config that's available publicly on the GitHub repository. And by doing so you can then look at the process relationships, the command line arguments and the network connections that your implant is making and how it's appearing on the endpoint. You'd also go a long way if you get familiar with some common quote unquote normal Windows parent time process relationships. And Sameer on Twitter posted this very informative chart with all of these examples which I refer to very often. Then I want to masquerade as something legitimate and I strongly recommend that you refer to this chart. Alright so offense informs defense and that is why we want to get better at offense and we want to go from the observable to the observed. And we want to help the blue team to observe our activity so that they can defend against threats better. So to detect parent process ID spoofing you would want to start collecting data from event tracing for Windows. Now event tracing for Windows was actually designed for debugging and not for security monitoring. But that being said it is gaining popularity to gather granular information about activity performed in the host. So to detect parent process ID spoofing you'd want to collect the event header process ID via ETW and correlate with what parent process ID you're seeing of the process. Also parent process ID spoofing requires creating processes with the extended startup information. And you'd want to monitor your process creation calls which have such information. This point is referring to the startup info XA struct. And that is a necessity if you want to perform ppins spoofing because only with that struct can you provide the handle of the process that you want to spoof as your parent. And naturally you'd want to watch out for false positives because parent process ID spoofing is actually something that UAC does and this is legitimate behavior. So you're bound to have a few false positives but as long as you know what you're looking for you should be good to go. A quick image posted by the good people at fsecure. This shows the, you can see the event generated by ETW and quite obviously the event header process ID and the parent process ID are different. And the event header process ID shows the actual parent which is 9224 process ID 9224. I also want to talk about a concept that Jared Atkinson of SpecterOps talked about in his blog. He said that we have this funnel of fidelity when it comes to detection and blue teaming. The idea here is that the funnel at each stage exists to filter out noise in a calculated way but also affects the ability of a future step to be successful. So as you can see you may have a million events in your detection funnel but with all the filters you have in place be it filters of technology or a human eye. Everything you have in place should provide output to the very next filter which would take that output as its input. So when you're triaging you should have a lot fewer alerts that you want to send to the next phase. This is because investigating a hundred alerts or even a hundred thousand events is fairly infeasible no matter how large the organization is. And as Sapti puts it in his stock along with Ross Wolf called Fantastic Red Teams and how to find them. He says that behaviors happen over time and we need to monitor where the action happens. So for example SVChost.exe being spawned without the hyphen K command line parameter is something that's quite obviously suspicious. And SVChost.exe being spawned not as a child of services.exe is also something that you should be looking at because the normal process relationship of SVChost is as a child of services.exe and again with the command line parameters have hyphen K and the name of the service after that. So another such odd behavior would be system level processes being spawned by non-system parents. This usually indicates some level of local privilege escalation wherein your non-system parent process is generating a system level escalated privilege process. So the idea would be to locate attempts to blend in and also locate legitimate binaries being renamed or being replaced and put in a different directory which is not its standard directory. You would also go a long way if you find processes which are creating network connections but these processes are part of the living of the land binaries. So lol bins as you want it. Another great blog post by Gerald revolves around his philosophy of detecting attack capabilities. He calls this the concept of capability abstraction. So the idea here is that an attacker's tools are merely an abstraction of their attack capabilities and detection engineers must understand how to evaluate abstraction while building detection logic. So what he means is that when an attacker runs let's say invoke Kerberost or Rubius or Mimikatz then these present itself as detection opportunities at many levels. So first is the managed code itself and the other is the underlying Win32 API call that is being used and it could also be the RPC call on the network that you could build your detection off of. And lastly of course the network protocol that you can monitor for suspicious activity. So speaking of Mimikatz let's jump to credential harvesting very quickly. So creds are king naturally every red teamer knows this credentials are a red teamer's best friend and when we have plain text passwords it opens up multiple doors for us. Without creds without plain text creds we have other options like hashes and tickets. But I mean there's nothing quite like good old plain text passwords right. Every red teamer needs to use some sort of credential harvesting tooling in their red team operations. This is because in order to achieve our objectives we do need to steal credentials and make our way to some level of escalated privileges to complete our objectives. Now modern defenses have caught on to this trend and made life harder for real world attackers and consequently red teamers. But overall of course this is a good thing we want this to be hard because we don't want it to be easy for the real world bad guys. So certain techniques that have been used are extensive signatures itself for the credential harvesting tools. So you now know that Defender does very very well against Mimikatz and by Mimikatz I mean just the word Mimikatz. You can have the word Mimikatz in a harmless program and it would still be detected as malicious which I have no complaints against. It is a good thing because nothing legitimate comes out of anything called Mimikatz but this is a strategy that they've chosen to go with and I respect that. So a few other techniques that we have seen being used are user-learn API hooking. So specific APIs like read process memory and sometimes open process on the LSAS process itself have proven to be suspicious or detectable by a certain EDR vendors. And of course there is protective processes light which is an OS level mitigation. Alex INSku has a great blog post series on PPL if you're interested to get into the details and internals. So what is API hooking? Think of it as a man in the middle attack by the EDR product as you can see in the image main.exe is using the create remote thread API call but this API call is hooked. So what actually happens under the hood is that there's a jump instruction that hijacks the execution flow and this jump instruction takes the flow of execution to the process space. The process space of the EDR and its DLL. So once it's in the process space of that DLL it will then perform its checks, it will look at the function call, it will look at the arguments, it will see if the parameters are safe. If it's fine then it decides that execution can assume, if it deems it as suspicious then it will either generate an alert or outright block it. Certain other techniques that have been publicly documented are unhooking these userland API hooks using direct access calls to NTDLL.dll. So what we want to do here is that we want to use the very same hooked API calls but we want to use the underlying NTDLL function call with the help of syscalls in ASM. So in order to do this you first need to resolve the syscalls from NTDLL and then jump directly to the NTDLL call. Another alternative that is publicly documented is getting creative with certain Win32 APIs. For example the PSS Capture Snapshot API. This API takes the, this function takes the snapshot of the LSAS process and what happens is you can then use the mini dump write dump function on the snapshot of LSAS instead of LSAS itself. So you're essentially creating a copy and performing all your malicious activity on the copy and not the original. So this tends to evade certain detections that rely on your getting a handle on LSAS and reading the process memory of LSAS itself. So in some occasions you'll also see LSAS running as PPL. This is something that you can observe from the registry key. This registry key is run as PPL as you can see in the image.  So something like MimiDRV.Sys which is the kernel driver which is created by the creator of MimiGats. And if the vulnerable driver is unsigned then you would need to use the vulnerable driver to first disable driver signing enforcement, then load your driver and then dump credentials. There's a lot more to this talk but it's outside this, there's a lot more to this topic, I'm sorry, but it's outside the scope of this talk and the timeframe of this talk. But typically loading drivers on production environments is deemed risky and if you want to do this then you should request permission beforehand because ultimately we are a red team, we are not the real adversary, we don't want to cause blue screens of death on production environments and as an attacker of course the concept of offense in depth is important to us because we need to know different techniques to achieve the same goals because if one technique does not work or if one technique has been patched then you should have the knowledge of different ways to achieve the same result. Which finally brings us to being a red teamer in 2020 and how this has changed in the past few years. So to begin with the training landscape for red teaming is ever changing, there are very few courses out there, there are a few good ones of course and that number is slowly growing but most of the mainstream courses have little or no focus on skills that will enable you to walk into a red team role and like pentest roles as well there's the catch-22 of red team roles requiring experience and you needing a job in order to get experience in the first place so what is the best advice I would give to myself if I had to do it all over again? I would very very strongly recommend watching Rafael Maju's red team operations video series I mentioned earlier that this is a nine-part video series, it's based on Cobalt Strike but it will teach you the fundamentals of red team trade craft and most red team roles will require you to fully understand the ins and out of Cobalt Strike anyway so it's a win-win, the best part is that it's free and there are two such series that I strongly recommend one is the red team operations as I mentioned and the other is the in-memory evasion video series which talks about some of the features that Beacon has recently implemented which help with keeping it upset safe in memory so once you're familiar with a mature C2 framework, I would recommend that you build your own from scratch a very basic one, it doesn't have to be something sophisticated but building one yourself will go a long way in helping you understand the integrities of implants and C2 frameworks and Rastlamaus has a very informative video series on the development of Sharp C2 that is currently ongoing and I've seen that Rastlamaus is very regularly posting videos to this playlist I would also strongly recommend reading through Dominic Chell's post on learnings from a decade of red teaming he talks about what he has learned in an entire decade of red teaming and there's some very useful insight for someone who's been around for over a decade and definitely give that one a read also watch Will Burge's talk on red teaming, sorry if I butchered your last name this is a very informative talk, it pushed the envelope in favour of red teams very, very significantly and the three pillars of EDR that I kept mentioning throughout the talk are something that Will's talk has also addressed also you would want to master every attack vector on the Active Directory so for that there's no better place than going to HarmJoy's blogs and Tweets and also Biotec's Tweets and ADSecurity.org which is a fantastic resource for all things AD and security learn about process injection, you can typically do this for free because there are plenty of resources out there but I have been made aware of a course by Pentester Academy and it's being taught by Pavel Jocifovich himself which is going to be a very promising course and that's something that I might look at taking up as well I also want to mention that I'm not paid to sponsor any of these trainings or any of these materials, this is an independent and unbiased recommendation and lastly learn how to set up your C2 infra then automate it for speed and efficiency you can use Terraform, Ansible, there are plenty of ways there's a lot of DevOps influence on recent C2 infra deployment and a lot of people have found very innovative ways to do this so keep an eye out, keep reading, never stop learning so a huge shout out to the people who made their research public and pushed the envelope to improve security this is the short list and I'm quite confident that there are a lot more out there who have contributed and thank you all for all your work and image credits of the A12 Archangel and SR71 to the good people at Langley right, so now I'll open the floor for questions please post all your questions on the Discord server thank you all once again for watching my talk feel free to reach out to me on Twitter and have a nice day


Your Excellencies ladies and gentlemen welcome to the Banyan Tree Leadership Forum at CSIS. Thank you for joining us for this important presentation today My name is Ernie Bauer. I'm the senior advisor and director of the Southeast Asia program here as well as our brand new Pacific partners initiative. I Lead that program with my colleague Dr. Mike Green and it's the first program at a major Washington, DC think tank Focused exclusively on Australia, New Zealand and the Pacific Island countries We're honored to have on hand one of the people who inspired us to initiate that new program here as our honored speaker today Assistant Secretary of State for East Asia in the Pacific Kurt Campbell Kurt. Thanks for joining us We're lucky to have Kurt with us today He's leaving for Auckland, New Zealand to help the largest to help lead the largest ever United States delegation to the Pacific Islands Forum And I hope as a fellow rugby player and avid fan that he's got a ticket for the all blacks Tonga game that kicks off the 2011 Rugby World Cup in Auckland this Friday Kurt has been a leader as you know of US policy In Southeast Asia and Asia in the Asia Pacific generally during his tenure at the State Department His strategic thinking coupled with his intense commitment and high energy Have combined to deliver impressive results His leadership on a proactive and engaged US foreign policy is well known both here in the United States in the United States And certainly across Asia, and I think you'll agree that Kurt's actions Speak louder than any words I could use to introduce him today. So without further ado, I'd like you to join me in welcoming our guest speaker today the Honourable Kurt Campbell Thank you very much Ernie, and it's great to see so many friends in the audience and very grateful to be back at CSIS I want to say how pleased we are that this program is underway the work that Ernie that John Hamery That my green and others have done to advance not only our thinking and understanding of the developments in Asia But particularly the work on Southeast Asia and now on the Pacific and Australia New Zealand. I think helps complement the concept of a totality in terms of our comprehensive approach to the Asian Pacific region in which countries like India Even in Latin America are playing a larger role in this dynamic region today I'm here to talk to you about the Pacific and one of the things that you find when you talk about the Asia Pacific Many friends in the Pacific will tell you that in that Shorthand it is the second word that gets short shrift that there is enormous focus on Asia, but not enough focus on the Pacific and One of the things that we have tried to do over the course of the last few years is do a comprehensive assessment almost an accounting of where we stand in the Asian Pacific region in the Pacific and Think about what we need to do in terms of going forward. I had the great good fortune in the summer of traveling on a Multi-agency trip throughout the Pacific in which we hit ten islands in about a week and a half Led by Admiral Walsh our very able sink-pack fleet, but also with friends from USAID and the Department of Defense as well I think it would be fair to say that what we have found over the course of the last couple of years is a two-fold Set of truths one is the United States continues to have enduring strategic political Moral interests in the Pacific they date back to before The Second World War and they will continue and they endure I think the second thing that at least I have discovered personally is a general Disappointment with the lack of performance on the part of the United States and indeed other countries in terms of implementing our overall game plan in The Pacific and a deep recognition that we need to do better and we need to better work together in terms of Ensuring greater coordination on a variety of issues But also reflect more honestly about what some of the nature of the challenges are that we are facing in the Pacific as a whole So what I thought I would do is give you kind of our overall assessment of what we find as we look at the Pacific and then try to Give you a glimpse of what our strategy is going forward what we want to achieve What we think some of the inhibitions are of success some of the challenges that we face and sort of the overall Recognition of some of the limitations both in terms of resources and also obviously an extraordinarily full foreign policy National security Agenda so I think we began if you look over the course of the last 20 years a fairly dramatic scene-setter Reduction in US assistance cutting back on our diplomatic outposts in the Pacific Consolidation around a couple of key islands challenges in terms of Democracy and the stability of Governments in the Pacific if you look at the Pacific many respects the the the hinge the the overall transportation Economic links Basically are built around Fiji with the developments and Fiji has made it very difficult to do the kind of Consequential coordination that we would like to see I think we've also seen a Lack of coordination among some of the key countries who have interests in in the Pacific clearly The Pacific is in the backyard of Australia in New Zealand I think it would be fair to say until recently we had not done enough coordination with our allies and friends And we had not done enough to support them in their important endeavors in the Pacific But it does not end there obviously Japan China Taiwan the EU the international finance financial institutions the multilateral development banks all have Extraordinarily developed programs in the Pacific and in fact if you look at the Pacific and its challenges enormous poverty Extraordinarily acute health challenges a number of problems associated with the environment If you if you think about climate change the Pacific really is the canary in the coal mine If you travel to the Pacific particularly low-lying atolls it is Immediately recognizable some of the effects on their lives and livelihoods One of the things that we have seen generally is that compared to other very challenged places around the globe The Pacific actually has a Remarkably high level of assistance that is coming in either directly from the United States government Some of our monies go through a different mechanism what are called our Compacts with countries that we have enduring security and political relations Given our relationship in quadriland and Micronesia and the like but also from all these various different Countries all of which have bilateral interests in the Pacific as a whole so we see an environment of just enormous Challenges spanning every aspect of life energy costs are higher in the Pacific than almost any place on the planet at the same time remarkably little systematic use of recyclable And other energy technologies Health problems, which are acute which have led many Islanders to leave their homes to seek treatment elsewhere a set of challenges associated with Braindrain that are immediately recognizable from any country in Africa or throughout the third world And so as we as we scan that environment one of the things that was also clear on this most recent trip It is that if you go to any of the capital buildings more Recent Structures you will see black and white pictures of earlier periods of American and other engagement in which we had remarkably more resources to bring to bear But at the same time it is possible to glimpse shall we say the the The legacy sometimes rotting in harbors Over a period of 30 or 40 years there have been several efforts to try to bring new patrol boats for instance To the Pacific this is the largest oceanic domain on the planet Millions of miles some of the most important areas with regard to fisheries Some of these fisheries are still Relatively pristine they are in They're at risk. They're at risk of being overfished due to Large trawlers coming in illegally into into coastal waters We have seen a variety of major projects That frankly over the course of the last 30 40 years have failed for a variety of reasons And so when we took stock we tried to think carefully about how you use Scarce resources, how can you be effective given the nature of the challenges that we're facing? And how can we build on our strengths by an order of magnitude? We are still the most important security player in the Asian Pacific region in terms of our Our Navy and our Air Force and also the role of our Coast Guard that plays a remarkably an innovative Role in the Pacific as a whole so our overall game plan is Is Along these lines first we sought to really learn from the past To look carefully at what we had done in the past see where had it had been effective But also recognize that there have been many failed attempts Both in terms of improving health indicators But also in terms of for instance maritime domain awareness and the ability for these very small island nations to patrol Vast areas of water so how to think constructively about again limited resources Enormous challenges. I think the first thing that we recognized was a need for a substantial institutional Engagement across a range of both bilateral and multilateral arenas the first was a decision that Raj Shah and Secretary Clinton made To reintroduce us a ID back to the Pacific now you could say well, that's a modest thing But it's enormously important to our friends in the Pacific and it is important all the more so Given the fact that we are under enormous budget Challenges the fact that with the support of key players on Capitol Hill There has been a consequential decision to go back to the Pacific and to focus carefully on a range of issues focused on a couple of key areas climate change The role of women and girls and of course some enduring enduring problems On the health agenda going forward and so we're proud of that. It's a modest first step but again within the larger backdrop of Substantial cuts. I hope friends understand The important nature of this and what we have found is how many countries particularly Australia New Zealand and other friends in Asia have said how much they want to coordinate and cooperate with us And so our goal is to work with other nations other like-minded and other countries to ensure that our Assistance is better coordinated going forward. So that's the first part of what we might call institutional re-engagement The second is that the Pacific also has a range of Institutions the most important of which is called the Pacific Island Forum One of things I did not mention mention at the outset is that what's also immediately Available to anyone who spends time in the Pacific is the enormous Differences across these islands different cultures languages different approaches and so they resist and Frankly somewhat resent the sense that they are Thought of as just being all alike as Pacific Island nations And so we've sought as we engage in Institutions like the Pacific Island Forum to work not only as part of a larger group But also have important bilateral interactions particularly with the Key Island nations As Ernie was gracious enough to indicate actually as I leave this afternoon I'll be going as part of Deputy Secretary Nides's largest delegation ever on the part of the United States to the Pacific Island Forum We'll send about 40 people there from almost every important agency the State Department the Coast Guard the Department of Defense US forces USAID Interior Department Virtually every the White House virtually every agency inside the US government that has a role in How to think about the Pacific will be sending senior representatives and we will all be Under Deputy Secretary Nides's leadership and I look forward to helping represent the United States as part of this very substantial delegation I just want to underscore here what what the contrast is six years ago during the Pacific Island Forum We had two people there. All right, and so this is really a Determination to suggest that we want to bring more resources to bear, but more importantly we want to coordinate Inside our government the other issue that we found as we went through the Pacific is that we just discovered Programs and other initiatives that we had no idea were underway, right? And so when we talk about the Pacific as a whole we think one of the most important things that could be done is A greater degree of what we might call donor or assistance coordination When we think about that our first way of thinking about it is along the lines of making sure that countries like China and Taiwan and Japan and France and the EU and Australia and New Zealand the United States are coordinated More effectively together that is absolutely essential and one of the things that Kevin Rudd did in Karn Cons I always pronounce that incorrectly apologize three years ago was to put in place an initiative Which is designed to improve our overall coordination, but that's not enough We actually need to be able to be more effectively coordinated within our own government to actually Understand what these disparate programs do and what they're responsible for fact of the matter is unlike many places around the world The Interior Department is responsible for much of what we do in the Pacific not the Department of State And so what we've sought to do over the course of the last couple of years is improve our coordination and understanding of what each of our institutions do in the Pacific as a whole and so we think that there is Enormous potential at this is not one of those places where there is a substantial gap in resources In fact, if you look at the collective whole it is extraordinarily substantial The challenge is a better degree of coordination and that coordination has been remarkably difficult Ironically not only within our government, but with other Governments as a whole, but we've seen some progress in recent in the recent period We've also been struck frankly as you travel through the Pacific there are new Indicators of changes in the sort of geopolitical context in almost every Capital there are large new buildings many of the in stadiums mean many of them built either by China or Taiwan Over the course of the last several years more recently almost all by China What's striking is that they all not only indicate China's interest In the Pacific which we support and we recognize that this is a natural thing and in fact We welcome a closer dialogue with China on the Pacific and we want to work with Chinese friends in this regard But we have to think carefully about how we use again scarce resources in one or two of the island nations that we went to We saw magnificent buildings that literally local governments are unable to cool in the summer period or heat when necessary because the The electricity costs energy costs are so high So what we're seeking is a more comprehensive dialogue with the key donor nations about Basically designing approaches that are more relevant and sustainable to Given some of the challenges that we're facing in the Pacific as a whole When we are in When we are in Auckland we will have detailed discussions with virtually every country including China we'll have discussions with our friends in Taiwan with India with Japan with virtually every country who Have strategic interest in the Pacific as a whole the other thing that you will see that we think is Basically a continuation of the past But we want to put an exclamation point on it is there is a recognition that profoundly and deeply this is in Australia New Zealand's backyard Australia New Zealand have been remarkably supportive of us in areas where we Have asked for assistance. This is an area in which their knowledge their proximity mean that they have real Powerful national security and national political interests And so we are seeking to coordinate more closely and frankly to support Australia and New Zealand more on a range of issues through the Pacific and one of things that we have sought to do is to take really very clear and demonstrable steps to improve our Dialogue and coordination on these matters for the United States sake We give very substantial resources as part of our compacts to a number of islands in the Pacific And I think one of the most important things in this current budget season and with this very Intense scrutiny is we need to ensure that those resources are spent and used wisely And we are working closely with governments and also with friends in Capitol Hill Senator Inouye has been an enormous supporter of our Approach to the Pacific but the what we have seen in recent Years is substantial Out migration from some of these islands to the to the Hawaiian Islands And it's put an enormous burden on the infrastructure there and we need to think carefully about what can be done So that that we can maintain a Pacific in the balance as a whole I think there's also a recognition recognition that with scarce resources, but the new Potential uses of technology that the Pacific frankly is ripe for innovation One of the most innovative things that we've seen that was implemented by the Coast Guard and come up with by a Very junior person is this idea of what is called the ship rider agreement, which is if a National law enforcement national from a particular island nation is riding on an American ship Either Coast Guard or Navy then if we Come across In illegal Fisher fishermen then then that We will be able to work under a legal framework to take appropriate steps to put in place You know legal consequences fines and the like that has Enabled us to work much more closely with the range of the island nations to improve Our ability to patrol these vast areas of space We're also working Again using technology developed elsewhere in the Gulf To improve maritime domain awareness. It is no longer feasible to have Large navies in these small island nations what we need is a much greater sense of where the challenges are so you can vector Small numbers of ships and resources to particular places where you think there might be illegal fishing or Problems associated with transshipment of people you name it some of the things that we Send we we see in the Pacific region as a as a whole We also want to look very carefully at what I would call targeted initiatives. We've made clear To Chinese friends that we want to highlight areas where the United States and China are seen to be working closely together We recognize that when we talk about building trust you have to build it piece by piece together And so that requires the United States and China to identify clear areas whether it's energy efficiency or mangrove planting where our two countries can be seen To work together for a greater good in terms of the well-being of the lives of the people of the Pacific as a whole We want to take consequential steps over the course of the next few months To demonstrate our desire to secure the tuna treaty the tuna treaty has been one of the most important Treaties that helps regulate really what is the last healthy? pod of tuna in the world and it is at some risk now We want to communicate very very clearly to the signatories the strong American commitment To see that remain in force and I want it to be clear And we'll make it clear when we're in Auckland of our strong determination to take necessary steps and we want a Reciprocal approach from some of the key countries who are involved in this overall effort There are a number of places as you thought you fly through the Pacific and I'll just give you this contrast if you if you wouldn't mind All of you or many of you have been to Europe and have gone to these wonderfully pristine World War II battlefields these you know Manicured lawns remember the opening scene of of saving private Ryan just just you know in which everything is perfect You know wonderful marble columns depicting how various columns and pincers movements played out You fly through the Pacific and what you are struck with is is if Unbelievable carnage and killing and then what was done people got on planes and boats and left you can find Rusted tanks in almost every place where wars were fought during the Second World War unexploded ordinance enormously chilling reminders of war when we were on When we were visiting Tarawa Beach Again, one of the greatest scenes of heroism in our history To see it you know covered in in garbage and not tended to in the way Frankly we should it was heartbreaking, but at the same time when we asked our friends Do you ever find unexploded ordinance? I think that was mistaken by our our host Can you find us some unexploded ordinance and within about five minutes? They brought shells and we're like just just put them down. We'll move away, but we have found some resources we want to work with our friends in the Pacific and Other countries to put back in place some unexploded ordinance initiatives that will assist every year There are tragedies associated with this and we think this is an important Legacy issue that the United States has to be engaged with we're looking closely at At the Peace Corps the Peace Corps has substantially downgraded its capabilities and its resources in the Pacific But we think we have some opportunities here Every place we go every place we went in the Pacific the leaders of every one of these island nations would say first of all Cannot tell how much we appreciate the Peace Corps for those countries that still had programs and for those countries that no longer had them The first question was that is there anything that we can do to get them back? Clearly Intensity of storms due to climate change and other things are picking up We need to work more closely with a variety of countries on disaster relief Not just what we do once they happen, but preparing in advance This will be a subject of some of our discussions in Auckland over the course of the next couple of days and also Obviously taking whatever steps possible to deal with this remarkable set of challenges associated with energy again More sunlight than basically anywhere else on the planet Less use of renewable energy than almost any other place on the planet. So the challenges are stark they are Troublesome But we believe fundamentally that that a continued effort on the part of the United States Working closely with friends and others who share an interest in the Pacific that we can make a difference the key here Also, and I'd like to conclude with this is that look we're in a very difficult period Domestically lots of fighting about a lot of issues But one of the things that we can be grateful for over a period of decades is that we've had a relative commitment to bipartisanship In terms of what we've done in Asia and the Pacific I'm joined here by a very dear Finn Torkel Patterson when he was in government there was nothing more I like to do than to support him same with Mike Green what we need to do is to sustain That overall commitment to so no matter who the baton is handed to in the future That there is a recognition that these issues are profoundly deeply in the national security Political moral and strategic interests of the United States. I recognize that I've skipped over a lot of things But I want to leave time for questions. Thank you all for coming and I'll look forward to reporting back Through Ernie and others what we what we accomplished when we're out in Auckland. I think I'll take my questions from there That's all. Thank you very much. Thank you very much Thank you very much Kurt really appreciate that tour of US strategy in the Pacific Appreciate you're taking some questions. Let me just remind everyone we welcome your questions, but please Identify yourself and your Affiliation when you do so, I think I'll stand up so I don't leave these guys out first question right here You will not will say haja money, but we are firmly safeguarded its national core interests So I wonder whether you have any comments. I Haven't had a chance yet. I look forward to reading the white paper actually on the long flights over I will say generally speaking that I think that Our administration previous administrations have made very clear that it is in the strategic interest of both of our countries to maintain strong healthy relations we want to see a China that plays a Strong positive role in global politics. I think we welcome deeper engagement on a range of issues political security Economic as a whole. I think it is also the case that particularly with respect to security issues We seek to step up the dialogue between our two sides and also We believe that a degree of transparency is a healthy thing in terms of Reassuring and communicating clearly Intentions and aspirations, but overall I think we're pleased with the progress in US-China relations And we welcome the publication of this document. We go over here to Stanley wrong Polynesia Polynesia and New Caledonia an issue in terms of how the other islands view us policy Thank You Stanley, and I appreciate very much the question and the the reference In almost every place that we went that I've gone in the Pacific The issue of the colonial role of not of France, but other countries does come up We've had good discussions with French friends about various aspects of our engagement in the Pacific I think these issues are less complicated now because of the Different set of priorities taken by a succession of French governments on nuclear matters And we look forward to consultations with them for instance when we sit down over the course of the next couple dates in Auckland In the back gentlemen here Riley Sice and the Australian National University. Thank You Kurt. I think there's a very welcome Development and thanks to CSIS as well for their related focus on the Pacific which is well overdue My question is how realistic is the idea of development cooperation with nations like China? Amongst others given that as you alluded to a lot of the Chinese aid in the Pacific is is really not developmental in nature It's prestige projects, and it has a strategic dimension Of course the copper the competition with Taiwan is another big issue So, you know the idea that you will cooperate with China sounds sounds Terrific There's also the basic problem that for a lot of Pacific governments the having a range of donors Competing with each other has has been very useful over the years because they've got a lot of money out of it So could you address that issue? Well first of all, thank you very much for the question Let me say that if you look at almost every area of Success in which the international community has been Consequentially engaged in either a development or an assistance project. You see a high degree of coordination and integration That coordination integration is generally absent in the Pacific and so I believe that ultimately It is in the best interest of the Pacific peoples of their governments and of the donors as a whole to work more comprehensively together on sector approaches on Looking carefully at what's worked and what has not worked and also a recognition that you know prestige projects and the like only Goes so far There are a number of areas where the United States and China have been able to work together in Southeast Asia and Elsewhere and I have high confidence that if we take this in a sustained and committed way that working and it Won't be just with China. It will be with Japan with South Korea that we will be able to find areas that we can work together And that we can demonstrate success And and I believe at a fundamental level that that there is much basis for For coordination and I don't believe that there is that much frankly to compete over Overall, there are a few islands that have some substantial resources But basically what you have in the Pacific is a series of very difficult and practical problems that sometimes Newcomers to the region find out sooner or later. So it's up to us to see how we can work together To bring again limited resources in a way that that are designed for the betterment of the people and frankly There is a lot of waste and there is a lot of misuse that with a more effective approach I think with that that we can at least improve Thank you. John San with CTI TV of Taiwan. Mr. Secretary, I have an issue you may find very hard to work with China could you Update us on the deliberation or decision on F-16 sales to Taiwan the clock is is clicking and The deadline October 1st deadline said by Secretary Clinton is fast approaching. Thank you Thank you for your question I think as you well know and you probably can repeat my line directly back to me the United States has a National interest in maintaining peace and stability across the Taiwan Strait. We take those interests very seriously we are committed to Taiwan's defense and we support The Taiwan Relations Act and We frankly have been very pleased by the positive developments that we've seen over the course of the last Few years across the Taiwan Strait. We'd like that to continue on specifics. I'm afraid I can't Provide anything further, but thanks for the question Thank you from Voice of America About the democratization process in the Asia Pacific region. We have that US special envoy Mr. Derek Misha is on the way to Obama and Do you expect that it can deliver the message to the army's government to better time with the United States? Or and any how do you assess that? Development inside Obama that you visited last year First of all, thank you very much again for the question It's a little further afield from the Pacific, but I'll but I'll take this on first of all very grateful that Derek Mitchell has the chance to travel. This is his first visit as our special envoy for for Burma We're looking forward to his deliberations inside country and frankly I'm just as anxious as you are to see what his reports are as he emerges from his meetings I believe he'll be having Consequential interactions with both members of the government and also on song sushi and also representatives from the ethnic groups I don't think I'd like to characterize any further. I'd like to frankly hear what Derek has to say. I will say that we have seen some steps in the last A few days that We intend to explore Thank you. Well, thank you secretary Tiger John from the Stimson Center. I have two short questions. Our first one is the What do you see the strategic relationship between the systematic? Re-engagement with the Pacific and the US re-engagement with Southeast Asia in terms of the US general policy towards Asia and the second question is given the budget cut and bipolar Fight in the Congress. What kind of hurdles or struggles? Do you expect in their support for future programs, especially USAID? Thank you. Thank you very much the excellent questions I I would say One of the things that I am finding As I as I you know consult and talk with friends on Capitol Hill and also allies is I think there is a welcome recognition that our future and Frankly much of the history of the 21st century is going to be written in the Asian Pacific region and the United States has an Incredibly important role to play in that and I think one of the great challenges of American foreign policy and national security is How we carefully and responsibly? Rebalance Tom Donnellan her national security advisor has talked about rebalancing We have enduring security interests political interests in Europe and particularly the Middle East But clearly we will need a deeper more sustained engagement not just bilaterally not just with new Friends like Indonesia in India a strong dialogue with China But one of things that we have not talked about which is really a commitment to institutions in Asia and Pacific That's the reason that we talked about the Pacific Island forum in November And I expect Ernie and CSIS will have a session about this later. The United States as you know We'll be Joining the East Asia summit for the first time. We will be holding another of our series of us ASEAN summits This is will be our third in the last few years There are a number of consequential steps that we want to take within these Multilateral frameworks with the recognition that if Asia is to play its role it needs stronger institutions with deeper roots and the United States wants to support that and See what's possible over the course the next few years with the recognition that this process will take a substantial period of time But just to conclude where you began I believe that there will be a strong bipartisan commitment To a stronger US presence in the Asian Pacific region and I am Quite I believe in that and I'm intent on on seeing that come to pass Who is Phoenix TV? Hi my question is it was reported us in the end Japan are going to have a trilateral meeting next month and you will Be the leader of the delegation for the US Could you please confirm this report and what is your Assessment and how significance is the trilateral relation among us Japan India? Well, well Let me just answer the question more generally So I would say that obviously at the at the heart of our relationship Are our bilateral security ties and we have sought to follow on the strong work that President Bush Presidents before him have done to keep those relationships the center the core of what we've Sought to do in addition as I indicated these more formal multilateral engagements Recharging a pack the East Asia East Asia summit extraordinarily important One of the other things that again have we've seen over the course of the last few years Is the rise of what one might describe as many lateralism smaller? ad hoc groupings of nations that are designed to tackle particular problems or to increase Dialogue or consultations. So for instance when we were in Bali We had a very consequential meeting between the United States Japan and South Korea We want to actually establish a secretariat that will help Support the recurring Preparation for those sessions and we've sought other sorts of trilateral engagements and other larger scale efforts It is our larger goal to do what we can to draw Indian more into the Asia Pacific region To get them to have successful engagements in multilateral for to play An important role in the trade strategic economic Interactions in the region as a whole and to work more closely in the diplomatic context I'm not going to comment directly About the specifics, but we have said that we want to improve coordination between Japan the United States and India I will conclude by saying on this issue that we have had very detailed discussions With Chinese friends about their involvement in a number of these institutions and we've given them a number of proposals We'd like very much for Chinese friends to engage in some of these settings because we think that they will help build trust and confidence We think that they will help us to Tackle common problems transnational challenges and the like and we think that they send an important message of reassurance In a region that is looking to see that the United States and China understand Our responsibilities in terms of demonstrating an ability to work together on important problems Take one last question Thank you secretary. I'm gaining with voice of Vietnamese Americans Would you Comment about the current posture of China in the South China Sea How would that affect your initiative in the Pacific? Thank you. I'm well Let me just edit at a general level the the way the United States thinks about Maritime related issues is obviously freedom of navigations freedom of the seas maintenance of peace and stability These are all Enduring core values in terms of how the United States sees our role as a whole I think we were pleased at the first step that was taken in advance of the ASEAN regional forum in terms of the understanding that was reached between ASEAN and China I think Secretary Clinton said it's the first step, but only a first step. We'd like to see some Consequential diplomacy that will follow on from that Hopefully improve trust and confidence in the South China Sea there's a recognition that these issues must be handled carefully and That by some measures, you know a third of Global commerce Places through the South China Sea. This is already An issue of deep international concern and we want All issues to be handled With a cool head and a strong strategic sense Okay, thank you very much Kurt before I close Let me remind you and I guess this backs backs up Kurt's assertion that on Friday September 9th We'll be hosting the US Armed Services ranking member Adam Smith of Washington State Congressman Adam Smith for a policy address entitled America's commitment to Asia and he's going to be talking about how Congress views the role of our Armed services in the region and that shifting of balance that that you talked about Kurt's I hope you'll you'll all join us on on Friday Can we thank Ernie also for the great work that he and CSIS has done if we could? Well, I want to I want you to I want to ask you to join me in thanking Kurt Campbell for his His great leadership. Thank you