Testing. Howdy. How are you all doing? I am David Mainer and we are here to talk about bringing sexy back. However, if you're expecting to see Justin Timberlake, I am sorely disappointing you. You'll just have to see me topless, which I think will be just as good. So, if you don't know me, my name is David Mainer and I'm with a small company out of Atlanta called Arata Security. And this gentleman to my right is Robert Graham, he's the CEO. And Rob's famous for a lot of things like inventing IPS. That's pretty much about it. But what we're going to be talking about today is we as a company do a lot of pen testing and we don't do traditional pen testing because that's kind of boring. Everybody runs your vulnerability scanner that gets kind of old and repetitive and there's actually no real return on investment there. So we actually always seem to end up with clients that want weird custom things done. We're going to talk about two of the custom things we've done. But before, I have a question.  Has anybody been rejected by a hooker today? You know, we got more hands for that one. That's kind of good. So without further ado, I'm going to turn this over to Rob and I'm going to heckle him. If you can help me heckle Rob, that would be great. So what this talk is about is getting creative with pen tests. First of all, I want to mention the fact that pen tests in general are supposed to be boring. So Dave and I used to work for Internet Security Systems before they were bought out by IBM and ISS did a lot of pen tests. That's a nasty rumor by the way. There's no actual proof we ever worked for Internet Security Systems. So ISS would also have the X-Force Group, which is well known for finding zero-day vulnerabilities. So everyone assumed that ISS would use their ODes on pen tests. But the reality is that ISS never did. Because the point of a pen test is not to see if I can pop you with ODes, which in most cases everyone sort of accepts that's true. The point of a pen test is to say, are my defenses adequate for the likely sort of attacks I'm likely to get? So for most corporations, their likely attacks are from script kiddies or from this well-honed industry of fishing and script kiddies and crawlers coming against their sites. So the tests that most pen testers do are very simple.  And that's the height of the threats that most corporations are going to be affected with. Now one of the interesting things we've noticed is that anytime you do a pen test, you know the first time you want to figure out anything, you just put it in the Google, right? Googling your client should be part of a pen test, but I have yet to see any reports that actually include it. Just like finding out everything that Google has indexed from your client is a lot easier than trying to find everything manually. As you've seen from Giant Lawn's talks and things like that, you can actually find a lot of interesting things just from Google. So that's the kind of stuff we're going to be talking about, weird and interesting things. So the next question is when creativity is good. And that is for the small subset of customers that realize that they're not just under attack from your standard script kiddies, but they've actually got serious people that are motivated to get them. And really they fall into two primary categories. One is financial firms, Wall Street firms. They've got a lot of money, hackers are trying to get it. The other is government agencies. Everyone in the world outside the United States and actually inside the United States too, when they go to bed at night dreaming about who am I going to attack tomorrow, they're dreaming about the Department of Defense. I dream about sending Margolis. So that's when creativity is good is the more fearful organizations that got reason to fear that they fear a well-funded determined adversary. So one thing we've looked at for a lot of our customers over the years of if you want to have a guaranteed return on investment, imagine that you're a venture capitalist firm, but you're not funding venture capital startups in Silicon Valley, you're funding Russian crime bosses to go after American financial firm to hack. So how much would it cost for a Russian crime boss to hack an American corporation? We estimate that would probably be about a million dollars. They would hire a few hackers, they would spend a year scanning the site, reverse engineering their applications and doing lots of strange things. And over that year they would gradually work their way into the network and then find things like, if we grab a million dollars or a hundred million dollars from this company, how do we avoid tripping financial controls? A good example of this is a French firm recently in the last six months is one of their traders was previously involved in setting up their financial controls to detect massive amounts of money are being transferred illegally. Since he worked on that system, when he became a financial trader himself, he nearly bankrupted the company, losing billions of dollars trading things that he wasn't supposed to. Now he wasn't trying to steal the money, as it turns out he had just made some bad trades and then kept doing more trades to try to recover and get back to his original position. We are all here in Vegas, so we know how that is, we lose ten bucks. Well, if I keep playing, maybe I'll win that ten dollars back, and go twenty down, hundred down, thousand down, ten thousand down, and now I have to walk home instead of driving. So this guy had bypassed the internal controls. So that's the sort of thing you need to start thinking about from creative attacks, is if I'm a well-funded adversary and I'm trying to emulate a well-funded adversary against a corporation, I need to start thinking creatively. As a disclaimer for this slide, we're not singling out Russian crime lords. It's also where it's the Brazilian crime lords, Japanese crime lords, Indonesian crime lords, if there is such a thing. So one of our ideas that we came up with that we've used is iPhone in the box. And that was sort of the impotence for the title for the talk. What's the title of the talk? Getting Sexy Back? Unfortunately, Dave Maynard here is the Justin Timberlake fan, and so I'm not really up on Justin Timberlake as Dave is. But Justin Timberlake did a sketch for Saturday Night Live, I know last year and Christmas are two years ago, which sounds like iPhone in the box. So the idea is simple. You get a box, you put your iPhone in the box, and you mail the box. In case you were wondering, this idea literally came from a drunken night while watching that Justin Timberlake video. So step one, you have to get a box. We use the original iPhone box because if you're shipping an iPhone and an iPhone box, that doesn't really look all that suspicious. So it's the perfect size for everything because under the little plastic tray that the iPhone comes in, there's all this space, and you know what would fit perfectly in that space is a battery. So this is all the material we used. That's the iPhone box, that's the iPhone itself, and that is the APC battery, and we have one actually right here on stage. Unfortunately, due to a mishap, we don't have ours, but we were able to borrow rich moguls, so we're going to have to do something bad to it before we give it back to them. So Dave did a lot of work to get his iPhone, actually my iPhone, packaged up. And before he took the flight here, we fed exit to the hotel here. It arrived fine, was carried up to his room, then showed it to a bunch of reporters. And then this morning Dave wants to bring the box here. He wants to bring the box here for the presentation, which was the whole point, and he leaves it in the cab. So somewhere somebody's enjoying a...  And the sad part about that is it's my iPhone, not his. This is his iPhone. So let's talk about some interesting things. That APC battery that we're talking about on a standard, not to 3G, because the 3G sucks battery life like crazy, but on a standard iPhone we found out with it fully charged, and with the battery fully charged, you put it in the box and send it somewhere, it can stay on for about five days, which means you have about five days to scan and do basically whatever you want from the iPhone, which is enough to fed exit overnight somewhere, let it sit in somebody's receiving facility, let them figure out that there's no one there named Jack Mioff, then have them send it back. So, so far we've always returned, gotten the iPhone back and it's still running. An iPhone? Yeah, ours is lost in the cab, so. And it's in the original, was it UPS or FedEx? So actually what we're worried about now is somebody's going to look at that and see there's an iPhone with a battery and think it's a bomb. So if you guys see a bomb scare tonight, don't tell anyone it was us. Let's just keep it between us. And one of the things we haven't done yet, I'm kind of disappointed Dave lost the box, because I wanted to see what it looks like through an X-ray machine. So my first thought was, okay, I'm going to carry it through the X-ray machine and take a picture of the X-ray as it goes through to see if it looks like a bomb. Then I thought the better of it in thinking that Dave should do that. So as a little back history, last year we were at a conference and Rob was reading a paper in Seattle and he said that you have to get tased now in the state of Washington to buy a taser. He goes, you know what we should do? We should have a poll on our website to see which one of us gets tased. Knowing full well I was going to lose, so I ended up getting tased. So basically when it comes to Rata and things where you can almost get arrested or more than likely, I seem to end up getting the short end of the stick. So by the way, just as an offside, is that this APC battery pack, I've never really heard much news about it, but it's very light and it really lasts actually a fairly long time. We're being sponsored by APC. No, we're not. So this is actually really cool. If you're thinking about using mobile devices to hack with, this is actually a fairly useful device to have with you. It's great because it charges via USB and you know the other end of the iPhone is just USB so you plug in and you're ready to go. No soldering, no hacking required. This could be almost script kitty hardware hacking. So it just got USB in and USB out and it rocks. So since we don't have the box to show you, here's the original picture of the box and as you can see it's got a nice little slot to hold up the iPhone and underneath it it's got a great place to put the iPhone. It needs a little bit of cardboard hacking to actually cut a hole in it so that you can fit in all the cables in. So here's pictures of Dave taking his box and cardboard hacking and here you can see the little... We actually had to end up cutting a slit right there so the battery and the cables and everything would fit but when you put the top of the box back on it looks just like a regular box. And that's it running. So one of the things you have to do is when the phone goes into auto lock mode like a lot of the interactive stuff you have running on it will stop running. So we recommend that you turn off auto lock and make sure it doesn't automatically power off. And fortunately iPhone is shipped to you as a mobile device so Apple is very concerned about powering off as often as it can to avoid sucking down all the battery but we want to use it as a free BSD machine and so we had to actually turn off all these wonderful nice user features that Apple has just to make the free BSD stuff work. So this is the gayest picture of me ever taking. This is my thinker post. If you actually look at some ads for some gay bars here in Las Vegas you'll find that this is not the gayest picture of David ever taken. This was my audition photo for Thunder Down Under. So after you do this and if you work for Apple or their law firm please cover your ears. The first thing you have to do is jailbreak the iPhone. I assume everybody here has a jailbroken iPhone. So after that you saw the SSH and BSD subsystems and I've gotten a lot of flack like this week already from Max Zellitz they're like oh my god why are you doing this with an iPhone you can do this with any phone. Well it's actually really hard to do with a Windows Mobile phone because Windows Mobile doesn't have a Unix-like interface right underneath it. So I suppose you could do it with a Symbian but if you've ever tried to use that SDK it'd be better just to do it with the iPhone. So for disclaimer purposes you can pretty much do this with any device that has both a network connection to something like AT&T and a Wi-Fi connection. It's just a lot easier with the iPhone. Dave's notebook, like this notebook right here has an HSDPA connection built into it so in theory you can do the same thing with this notebook and ship it to a customer. Because I don't trust the Wi-Fi network here and I hope you don't either. But it's a lot heavier, it costs a lot more to ship and it's not quite as sexy.  For example we use the AP logger to keep the Wi-Fi interface going otherwise the Apple software wants to turn it off. So we want to have TCP dump running like capturing all the packets all the Wi-Fi raw packets. We also have to do a little bit more custom stuff. One of the problems we have is the SSH daemon is you can't actually SSH to an iPhone across the Internet because AT&T's network has firewalls that block all incoming connections. We also have the problem of not knowing exactly what the IP address of the iPhone is. So and there's also issues it's not always actually on when it's flying in the airplane going from FedEx facility to like the hotel or something the Internet connectivity is not on. Now we like to point out that our device is not on while a plane is flying because that would be illegal according to the FAA. So we have an application that uses the accelerometer to detect when it's going faster. Just for FAA purposes. So we just set up a cron job and we just have a cron to a little reflecting app we've got that simply takes an incoming TCP connection and reflects it on back so that we have SSH into the reflector. You can use Netcat probably for this. We do actually. I assumed you wrote something, okay. So you SSH into the reflector. You can tell when someone gets into management they're like, you know, I just assume we do this and I just assume we do that.  Now there's two things that we like to do. That's Farah and Metasploit. Farah is the tool that I wrote last year and I've given presentations at at Black Hat and stuff. It pulls down all sorts of information that notebooks are leaking. So if you sniff right now on the Wi-Fi coming here you'll find out lots of information about people they're broadcasting about themselves, such as their names. So there's lots of people here that think that they're hackers evading the FBI or something, they're coming incognito but then their Apple MacBook is saying it's broadcasting out saying that this is John Smith's computer. So the FBI just listens on the Wi-Fi and they know everyone is here. And the last access point they connected to was John's secret layer. So in our Ferret tool we found out that all sorts of corporate machines are leaking the same information. So that's a great tool to run on the iPhone because you're sniffing the raw packets from the Wi-Fi packet. So imagine a corporation that's done the right thing for pen testing and they have no access points that we can access. We can still listen in on these notebook broadcasts and find out a lot about the corporation. One of the biggest things we found is that they go through most computers go through a list of all the previous access points that they've gone to. So you can map out for example where the sales guys have gone. If the CEO has gone to like Microsoft and logged on to their Microsoft internal corporate network access points then you know if they've been to Microsoft and why is the CEO going to Microsoft maybe they're getting bought out. Or if the CEO has gone to DEF CON. So that's one tool that we find that is great for doing a site survey, finding out a lot about the internal corporation even before we start thinking about hacking access points. Of course now the main thing we want to send the iPhone for is to find out does the company have open access points. And if they do we're going to log on to them and then we're going to start hacking with other tools. One tool for example that we like a lot is Metasploit. Metasploit's awesome. One of the cool things, Dave's added lots of codes like Wi-Fi fuzzing to Metasploit. One of the cool things we found we tried to do this with the latest 3G iPhone but it sucks battery so it actually doesn't work as well. So it'll go from running from 5 days to about a day and a half which means by the time FedEx delivers it it's bad. So as a side note one of the interesting things we've noticed about this and we've tried this with DHL with UPS and with FedEx, internally all these companies they seem to have a lot of access points that are not locked down. So as your package is traversing this carrier company you could do really bad things to a carrier company. Yeah, it's sort of the inadvertent pen testing. Yes, we wouldn't actually do that because that would be unethical. But one thing we found is that... We shy away from unethical. When you grab the latest iPhone stuff, the latest jailbreak stuff and all the little tools and stuff you can actually download a Metasploit package for it. I don't know, did you try it and see if it ran? Yeah, no it runs. You get the little move banner. That's my favorite Metasploit startup banner. Now let's hear what your own favorite Metasploit startup banner is. No? No one? Alright, well... So once again we're back to gay pictures of me. So actually wait... So strangely if you're ever in Atlanta that's a really good Thai restaurant, nah. So as you can see this picture the picture on the side is the finished version. And as you can tell, if you were looking at it it doesn't look any different than you had just bought an iPhone. In fact, we told everybody at all the stores where we set FedExium or... So you can't FedEx from a UPS store but we told everybody we were shipping them from that somebody had won an eBay auction and we were sending them an iPhone. You know, we didn't need to tell them that. It just felt like, you know, people were staring at you you feel weird and you want to tell them why you're doing this. And we're hacking your network didn't seem like a good idea. So I don't know if you've noticed this. I've actually lost a lot of weight. 250 pounds and now I'm down to 205. That tells you how long we've been doing this. Although I'm wearing almost the exact same outfit. I washed my clothes I swear. So another thing we've been working with is... There's something more stuff. So the thing that we found out about this is when it gets to a receiving facility somewhere it will just sit there for a while. So people will accept... I don't know if you've ever worked in a mail room or seen how a mail room works or anything like that but generally like when UPS, FedEx or DHL comes to the company you'll get a whole lot of packages. You'll sign for them all and then somebody will sit and sort through them all.  We've got to send this back. You know, return to sender. There's no one that's ever worked here. While that package is sitting there in their mail room generally which has an access point generally for nothing more than the symbol technology for meters, for inventory control systems and things like that you can then connect to the iPhone and use the Wi-Fi interface to start scanning for different types of packets. You can associate to the access point or you can just basically start collecting data you can use to crack passwords with tools like K and Able and things like that.  Right, so something like this would completely bypass your DLP system and allow us to grab credit cards while it's sitting in your mail room. There's a point of cell terminal close to your mail room. So the other thing that this really comes in handy with and I don't know if anyone here has ever done it but if you ever talk to a SCADA guy or somebody who runs like SCADA systems they get very uppity about security. Like we have guys with guns. We can get near our wireless access points. We'll have them shot. It's like does a FedEx guy come in? Oh yeah, he comes in every day at 10 a.m. Well that's that then. I was talking to a reporter about one of the benefits of this is that you don't have to sit outside in your car and be typing on your laptop, which is very suspicious. And the reporter said, yeah, that he actually has been detained by the police before because when he writes stories he often sits outside in a car typing on a laptop in a place where the police come by and says that guy doing that, it's suspicious, let's detain him. So doing this means that you don't have to get arrested for being physically close to your target. Another thing is from a pen testing point of view it's much cheaper. Pen testers are part of pen test engagement. They'll negotiate with us and say, hey, we want you to come by five different sites in the United States and do a site audit, a pen test. I don't mean a wireless pen test. Well, it costs us a day of travel time from there and back that we have to build a customer plus a couple hours on site, which kind of sucks. So doing this. Especially when you're going to a place like Wisconsin. I don't mean to offend anybody if anybody here is from Wisconsin. You see what I mean? And so, of course, when we do that that's the sort of boring part of the pen test so that's the job I delegate to David.  He doesn't want to do that so he figures out he doesn't have to go. But thinking about from a point of view of hacking if the site gets this and they figure out, hey, this is actually probably something hostile. Maybe the x-ray and think it looks like a bomber. They pull it open and say, why do we have a running iPhone? So one of the questions we have is anonymity. How maybe they want to track back who sent them this, this hostile device. And well, since you've already jailbroken the iPhone it means you can put in pretty much any sim you want which means you can go to Czechoslovakia get a prepaid phone there, pull out the sims to get in your iPhone and it'll be perfectly anonymous so that you sent an iPhone to a site and there's no clear backtracking back to the person who sent it. Unless, of course, you get a picture taken at the FedEx or Kinko's location you sent it to in which case you should smile. So the software for this is going to be released open source. We're trying to set up a repository right now where you can just hit one button and have your iPhone on a go. But if you check our website next week the software should be up. It would be up right now if we had the iPhone but some cabby right now I'm sure has the power to take down the CIA. You know what's funny is I was thinking about that we should actually just set up a listener and wait for it. Unfortunately our listeners back at home when we were here at DEF CON. Like I said, Epic fail. Epic fail. We also think unfortunately we didn't have the email client set up so we can't email like naked pictures promising the cabby things if he brings the phone back to us. We do have a young new bio intern that we were offering up in exchange for the iPhone. So the original iPhone doesn't have very good GPS. It's got that cell tower, locational crappy stuff where you can find it within 400 meters. If you walk out on the street and look around 400 meters how many cabs are there?  So the second thing we did is we came across a client it was like hey you know we've had people do these penetration tests before we never get anything out of it and we've done some studies 80% of the malware that we get in our network comes from secretaries and I'm not being derogatory. Secretaries clicking on things. So they wanted to see how you could test phishing without actually you know being phished. So basically what we did was set up a VMware image you know Linux you know basically a lamp set up with a fake website on it and do you know how easy it is to get certificates to make your fake website look authentic? Rob how easy is it? So that's a couple slides from here. Oh I'm sorry I'm getting ahead of ourselves. So one thing is that, well it's talking to a reporter and he was saying you know like with this Dan Kaminsky thing that one of the things Can we get a hand for Dan Kaminsky and the DNS thing? That was pretty awesome wasn't it? Wait did anybody use that to do anything bad or malicious? For good things. So Dan's stuff, the reporter was saying how and one of the things that Dan mentioned is that this yet again shows some of the weaknesses with SSL because of course when you're spoofing these websites you're sending things back through to the wrong website and SSL really doesn't really help you all that much. And that was one of the points he made about our talk too is that this yet again shows some of the weaknesses of SSL it doesn't quite work as well as we thought. The way that SSL works is that a certificate authority like VeriSign verifies that you are who you say you are. So we've got certificates from a rat of security and so VeriSign verifies that we are actually rat of security. And the way they do that is they go and do a done in Bradstreet report.  So it's kind of like Equifax for companies. And it's really kind of simple as if you can afford the $395 you're probably legitimate and not living out of your grandmother's basement. Like Chris Glass.  We're also sponsored by VeriSign. Or another like thought or something. So now that you're a legitimate company so that when people go to rat security to their SSL that will have a nice little padlock icon that says this connection is now trusted and people will tend to trust that. Interactive S-control is signed. And so you apply it to spearfishing. Spearfishing is the idea of you target somebody like an internal corporation. So instead of broadcasting out to everyone in the world you get a mailing list of let's say every public mailing email address for a corporation. Or you can send an iPhone to their shipping department and then enumerate all the user names on the windows domain. So that's spearfishing. But when you do a phishing attack you'll often send it back to a website that is fundamentally untrustworthy. And the SSL will tell you at this site you can't trust do you want to continue. Now phishing works because enough people will continue that you get to break in. This is a true story. Everybody in here has ever heard a story like this where some guy is very indignant and they're like I would never download malware. Like really? Would your secretary? And then they go oh. I mean that happens to us generally on a daily basis. Now having been an executive at a security company we quickly realized that the secretaries are not security knowledgeable. You think that for an average security company imagine a five-man consulting company they've got a secretary and she still does not know anything about security. So SSL gives you a warning but people ignore the warning. But imagine that you train people to pay attention to that warning. If you go through this process you'll get no warning and people will trust you. So one question about this I put a larger number here for creating a real company is that it comes back to you so you'll get caught if you're actually doing this maliciously. That's why you date a lawyer and have her do it. Or him depending on who you are. Dave dates a lawyer. I won't divulge whether it's him or her. So one thing you do for a company of those you can anonymize it. You hire a lawyer who will then act as the officer of the corporation your one-man corporation and you'll have a nice full board of directors of other lawyers in the law firm and they now are the public face of your company and people can't really easily penetrate that. Now law enforcement can law enforcement can give a warrant but actually for the average private investigator or normal investigator they can't penetrate the corporation and find out who you are within your one-man corporation. So a lot of people actually do this. For example I own a home but my home is not owned by Robert Graham it's owned by my corporation. A corporation that exists solely just to own the home. And I do that for privacy reasons so people can't look up in the county's assessor's office and look at my social security number and see what's the tax ID of the corporation. Doesn't due diligence just sound dirty? So you might want to anonymize the company so people can't find out who actually you are. So between one and two thousand dollars you enter the system of trust the circle of trust. We've all seen that movie Meet the Parents where the XCI agent is like, you know, grilling his new son-in-law or soon to be son-in-law in the circle of trust. And you're on Ben Stiller. So for about two thousand dollars for two thousand dollars you now enter the circle of trust. You now become the man and all the other of the men trust you as the man. And now you're on the inside and now all your SSL is good all your ActiveX is good. So basically you know the secret handshake and you have a key to the executive washroom. Now there are some ways to do it cheaper if you don't want to spend seven hundred dollars for an ActiveX control signing key you can actually steal someone else's ActiveX control. There have been a number of ActiveX controls in the last couple years that you can actually serve them from your own website. You can serve a Flash ActiveX, you can serve other stuff from your website that people will then run on their computers. And it's vulnerable, it's signed by a well-known corporation but it's vulnerable and you can hack into it. A lot of ActiveX controls we bought we actually make a tool and we make it available for free called ActSpan a little bit bad ActiveX controls we know about and a lot of the bad ActiveX controls we've tested don't check to see where it's instantiated from. So you could literally host it on your own site. A good example is a recent one about three months ago I think the HP Infocenter ActiveX control and it was part of HP Laptop so if you have an HP Laptop you had this ActiveX control. Don't worry Dale, Toshiba and Sony all have similar issues. Luckily Apple doesn't though they don't have security issues. I've been told that by lawyers.  And it's signed by Hewlett Packard Corporation which everyone trusts. Hewlett Packard is good. So now imagine a more advanced spear phishing attack is first of all you get an email address list which you can Google you get a large list you can also do other stuff and then you've got your email addresses. Now you spoof an email address from HR at whatever corp that you're hacking and then you have a message saying we've now changed 401K providers now you need to go to this new website and log in with your corporate credentials and you'd better do it before the next paycheck cycle otherwise you won't get your deduction done correctly and you won't get your matching 401K money. Also be very careful to follow IT security guidelines we remind you again that you should check the padlock to make sure that you've got secure SSL connection and that no one's been spoofing your man and then if you're the man though you have a trusted SSL connection you have a nice little padlock and they'll come to your website and it looks like a nice corporate IT website a nice touch outsourced IT website and then they log on with their corporate credentials a nice touch is on your fake website you set up under the news section write an article about how whatever corporation you're targeting has just partnered with this company to provide their 401K services that always looks legitimate now I've worked with companies now for a long time that send out these emails that look just like this I used to get them at ISS we used to get them at ISS I.S.S. changed their 401K provider and they told us to go out and log on to this website basically the email they have right here how many people have received emails like this saying go to an outsourced provider for HR stuff and log on with your credentials well that's more people that have sex with a prostitute in Vegas this time so that's a fair number of people here that their own corporations have essentially phished them now it was a legitimate thing to do I mean they send out saying go to this website and give your credentials but that's indistinguishable from phishing and so the second thing we then add once we've got their corporate credentials is add the ActiveX control to it and saying okay now to actually change your 401K you need to run this ActiveX control what's funny is the ActiveX control is presented as a security feature to enhance the security so what we'll actually find out is people will say yes install the ActiveX control then they'll get to the part where they have to put in their credentials and they're like ha ha fuck off Fisher and you're like it doesn't really matter you even install the ActiveX control at that point you're owned so we'll just take your credentials it doesn't matter so the upside is is that phishing attacks are actually pretty darn lame I mean I follow phishing attacks so I don't have an account at B of A so I'll gladly click on a link to B of A website to enter in some credentials because I know it's not B of A but I know they're not my credentials that's actually how I end up with most of my identity fraud is Rob puts in my credentials so you wake up in the morning find out someone spent $2,800 in Guatemala you're like what the hell I've never been to Guatemala and what's polio so but when I go to those sites I can tell that they're not secure I mean they're going through a botnet that's got spamming all those IP addresses everywhere SSL does not work and they're pretty well done visually they look like B of A or whatever and they look very good server-side includes are your friends for this kind of stuff but when it says bankofamerica.foo.tk or something you know it's not really dot defconn.org you know it's not actually Bank of America but with this we were going to like you know in our example we told them go to erraticorp because erraticorp is now we're outsourcing our 401k to it so they see erraticorp.com and according to SSL it's actually the certificate it's actually the name of the email you know it all looks legitimate the most important part of this entire process aside from the depressed release is you have to come up with a catchy slogan for the fake company like erraticorp we're watching your money and then you can laugh every time you own somebody because you really are watching their money but it's also one of those things if you go to these outsourced HR human resources websites they always have a bunch of you know very well looking good looking people in suits shaking hands with each other nobody from this room stock file photography yeah so it's stock photography and it's amazing how when you see two people wearing suits it's kind of like the SSL analogy when you see people wearing suits you automatically trust them if you see people wearing chagrabara t-shirts you tend not to want to give them your money so that's the logical equivalent of what we're doing here is for a certain amount of money you now have the cyber equivalent of a suit and people trust you so the continuing rods point you can actually google stock photography you can buy all that stuff to make your site look legitimate for like a buck if you're missing on the iPhone the box we've also done some other stuff it's actually pretty boring but we find it interesting one financial firm used an ActiveX control to provide security to their site so we reverse engineered the ActiveX control and we found out that they had secrets embedded that they assumed no one would be able to reverse engineer that we were then able to use to help get into their site reverse engineer who does that only a legal hacker kind of people there was another customer they had a software application that would update itself via FTP and we just put a sniffer on the wire to watch the software application and it would just FTP to an FTP site it would give a secret password that only they knew in clear text of course and it would then look for a newer version of the software just by the date on doing the FTP date on the directory listing that's a security application and it was a security application by the way so we logged so getting the password from stiffing we then logged on to the FTP server and found that that directory was read writeable anybody want to own a security company now you guys have all laughed because you've immediately made the connection I write a new version of the software it's my hostel software and every one of those client applications downloads and updates themselves with my software it took you a millisecond to figure that out for yourself this company actually took a while for them for us to really prove that yes this could happen this way are you sure it's bad I mean it's FTP it's pretty safe the results of that were kind of fun but using sniffers is pretty basic and it's pretty common best quote ever out of that story is do you know what the best thing to do to resolve this is let's just not tell anybody what are you Apple ooh I hit an Apple joke somewhere Steve Jobs is plotting to take your money so thank you very much so the conclusion is is that pen testing today is pretty boring I know how many people here have done pen test or worked on pen test but they're pretty boring because the customer fundamentally doesn't want you to do exciting things so one thing that Dave and I get to do is we get to find the customers that want us to actually stretch our wings a little bit and actually have fun with the pen test so we actually enjoy pen test quite a lot so do we have any questions comments suggestions does anybody here have an iPhone in a box that they recently found in a cab it's not eBay thank you very much thank you for attending our boring talk


This 2019 Volkswagen Atlas SEL is stock number 21J177B. We're here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used SUV headquarters. This 2019 Volkswagen Atlas has the 3.6-liter V6 engine, Pumpsau 276 horsepower. This vehicle has been fully-safetyed and inspected by our service shop per the state of Wisconsin. The inspection process has a fresh oil and filter change. All the fluids have been checked and topped off, and this vehicle is 100% ready to go. We're going to go inside, outside, around, and under the hood on this vehicle. We'll start it up. In this video, Torma Line Blue is the color. We shoot all of our videos in 1080p, 60 frames per second, so if you have HD capabilities on your computer tablet, smartphone, or television, I highly recommend turning them on right now because it is your best way to check out the quality, condition, and options on the vehicle. If you like the video and want to subscribe to our YouTube channel, where we do videos of our new and used inventory each and every day, and the upper right hand part of the screen is a link to subscribe to our channel. Click that, and then click the bell notifications, you'll get updates every single day. Comes with the 20-inch painted alloy rims, no scuffs or scrapes on them, and it has Continental Cross Contact LX Sport 25550R20 tires. These tires have right around half the tread left on them. Front fender is in excellent condition, I didn't see any dents or dings on there. This one has the LED headlamps, LED running lights, and the factory fog lights, front bumper parking sensors. The bumper itself is in excellent shape, I didn't see any dents, dings, or cracks or major scuffs on there, and you do get the nice chrome-trimmed grille on the atlas. The hood is in nice shape as well. And the passenger side front fender, no major dents or dings on there, looks really good. And the passenger side rim, no major scuffs or scrapes. Take a look at this tourmaline blue, metallic, it's got a lot of metal flake in it, it looks really good. And as you go down this side of the vehicle, take note of how clean the body is, how reflective and mirror-like that paint is. We take these HD videos, so if you are far away, or even if you're close by and just cannot make the trip down, but you're still interested in purchasing the vehicle, you can see the vehicle, hear the vehicle, and have confidence in what you're looking at before you even get here. So when you do get here, there's absolutely no surprises, and you can make a smart and informed buying decision from wherever you're at. And if this video helps you make a decision, let your salesmen know that you saw the video, liked the video, and that it helped you out, and that Brett sent you. Back rim is in excellent shape, and the back tires have just about as much tread as the front tires. Coming around to the back of the vehicle, you'll notice that it does have the towing package, the dual rear exhaust, the rear bumper parking sensors, receiver hitch, and seven pin wiring. The tailgate is in excellent condition on this vehicle as well, and you can see that it is a four motion all wheel drive vehicle. Has the power liftgate that lifts up nicely. Back storage area is in excellent condition.  Then you just grab the strap to lift them back up. To get this gate down, you just press this button right here, and it'll come down like so. LED license plate lights, and as we come around the driver's side, just as clean as I pass under side, no dents or dings on the rear quarter, and for full disclosure, this back rim is in excellent condition as well. Down the rest of this side looks really good, does have blind spot monitoring, built-in directional signals in the mirrors.  Both of these front seats are heated, no rips or tears on the seat. Does have memory driver's seat, lumbar, and factory Atlas all-weather floor mats. Tilt telescopic steering wheel, you get auto headlamps, power windows, power locks, power mirrors, heated mirrors, and a nice wood grain trim on the doors as well. We'll hop inside, turn the ignition on, check out the miles, information center, and everything that comes with this vehicle. We will be putting some fuel in this vehicle right after this video. I think we got to start it up to see the miles on this one. You get your miles per hour there, digital speedometer, compass, temperature display, distance, travel time, range, fuel economy, all that good stuff on there as well. I think you got to turn it off to see the miles. So there are your miles, 43,558 on here, you get the neat Atlas animation on there as well. Under wrap steering wheel, your adaptive cruise control, audio controls on the left, and information center controls on the right. Comes with the factory navigation system, AM, FM radio, can change your bands there. It does have Sirius XM as well. This is where your backup camera shows up to. And down here are your heated seats and climate controls. You also have a heated steering wheel, start-stop capabilities, AUG's in a USB jack down there, automatic transmission. You have your different terrain settings right here, so snow, highway, mountain, and mountain with a star. Not sure what that is. Heal us entry with your remote start on there, passenger side format. And seat are in excellent condition, no rips or tears on them. It does have the power sunroof, and it is a Vista roof, so it has the sunshade on there. You can see that it has the full glass roof there. That works nicely. Up here you get your SOS and homelink buttons for your garage door security systems and line systems. Right there, SOS buttons, that's your sunshade controls and sunroof controls are right there. Auto dimming rear view mirror. We'll take a quick look at the back seats and then we'll start it up and take a look under the hood. We'll also check out all those LED headlamps and running lights. Second row quad seating. Get the latch child safety system back here, no rips or tears on these seats. Factory all-weather floor mats back here. You do get two USBs, rear air controls, and it does come with a 115-volt plug-in down there as well. Carpettings in nice shape, no rips or tears on that. And these seats do fold down, and the third row seats are in excellent condition as well. And to get these seats back up, you do need two hands once they go into the flat mode right there. Anyways, let me pause it, I'll get it back up in the... To get to the third row seats, you've got to grab this handle right there, and that seat will actually slide forward like so. Third row seats, no rips or tears back there. Very nice and clean. And to get these seats back, you've just got to grab that handle like so. They do slide back like that. And then these seats also go down completely flat. You just have to do that with that lever right there, and you'll see that it goes down completely flat. Now that locks into place, so I've got to have two hands to get it back up, but you can see how that works there. The other cool thing is that this one has the sun shades for the second row, which is very nice if you have people riding with you a lot. Child safety locks on the back doors and the bottoms of the doors all look really good. We'll start it up and take a quick look under the hood. So other than the hood and door being open, no check engine lights or anything like that, I did want to show you the backup camera as well, and that is working nicely. And we'll take a quick look under the hood. Volkswagen's very nice about letting you know that the engine is running. There are your LED running lights. They look really good. Like I said, we'll turn those headlights on in just a second, too. Under the hood, we have the 3.6 liter V6 engine. Engine bay is very clean, runs very smooth. Once again, this Volkswagen has been fully safety and inspected by our service shop, has a fresh oil and filter change. All the fluids have been checked and topped off. There's your emission sticker.  And as promised, I'll turn those lights on for you. See those LED headlamps are very bright. The headlights are working nicely. And this Atlas is 100% ready to go. I would highly recommend this vehicle from a quality and condition standpoint. And to see more pictures of this vehicle, or one of our other 450 new and used cars, trucks, SUVs, minivans, Wranglers, you name it, we got to go to that website right there, www.SummitAuto.com. Full pictures and descriptions of every single vehicle from two locations all at Summit Auto.com. And if you'd like to check out more HD videos, you can go to YouTube.com slash Summit Auto. Remember to like, subscribe, and share on this video and all the videos that you see there. Click the bell notifications. You'll get updates on the videos we do each and every day here at Summit Auto. In fact, in a second, you will see a link to subscribe to our YouTube channel in the upper left. A link to more Volkswagen and Atlas videos like this one in the upper right. A link to this vehicle on our website in the lower left. And a link to one of our latest YouTube videos in the lower right. Click those, check us out. And we're super excited to help you with this Ultra Clean 2019 Volkswagen Atlas SEL 4-Motion 4-Wheel Drive in Tormaline Blue Metallic. Thanks again for checking out the video. Remember to like, subscribe, and share.


In this episode, we'll be talking about how service design can drive business innovation. We'll talk about how we can use computer-based tools to assist in the design of better services and finally, how can we measure and evaluate the impact we actually have on the user experience. Here's the guests for this episode. Let the show begin. Hello, I'm Yongse Kim. This is a service design show. Hi, I'm Mark and welcome to a new episode of the service design show. This show is all about helping you to design services that have a positive impact on people and are good for business. My guest in this episode is a former Stanford University graduate. He has a long history in regards to design and creativity. He is a service design professor at the Shenzhen One University in Korea. His name is Yongse Kim. In this episode, we'll be talking about how service design can drive business innovation. We'll talk about how we can use computer-based tools to assist in the design of better services and we'll talk about how we can measure and evaluate the impact we have on the actual user experience. We post new videos every week here on this channel. So if you haven't done it already, be sure to subscribe and click that bell icon so you'll be notified when new videos are out. And if you'd like to learn how to explain service design in plain English, check out the free course that I've got for you by heading to servicedesignshow.com. So that's all for the introduction and now let's quickly jump into the interview with Yongse. Welcome to the show, Yongse. OK, thank you for inviting me. It is my great pleasure to join your show. Cool. I'm really excited to have you on. You're the first one from Korea on the show. I hope a lot more guests will follow. You've been in the design, the creative, the innovation field for so long, way before design thinking and service design became the popular terms. We'll talk about that in a second. But do you remember your very first memory of service design? When did you get in touch with the term? OK, I think I mean, specifically what I recall is probably I heard about service design informally without recognizing much. But specifically when I attended a conference in Paris, 2007, that is a design society conference. And I watched the presentation by a team, a team. Professor McCallone is at TU Denmark. And they talked about their research project on product services systems. So that's where I first encountered. I think if I kind of trace down. So they were doing the nice product services system design project there. So, OK, so how the in comparison to product design, how the service design component, which is relatively new, should be developed kind of an interest to me. So that's how I started. I've noticed that product service systems is really a term that lives in academia. I see it here in TU Deloft and TU Eindhoven. That's the term they usually use for service design related stuff. Right. Product system, products, product services. Exactly. Yeah. OK, you sent me three really interesting topics. And of course, I've sent the question starters all the way to Korea. You'll have them. Are you ready to start with the first topic? Yes. OK, let's go. It's here and it's called business innovation and service design. And do you have a question starter that goes along with this one? And can you show it? And I think we need to revise this. OK, I think I would say the. I would pick how much, how much, yeah. OK, how much service design is actually done for business innovation. But that is that would be my question. And before we dive into this topic, this is also some of the title of a book that is just out, right? You've written a book with almost the same title. Yes. Yes. I mean, my book just came out last week is a business innovation service design. So I mean, the it could be just a service design. The title could be just a service design. But I wanted to make some point that the method my service design method is probably more suitable for business innovation rather than yeah, other kind of topics. Yeah, so that was yeah. How much how much is service design focused on business innovation? What's your perspective on that? This this is this probably represent the current Korean situation. I mean, the in Korea, the Tom service design became very, very popular around the 2009, 2010, the kind of a time frame. And every basically every design educators and every design consultancies, they wanted to jump on to the service design wagon. And but looking at the almost the 10 years from now these days in Korea, a lot of a service design project is about social innovation project and related with the government. There are some significant development, the health care service design. But we don't see enough business innovation cases yet. So which is what we regret. And we want to kind of make sure that not only social innovation, but we want to make sure that business innovation is going to be the one of the key target on service designing. So that is some of the intent, how I term my that gave a title for my book. And so that this is the kind of a question, how much and maybe the situation will be different in Europe, maybe different in other countries. But that is the current question that we have in Korea now. That's really interesting because my previous guest was from Colombia and he actually said all the service design work is done in the commercial sector. Almost nothing is happening in the public or the social sector. And you're describing that the situation in Korea is exactly the opposite. Any any ideas? Yeah, to make it clear, I mean, that many of the services and activities are done in commercial sectors as well. Those are newly new services cannot perform as a critical role in kind of a revenue making role. So it is rather used as a supportive activity. Maybe it is used to promote products. Right. Maybe it is used to promote the house sales. OK, but I think the most specific of the revenue creating services could be made. So that is something that I would like to see in the coming days. So that was my point. So so what is what is holding this adoption back? Or if I reformulate this question, what do you think needs to happen to accelerate this adoption of service design for business innovation? I think it requires those the buyers of a service design walk. And then their concept still is related with a kind of a more tangible outcome. They may want to be able to pay for tangible outcomes. So their business issues are still coming from the revenue obtained from the tangible things. So that is one of the key challenges that we have. And it's been there. I mean, it was like that almost 10 years ago, and then it is still not much improved. Even though the government actually tries to make us some help that manufacturing companies to move into servitization, right? But that is very slow compared to the government effort and some of the academia effort. So that is something there is still a really strong manufacturing mindset, a really strong yes, yes, outputs, product oriented mindset that that is driving. A lot of the UX issues, user interface issues for some of those digital services. But it is regarded as not as the key money money making asset. It is something you should do anyway to continue your business. So that is some of the issue that I think we should keep improving. Yeah. And I think a lot of service designers can relate to this challenge. So, you know, how do we help a company which has a strong heritage in manufacturing in a product mindset where the whole organization structures focused around pushing boxes out the door, right? How do you help them to see and adopt a service design to actually create new revenue streams? Well, what did you write about this in your book? Can you give us some insights? How do you have how do you approach conversations with these organizations? I think we may want to identify the user kind of a behavior and experience more tightly so that through that we can develop some the new the service based revenue opportunities. And in my book and then the another book, which may come hopefully soon, we kind of identify service concepts along some kind of different stages. And then that kind of the method could help to see how more obvious service concepts like, for example, the commodity sales and then the maintenance, the services to which could enhance more the user behavior oriented the services which could lead into the new revenue making. So we are developing that kind of a method and then trying to apply that with some companies. I guess one of the hardest things that I see with manufacturing oriented companies is they if they start investing in a new venture, they want to have it replace existing streams of revenue. But it's really hard to replace a product revenue stream with a service revenue stream. It's yeah, it's a big challenge. If I know you've gotten this question a lot lately, but the book is written right now in Korean. And we talked about this before the show. Do you expect that an English based version will come out any day soon? I don't know. I mean, I mean, that yeah, it I think it may be useful, although I had kind of in the conferences, I've explained my methodologies, but not in its entirety as shown in the book. So but usually I'm very lazy in writing books. It may not be. I mean, it's very difficult to make a promise. But yeah, yeah, I'll I'll try to somehow deliver the content. Maybe not in its entirety. All right. All right. Cool. Let's hope that it comes out. Let's move on to topic number two, because this one is cryptic. And I'm sure you have a really interesting story around this one. And this one topic number two is called representation. And once again, the question to you, do you have a question starter that goes along with this one? I'm really curious representations. Thank you. All right. What if is my choice? And what if you could use representation of customer activities or representation of the product services systems used to develop the new service or to design new product services systems? So how that kind of a representations could be used in supporting service design activities? So that is going to be something that I'm interested in. I I'm struggling to understand representations. What what are you thinking about when you hear the word representations? What? So, for example, I mean, that I would put it in a more like a formal representation or computer based representation. And if you look at the computer aided design, the kind of a history in 1970s, early 1970s, some of those representation of how we represent, for example, this kind of a solid object that research started like a 50 years ago. And then over like 20 or 30 years since then, the CAD systems has been kind of used in most companies, which is used in supporting design creativity, supporting design efficiencies. And I think at some point, the service design field needs that kind of a tool. So it requires how we should represent human activity, which is going to be different from the physical things should be represented in a computer system so that this could be used in designing better activities and better services. So we have developed some of those representations and some of those are the software based design support tools. As a research project, we have not moved that into the commercial product yet. But this is going to be some of the issue on the research community related to the service design may needs to think about. For example, a lot of people talk about digital transformation, but we should also think about the digital transformation of a service design and activity itself. So that is something that I think probably research done about this time is going to be used in maybe in 10 years, in 20 years. So I think some part of our community should be worrying about that. And I would put myself one of those people doing that. So just to see that I really, really understand what you're saying in the same way that we've developed, for instance, tools to model physical objects on a screen, all the cat software in the same way you're thinking about, how can we use computer aided tools to model user experience or model a journey or model? I don't know. Right. That's what you are thinking of. Yeah. And what are your what have you seen that really interests you? Are there any tools out there of which you think, well, this is an interesting starting point for the next 10 or 20 years? Because for me, it's really hard to think about how to model or shape a user or customer experience on a screen. Almost on a screen in a way, but in a computer way, in a digital manner in a way. So we developed what I call the context-based activity modeling, which kinds of the some of the representation language, modeling language for human activities in a more formal sense. And particularly, we emphasize the on the context part and how I mean, they even though it is the same activity by looking at different context, it have a different it's related with the different value things. And so we have that defined and then we have our own computer based tool for that. And actually, we are using that to designing new activities. For example, what if we change the suppose the current activity, the location is outside? But what if we change the current location context inside? And then that is going to be could really lead to improvement of the values. So, yeah, this is a kind of a design support tool is not to replace creativity, but it allows some something that designers can kind of use in generating the creative ideas. Yeah. And so that's something that we are working on. And it's probably it will allow us to test and prototype ideas and concepts much more much faster, right? That that's the whole. Yeah. Yes. And then probably this is something that I always I mean, as a educator at the university, probably this kind of a tool will not make really, really creative designers. But it can help some of the design students who whose creativity level is at this. Maybe through this kind of a tool, it could be kind of improved that way. Right. So, so we are thinking about that kind of issues. And this is about the six p.m. the sun. Yeah, I see the sun. Do you want to close the curtain or is it OK with you? I think that I can rearrange some of those. Or even even I change my position. Yeah. Yeah. That's better. That's better. OK. Yeah. So, a final thought about this. The first while you are describing this with my limited imagination, the first thing that comes to mind mind is, for instance, creating environments and situations in virtual reality or augmented reality and then going through that experience as a simulation of that that journey. Is that also the way you're thinking about these computer aided tools or do you have completely different ideas about that? Yeah, the my computer based the tools are not that fancy yet. OK, in other words, it's not virtual. It's not augmented, but it's about the reality itself. OK, OK. So it is it is a it is a bookkeeping tool. So, for example, it can kind of help the designers to to follow his own designing activities, the kind of a so that his design knowledge could be acquired so that it could be used in designing the new design project. So that is the kind of a tool which does not require the very fancy technology, but it is more about the the bookkeeping it kind of a in a very well structured database systems. So that way you can kind of reuse your knowledge on and on. And I think compared to the product design, the human activity design didn't have much of the the effort emphasizing those issues. And for example, I teach about the issue on affordance and the affordance is, for example, we have this kind of a nice grasping affordance features. But before this feature, what is more important is the human activity of a grasping. So we want to kind of a but in a computer based model, we have a very good way to represent this, but not the activity itself. Right, right. This is something missing in a way. So we want to provide the kind of a complete linkage between human activity and and even these kind of artifact, the physical the properties is super interesting topic that I hope we'll talk much more about on the show in the future. How do we use computer aided design tools to design better experiences? I think that's a really interesting field that we don't know a lot about right now. But yeah, it's good that we're already discussing this. The third and final topic is called experience evaluation. And I'm sure you'll also have a question starter that goes along with this topic. And that is OK. How can we how can we evaluate the user experiences in kind of a more useful way? So that is my question on on this third topic. And what is, of course, your perspective on this? How how do we evaluate user experience?  But how well can we actually evaluate those? The user experience is my question. I mean, the the still, I think many people are relying on surveys. But those people on related areas say, oh, no, no, no. Always the survey doesn't match the reality. So then what would be the better way to understand the customer experience? And before, I mean, the not based on the the the customer's memory, which could be done much more in a real time, but still take that experience evaluation in a digital form so that kind of an experience evaluation is not used as a prototyping the evaluation tool, but it could be used as ongoing stuff. I mean, that you want to kind of provide a new service and evaluate the customer's appearance, even in many cases, the experiences of the service providers are also very important. And it needs to be kept kind of a monitor and then it is going to be used to develop the new service. So it is a kind of an iteration. And my service design process is composed of a value modeling, human activity design, interaction design and experience management. It should kind of a moving. But I don't think if we rely on surveys, if we kind of want to evaluate the the customer experience, maybe two or three days after the experience happened and it is not going to be right. So we need a better tool for that. We need to use more extensively on the experience evaluation. I think that's some of the important issue. Yeah, but this, I would say this would be the golden nugget right now in the design community. If we are sort of able to quantify or show the impact of our work, because that's what we will be able to do if we can actually evaluate the sort of the impact of our activity. So if it's not surveys, if they are not adequate, what are you thinking about? How can we do this? I'm emphasizing the kind of a real time experience evaluation method. So the survey may not be enough. And some of those ways to quickly get the user evaluation input without much hindering their experience itself. This is going to be very challenging issue, though, in a way that the customer experience is going to be represented in a digital format. And so we have developed a little bit, some of the very simple tool for that. And we are using it in many different cases. And some of the new services that we develop for the actual, the real industry manufacturing services and project actually uses that capability as a key service concepts. So more and more effort along that kind of the effort should be done. And also we want to attach a lot of the physical context information with the user evaluation. For example, these days a lot of the IoT sensors are available. And those sensor information is attached with the user subject to evaluation so that we have a better understanding on the user behaviors. Maybe users experiences on very specific value themes. And then this is kind of related with this kind of passive data. And those active data and passive data can be attached to understand better about the users and to be exploited in designing new services. I think this is the kind of technology, not a big technology, but some useful tools which could be developed and which could be used in service designing in many different cases. So you sparked my interest by saying that you have a really easier and simple tool right now to evaluate the experience partially. Can you give what is that? How does it look? How does it work? For example, if you have a trouble with the sleeping, for example, because it is a very hot day, so it is too hot. And then you're kind of very difficult to get that nice sleep. But these days everybody kind of when they go to bed, they kind of, I don't know, when I go to sleep, this is within my reach. Okay. So somehow if you could self-report your sleeping experience, and this could be used to customizing some of the environment which where that you sleep. So we have that kind of a tool developed and it is based on self-report. Right. But in this way, you don't have to worry about the user privacy information. This is the information the user gave on a voluntary basis. And using that, you know, the different preferences of different users which could be used in customizing some of the services that support your sleeping. I really like this way of thinking because it sort of gets to the essence in your example with sleeping, triggered my thought by thinking I'm using a Nest thermostat to control the heating in my house. For instance, if I change the temperature, that's a signal of that the environment or that my experience with the current environment is not optimal, right? When I change the temperature up, then it's probably that I'm feeling cold. And that, of course, this is like a mega simple, over simplified example. But this way of self-reporting and changing, adapting your environment is a way to evaluate the existing experience, right?  So that's what you could get. And then you can get at this particular temperature, in this particular physical context, this particular user said, it's so hot. So that information is the evaluation. So and probably he will just go back to sleep, but without lowering the temperature. But that is the experience report given by the user. And then we want to utilize that information. And it will be, as you said, the challenging part will be how to enable this reporting without sort of interrupting or intruding the existing experience. Yes, yes. So so that way, I mean, without even touching the smartphone, if someone says like that, that means that he is hot. OK. And then it may be good, but it is not there yet. But yeah, this kind of a subjective evaluation given by the user is very valuable information. And if we can take that information at right time in real time, and probably it is going to support that developing a better tool to help the person's sleeping experience. We are we're going to move on to the final part of this episode. And that is I'm going to invite you to ask us a question. Is there something on your mind that you would like to share with us? Ask us a question about. So, for example, I'm in the fourth service designers and how much you'd like to use kind of the. In a kind of a represent your own design experience and design knowledge. Done when you are doing some certain project and accumulate that and how you are going to use it in your in your next project, new project. So, for example, the typically that a lot of the designers are busy dealing with their current activities and but how much reflection you can do so that that information can be compiled so that it is going to be used by the designer themselves or in by the other designers in the same agency or the designers in the community in general. So, so that kind of a design knowledge acquisition, particularly on service design. I would like to ask that to many of the service designers out there busy working on any new project. Yeah, it makes sense because we are doing so much good work, but we share so little about what we do. It's it's challenging to document and share it in a in a way that is maybe not standardized, but at least understood by a larger part of the practice. Yes, yes. That then it is going to be somehow helped to develop a better service design and that is going to help the more business innovation. Exactly. Yeah, we will be able to professionalize our our field much faster. A lot of things to think about a lot of inspiration. So thanks a lot, Jung, to say it was great talking to you. I hope we'll find more people, interesting guests from Korea and learn about what what's going on there. So once more, thanks again for sharing what's on your mind. In this episode, OK, thank you very much. It was my great pleasure to talk with you and then hopefully to talk with a lot of the listeners to your service design. Sure, I would appreciate their comments on my effort and thinking. Thank you very much. All right. If you enjoyed this episode and, you know, someone who might benefit from the things we've just discussed, make sure to grab the link and share that with them. I would really like if you haven't done it already, that you subscribe to the channel so we can keep bringing you more videos like this. Thanks so much for watching. And I look forward to seeing you in the next episode.


Going on everyone, Sam here with Lane Sports Carriageman 23-24 Bowman University Chrome Basketball Delight, 12 box case number eight, Picker Team Style, Names and Teams. Anthony C, USC, Brian S, UNC, David O, UConn, Douglas W, Maryland, Edward P, Texas, Norfolk State and Oklahoma State, Eric M, Auburn, Florida State and Baylor, Garth M, Creighton Gonzaga, Florida, Jacob C, Houston, Jacob J, Michigan State, Jason B, Ohio State, Jeff S, Illinois, Memphis, K State. Jesse C with Arkansas Marquette, Joshua G, Stanford, Justin W, Colorado, Alabama, Michigan, Logan P, Duke, Mike H, Kentucky, Nick P, Indiana, Providence, Weber State, Nick M, Boston College, Pittsburgh, Notre Dame, Patrick K, Oregon, Patrick R, Miami, St. John's FAU, Paul B with Tennessee, Robert S, Arizona, and LSU, Ryan J with Iowa, Ryan E with Purdue, UCLA, and Louisville, S, Han, Iowa State, Thomas K, Kansas, and William H, Villanova, Virginia, Virginia Tech. Guest of Superfracture everybody, going to give you 30 seconds to guess a player on the checklist. If you pull a Super of that player, you will win a break credit. 300 something dollars of it. So good luck everybody. Guess it's starting out. Get him in. Last time today. Fiscianato staying with Fiers. Fiers, I love it. I love it. Love it. Because you know the one time he doesn't guess Fiers, it's going to be Fiers. So I'm in on that, Fiscianato. All right. Three, two, one. Type in guesses are closed. Closed. All right. Good luck here, everybody. Look, we're sold out on the day as well, everybody. So thank you very much. Get a personal resume after group breaks are over. What's up? He doesn't know how to use them anyway. 999 is that color. 150, Filipowski for Duke. 299, DJ Wagner. 399, John Roberts. And 199, Kwame Evans. Ozzie Gullion, Quentin Post. Sean Stewart. Jayden Aikens, Mackenzie Mbackeau, Sharpshooter. Base auto, Zac Eady. I just won there for Purdue. There's a Tom C in there. There's a Tom C personal in there. First refractor to 250, Elijah Martin. First base auto, Dennis Evans for Louisville. And then first yellow auto, Haley Van Lith. 275, for LSU. Yeah, we got some good, uh, good personals in queue for sure. And Tom's got a couple of words, I believe. Is Deshaun Harris-Smith to 199. 299, RJ Jones. 399, Jeremy Fiers. 299, Omaha Billy and 399, Chris Johnson. Refractors, Filipowski, Miro Little, A.J. Hoggard, and Santiago Vescovi to 150. Tennessee. 2199, Rikia Jackson, Lava Auto for Tennessee. To first base auto, Taryn Shannon Jr. going to Illinois. And then first green auto, Isaac McNeely going to Virginia. 299. Huge drive for the passers here. Playing B-Bop. Wow. True red, Bronnie James. One of five. Holy cow, man. Congrats, USC. I think that's going to Anthony. Yes, it is. Anthony C. Congrats, brother. This is also a coffee doll. No, a different name. One of five, True red, Bronnie James. Insane, man. Insane. That is- That's killer. Killer. That's straight to a mag. 199, Scotty Middleton. 399 is Mark Sears. 299 is Aaron Bradshaw. And then Gold Omaha Billiute of 50 for Iowa State. Anthony is going to be a happy individual. I can tell you that. Billingham, Beers, Hopkins, Sharp Shooters, Tyrese Proctor to 150. We've got a laden blocker on the on-card auto. Congrats, Arkansas. There you go, Jesse. First base auto, Jackson Shellstad. Lava auto to 199, Quentin Post. And purple to 399 is Coleman Hawkins. McCulloch to 399. 2199, Jordan McCain. 299, McKayla Williams. 399, Jordan Dingle. And to 100, Devin Roy. That's- It's a big one right there, for sure. True red, Bronnie James, man. Angel Reese, Justin Edwards, R.J. Jones, Ron Holland, Sharp Shooters, that'll be a random. Caleb Love, base auto for Arizona. Refractor, R.J. Jones to 250. And then Dillon Jones, first base auto for Weber State. Now I think the pack were a good bet, because they were getting a ton of points, man. They're driving now, too. Man, if the Niners are knocked out. Zaden Hyde to 399. Xavier Booker to 150. Simeon Welcher to 299. 399, Steele Ventures and 199, Cameron Brink. Shannon Castle, Collier Tyrese Proctor. Base auto, Milan Momsilovic for Iowa State. First refractor auto to 250, Kylan Boswell. And first base auto of Georgia Amor for Votek. Steele Ventures to 399 to 150. Point post, 299, Stefan Castle. 399, Givante Taylor and 199, Tyler Burton. Boswell, Nect, Namari Burnett. And Gerard McCann, McCane, Gerard McCane. Tamari Dell, first base auto for Kansas. First lava auto, Solomon Ball for Yukon. To 199. And then first base auto, Andre Stojakovic. Steele Ventures. Here's your new car accident called Steele Ventures. Turning out log. Jayden Akins to 299. Zachary Rissache, that'll be a random as well. To 399, that'll be a separate random, so we have 2 to do now. Small Sheed to 100. To 199, Trey Norman. And to 299, Devin Williams. Mary Young, Dennis Evans. Momsilovic, Mackenzie Mbaco to 150. For IU. Base auto is Frenny Dillion. Tennessee. To 199, Ryan Kalkbrenner for Creighton. First base auto of Tyrese Proctor. And gold first auto to 50, Boba Miller. Going to Florida State. Now to get that guy some church bands for sure. If I get that baby some church bands, bro. I got my church band, so. Haley Van Lith, 299. 399, Eric Dixon. To 100, Kylan Boswell. To 199, Spencer Jones. To 299, Jamari McDowell. And to 75, AJ Hoggard. Thank you Bob. Hello Ellis. Mookie Cook. Scotty Middleton, we've lost it. I say a colleague of inspiration. First refractor, Rob Dillingham to 250. There you go, Kentucky. Grads on that. First base auto, Scotty Middleton. And then Armando Bacot for UNC. To 99, the insert auto. How did Green Bay didn't score on that? What happened? Green Bay. I knew that was coming. 399, Ellis. To, Bronnie James, 299. Is a Cormac Ryan to 399. To 99, Jeremy Fiers. And to 299 is Riley Kugel. Dramonte Taylor, Tyler Burton, Coleman Hawkins. Paige Becker, Sharpshooter. Got a Bryce Hopkins first base auto to Providence. I missed field goal.  I say a Collier to 199. Congrats USC. I say first base auto, Solomon Ball for UConn. And to 75, Devin Williams for UCLA. I got my church fan song. I got my church fan song. 28 yards from Iook. To 199, Spencer Jones. 399, Jamari McDowell. To 399, Jaden Acons. Johnny Broome to 150. And to 299, AJ Hoggard. Fractures of Dylan Deesu. Paige Becker, Xavier Booker. Big Kahuna, Simeon Welcher. Congrats on that one there, St. John's. Big Kahuna. Got first base auto, a little bit of Quentin Post. For BC. To 199, Stefan Castle for UConn. Got first base auto of Ryan Colkbrenner. And then, Gold Javante Taylor for Memphis. 250. Gold Sean for the church fans on the track list. It's gotta be number one. It's gotta be up there for sure. It's gotta be number one, man. That's gonna be so fierce. That's, come on. 399, Dalton Necht. To 199, Prince of Ligbet. 399, Darren Green, Jr. 150, Dennis Evans. And to 199, Jamal Sheet. Got Peyton Brazil. Simeon Welcher. Rijan Ellis. And an Orange, Big Kahuna, Hailey Van Liff. To 25, for LSU. Congrats on that, LSU. To 250, Cormac Ryan. I say Akala, your first base auto for USC. And then, Green to 99, Myro Little. For Baylor on the color match. This is Chris Conley. My God, what year is it? This is Conley. 399, Ryan Colkbrenner. Kyle Boswell, or Kyle Lynn Boswell. Angel Reist at 399. 299, Leiden Blocker. 399, Tyler Colick. And Dennis Evans, 275. First refractors are Aaron Bradshaw. Hale of Love. Garway Jewel. Riley Kugel, Sharp Shooters. First base auto, Stefan Castle. For Yukon. First base auto, Rikia Jackson. For Tennessee. And then refractor auto to 250, Kyle Filipowski. Congrats on that, Duke. Alright, a couple of randoms to do. We've got the college cards, or non-college cards, and then the Rissache purple. Do this random. So we're going to start with non-collegiate cards. Roll the dice. Whatever team is on top after 11 times, we'll get all of the non-college cards that are not numbered. So 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11. Going to Oregon. Oregon will get the non-college. And the Rissache purple to 399. Rissache purple. Rissache. 4 times 1, 2, 3, and 4. Going to Boston College, Pitt Notre Dame. Alright, quick recap here, everybody. They really have been shady. Not wrong. Kahuna of Simeon and Wiltshire to 99. Jeremy Fears, Isaiah Collier to 75. Dennis Evans, E.J. Hoggard to 50. Omaha Biliu to 25. Haley Van Liff. Base autos, we've got Caleb Love, Zach E.D., Jamari McDowell, Andres Kolyakovich, Milan Momsalovic, Georgia Amor, Jackson Shellstad, Stefan Kassel, Rikia Jackson, Isaiah Collier, Ryan Colkbrenner, Quentin Post, Bryce Hopkins, Solomon Ball, Freddie Dillioni, Tyrese Proctor, Scotty Middleton, Dylan Jones, Taryn Shannon, Dennis Evans, Levin Blocker, Institute 50 now, Kyle Filippowski, Cormac Ryan, Kylan Boswell, Rob Dillingham, R.J. Jones, Elijah Martin to 199, Isaiah Collier, Ryan Colkbrenner, Solomon Ball, Stefan Kassel, Rikia Jackson, Quentin Post, Armando Bacott to 99, Miro Little, Isaac McNeely to 75, Devin Williams, Haley Van Liff, the 50, Boba Miller, Jabonte Taylor, and then how about a true red Brani James to five, one of five, unreal man. That'll do it for the break, everybody. Thanks again for the fill. Up next is...