Good day. I'm Colonel Jerry Morlock, the Director of the Combat Studies Institute. You're about to use a video series which our instructors have prepared for the sole purpose of approving your presentation of M610, the Evolution of Modern Warfare. We've taken care to make the course that you teach as similar to the one taught at Fort Leavenworth as possible and choose to add these tapes to your libraries in order to give you every advantage as you prepare to teach this new course. These tapes are similar to the weekly train-up sessions which we utilize to prepare our instructors here at Fort Leavenworth. My intent for the tape sessions was to provide you insights and tips on ways to approach the lessons of M610 that were not available in the instructor notes. I've drawn various instructors, military and civilian into the sessions based upon their specific expertise and historical background. They were asked to just talk to the lesson structure and content, giving you some additional information on the historical context and differing views on how to approach the lessons. These tapes will provide you a wealth of knowledge and direction that will significantly improve your readiness to teach our new history course. One word of caution regarding how to use these training tapes. They are not designed to be substituted for your instruction during the individual lessons of the course. As instructor preparation tapes train the training material, if you will, they are inappropriate for direct instruction to students and are not intended for that purpose. Our intent with these tapes is to improve your ability to lead the students' seminars by sharing tips and advice from some highly qualified experts. The Combat Studies Institute stands ready to provide whatever additional expertise or assistance that you may require and we've included the institute's phone, mail and email contact information on the tape if you should need it. Good luck with the evolution of the modern warfare course. Have a good time. Hi, my name is Mike Perlman. I teach at CSI Combat Studies Institute. I'm the F College at Fort Leavenworth. Jeff Shadburn, Jerry Brown, and I are going to discuss some of the issues here to lesson 11, the Pacific War. Hopefully you'll get some ideas that you can run with and probably do a better job than any of us ever do when we try to teach this course here, which really wouldn't be a high standard at all. Anyway, I'm going to throw out some questions here to my alleged subject matter experts. We've got here, for instance, you've got these three learning objectives. Analyze the major events in the Pacific War from 1943 to 1945. Let me number one say, I think this is a misprint. The Pacific War for the United States, of course, goes from 1941 from Pearl Harbor to 45 and we're going to focus here on the war as a whole, just not the latter period, which is the period in which the United States goes on the strategic and operational offense. Anyway, on Pearl Harbor Day, or actually before Pearl Harbor Day, the United States Armed Forces has been in staff talks with the British, so at least we have a strategy to be executed after Pearl Harbor Day. It's obviously a contingent strategy. It's to be executed if the United States becomes a belligerent. And essentially, well, subject matter experts, what is the strategy for the Pacific feeder in what is a global war? The first thing is to make sure you focus on the primary threat to the United States, which is what? Which is what? Which means against the Japanese Empire, you're going to have to have a strategic defensive action to ensure that you don't siphon off strength that you're going to use against Germany. Now, what is the war? Well, what's considered the worry in December 1941 if the United States goes on a two-ocean or two-continent offensive war in both directions at the same time? Worst case it, what's the response? I'm not sure what you're getting after that, but worst case scenario is Britain's been knocked out of the war and it's the United States alone. Only Britain? Well, where have we got another attack? France would have been knocked out in the Soviet Union. And the Soviet Union has not done very well in the first six months of their war. In fact, when he's talking about the Soviet Union, they have entered the war at all. So it's an undivided Germany that's conquered Great Britain, France. Well, this is December 1941. The Soviets are on the doors of Moscow. They're on the doors of Leningrad. They've captured Kiev. They're moving in towards, well, not yet towards Stalingrad. They are hanging on by their fingernails. The worry is that if the United States does not reinforce Europe quickly, if it beats Japan, it will then have to turn around and beat Germany with who is allies. The United States is allies? Yeah, well, who will be? Do you want to take on the Germans one-on-one? Absolutely. The United States is the worst case? Absolutely, no allies. So your perfectly sensible solution is what? Is hang on in the continental United States while you build up your combat power to project it into Europe. And what does this mean for operations in the Pacific if for unforeseen circumstances we go to war with Japan? Wouldn't it be, by the way, better if we say did something which would deter Japan? I've got a brilliant idea.  Let's move the fleet from San Diego to Pearl Harbor on the grounds that this will deter the Japanese from moving at all. And therefore we won't have a war because we'll put them in a box.  In fact, as long as we do that, why don't we put some long-range bombers into the Philippines that can reach all the way to Japan? Oh, you mean those B-17s? They can't reach Japan. That's true. They can reach into China. Well, they can reach Formosa, but all this will do. Oh, you guys. You guys are smart as I am, which says something to you. In other words, we won't have to use this stuff. We'll just make sure that they'll be so intimidated that they won't be a threat to America or British vital interests in the Philippines, Singapore, or what's then called the Dutch New Netherlands, which will become Indonesia after the war. Okay, we've agreed and they won't move? No, absolutely not. Japanese won't.  Okay, so then we only really have to worry about this war in Europe. That's a great idea. How do you justify that in light of the fact that for the previous 30 years Plan Orange had been our primary strategic focus? What's this Plan Orange? I haven't heard of anything yet. Well, would you explain what this Plan Orange is? Plan Orange was one of the color plans that had been initiated back under the presidency of Theodore Roosevelt. Not Franklin. No, I said Theodore. Okay. As a contingent for the defense of our interest in the Far East. Which is particularly... Particularly the Philippines. Yes, so it's a hostage rescue plan if the Japanese take the Philippines. And this plan had been worked on for more than 30 years. It had been revised and war-gamed and studied. And everybody considered this to be the most likely scenario until the late 1930s. Well, likely scenario. Or a war in which the United States might become involved. Well, actually the most likely war we're going to have by most Americans is against Mexico. But if we go to war in the Pacific and the Philippines seem to be some sort of hostage it is virtually adjacent to Japanese home waters. They can take it. We have to have a plan to take it back. But by the way, if we put these B-17s in the Philippines in Luzon, Clark Air Force Base, and we move the fleet into Pearl Harbor, I guarantee you the Japanese will be too intimidated. So we don't have to rescue the Philippines. They'll simply quake in their boots. Of course, if I'm wrong, we got some B-17s that will be shot, will to be destroyed, not even getting off the ground. And we're going to have some battleships like the Arizona. Lots of good men are going to be dead. The next thing to look at to make that work is you have to be able to protect what you extend out there to intimidate the Japanese. And what, MacArthur, he predicts that he'll be ready to defend Luzon effectively against the Japanese by the summer of 1942. But before then, the Filipino Army won't be ready. So does this mean the Japanese look upon, obviously, a deterrent to us may look like a threat to them. And they have a window of opportunity to close this threat because if they wait, the Philippines will be stronger to defend. The other thing is that in 1940 America passes its first great naval building budget, the third Carl Vinson bill since, I don't know, since the days of Peter Roosevelt. This fleet will come in with, 12 new aircraft carriers, not these Jeep carriers, you know, the Big Angel Addis. I think it's 17 new battleships in 1943, meaning if Japan is going to move, they've got two to three years to move. And what looks like a deterrent, which is to stop them from moving, becomes a target to be hit. And in December 1941 through first years of the war, say through March or April 1942, what does Japan specifically or just in big pictures do? They try and extend the control of the Pacific as far as they can get it to create a large buffer so that as they go into war with the United States, if they can create that buffer, they can make it more difficult for the United States to reach all the way to Japan, and then they can take more control of the situation. They have time to do that. The Japanese Empire, as of December 1941, it is foremost they have camera, they've just established control of camera and bay, projecting out into the, and I was confused east and west in this world, east into the Pacific, the Japanese Empire is how extensive in December 1941? Well, it's not very far at that point because there are several obstacles that sort of thwart their locks, one of which is the Philippines. And so before they can extend their area of influence in the area in which they can exploit the resources of the Pacific, they have to take out the Philippines. But the Philippines is not sky blue. It is an obstacle on the way for what is, so we're talking about a five or six month, four or five month period in which in terms of the physical distance, the Japanese have the greatest conquest. Between December and April, in the history of mankind, five month period they are extending all the way to places nobody and the very few people have ever heard of in the west. Some god-awful place, Guadalcanal, or to the eastern tip of New Guinea, a place called Buna, in which does what to the U.S. strategy, which going into Pearl Harbor is to hold defensive perimeter from Alaska to Hawaii to the Panama Canal, beat Germany. And if Japan remains, which I say stubborn and doesn't listen to reason, after Germany is beaten then the U.S. goes on the offensive. The only problem with the strategy, like most problems with strategy is the opponent doesn't read the script. He doesn't know that he is supposed to in effect be satisfied on the other side, on his side of the wire, defensive perimeter and Japan is now threatening to close off America's contacts with specifically? With Australia. As Australia is going to be for the United States, something like Britain will be for the European theater, it is the major base from which America will project its combat power. And then the strategy, which means that now the United States by 1942 will be making commitments I guess it's mid-1942, commitments which it never foresaw in the original concept of strategy in the Pacific. And conversely, the Japanese have expanded far beyond their initial expectations. Because I guess they were putting the pedal of the metal and say, I'll go as far as my logistics tail can take me and there's not much physical. The resistance out there is natural. It is nature. It is the water. It is your own ability to simply get there. And they're extending far beyond their initial concept because as you said, Jeff, what? They have this idea that as further and further we extend, the more and more difficult it will be for the U.S. to push us back to our inner core empire, which we must maintain under all circumstances. In other words, I get in strategic depth and that's always a good idea. Well, not really. I think the Japanese will find that out. One of the problems they have in trying to establish that buffer is, and it's the other side of that, the second learning objective we have, even though we're going to look at the U.S. as far as the body command before the Japanese, the Pacific is a navy theater at which once the navy seizes the outer perimeter for the empire, it's going to be defended by the army. But the army's main effort is in China. And while they're prepared to... They will always be in China. While they're prepared to defend what's agreed upon in the Pacific, when the navy extends control past those agreed areas, it will cause the army forces not to be increased in the area, less strong and further out and won't be preparing defenses where they had originally agreed on on the outer perimeter. Because they will be in areas in which they are new to that area. New Guinea, the Solomon's. They don't have time to prepare and certainly the combat environment is horrendous for everybody. They spend so much time pushing out that they continue to push until there's anything about it. And so they have less time to prepare whereas if they would have had a less strategic depth they would have had more time to prepare what they had seized instead of less time to defend even more. Well, in this case it is horrendous as these two America ground forces first two battles. Battle canal for the Marine Corps with an army division. Buna Carther. And most of the casualties Americans are one of disease exacerbated by malnutrition. As bad as it is for us it's even worse for the Japanese. Because they are extended really beyond their reach. The Navy can relatively isolate this area. The Japanese were well fed and sustained I think they'd be holding Buna today. Most of their casualties are malaria and disease. We have a hell of a time getting combat power there. And it is relatively weak but they are a shell when we get into contact with them. Somebody says it reminds historians like Burma in the rainy season you in effect have got these two I don't know a lion and a tiger but they're chained down.  We have a company down a trail that's all you can come in you may have a whole division attacking you but only a company can come in contact at a time. Which is MacArthur's problem at Buna. The thing that the Japanese are such are so badly are so strapped of basic food and medicine that they are almost withering on the vine out there to begin with. Alright so we've got this in 41-42 and beginning in mid 42 the United States does make greater commitments that it had ever conceived but originally now commitment is justified as protecting the lines of communication to Australia. In other words I'm still considering this within the strategic defensive that I will have in the Pacific until we be Germany. But like many things in war you get a ladder up. Now you have beaten the Japanese at Buna. You have beaten the Japanese at Guadalcanal and then at Bougainville which is also in this area here of lines of communication to Australia. Now the question is what do we do next? Well you got two choices. One is once you solidified and held that line of communication wasn't that my purpose? Yes I says your one choice is at that point in time fall back on the defensive and shift your resources back to Europe. Your other choice is to change your mind and say look right now we've got them backpedaling we've got to keep pushing because if we don't they consolidate they dig in they fortify a tough nut to crack when you go after them in 1945 or 46 or 47 But there's also another condition that makes that possible and that is that mobilization is being more successful than anticipated more equipment is coming off the production line than you had anticipated. So now you have more resources to do more with. Now there's another issue on this because this is a theater of a global war and that is the United States is still not putting ground forces you have any great strength into Europe because we still have a Mediterranean strategy and how many divisions can you put into Sicily meaning that now because in effect the cross channel invasion is now being put on hold while America and the British are debating this whole strategy and this issue and the other thing is that the Russians have survived 41 they have survived at Stalingrad for the winter of 42-43 they are holding their own it would mean with all these issues I think we're going to change the nature of this European first strategy. So you're saying Germany all of a sudden becomes less of a threat? No, not less of a threat I think Germany remains a great threat but less than they were before we're not talking about Germany beating the Russians after Stalingrad we may be talking about the Russians exhausting and the Germans and the Russians which is a big fear in the United States about coming to some sort of understanding going back to the borders of 1939 or 41 it's a possibility but we're not considering as we did in December 41 are the Russians about to be closed off within a 3-4 month period? Germany may remain still the major threat but it looks like the Russians can hold their end of the bargain we have yet to find to get into northwest Europe a lodgement area in which we can commit these masses of forces and here is all these issues to say we're going to change the nature of Europe first or Germany first and it changes with the US where it once was hold in the Pacific win in Europe and then go on the offensive in the Pacific there will probably be a two year some people say three year difference between VE Day and VJ Day the idea is to go on a two ocean war and the difference in Europe first is we'll just have a surrender of Germany first and our people particularly Marshall is very good at this one we're going to be in trouble politically at home once we defeat Germany there will be a lot of people and it's Miller time as they do is that we better have a close window we better make this a bang bang finish you know three to six months maximum or else what's going to happen is remember we've got some disadvantages or advantages is that certainly the Russians and the Germans don't have they don't put war strategy grand strategy up to a political vote in fact neither do the British they will not hold elections during the war I say we're going to depoliticize this the United States is the only country in the world that has elections in the midst of the war if the public say hey you guys are screwing up we can if we can't we can find a new commander in chief anyway so in 43 we change the nature of this European first strategy and we say go on the offensive in the pacific but that doesn't tell me much go on the offensive with who as think pacific and in what avenue of approach towards the far east we have got the navy out of pearl harbor owning the central pacific we have Douglas McArthur commander southwest pacific area out of his base in Australia into new guinea trying to go towards excuse me the Philippines I guess the navy is on its way it hopes towards Formosa and well any good arguments for making Douglas McArthur sink pacific theater which would make southwest pacific area the main avenue of approach and having an effect the navy being the transport service for the army and of course protecting the army transportation from raids by aircraft carriers essentially as you already stated earlier the pacific is essentially a navy theater so that's to be said against it's a large body of water you're not going to do anything out there without the navy navy will not only transport you to and from where you're going it will protect your vessels as they go to and from it will also ultimately at some point in the future be responsible for carrying the war to the enemy well here well obviously this world I mean it isn't my fault that this world is two thirds water I mean it was at least me it used to be decapitated coffee but the question is is that the function of the navy to do what essentially the navy does for the european theater which is to get the army ashore and get it supplied now the navy loses the battle of the Atlantic we cannot get an army ashore but look we got a a europe he's not a european theater it's not europe wide a sheaf commander who's an army guy Eisenhower under the understanding that the army will be the lead service for beating Germany but you have to deal with Douglas McArthur who do I have to who is yes you can't avoid dealing with Douglas McArthur you can't talk about this war and not talk about Douglas McArthur by great he ranks the chief of staff he doesn't out yet but he doesn't by great outrank the president of the united states no but the thing is in 1940 Douglas McArthur is perhaps the only soldier whose name is known in every household in America at that time people like Dwight Eisenhower are still obscure colonels lieutenant colonels and people like George Marshall are still not totally known quantities but Douglas McArthur is a force I understand okay and you have to deal with this guy he has a name recognition he is a genuine American hero he has been a general officer now for 22 years longer than any of his soldiers will be alive well here so far what you have given me and I'm president of the united states is political advice about that this guy can raise a crowd against me he may be even a challenger if he resigns what Harry Truman used to say when military guys gave him political advice saying that's my business it's not yours and Harry Truman at this time was an obscure senator from Missouri thank you I'll make the point again which is thank you is that I don't want political advice from amateurs I'll go to politicians for political advice I'm asking you to give me a good military reason why I should not make the central pacific the main avenue of approach what is to be said for swapper well once again if you would let me do I have to proceed you can't you can't separate these issues from issues of personality and from issues of history in other words you want to give me these political reasons but you can't separate them I certainly can't separate the military from the political there's every reason to argue that the central pacific is the shortest route to Tokyo there's every reason to argue that that plan orange which had been worked on by the navy for three decades in fact came up with the best possible solution to defeat a Japanese threat in the pacific well what would be wish we had maps here what would be the downside of using this extraordinary fleet particularly these fast aircraft carriers as fire support for Douglas MacArthur's hopping up the spine of New Guinea back to the Philippines which I guess we could argue as a pace particularly when we could then reconstitute it as a submarine base to cut off Japanese supplies the southwest pacific area which is particularly its energy and petroleum supplies you don't need the Philippines as a submarine base Pearl Harbor works very fine all the more reason now then to argue that General MacArthur should be made some backwater commander except for the fact that he's got name recognition there's another reason and once again you perhaps disagree with it because it is a political moral obligation and that is when MacArthur goes on the national media in March of 1942 with his famous I Shall Return speech this is a commitment which the United States was going to find it very difficult to turn its blind eye to first of all we have a moral political commitment to the Philippines yes but you know how you can get the Philippines you force the Japanese to surrender in Tokyo and guess what they don't keep the Philippines I don't disagree with that what I'm saying is that it's not clear in perhaps March and April of 1942 when these deals are being worked out what's going to happen by 1944 when we have clearly taken the initiative when our sub campaign is being very effectively unleashed against the Japanese trade in the western Pacific when we have landed now in the Philippines when we also landed on numerous other islands in the Pacific and we have begun to figure out how to fight our way back across the Pacific nobody can predict in the early months of 1942 how successful the fast carrier task force is going to be that is all yet in the future there are people who make claims who prophesy who foresee but nobody can tell you yet how successful that is going to be and there are those Americans who have that great sentimental feeling for the Filipinos who have been painted in American propaganda as suffering grievously under the occupation of the Japanese if they do resist collaborators don't suffer for people who resist too and I'm not saying they don't I'm just saying there's a tremendous propaganda effort so far so far I haven't seen a single military well the thing that will not pass such things has given me lots of political reasons why presidents are get to office by being political people high level strategic decisions are often made for political reasons but political means a lot of different things you're talking essentially domestic political as opposed to international political it is a domestic political issue thank you when I run for county commissioner I know who to make my campaign chairman Jeff something is going to happen in November of 1942 there's going to be a congressional election which will perhaps be a mandate on the conduct of the war up to that point and 1942 has not been a happy year for the United States fortunes around the world no question about it is one of the things that reason why when Franklin Roosevelt gets into Guadalcanal which is the longest battle in American history you call it a battle it's a campaign less for approximately six months from August of 1942 to January is that he who is held doesn't want a loss to stare him in this face but now that we have got Guadalcanal the question and we made the decision for I think justifiable military reasons that the world has changed since December that we can go on a two ocean offense or a two continent offense at the same time the question becomes for the Pacific what should be the avenue of approach now MacArthur obviously wants to make it his area of operations minutes wants to make it his area of operations what would be the downside since you apparently don't think there is much I'm going to say before you get to the downside you ask for the military reasons why you should focus on MacArthur going up the Philippines the first one is to interdict the Japanese line of communication into the southern resources area if you focus on the central pacific first trying to get to the main islands in Japan you are not going to be able to invade the main islands in Japan until you can weaken their military machine that is essentially done through the submarine campaign not by taking the Philippines again that's not predicted that can be attractive there is another thing they would be more effective if we could liberate the Philippines even I can understand that when you were projecting all the way from Pearl Harbor your turnaround time and your petroleum expenditure just to get in this area obviously would like a base now it so happens that the submarines are effective prior to the liberation of Lausanne which I guess isn't really until December of 1944 but that's not predicted ok largely if you could retake the Philippines early early 1943 or mid 1943 and effectively interdict those locks from the Dutch East Indies then that would be a strong military argument for the Swapas the problem is however that in the early months of 1943 you're still mopping up in New Guinea you're a long way from being ready to go to the Philippines yet and you have other places that still have to be dealt with it's kind of interesting because when you look at the decisions that are being made they're based on time tables that are years out not in a matter of months they're trying to say we think in six months this is going to be the situation and they make decisions based on that prediction it's kind of interesting to watch that go on a second military reason if you're able to retake the Philippines you remove any threats to Australia that still exist from the Japanese that's not a major reason because from the Philippines they can only reach I think with air power into the northwestern part of Australia and there's nothing there which is probably overblown so you can still argue that that may be primarily a political reason as opposed to a military reason and then you also have the possibility of being able to bring in Filipinos but I don't think that's a major reason either a third and probably more important in a decision that could have been important in a decision to focus on the Philippines is to open up a line of communication into China that doesn't go to Taiwan that allows you to base aircraft in China so you can bomb Japan directly from China all the more reason now for going to Formosa which means to Formosa so you go through the Philippines to reach Formosa or else a direct move from the Central Pacific to Formosa now the problem there and that kind of gives a problem you can do that from the Central Pacific but then the flank of the Central Pacific approach is threatened from the Philippines so if you go through the Central Pacific to Formosa you need to again seize the Philippines to protect that left flank the Japanese strength in the Philippines ultimately is not its naval and sea power but approximately 300,000 men they will eventually move into the Philippines as we see in such battles as the Leyte Gulf Japanese naval power of course that's late in 44 it's land air power and then you're trying to predict well out but that doesn't mean that you can't have the main efforts still be in the Central Pacific controlled by Nimitz with MacArthur and the Philippines being a supporting effort ok since both of you guys failed this question and these poor people here listening saying you mean these guys can't even agree on what day it is and I'm going to have listen these guys for help I will summarize and then hopefully get on to another issue those good arguments for both sides if we had a map here you could see that particularly these aircraft carriers and particularly the way they're built by the American Navy they are built to have maximum amount of planes natural amount of of munitions which means as I've said before in a prior one they're made with teakwood decks rather than they are today with steel decks this is an extraordinary amount of combat power in I guess an area as large as two football fields there's nothing equivalent to it in ground warfare but it is very vulnerable and in Swapa area it is literally running a gauntlet it would be far, far preferable to use the Central Pacific which is masses amount of water with little I'm looking for the words not even islands what do we call them little atolls here in which an aircraft carrier whether job is to hide or disguise its position if it can be in any point in the circumference obviously it's safer if you go against a place like New Guinea by its very width you're cutting it it can only be in half the circumference I'm immediately cutting off 180 degrees of searching for it so it is hell for aircraft carriers but on the other hand what MacArthur does have there's no room for maneuver in aircraft carriers or capital ships or cruisers however what does MacArthur have as a military argument for Swapa and that is where once infantry gets a shore at places like Tarawa where can it maneuver straight ahead it can't it's a postage stamp Swapa is maneuver space for infantry MacArthur and he becomes an expert can in effect land behind enemy lines there is no landing behind enemy lines on these postage stamps Quageline or Tarawa in the Central Pacific that area may be safe for the Navy but it's hell on the Navy's army the Marine Corps but you know there is a prima ballerina and in the Navy it is the aircraft carrier and it is infantry that sacrifice to the prima ballerina and in Swapa infantry and supreme this is an army base and the Navy will be exposed there are good arguments to be said for or bad arguments to be said for either avenue of approach and the final American solution when there are good arguments or bad arguments on either side is ok same arguments for A same arguments for B and my final decision will be A or B is what? A and B do them both don't have a commander in chief Pacific area what's to be said for that type of final decision well one everybody gets a piece of the action again we're back to politics military what's to be said for military justification it presents some significant problems for the Japanese because there is no main effort for them to put their main effort against for defense and with their inability to maneuver across Pacific once the US Navy takes control of it it causes them to put their efforts on both avenues where the United States in spite of their adversarial relationship Nimitz and MacArthur actually cooperate they're able to shift the main effort back and forth between the two axes so that they're able to bring overwhelming combat power to bear on either axis on an alternating basis and they're able to do that because the increasing resources available to those forces are increasing that freedom if you have a resource constrained situation then you have to make a decision which one of those two forces will get the resources but as resources expand and they expand very well in 43 and more so in 44 you have now the freedom of action to choose one or the other or both and the correct decision in retrospect was to to do exactly what they did have dual main axes so this turns out to be a correct military decision perhaps done for incorrect reasons in other words, Roosevelt doesn't want to have a revolt in the army or a revolt to the Navy he can't make up his mind so he does what any politician will do in this situation but he cannot make a clear decision he will give approximately the same thing to each of these two petitioning groups which may be a hell of a way to run a railroad but it turns out to be the correct decision it works it gets the cargo there because you have enough engines but you have enough engines the question is not just whether it works because I think SWAPA if would have eventually worked the Central Pacific worked my question is is this the correct decision the best decision that could have been made and maybe it was made because we should have had somebody in the White House who would make a decision but he didn't he let an effect the situation dictate to him and it turns out to be what was the best situation yes are you an opinion on this or is this the one topic of the world you don't have an opinion on I'm prepared to say that if you judge it exposed facto it's the right decision well that's what we do in our business we judge everything exposed fact it's interesting as you look at it we're talking about unity of effort between the commands as opposed to principality of command unity of effort operations by an effect separate institutions if there's one will not subordinate to another wait I have a protest against this position that this turns out to be the correct decision for military reasons in retrospect well you said the correct decision we'll sell this one away from the camera you got to win the war yet well we may never get to it what turns out to be the downside I believe that central pacific we've got these aircraft carriers that once they get sunk takes three years to build they cannot be replaced they have to be used in the central pacific the real look upon this strictly as a pacific theater issue this dual approach turns out to be not a correct decision you're wrong as you usually are it turns out to be the correct decision one problem is that this is not a pacific war this is a pacific theater in a world war macArthur has got I guess it's two armies right he's got under his the sixth and the eighth this could have been eisenhower's it would have given eisenhower another army group for europe in 1944 those poor guys from september to march september 1944 to march 1945 are on the line and day out because there is no reserve eisenhower's strategic reserve so that he could do the type of punch a hole and exploit that the russians do which have a great operational reserves are with douglas macArthur in new guinea and that's the downside of a good decision but there are no decisions that don't have downsides okay I'm trying to give a brief separate wrap up now so I can get you out from watching this tape and back to your real work this is on how the war in the united states against japan ends for those who want a fuller rendition of at least my thesis I I can't say I recommend but you may want to read unconditional surrender to mobilization the atomic bomb it's an essay I wrote it's published at CSI it's for free so at least you'll get your money's worth what's the situation in 1945 Japan has never conceived the possibility of the conquest and the occupation of the united states they have always wanted by the force of arms to impose their empire in the pacific to make the united states accepted as a fact of life like say the united states accepted the british empire as a fact of life and they plan to do this in 1945 by raising up the cost in blood and treasure of continuing this war now in 1941-42 Japan had extended their empire from its core northern asian empire which is Korea Manchuria and northern china into what we talked about earlier which is everything from french indochina all the way east to the salamence intropical or southern asia now they've all lost all that by 1945 but they haven't lost their core northern asia empire and in 1945 at luzon okinawa and iwo jima the united states suffers 50% of the total casualties in six months time that it will it will suffer in the total war three and a half years at this time there are lots of singles that japan's strategy is working in that war wariness setting in on the american public and it becomes particularly acute after the e-day victory in europe because the united states obviously wants to celebrate what's the indication of this war wariness well demobilization of the u.s. army 450,000 soldiers combat veterans george marshall calls them the wheels that make the army run are demobilized early congress is talking about demobilizing another million men and we have yet to face what is the worse problem maybe in this entire war which is the invasion of the home islands of japan japan plans they know exactly what beaches we're trying to we're planning to invade have virtually called the time our order of battle meet that force on the beach head get back and then negotiate negotiate assist a peace treaty in which they will retain control of obviously japan itself there will be no demilitarization no more criminals the japanese army will retain control the japanese government and their northern asian empire well what's the u.s. response to that we demand unconditional surrender at the same time we demand demobilization of our own army so there's an enormous gap between japanese demands u.s. demands and also a growing gap between u.s. demands and the price and blood and treasure that the u.s. will pay for it how do you close that gap well in war you do it with arm conflict but i think we've about had it in the blood that we are willing to spill of our own blood and the way how you close that gap in 1945 you guessed it is the atomic bomb this way america can have its warings and demilitarize and change the political structure of japan without paying the price on the beach heads the japan would have extracted from us okay gang hope you enjoyed it


The amount of nuclear material in the world is increasing steadily. It's very important that this material doesn't fall into the hands of terrorists. We know that criminal groups have tried to get hold of it. The International Atomic Energy Agency helps countries to keep nuclear material secure. We provide training to police and guards at ports, airports and borders to help them prevent smuggling. More than 10,000 people have been trained in the last six years alone. We have given countries over 3,000 devices for detecting nuclear and radioactive material. We have advised on nuclear security at major sporting events such as the Olympic Games and international soccer championships. We provide expert peer reviews of countries' nuclear security systems and advice on ways of improving them. We help countries to securely manage radioactive material when used in cancer treatment and when it's no longer needed. The IAEA greatly values the cooperation with our partners in industry who develop the technology that helps us to prevent nuclear terrorism. Responsibility for nuclear security rests with each individual country. However, the consequence of a major security failure could be a catastrophe that transcends borders. This means international cooperation is vital. Cooperation will be strengthened when an important legal instrument known as the amendment to the Convention on the Physical Protection of Nuclear Material finally enters into force hopefully this year. The amendment will reduce the likelihood of terrorists being able to detonate a radioactive dispersal device otherwise known as a dirty bomb. This could cause many deaths and injuries, contaminate a large urban area and lead to mass panic. The amendment will also reduce the risk of a terrorist attack on the nuclear power plant that could create a massive release of radioactivity. Much progress has been made in improving nuclear security throughout the world, but we can never relax our guard. The IAEA is the global platform for cooperation in nuclear security. We will continue to help strengthen nuclear security everywhere in the coming years.


That's the episode you do After I leave after I move up to 100 mile. That is the episode you do Thanks a lot Supernatural.  Well this episode just confirmed what everyone is always known Chuck is God. Well, yeah, that was pretty much It wasn't really much of a surprise, but the fact that they confirmed it was like Because we've always had that kind of wonder for the last little while and what we find out is God has given up Literally the fact that was we already got all this exposition from other people saying oh, he goes give it up Oh, he just doesn't care anymore, but this was it. He actually says I'm disappointed and Amara's here and all she does is destroy everything I make so whatever and the whole episode was Really the brothers were dealing with the mist stuff again but they again were Sidelined and that's something I really enjoyed they've done this in this show sometimes the real main characters were Metatron and Chuck and the conversations between the two was very interesting it actually made me like Metatron again because it It showed who he used to be because when we saw Metatron in the first time I actually liked the character, but then when he went to be an asshole and a bad guy I don't know. I thought he was a weak villain, but to see him on this road of somewhat Actually basically coaxing God back into doing stuff. That was actually really well done And I really enjoyed that I'll have the chemistry between Robert Benedict and I can't look up his name because I don't have the Internet right now. I thought they were very good. I think I thought he and Metatron really worked well off of each other and there were some really funny moments But also from very interesting insights, and I think they couldn't have handled it any I think they handled it probably the best way They could have Honestly, I think that was gold every scene with them was perfect. I loved it. I thought it was great That's that some of the jokes were amazing There is one funny thing though that actually was happening during Sam and Dean's whole issue going on with the town of the smoke They run into the police station and the smoke's coming the smoke's totally coming and they walk into the police station And they don't bother to close the door. That's right behind them like It's only a fog that's killing everyone What if Either way, I thought this was one of the best episodes in terms of dialogue between two people Now what I mean is mainly because the episode is controlled mainly by Metatron and Chuck and they had fantastic dialogue However, the entire story with Sam and Dean was really not Anything there nothing happened. It was basically a rerun of the first episode of the season which was a rerun of croat Owen getting it right this time and really nothing really happened with Dean in Sam until the end And it explained so many different things that was very I liked how this episode did pull into a few things that have happened in the past also also God wrote an autobiography that was hilarious So admittedly while the Sam and Dean part of the episode very as passable It's until the very end nothing really matters between them. You're completely focused on metatron and god I can't believe i'm saying that anyway guys this episode episode 20 gets a six out of seven from me I'm really happy that I was able to watch it and I found someone who I can possibly watch the episodes with On the day of So that's a good thing. Anyway guys, I hope you enjoyed this review and I'll talk to you guys next episode


Because I I have no hatred in my heart And so I love all people even my enemy and so those people who hate me I love them too not with mama's love, but with perfect love The love that come from the father and I hold nothing against anyone I don't agree with all this evil stuff this mess is happening But I understand the people that are doing it. They can't help themselves Satan is their daddy And I'll call them out on it, but I don't hate them for it. Okay


we're now going to continue on looking at vector relations in this segment what we're going to do we're going to take a look at the dot and the cross product so let's begin with the dot product and dot product is also sometimes called the direction cosine and what the dot product does is it takes two vectors and converts those two vectors into a scalar so we're turning back to our two vectors and B so we would say a dot B sorry and we can express the dot product in the following way so that is the dot product and what we're doing here we would take the magnitude of a multiplied by the magnitude of B multiplied by cos theta and I'll draw a picture in a moment but theta is the angle between the two vectors a and B so let's take an example one that we often use in fluid mechanics and that is mass flow through a surface so I'll begin by drawing a schematic of what we're looking at so we have some area a and becoming out of that area we will have a velocity vector and I'll draw it as B and we also have a unit normal the unit normal is perpendicular to the surface a and we'll give that the symbol or the sign little n with a hat to denote the fact that it is a vector but it's a unit vector so it has magnitude of one and so we can re-express the area a as being the scalar value of area a multiplied by that unit normal vector and that would give us a representation for area a as a vector now what we can do at the dot product I mentioned it enables us to determine the mass flow rate through a surface so oh one thing that I forgot to mention here is the angle there's an angle and that is shown as being theta and it's the angle between our unit vector n and the vector v that we're interested in so we know from our analysis and fluid mechanics that the mass flux or the mass flow through that surface is going to be equal to the density multiplied by the velocity normal to that surface and then multiplied by the a or the area so that would give us something in kilograms per second and that is what we would call mass flux now we can express this in terms of the dot product by writing out in the following manner that would then be equivalent to rho times v dot a and expanding that using the definition that we provided for the dot product would be like that and that is why it's called the direction cosine because what you're doing is you're projecting a vector v in the direction of n and being this direction right here to projecting v into the direction of n giving you the normal velocity enabling you then to evaluate the mass flow through the surface so that is dot product we use that quite often in fluid mechanics and the next one we're going to look at is cross product so the cross product what it does is it takes two vectors and it produces one vector and we'll use it quite a bit when we're computing vorticity and we'll see that later on in the course but the cross product again dealing with our two vectors a and b this would read a cross b and the definition is that's it written out as a matrix the vector operator and I'll show you that in a moment but the other way would be the magnitude of a multiplied by the magnitude of b and then we have sine theta remember the dot product had a cos theta this has a sine theta and it is operating in the direction e that we do not yet know but we use the thing called the right hand rule in order to enable us to figure out what that direction e is and so before we get to the right hand rule let me draw a little picture of these two vectors so let's say we have vector a here vector b over here and I'm going to draw this angle theta between those two vectors now with the right hand rule what you do is you take your right hand and you point it at your vectors so you have your fingers curl in the direction from vector a to vector b whoops that should be a vector so put your right hand there have your vectors curl curl your fingers and in the picture curl your fingers from a to b and your thumb is going to point in the direction of e I'm sure you've seen this in physics but that is how to determine the direction of e that comes out of our cross product equation and we can also express the cross product and and this is another way of expressing it and this is the one that we'll use quite often as well you start with the i component and going through the operation we will have a y e z minus a z b y the middle you always subtract j it's not plus it's a minus j I always draw lines on the on the matrix here in order to figure out how it is but everybody has their own technique of doing this and then it's plus in the k direction which is going to be a x b y minus a y b x hopefully I didn't make a mistake there that's supposed to be an ax okay that looks good so that is the dot product and the cross product and we'll be using dot product mainly for mass flux and cross product when we look at vorticity which represents the circulation in a flow field and we'll look at that later on in the course so those are two very important vector operators that we'll be using


My name is Chen Jiaojiao and I work with Pong Yangjin as a team Pong Anchen. We are story collectors. So today I would like to share with you some stories from our collections. This is a photo of a married couple. It has been torn into two parts from the middle. There wasn't any relationship problems. Instead it was to protect each other from possible implications during the Cultural Revolution. You can see the husband necktie has been cropped out of the photo to prevent being accused of capitalism clenations. This is an ordinary story of an ordinary Chinese family. And these stories are easily forgotten. There remains only in people's memories and slowly fades away when time goes by. Only part of the history has been selectively documented. As a result, we don't understand very well our nation's history. For that reason, Pong and I decide to collect photos, letters, objects and stories behind them. From ordinary people, we want to discover the unseen part of history from these real individuals. Our collection comes out in a box with some objects and some old photos and letters. Before the age of digital photography, people took it very seriously of taking photographs. You can see this family, they painted the photo into colors by themselves. The emotion is very strong that it is a better piece of art than most of the modern art today. This soldier is from the Korean battlefield. He wrote on the back of the photo, springtime is very beautiful here in the battlefield. The flowers are blooming then in the flames and the smokes. From these wedding photos from the 1980s, you can see how much people are influenced by the Western bridal systems. These are the intellectual looks and the beauties in that time. You can see the moments people share together. Those are the stories from the memories and some stories about the present. Right before the Olympic Games in Beijing, we make projects about stories in Beijing. And as you all know, in the last 20, 30 years, there are huge changes and fast changes happen in China that compared to the changes in the West happens in hundreds of years time. There are too many different and irrelevant things are compressed into one space and one time. People's sense of value shifted from one extreme to the other. It's a very special moment for us to document. This is the girl in the last swimming pool in Beijing. It soon turns into Olympic Museum. It's ironic that we lose a public sports base for a sports museum. She is a princess in China. She is the last princess in China. Her story starts from a member of royal family to our prisoner and to our ordinary worker. Her story reflects the modern history of China. At this point, he came to Beijing hoping to find a publisher for his points. He lived in this five square meter tiny room, which cost him only one and a half US dollars per day. And in this giant three-god statue, there's a hotel inside. It is the biggest image building in the world, Chinese records. You see, in the hands of the gods of longevity, there's a pitch. There's a room inside for people taking birthday parties. This couple, they are very lucky because in China, the best legal way to have two kids is to have twins. This girl, her ankle is a diplomat. He brought her a can of Coca-Cola in the 1980s. At that time, the Coca-Cola can has a decoration of Santa Claus for Christmas. For many years, she believed Santa Claus was the president of the United States because only Chairman Mao's head was everywhere in China. Punk at the name. A private luxury club and one people who refused to remove her home. There are more stories to tell. Punk and I will continue as story collectors. We want to document the stories which are easily forgotten. Thank you for your time.


In this video, we'll look at a change that accompanies all chemical reactions, a change in energy. One of the signs that a chemical reaction has taken place is that there is some kind of temperature change caused by the reaction. When a chemical reaction occurs, there's always a transfer of energy. Either the reaction produces energy or it absorbs energy from the surroundings. This is a result of chemical bonds forming and breaking, and we'll go into the detail of that later in the course. When we look at the energy changes in reactions, it helps if we divide the universe into the reaction that we're studying and everything else. And we can then look at whether the energy is flowing from the reaction to the rest of the universe, which we can just call the surroundings, or the other way round. If a chemical reaction releases energy, then as the reactants are turning into the products, energy flows from the reacting chemicals out into the surroundings. And this energy is now free to move through the rest of the universe. This energy usually takes the form of heat, so we detect the energy change by the surroundings getting hotter. Such a reaction is called exothermic heat to the outside. If a chemical reaction absorbs energy, where is it going to get the energy from? It has to come from the surroundings. That is from somewhere in the rest of the universe. Energy flows from the surroundings into the reacting chemicals and is incorporated or stored as chemical energy in the molecules of the products of that reaction. Because energy is being removed from the surroundings to the reaction, you observe this as the surroundings cooling down. You may also observe it as the reaction only being able to go if you provide a continual supply of extra heat from the outside. Such a reaction is called endothermic heat to the inside, where the inside is the newly formed molecules.


Yeah started everybody's like, okay, this is cool, but not that cool Apart from John who's totally cool Okay, should we start? Let's start. All right, you're up. So I'm gonna boot this off because I am I sort of started shellfish, but I sort of reaping the The benefit of it without really doing anything these guys are actually the brains behind it and The guys that stayed up all night doing all the work. I'm just looking at them thinking. Oh my god. I remember when I did that 25 years ago. Giovanni did a lot of high-level planning and sushi delivery Exactly, that's my role feed them. They will poop software. Okay Cyber Grand Challenge code that's really actually true. That's actually true. So I'm gonna be very sure in this Shellfish was born out of the sack lab, which is the security group. I you see Santa Barbara every time you say you see people say University of California, that's not right. That's Berkeley. You see Santa Monica. That does not exist It's you see Santa Barbara. So get it right sack lab is the group. That's where we come from and the group is led currently by me and my Colle Christopher Kruegel We look very professional here like professors, but we're actually Hackers behind weird handles like everybody else. I I never got the handle thing But I I needed one and so if you look about Zanardi on The on the internet is somebody with a gigantic nose and a ponytail which I once had Giovanni Would you say Chris is your life partner? I think Chris me Christopher is my academic wife. So I I have to take care of all these needs and is I wish he would be here. He would be very is super proud of everybody But this is our university not bad. And that's why Shellfish is here. Our lab is exactly there where the arrow points. We're all right on the beach We have a private beach and that's why our tagline is hex on the beach We're lucky might be back here. Is it back here? Yes, it is. It is. All right So how do you start it? It started in 2004? I know it's incredibly Such a long time ago. It's me, but then I had a bunch of grad students including Chris and we evolved into a Community and in 2005 we actually won DevCon CTF never won since then that was the good old days And it's all it's awesome because they say the older you get the more awesome you wear So I'm milking it for whatever I can But we grew up, you know, and then suddenly void Chris moved to Vienna became a professor there Recruited some more people that became more people that came back to Santa Barbara because it's awesome became more people more students more students even more students and What happened is that some people went to Boston? So we have a substantial presence in Boston and we evolved as a group more and more in the years Until at a certain point all our graduate graduate students actually became Professors as well. And so a lot of you, you know, you see people Became professor all around the world in London at Arizona State University Eurocom in France and right now Shellfish is a very big group of all academic people all around the world doing interesting stuff. So Right now our group is pretty much this we're very inclusive where you know, we foster research and that's what we care about and with this I'll give my Presentation a tawn to young Thank You Giovanni.   Oh, yeah, right there Yeah, shellfish is Bigger than just the CGC team the CGC team is a straight subset But we have a lot of people that were cheering us from the sidelines even on the team So let's talk about the cyber grand challenge Um DARPA has a history of grand challenges, right? You guys are probably familiar with the self-driving car grand challenge and the robotics grand challenge because they got a lot of press similar to the cyber grand challenge just now and The idea behind these is DARPA finds this fledgling technology self-driving cars and they fund It with a lot of money, right? So their prizes million-dollar prizes for self-driving cars and This motivated a lot of people to put a lot of research into it at the time people were of course saying Because the time was 2006 when we didn't even have smartphones and people were saying do you really think that?   So the cyber grand challenge really pushed the frontier of automatic program analysis exploitation and defense Right now. It's in its infancy. I think You'll see how the CRS is did at DEF CON CTF But maybe they won't be the best humans But that's the beginning the chess systems didn't be the best humans and the self-driving cars aren't gonna be the best humans and Races right now, but eventually they will and eventually Mechanical fish will kill us all or hack us all while the actual robots kill us So as a cyber grand challenge Let's talk about shellfish is involved in the cyber grand challenge as your money said shellfish is a bunch of Academics and hackers right so we're kind of academics so at one point we decided to shift our research Interests in at UCSB closer to binary analysis, right? We started looking into doing automated binary analysis and All of the things along with that automatic vulnerability discovery and so forth Completely independent of the cyber grand challenge. We started doing this sometime in 2013 and in late 2013 DARPA announces the cyber grand challenge, right? So I have an email somewhere in my history saying hey guys check this out This is this cool thing Maybe you should participate because we're working on a lot of the same stuff and everyone said yeah, let's do it Let's go for it. I said great and then probably forgot about it for like a year right so the deadline for registration was in late 2014 I sent in the Kind of application literally 15 seconds before the deadline because that's that's how we roll and They said great. You're in congratulations. Let's you know See what you got the first court event is coming up in like four months And so we're like, okay cool. Oh, no like on the graph is like in one month, right? So we said cool. Let's let's build a CRS We're gonna we're gonna rock the scored event the first kind of practice round that that was the term DARPA used for I'm scored events. So the first practice round You're gonna we're gonna do super awesome.  There's a practice round for the Cgc stuff tonight and so we started working on our CRS, right? So the first commit to the CRS is two hours Maybe three hours. Let's say before the practice round begins, right? So we start writing our CRS practice round begins. We play the practice round with some Janky ass CRS that that kind of half works Cool, so then we like all right well now here we started we're gonna get it all Super put together before the second practice round second practice round rolls around and now we remember about it Maybe three days before right so the second commit to the CRS happens three days before the second practice round We build it up build it up build it up play in the second round So okay, cool now we have this kind of cyber reasoning system That's kind of ready to play in the CQE if we keep working on it solidly until the qualifiers and then of course we forget about it for another couple months and Then two and a half weeks before the qualifiers. We remember.  So then we start working like crazy and not sleeping three weeks of complete insanity until the Cyber grand challenge qualifiers and we have a cyber reasoning system that we can field for the cyber grand challenge qualifiers And we qualify with three weeks of absolute insanity And so then we'll figured cool now a we're super rich because the qualifiers came with $750,000 of prize money and be we can now spend a year working solidly, right solidly with test cases test cases code freezes milestones milestones lots of milestones and absolutely, you know continuous Integration and and and you know test rounds and everything for an entire freaking year At child development. That's that's the key word here. None of that happened so for nine months we use our money to fly around the world giving conference talks and like saying how how cool we are and how you know Fish is a Chinese martial arts expert or wait that was that was Kevin Kevin's a Chinese martial arts expert And you know Antonio is mysterious and all this shit But it really we should have been doing is working on the CRS, right and three months before the finals three months ago. We realized this and we're like Crap We should really write a CRS for real actually, right like and we should take what we had in quads and actually like You know extended so it can win finals So three months ago. We started working like crazy. We stopped sleeping, right? I have a fiancee and I haven't seen her in three months. Basically that that's you know the insanity To the founding agency they're listening we're a lot more responsible than it looks yeah This is our hacker persona, right? We also have an academic persona where of course we have CI of course come on who doesn't have CI and code freezes, right? And we we finish all our papers two weeks before they're due so that our professors can go over them and Absolutely, this is the hacker shall see persona All right, anyways, so we went crazy for three months We got the final commit to the CRS 30 minutes before the air gap was established 30 minutes All right, and it was a commit in one of the core components. So shit could go wrong there's a slide for that and All right, I'm killing us so We did it we play the CAGC we got third and this is the team that we already introduced We're from all around the world Italy Germany the US India there was a guy qualifying with us who's hopefully sitting in the audience from Senegal officials from China We're from all all over the place And we are very rich because we got Two seven hundred fifty thousand dollar prizes now so That's kind of a brief intro to our involvement in the CDC I'll pass it off to Jacopo to introduce the CGC as a platform and what it means right so Very very very true and very effective introduction to the shellfish hacker very distinct from academia very distinct from the shellfish Academy All right, so just very briefly So what does it mean to actually score well in the CDC?  There's no limitation on how you do it You have to own them either by a crash or by leaking a secret and you also have to patch them So that the other guys cannot do the same to you and this is a classic Classic CTF Structure that has some modifications to the Cree in the decree operating system to make it more model more easier to model and Easier to handle for a program. Okay, so one of the simplifications is that so the architecture is Intel x86 All opcodes are legal which can lead to interesting situations that we will see in a bit um See schools are simplified much easier to model pretty much read and write select Allocate the allocate like malloc and free Random and obviously exit a lot easier to model for a program and the actual binaries are actually a lot a lot more realistic a Very real. They're not complete fake binaries So as a side note and the DEF CON CTF just finished and the DEF CON CTF was also played on the same platform So just an example of how real and complex these binaries could be one of the challenges in the DEF CON CTF was a Power PC interpreter and jitterer, which was awful. And so there's a lot of room for complexity in these programs And on the actual pony inside I Don't know if some of you guys want to barge in but basically What it means is that? There is no there is no state every program runs once there is no state It runs you either own it or it's gonna do its thing. There's no there's no state There's no file system to modify. This is a lot easier to to model for the for the qualifications And only for the qualification. It was just enough to crash the program Sec fault illegal instruction. You will get the points you have owned the binaries For the finals things a lot more nuanced and the actual exploitation as we will see is a lot is a lot more complicated And it's a very interesting application of how to use symbolic execution and static analysis But as a as a basic idea the two ways you do is either via a Control crash in which you can show that you can not only crash the program in some place But you can actually crash the program at a place that the API that that was gonna tell you please crash the program in this place And set this register to this value if you can do that you verify that you have actually control of the program or alternative that you can leak a secret flag from memory and On the patch inside just a brief note on how you analyze how this API is designed So that it does not become too easy like for instance we can submit patches to the binary Okay, so what is preventing us from just submitting a binary just exits These programs this program obviously never crashes, but also does not do anything useful So the way this is prevented is that is that there are functionality checks if you if the program does not maintain its benign function if the program is math calculator it needs to still be able to do all the math operation that it can do normally and Similarly, there is no signal handling So no way to just hide away all the sac folds if you sac fold you are crashing and finally How would prevent us from putting in an interpreter that runs everything? So checks before every possible instruction am I gonna crash am I gonna crash obviously you will never crash and The way this is prevented by that project you can actually do it.  This is believe me not as easy as it sound Understanding exactly how your patch is performing is definitely not an easy task many of us looking to eat I look into it a bit. I'm trying to look into it in a bit. It's definitely pretty hard And then we gave up testing performance. We just say this is our patch deal with it Yes, yes, that's very true and I know informally We know other teams also had trouble But I think none more than out of end knows very well how much of a pain How much of a big pain it can be to actually test the performance and the functionality of binary so big props to Arvin for actually pushing through this task and actually making it and This actually helped us a lot during our own internal testing even if it did not go into the live part and Are we now hand over all right, so the CQE for the qualifying event was not the full Now it was not the full cyber grand challenge It was you needed to patch binaries and needed to crash binaries. You didn't need to exploit anything You just needed to crash it the final event. You need to patch binaries crash binaries who find where vulnerabilities are and then exploit those vulnerabilities and On top of that It wasn't just a simple game or a simple program Challenge where you got a binary you crashed it. It was a game So you have to have a game theoretic aspect that Played against other actual competitors right similar to a human CTF, but all with computers So the competition was actually divided into 96 rounds and that wasn't predetermined it was you know However, many rounds they got through in a day there was a Minimum time per round and that ended up being 96 and there was a bunch of Challenged binaries as they term as DARPA terms them and which were provided to the teams to hack and for each score for each round the team would have a separate round score that When aggregated would be their total score for the game the score was calculated based on a multiplication of the team's availability, which means how much do they fuck up the binary and How fast the binary still was right how much overhead the patches had which is something Yakbo alluded to the security score Which is how exploitable were the binary still or were they still exploitable and the valuation score Which means did we find did the team find an exploit for this binary? so it was very easy to screw yourself in this context because They're all multipliers if you completely break the binary even if you have perfect Offense if you even if you find all of the exploits for this binary then you still get zero points because you broke the binary in developing for this competition we Ran into a lot of kind of Organizational things as I alluded to earlier we started super late. So for example up until Depressingly short time ago. This was our database All right After all these are research group run by an Italian Again, this is our hacker persona So we actually had to do a join on this database at one point when we got the real database up You're joining between the paper database and the actual database This is relevant because it's about our performance scores This is the best is the database of our performance scores. We're trying to analyze That was relevant to the previous slide specifically this database contains the feedback from some Practice sessions for the final event. So this is what diaper called sparring partner sessions We wrote them down and then we had to join them with the real database to get the actual information that we needed To tune our patches We also tried to go into code freeze several times So at 4 1 p.m. On some God-forsaken day We froze a component of our CRS called farnsworth and Very shortly thereafter. This is the commit log Right, so the code freeze didn't work very well There are commits such as this gem here so that that that's Francesca here that you know Beautiful beautiful good. This commit was okay. Actually, he just has very high standards.  We were still changing very Core components of the system. That's me upside down. I was at this point no longer sane so our CRS consisted of a lot of components, right? We had a We had a central database that we called farnsworth for some reason Which stored all of the data that we got from the Cybergan challenge API through a component That you'll talk about later. It stored network Captures it made It stored the scheduling decisions of what jobs to run and then it stored the result of those jobs So now we're gonna go One by one into all of these components probably pretty quickly We have 15 minutes left and we'll start with the Organization or the core organization components and I'll hand it over to Francesco and Kevin so obviously coordination is very important if you're running a cluster of 64 nodes and of course Since we needed to do that we since lay came up with like using one database to simply store all the ground truth that we have As a bunch of you probably know this is from future Amar So we just went with essentially funds worth because well good news everyone And it's the only component that we actually tested fairly well at about 69 percent test coverage I think the rest probably dumps around it like 1% Zero oh perfect even better And who needs testing anyways right anger has at least 15% code coverage. I think Francesco probably disagrees, but yeah, who cares Then on top of that we since they had to my star which the Germans and you know So since they just master Which looks at scheduling jobs and deciding what jobs we want to run what kind of part of our pipeline We want to run exploits patching if we want to run AFL these kind of things a schedule them based on priority End of this obviously Sorry, the last component that we actually changed with the last commit being I guess two hours and 18 minutes before The actual deadline. So yeah, this was at 1242 and the same deadline to actually the no shutdown was that 3 p.m But we made a commit. I think we rolled that commit back 30 minutes before the dead. Yeah There were a bunch of commits at like 2 p.m But we actually reverted them and cleaned up the history just to make sure that they're actually not there Because they caused a bunch of failures on our side Anyways, we would also like to give a big shout out to essentially the open source components that we should rely on One of them is Python the Microsoft research the 3 compiler all of our things runs into inside of Docker containers Which are running Ubuntu with Pi Pi? We're also using Kubernetes QAMU P we vax pos grass Obviously anger, which I'm sure a bunch of people are going to talk about now and I think that's probably young Possibly souls Andrew John I guess and pizza. Yeah, go ahead. I Agree we everything he said Angers the open source binary project binary analysis project that we have in the sec lab It's really really cool. It's been open source for like a year now. We released a defcon last year, right? Yeah It does everything. It's cool No time. It's very cool. That's our logo. It's creative commons We in order to do the actual exploitation analysis pipeline We split it up into a whole bunch of components and rearrange them into these Weirder things like we've used concoct execution in order to do some basic analysis of what can go where there's automatic Exploitation and patching which will all be talked about. I think they've all got their sections in this presentation There's crashes. I think you can slow down a little Fine Who wants to?  Guys, we haven't been sleeping for three days. So I'm sorry if your friends do all the funding agency. We're not doing drugs or alcohol Looks like it. I'm not even 21. All right crashes souls Nick talk about it You see how prepared we were for this huge defcon talk. Hello So crashing So our exploitation strategy is we find crashes and we turn this into exploits Pretty incredible So actually like a lot of teams the thing we do the most is fuzzing and this is what generates a lot lots of test cases Lots of crashes the majority of her crashes, but not entirely all the goodies we find so We use AFL as our core component Fuzzing we I'm more explain how AFL works like these slides do I suppose and Essentially begin by generating lots of inputs which attempt to explore different parts of the program the inputs are basically random Some of them are more or less educated guesses and how well these inputs do when exploring the program is tracked by instrumentation which is Compiled into the binary or which is provided by An emulator like QMM So See did I go over all these? So if it was a great job of doing this we've modified it slightly to work better on TGC binaries So we have a couple of hacks which I think will be open sourcing which make it perfect for CGC or at least a lot better Okay The uncrasher I don't think that's actually actually exists But I Don't think there's a non-crasher man the points of flag and all this shit. Yes. So what is like karaoke slides? right I already mentioned this right AFL. It's great. This is how fuzzing works Random stuff gets put into the binary Yep, same input all over again eventually comes up with a random thing that works This is a much harder for a fuzzer. We have to generate a very specific input fuzzing will have no luck with this of Keeps continues to lose Makes absolutely no progress if you guys can't feel like you can't keep up with my pizza. I feel like that very frequently Okay, so anger on the other hand is a symbolic execution engine It's slower and more heavy weight But it's great at finding very specific cases like the one we just described and the way this works is by Generating these states following different paths as you can see here in the control flow graph. We have different states which are being followed Eventually, there is a state which will satisfy the you win expression and we talked to z3 We ask it to generate an input which gives us the state and boom So what we tried to do is combine both AFL and anger And we this is called Driller Driller begins by fuzzing gets basic code coverage of the program the way you would expect AFL To and get maybe gets a couple test cases in this example x and y we get the cheap coverage Next slide Then it okay again, then we take those test cases and we trace all of them with anger So we make the input completely concrete almost we actually make it keep it symbolic But we constrain it to be this concrete input the AFL generated And we see at any point in the program if we could have taken a different path Which AFL failed to take if we could have taken that path we talked to z3 or anger more specifically and we say give Me an input which satisfies its new path in this case we get the CGC magic and The new test case is generated and now we continue The loop and we feed this back in the AFL which continues to mutate that further and buzz and it goes on and on until we continue to get work code coverage And then we play video games all right So this next part is the auto exploitation how we go from a crash Which is generated by AFL and Driller to actually an exploit for the CGC which scores as a flag All right, so in this example, I think there's a buffer so there's a buffer overflow inside the Heat inside this malloc object here, and when you overflow this buffer you actually control the function pointer and so We're inputting inputting inputting symbolic bytes and eventually we control the buffer the symbolic address We're gonna call into an address we control and so to exploit this we use anger We check we trace the input using anger and check that first the IP is some bog the PC here We say is the state does the state have a symbolic PC at that point? We know it's probably exploitable we can control where we're gonna jump to and so let's set the buffer to contain our shell code We ask z3 to give us input where the buffer point contains shellcode and then we jump to the buffer And that'll give us an exploit And to do this we synthesize the input in an anger. That's just called state dot posix dot dumb zero So in the CGC this is discovered by taking a crashing input and tracing that with anger So keeping all the input that AFL created symbolic and then following the path that took until we have our crashing symbolic state so Keep in mind. This is very simplified We have a bunch more techniques that handle the harder cases and that can take a Not so good crash and turn into a better crash And you can find those all when we do our open source release and when we release more details and papers later And in the open source release This component is called Rex if you're interested in auto exploitation check that out All right, so then the steps again We create a vulnerable symbolic state where we control the PC we add the constraints to set the shellcode and to set the The program counter to point to the shellcode and then we synthesize the input and that creates our exploit Okay, so this This component will be talking about augmentation of flag leaks So if you didn't know there are two types of exploits you can generate in the CGC the type one is sort of classic memory Corruption show that you can control the program counter and show that you can also control a general purpose register However, there's another type called the type to very creative which Shows that you can leak arbitrary memory from the program. So in the CGC, there's actually a sensitive sensitive data that's a map at a special address or in every single binary and if you can leak content from this page in memory you score points Like Heartbleed for example with there was a hardly challenge in this game, which Where the premise was leaking this data from this flag page the sensitive data So the way we do this in a fast way is we actually use the unicorn engine Which anger integrates to make the entire input completely? Concrete the only thing which is symbolic during the flag detection is the fly page itself so We trace the entire program and execute very fast because everything is being concretely emulated by QMM with unicorn and We can detect in transmit because we hook it with anger When the fly page is actually being emitted and then we can see exactly which transformations are done in this fly page You can tell if it's been exhored or if some complicated constraints have been applied for example This actually solved the DEF CON CTF challenge which Okay, it's enough time to talk about that but we saw the DEF CON CTF challenge this way so we'll talk about it a little more later so So of course one of the challenge was to patch this binary So we had a component called patch rex that was going from patch From a patch binary to patch binary So the general idea is we have patching techniques for this and let's add let's encrypt the return address and these patching techniques generate patches such as let's add this code here Let's add this data there and these patches were injected within the binary We had three different ways the first one was slower, but more reliable and the last one was faster, but Less a little bit less reliable and fish is probably gonna talk about the reassembly And so we had adversarial patches that were designed not to make our Binary our patch binary analysable by others and this is a one of them that is pretty cool and This is a detect QEMU detection this if you run this code in QEMU QEMU i3d6 It'll hang forever Well, not really forever as long as it takes to int to increment a 64 bit int to the 64 times That's basically forever And we actually owned the cyber grand challenge Visualization infrastructure with this they're apparently using QEMU for instruction tracing and so at one point during the CGC We noticed that their instruction tracing had just stopped and it stopped right on this code Which was designed to detect QEMU and crash will not crash, but hang for a zero day take a picture We have a lot of open source bug fixes to contribute starting now So there were other so all sorts of adversarial patches so to speak for instance our binary was starting by transmitting the flag out but They were transmitting to STDR so to STDR so that This could probably confuse an analysis system that could misidentify this as a as a type 2 Vulnerability we also have a back door that if some team was using our patch in the in their submission We could actually Exploit that and I'm not sure if the back door work during the CGC But for sure it worked during the city. Yeah, how many do you know during death corn? How many team? I know that our other teams use our back door during Can you name names? I'm sure And what three teams that fielded of our back door at the CTF? during CGC Yeah, okay, cool. So then we had also sort of genetic patches that are these are more standard academic things such as Protecting the return pointer protecting data codes and when we are going to release these Code you will see all these sort of kind of more standard techniques and then targeted patches So the general idea oh you can speak about so so targeted patches right so qualification events We just wanted to avoid crashes right because anything that crashes counts as an exploit So we had some you know, we just checked using a weird quirk of one of the syscalls Using a weird quirk of one of the syscalls we checked to see if the if memory was Readable at a certain point if it wasn't recrashed, so I would like to take Specific credit for our back one slide for our targeted patches in the final event, which were exactly nil And it worked great. So what what can I say? And one note that no functionality overhead That wasn't that and one cool thing about these that we thought we were cool Finding these weird syscall tricks to detect memory locations, but actually when we analyze Qualification binaries from other teams when they were released we found at least one other team was using exactly the same tree So you're saying they're both cool. Yeah, we're both. Yeah Okay, so we are running out of time. So Well, the only thing I want to say is anger is awesome I spent three days in writing Reassembler and another three days in ready optimizer. So it works out So what is a reassembler just real quick reassembler is a static binary? Rewriter that's basically Okay, we'll talk about it later. No Okay, I've yet we had a we had a breakdown from our I think I think Guys is Okay, it's fine the reassembler is awesome fish wrote a binary writer Where you can inject code into binaries and it'll seamlessly Reassemble the binary to include that code check it out in the open source release You go There's nothing much to say basically tried.  So we try to maximize this usage the usage of these nodes And yeah, we can did it with the C2 at least Not the memory, but That's it. That's it So the 64 servers we had a lot of media attention over the CGC and what we got What we got people excited about the most strangely enough is the fact that we had 64 servers all to ourselves Incredible. Anyways, so We implemented all these systems in a breakneck like three months and We pushed as hard as we could we got it all running We made commits at the last second and we played the game or rather our baby played the game She walked on her own We walked into the room and they told us hey Your guys's bot started up and it's doing a lot of this guy. Oh and we fucking lost it Because we freaking lost it because up until then We thought you know, it's gonna turn on and something will fail and and it'll all crap itself So this was incredible and then we got third place Top three is amazing for us guys I can't I can't tell you how incredible it is to have been part of this comp and we're going on It was incredible Since we played in the CTF we didn't really get much of a chance to actually look at the data However, we quickly briefly looked at it So in total there were 82 channel sense fielded at least our bot saw only 82 more have been fielded We might have actually missed them in total mechanical fish generated about 2,450 exploits We generally did a total of 1,700 exploits for 14 out of the 82 Channel sets all of them have 100% reliability and so far as a score like always leaking or essentially Crashing at a specific address. Did you check how many were like mostly reliable? I did not so this is it seems that we only got 14 out of 82 channel sets We do not know how many essentially grandma tech with tech X and Xandra got or mayhem with for all secure the rumors are that we have Top exploitation, but we didn't have the best game theory.  So yeah Yeah, and so we got two of the rematch challenges So so two of the historical challenges that DARPA introduced one of them was sequel slammer Which I think two other teams also got but don't quote me on that And then there was also crack at her which supposedly only we got right and Then in total if you look at essentially the different challenges that we had and the vulnerabilities that were in there This is the list of challenge sets that is what we got and with that from all of us. Thank you for the attention So real quick, let's talk about the next steps real quick the next steps beyond automated hacking is Machines augmenting human intelligence. So in DEF CON CTF, we hooked up our CRS mayhem as the winner They played completely autonomously We played with our CRS. So I mentioned already that the CRS actually pwned one binary Without us even realizing it it actually assisted us with five of the exploits. There were five exploits At which either after providing the crash Or after just providing interaction it created an exploit for and our CRS inserts backdoors into every binary that it patches and so you might have heard already that a lot of teams actually used our backdoor These sounds all awesome, but we didn't win even close. Yes, we almost got close to last So let's turn down the bragging that that's right. Just a tiny bit the CRS did amazing But there were some issues like for example the DEF CON organizers had to implement a separate API For the infrastructure then DARPA did right because the DARPA API had to be secret so that you know everyone was on an evil even playing field and so there were some API incompatibilities and Computers are very brittle and so these API incompatibilities Screwed us until the very last day. So the last day I feel we had a good showing up until then The CRS kept crashing the CRS kept getting invalid data. It was kind of touch-and-go So as you might have heard we're going to open source everything. We're gonna do Thank you We We're gonna do a full open source vomit because we believe in Raising the playing field for everybody so the next time a CDC runs around rolls around We expect all of you to play as well Hopefully using our stuff so We don't Have it all ready right now to push the github because we were playing the CTF We thought we'd had time, but we don't but Chris. Do you think you can do a symbolic open sourcing of engrop? All right, let's do it right on stage. I'm gonna unplug the video Kevin. So Chris isn't logging in Unless I mean just don't type your password into the wrong field I've seen that before at DEF CON. It was incredible It was someone fairly famous, too. Ah, there we go better save than sorry.  I enable logging before Chow chow for is what Giovanni says. I Think that's his password though All right, so we're gonna plug it back in while we try to Desperately find the settings of the open source project. So engrop is our Rob compiler So if you are tired of writing return-oriented programming payloads by hand You can wait. Hold on. Let me explain what it is You can use engrop which uses anger to compile Rob payloads into whatever you want So you say actually just read this memory or execute the sys call and it figures out the Rob payload that it needs to generate Chris wrote it is an amazing guy and it's an amazing project and here it is being open source for the world boom the rest of the code we need to scrub free of Private keys because there are so depressingly many and other depressing Things and then we'll push it out this week Also, if you find a private key that we haven't scrub, can you please gently let us know instead of destroying our infrastructure? I will appreciate it We're hackers hackers has on the worst security in the world So and and and my password is six characters long just to give you an idea All right, Kevin. How do I get back to our? thing But I think we're done basically Thank you guys So stay in touch Hit us up on Twitter By email jump on our RC channel You can chat with us about our CRS at shellfish CRS and free node. I'm the only one there right now super exclusive or On anger at free node on anger questions. Are there any actual questions? Yeah, hi Congratulations, thank you on your work So in your driller paper you had said that the fuzzing was mostly responsible for 68 of the binaries whereas Having the symbolic execution based fuzzing only let you find Vulnerabilities in 11 more than that So why is that still the case or is the symbolic execution more effective than fuzzing now you want to talk about drill is 3.0 Sure, so one thing we've done to actually improve One thing one thing we've done in action to actually improve a driller Especially on CGC binaries is to identify functions and install sim procedures in their place So what this means is that a lot of basic block transitions Which are hard for or uninteresting for once block execution solve are more interesting We have a super seizure we can talk about it more if you want to come up here Mike Oh last question. Okay. Well, congrats guys.  Would you put something else in there? Backplane Ram, what do you think so at this point? We don't actually know because we haven't gotten a chance to actually look through all of the logs We had some problems in the very beginning So actually on Wednesday still to get all of our Kubernetes pot scheduled simply because Kubernetes was not catching up We kind of solved that But we at this point We don't really know what the status is in so far as the utilization of all the nodes from watching the power consumption It seemed that the way that it dropped off It seemed that it had a lot of unnecessary jobs that would be scheduled later So I think we could have used a little less even And it was still yeah, we could have probably used 32 nodes and done about the same But the more the merrier especially if you can schedule more jobs We definitely had jobs to schedule that we couldn't schedule because of delays in Kubernetes Thanks. All right. Thank you. Thank you for organizing this thing. Please give shellfish team a huge round of applause What they've accomplished is immense Thank you guys. It was a dream come true to be here Yes