Okay. We got a ton of stuff to get through, so I'm going to kind of kick off. Just a quick disclaimer up front. We kind of cut this talk down from 140 slides and a 75-minute talk at Black Hat to 50 minutes and a lot less slides. So everything is going to be up on our site. If you catch our blog, we'll link to our research portal and we'll have the full content up as well as this. Just a quick overview of where we're going to go. We're going to give a quick introduction to the talk, kind of background on where some of our things are going. We'll talk about some drawbacks when you're dealing with cloud computing. And then we're going to look at some specific people. So the ones we looked at were salesforce.com, Amazon's AWS and Apple's Mobile Me, and then a quick wrap up. Just very quickly again about us. So SensePost as a company we're a dedicated security services company out of South Africa. Been around for about nine years. We've spoken at Black Hat and Defcon for the last eight to those years. We do a ton of research, a lot of training, put out some papers, kind of put out some books, not going to hop on us. So really quickly, the moment you talk about cloud computing, the question has to come up why we're even bothering. At the moment cloud is a real headline stealer.  But we've been doing talks for quite a bit. We've spoken at Black Hat, Defcon for quite a while. And we're not famous for doing talks just because they headline Stealy. In fact, some of our talks have some of the most boring demos known to men. We've got probably the slowest port scanner, probably the slowest tunneling tool ever released on the interwebs. And the reason I'm saying that is we wouldn't choose a talk just because of its fashion appeal. Okay, we think there's something important going on here and we think it's important that people start noticing it. So there are a few people talking cloud. But the moment cloud is spoken, you get people splintering into different groups. There's a group of people who immediately go, that's nothing new, cloud, cloud, cloud. It's the same old thing. Schneier's gone on record a few times saying it's the same old computing paradigms that we've done. What's interesting to note is that he said that multiple times in multiple interviews. Okay, so clearly something new is happening here. Something's coming up. There's also something that we'll touch on later on during our talk. And that's lots of attacks that we previously thought were uncool and unsexy. Suddenly start to take on a different tinge with the new paradigm. And the bottom line there is that at this point with attacking the stuff, with testing the stuff, we really don't want to waste time splitting hairs. Okay, this is not the time for us to be deciding whether Web 2.0 is or isn't new, whether JavaScript is or isn't an attack, a cool attack vector. What we're interested in is what we can do with it and to make sure we're prepared for these attacks. So why would we want to attack the cloud? Why would we want to try and find things to break? Well, as much hype as it is, a lot of people are actually moving there. A lot of businesses are going and outsourcing functions and putting things up in the cloud so that they can then abstract that infrastructure and not have that responsibility. It's also fairly insidious, right? So even as a technical person, you could be fighting that and saying, look, we don't want to give away those things, but the decision is made above you at a business level because that's what's happening, right? And that's where those calls are made. So everybody in one way or another is kind of moving into the cloud, which makes it a really, really attractive target for us. And interestingly enough, if you consider the nature of the thing, it's out there, right? It's a web app that you're accessing things through. Clearly, we haven't got web apps right since the dark ages. I mean, we're very prone to making those same mistakes again and again. But the truth is we don't have to make those same mistakes if we tackle the stuff up front. So if we look at some of the drawbacks of cloud computing, there are a couple of issues that we face as testers or as people that are putting their data out in the cloud. And the first major one is transparency. Anybody who remembers a couple of weeks ago, the Amazon debacle, they got really attacked pretty hard about their transparency on that. Felton came out and said that they need to really step up to the plate and make sure that there's more insight into what they're doing, otherwise they're going to lose the user's trust. Privacy is a big deal as well. So on a small scale, you could be saying, look, I'm concerned about giving my email to Google. But on a bigger scale, what happens when you're outsourcing core business functions or your core data, like sales-related data, whatever it is? That thing goes further when you look at the legalities that are involved. So in essence, what's happening is you're losing your fourth amendment right to a warrant being searched before you get your data. So what actually happens is with the law at this stage in time, your cloud provider can be told to give up your data. And you don't even have to necessarily be notified about that. Never mind, have a warrant to give consent, which obviously is a big deal for a lot of people. One of the other big things is compliance. We don't necessarily know how to handle compliance in the cloud at the moment. So some people are doing some work around it, the cloud security guys.  Vendor locking is another one.  Or if you make a massive investment into a specific platform, how portable does that become? The big one as well is availability. So availability is one of the major promises from the cloud. It's always up. There's massive kind of scalable infrastructure. You can always get access to your data. So from a browser, from a mobile device, whatever it is. But a lot of people are failing in that space, even though that's one of the major selling points. So you look at somebody like cloud files, for example. I want to access my files. I want to write stuff up. But at the moment, it's in read-only mode, because they're having issues with their data center. All right, that's less than ideal. You could also look at someone like SugarSync, who promises to have all your data in your contacts and whatever it is synced at the same time. I want to try and access that data because that's why I'm paying for the service, but they're down for maintenance. That stuff doesn't scale very well. I mean, it's not the smaller guys. The big guys are vulnerable to that as well. Google App Engine had a really big issue recently. So if you're thinking about availability, one of the things you'd need to keep in mind is that it's not just about uptime. So when we were looking at this talk, we were pretty much browsing around looking for cloud providers to attack. And one of the first guys to come up is for disk storage was Usa.  Okay, how they handled people getting their data back is questionable. If you go to Tech Crunch, Tech Crunch lists a whole bunch of online storage guys you should be using or could be using. And what you almost see highlighted down there, almost see highlighted down there is them recommending Omnidrive.  Omnidrive is no longer available. We now recommend Nomadisk. Okay, so it's a big problem. It's something that needs to be considered. But as an attacker or as an auditor, something else that pops up is that it's not just stuff that's out of your control like this.   The other big issue that comes up is that by default if you're giving things away and you're outsourcing functions, you're automatically extending your attack surface. So it's one thing to protect your systems when they're in-house, but once that stuff is out there, other people can get at it. Even more so, a lot of things that are now out of your control can affect your security posture. So consider the case with a traditional phishing attack. Right, your users get phished, maybe they lose some email, maybe you give up some creds, whatever it is.  If anybody thinks that's not a big deal, we can talk about how effective user education is after the talk. I'm sure everybody's dealt with users and seen the phishing attacks. It's happened to some of the bigger guys, so everybody knows about the Twitter stuff. It's happened to some of the other big players as well. While we're on the phishing attack, all of a sudden now, again, like I said, you're not dealing with a loss of somebody's credentials or giving up some email, suddenly you can get phished and your entire data center gets given up because you've got one username and password for Amazon to buy books, and that same username and password grants you access to your entire data center. So it's a slightly bigger deal for what we'd potentially consider a lame attack. Trust is a big deal too, right? So the question we say is, why would we give our data to these guys? If we want to outsource this function, it's because we trust those guys, because they're specialists at what they do and we're trusting them to control their data. But there have been a couple of fails there as well, and a quick Google for cloud fails will give you tons of hits coming back on how those things have gone wrong. So interestingly enough, on IRC recently, I was speaking to someone who was talking about how much cost years, cloud break stuff. So for those of you who haven't seen it, it's a really, really elegant exploit that allows you to escape from VMware, and he was talking about how scary this attack is. And what keeps coming up is the point that while the attack is scary, and cost years clearly got more brains than some small countries, that actually that type of attack, we've got no reason to not fear that attack natively from Amazon, right? If you're running in Amazon's data center, you don't know that Amazon don't have a Trojan hypervisor already. All the hypervisor has to do is give them access to stuff that they want men to, and actually you've got no way of knowing it. So sometimes we tend to focus on the wrong threats. So if you take the popular phrase trust but verify, you'll find that one of the problems you have with the cloud is your inability to verify. So to some extent, reverse engineers keep Microsoft honest. If you remember back in like 1992 or 93, people found NSAID at DLL in Windows, and everyone went nuts because we thought there was something wrong going on, that stuff's almost impossible to do in the cloud. Even if you verified somehow that Amazon didn't have an evil hypervisor on your system today, you don't know that that's the same hypervisor that you're on tomorrow, okay? And it's just one of those things that you give up the moment you enter the cloud. So like I said, the problem is, even if they're not evil today, how do you know that they're not evil in the future? One of the things that you need to ponder, so I'm not sure how many of you remember, but a little while back or a long while back, the story of Swiss AG came up. Swiss AG was the Swiss company selling crypto to about 140 countries, and it turned out later on that Swiss AG was just a front for the NSA. So all these countries that were buying crypto were actually buying specifically weakened crypto so that the NSA could have access to it. I'm not saying any of this about any of the current cloud providers. I'm just saying that if they are doing it, you don't know, and you probably wouldn't find out. So another interesting angle is not attacking the cloud itself, but using the cloud for things that are interesting and taking advantage of the extra resources that we get. And a couple of researchers were kind of quick off the mark on this. So if anybody remembers back to the Debbie and Weak Keys debacle, Dino D'Iservi picked up on that really quickly and used Amazon EC2 instances to brute force keys. There was another case where Ben Nagy at his syscan talk, spoke about how he'd used parallelized resources for when he was building his metafuzz harness for attacking office. And some of the guys like Dave Molnar and Dynamics are also using it for things like malware analysis and fuzzing. So you get this ton of resources and it's kind of more cheaply available and you can really, really scale your attacks and speed things up. So with a background and some of the drawbacks out of the way, let's dig into some of the specific providers that we looked at. And the first one is Salesforce.com. We figured we'd look at Salesforce because they're the leader in the industry and pretty much everyone who's anyone is using them. So we figured they'd be an attractive target. Salesforce also gives you two things. So on the one hand, you've got platform as a service where they give you a development platform in the cloud and you can start to build your own apps or extend functionality, but they also give you the full software as a service stack.  So we took a look at them and we kind of started out probing them for traditional web app vulnerabilities. Again, we had limited time and we were kind of working at that stage without a mandate. So we were really, really careful about what we were doing so we only did cursory testing. But again, they hold up really, really well against that stuff and fully props to them for the work they've done. Ultimately though, what you're dealing with is a web application, accessing the stuff over the web. And everyone knows over the years that nobody makes web app mistakes anymore. So you've got a fundamental problem now where we suck at web apps as an industry. Now we tying the cloud to the web and things can go horribly wrong. If you look at the statistics on web app vulnerabilities pretty much from any source you come across, that stuff looks terrible. Nobody can argue that that stuff is good. And we've had a couple of high profile examples. So from Sammy in the early days on MySpace, through to multiple cross-site scripting worms of the same deal earlier this year against Twitter. Right? And if you think about Twitter... I need to interrupt you. Yep. I'm sorry, folks. You've got news. The good news is I will keep it short.  I'm sorry, I'm very upset right now. The slide on the screen is very apropos.  Police yourselves.  Stop them. The staff is flashing back to DEFCON 9, which was our worst DEFCON ever. You guys are better than this. Is there anybody here who doesn't like the hotel? Who doesn't like coming to DEFCON here? Would you raise your hand? Good. We like it here, too. Keep doing what you're doing. We won't be here. Do not bungee jump off the roof. Do not go to the roof. Carrying a concealed weapon in a casino is a big deal. Even if you have a permit for it elsewhere.   We're supposed to be in the top 10% in terms of IQ in the United States, if not worldwide.  Knock it off. I'm sorry. That's going to be a really hard act to follow. I'm going to leave you with the idea that if we're talking about web app security, look at somebody like Twitter. They've been owned so many times. All they're doing is they're putting out 140-character strings. If they're not getting that stuff right, what hope do we have for the more complex stuff? We decided to just demo a quick attack. It's a fairly overhyped attack, so I'm not going to go into... Everybody knows about the click-jacking bug. I didn't discover it. I don't want to take credit for it. But if we fire up a video clip very quickly, what you'll see on the screen is you've got... Kind of in the app, you've got tasks that can get assigned to a user in Salesforce.com. And to close that task, they kind of get listed like that. And if you just go through the motions, you hit the X button and you can kind of go in. You can check out the task. You can hit Save to carry on. So I'm going to skip ahead a little... Skip ahead in that guy. What we can do is if we fire up a malicious page on our site and we get a user to brass to it, essentially we can load that page as a frame in the background. And you can see it's kind of semi-transparent. So we did it like that for the demo. You could make that thing completely transparent or you could put up a punch the dancing pigs or the lolcats or whatever it is and force the user to click where you want them to click. But what you've got is within the page, you've got JS that will follow the user's mouse clicks. So what we can do is we can force them to click wherever we want them to. So in this case, we get the user to save their task. We do a refresh in the app and the task is gone. Simple click-jacking just shows that even some of the guys who are doing everything right can still be vulnerable to some of the smaller web app vulnerabilities. So for the Mike Myers fans out there, allow myself to introduce myself. My name is Mark from Sense Post. So we didn't get the intro right at the beginning. This is Haroon. This is Nick. So just if you need to figure out in your head who to give the credit to, it's probably to those two, Haroon and Nicholas. Okay, so I'm going to carry on talking about Salesforce for a little bit. I focused on Salesforce as Nick pointed out because they actually managed to split the software as a service and platform as a service quite nicely. So what they do as their core business is provide web-based CRM software for their clients and they've got a lot of clients and they're a big company. But they also expose that infrastructure and that platform to developers for third-party applications. So essentially they've got a system kind of like the App Store for Apple whereby developers can code their own apps and sell them to customers. So they've got massive infrastructure spread out across the world. But what's awesome for us, we're South African, we're kind of cheap. So they do provide us with free accounts to test with. They provide you with free dev account. And so we played with that to see what we could get. Our goal here wasn't to, well, while looking for exploits is fun, when you don't have mandate, it becomes a really, really gray area as we'll chat about later. So in this case, we're looking to find ways to abuse rather than exploit. Their platform. So if one wants to develop on their platform, basically they're three main components. The one is to write front-end. Front-end pages are written in a language called Visual Force. It's a HTML-like templating language. So you might be able to read that. You might not. You'll see that they've got custom tags embedded there with HTML. But that's less interesting for us. They also support business logic language that's kind of got sort of Java-like called Apex. But it is their own language there. And Apex is quite interesting for a number of reasons. What you'll find is that it supports interesting APIs. So for instance, you can make web requests from within Apex. You can also code web service endpoints from within Apex. So in other words, you can have business logic that runs when someone hits a page on your Salesforce site. And likewise for email. So you can send email and you can also have Apex that runs on the receipt of email. And then the third part of their platform is the data store. Obviously it's kind of an embedded database that they have. So when you're dev for force.com, you're either in Eclipse with a plugin or they've got this web-based dev environment, which is kind of cool. But the big thing here is that it's a multi-tenant system. So you share infrastructure with other people. So you need to quite carefully protect instance or organizations or accounts within Salesforce from one another. You can imagine if one account monopolizes the resources on the platform, everyone else suffers. So in order to protect users from each other, they've got a piece of technology called, right, so they've got a piece of technology called the governor. And the governor is, so it's built into their platform and it enforces all of the execution limits. So essentially any script that ever executes is subject to a whole number of limits.  Limits vary dependent on how and where your code executes, but your code at all times is subject to limits. The type of limits you'll see are things like the number of script lines that get executed, number of database queries, the size of the result sets from database queries, number of call outs, number of sent mails and so on, and those are all published. But they're also, of course, a number of unpublished limits that we bumped into along the way, which points to good thinking on their part. So things, the kind of unpublished limits you'll hit are a number of received mails as well as running time of scripts. But this language called Apex comes with a number of limitations. It's not a general purpose language. It's a business logic language. So you'll find that there are a number of primitives you'd like from other languages that just aren't present here. So things like, you don't have locks, explicit locks. You can't pause execution, they aren't real threads. There's no explicit shared memory and so on. I mean, you'll also find that the order in which you make API calls is quite important, just because of the way their system has been built. So this is less interesting.   They don't count, well, so they only count script lines rather than the size of the expression on each line. So in this slide, basically what we're showing is you can chain about 200 odd cube roots to pause execution, and that just counts as one line of script. So, but you'll agree, I'm sure that that's quite a horrible-looking hack. We also managed to figure out ways to do locks and synchronization. They do support one implicit lock mechanism. It's less important. Shared memory you get by default with the data store. You just have to write it as such. You also get access to triggers. So within the data store on certain actions, you can set triggers that'll fire and the triggers can do things like make other updates into the data store, send emails, send web requests and so on. And so we focused on trying to bypass the governor, because if you can bypass the governor, then you get access to a lot more computing power than was intended. And with their platform that's spread out across the world that equals both computing time as well as bandwidth. We really don't have a lot of that back home. So any bandwidth that we can get is gratefully accepted donations. No? Okay. So what we wanted to do there was to create a way to fire off a lot of actions, more actions than should be allowed, based on a single user interaction. So in other words, normally a user hits a script, it executes its subject to limits. What we wanted to do is to find a way by which we can hit a script, it executes and we get a lot more processing time, processing power than was intended. And so what we focused on doing was to create event loops. So essentially chaining together multiple execution steps of a single script. And the first way that we tried, which didn't work, but it's worth reporting on failures, I suppose, gives us time to talk here, was to create a web service endpoint that called itself. But that gets detected on their side. So the next thing that we thought of, but discarded fairly soon after that, was to have a third party.  But that involves a third party, so we did clear that. So what we finally decided on was to go with email. So essentially you can create email loops. You can imagine how that works. We send an email to a Salesforce address. It does a small part of the job that we're interested in and it then fires off another email to itself, carries on with the job, sends off an email once the limit approaches for that script, and so on. The loop continues.  You still hit an unpublished limit eventually, but it gives you more processing time than was originally intended. And of course, whatever job gets executed is then up to the user's imagination. We don't have much imagination. So what we came up with was SIFTO, which is essentially a port of the Nectar web scanning tool onto the cloud. So I'm sure most of you are aware, but Nectar basically scans a website for vulnerabilities based on a database that it has. And so we ported that, as I say, into Salesforce. So our little app will basically add your target website into the allowed endpoints. If you're a developer on Salesforce, you'll know what that means. And then it kicks off this event loop. And in each iteration of the event loop, you'll get results for 10 of the Nectar tests. And then you'll get an email coming through every time hits received. Of course, the question you're going to ask me is why would you want to do this? And as I say, this is a proof of concept for utilizing the cloud or a cloud platform or as an attack platform. You can fire up EC2 instances and scan the world if you want, but this is actually using a programming language within the cloud to also perform security testing. So for one, it's free. So as I said, you get access to a whole lot of infrastructure that we just don't have. You get a degree of anonymity, but of course they definitely do monitor as we found out. Okay, so I'm going to show you a little video of this thing in action. Okay, so this is us just doing the setup.   So all of this is now done through their web interface. We have an alert email that gets sent when a record is updated. So that's our trigger, which will help us kick off the event loop, and then the email address which receives the trigger mail is that. So as you can see, it's kind of a randomly generated email address that they provide you with. Less important. Okay, so what we've got then is a little shell script that wraps up all our calls to the site. In the one console, we're going to tail the victim's web log, and on the other side, we're actually going to kick off the scan. So you'll see that the request starts to come through on that console. There we kick off the scan, and now we start to see requests coming through in the web logs. So essentially, we perform one user action, and that's caused our scanning tool on Salesforce to kick off. So we bypass the governor limits. At that point, we can make a lot more web callouts than were originally intended. But I'm afraid there's no shells to be popped yet. Okay. So what we see then at the end is basically as results are found, they come through via email. At the end, we get all of our results via email. And I guess for us, the more interesting thing here is just that little slide that says, we started at 105, we ended at 116, total scan time, 11 minutes, which if we had to do from a single machine on the bandwidth that we have would take a lot longer than that. Okay. All right, so then we're gonna talk just a few pros and cons of the approach. As I say, this thing is a proof of concept just to get an idea of what can be done in on custom cloud platforms. It is free, you get lots more bandwidth. Of course, the question about denial of service does come up here. We're not gonna talk about it too much. There are a few cons that are listed there. So the one thing that's immediately obvious is to say, look, you only had 1500 possible iterations, now what? Well, that's true, but the converse is also, well, not the converse, but there's an alternate approach which says that a cancel is zero cost. So actually we can register one account that will perform 1500 iterations. We can register a second one which we'll carry on with the next one. We can register a third one which we'll carry on with the next 1500 iterations. Okay, so we can spread it out horizontally instead of having one account responsible for all execution. And of course they can communicate via email. So for this, we needed to have a whole bunch of accounts so we needed to auto-register. There's a problem. The registration page is protected by Captcha, not a particularly strong one, but it's there. However, we found when we pulled the Captcha, actually just on the command line, they had a unfortunate print R at the end of their Captcha script which just dumped out the text of the object. So actually it was there. Ready? Okay. To their immense credit though, they fixed that within 15 minutes. So I think that also probably deserves a round of applause. Okay, so at this point we now have 200 accounts. They spread out around the world. And so at this point you can then do that horizontal scaling. Yeah. So some of the things that we figure should be pointed at are basically, Cyfto is really basic, but it does hint at the possibilities for attacks from within the cloud. Their platform is developing rapidly. They're already on API version 16. And so we'll be monitoring that as new features become available. I think the third last point there is of most interest in the sense that we now have the security for an organization is transferred to your Salesforce administrator. And in many cases that's actually a C level executive. And this is the guy who's getting fished on a daily basis. He's not, and fair enough, he's not a security guy. This isn't something that he should have loads of knowledge about. But if he gets fished, they go all your customer data. So something to keep in mind. Yeah, one last thing there. Salesforce was really positive with the interaction with us. So we just wanted to acknowledge that they fixed the bugs and they've actually been quite cool to work with. So that ends my Salesforce stuff. I'm gonna hand over to Haroon to talk to you about Amazon. Okay. Okay, so we've got Amazon, Amazon and straight after that mobile me coming up. So really quickly, Amazon Web Services. We have to say right at the start is cleanly one of the coolest things we've worked on for a long time. The ability for a shell script to fire up 20 boxes and some data center somewhere, do some work and then send you back some results is really cool and well worth fiddling with. The pieces that we'll touch during this talk, we're gonna look at EC2, which is the elastic compute cloud. S3 will touch on SQS, which is their queuing service and dev pay. We're not gonna look at a whole bunch of others right now, although we're doing some of that testing back home, we're not ready to talk about some of it. So EC2 really quickly, if you break it down into its simplest form, you hit a webpage, if you want to, you can do it from the command line.  Okay, it's got a whole bunch of other functionality which we're not gonna need right now. S3, it's simple storage service, relatively easy to understand, it's storage in the cloud and it works with a bucket model. Okay, for all of the services, Amazon's trying to get support, their pricing's really good, really attractive. Some people differ on the EC2 costs, but for lots of uses, you'll find it's a really quick, really reasonable way to get machine time. If we look at S3, there's a Firefox plugin called S3 Organizer, so it gives you pretty much an explorer type view that allows you to drag and drop files around. Its usage is increasing, January 08, it was storing 14 billion objects. Okay, and something that's gonna come up in a little while to bite them is the fact that it's pretty much got a flat name space. Okay, which means you get to choose your bucket and if you grab your bucket early enough, then that bucket is yours. Okay, so nothing stops me right now from grabbing a bucket called Defcon and going into the future, nobody else gets to store something as top level Defcon on S3. This doesn't sound so bad, but we'll be able to use it for fun and profit shortly. Okay, so one of the quick things that come up when you look at AWS is its feature for auto-scaling. Okay, it's a really big promise. Well, it's a really big promise with the cloud and basically it means you don't have to plan for peak usage anymore. You can basically have your app rise and fall as it's needed. Okay, of course you can probably see where this is going to start going wrong. If you take Amazon's SimpleDB, SimpleDB gives the site the opportunity to charge depending on SimpleDB usage, which basically means that you, with your little WGet script, can start adding cost to the guy who's using SimpleDB in the background. Okay, now the immediate response is we've bumped into this problem before. It's the same thing that happens with click fraud and with ads, except that with ads, the system self-regulates somewhat. If you get a bazillion clicks and only three of them convert, the price you're willing to pay for your ads go down. Okay, in the case of SimpleDB, you paying a price based on number of hits, whether those people actually buy from you or not. Okay, so there's actually less incentive for that problem to be fixed. Google have to fix click fraud because if they do it, if they don't, it devalues their ads. If there's the equivalent of click fraud happening on SimpleDB, you get poorer and Amazon gets richer. Okay, so we were looking at what we could do with AWS and we didn't have ideas initially or I didn't have ideas and probably a safe thing to do in any such situation is to copy Marco. So what we were trying to do was just see if we could steal resources from Amazon. Okay, they put the stuff up, let's see what we can steal from them. Turns out we can or we could. So if we take a really quick look at how this works, what you're seeing there is the page that comes up when you log in to the AWS interface and you now want to boot up some machine. Okay, what's interesting to note is what you should see at the time that screenshot was taken, that there's 2,800 just about machine images that you can fire up. Now interestingly enough, only 47 of these images were built by Amazon. Okay, all the rest are user contributed in some way or fashion. Okay, so you should be starting to get worried already. Now with these shared AMIs, what's interesting is people basically take an Amazon AMI or build one from scratch, bundle it together, then upload it to S3 and share it with the world. Okay, so the first question is, how many of these people are doing it right? Before you even wonder about how many of them are evil, just the question of how many of them are making mistakes. So if you troll Amazon's forum pages, you'll find a whole bunch of forum posts from people who are claiming or complaining that they can't get something to work right. And if you actually look through at the cause of their problem, you find that they've actually uploaded their secret Amazon credentials to the Amazon instances and then given these instances away. Okay, now all that means is you've got to boot that image, take those credentials, and now you transact as those people when you're transacting inside of Amazon. There's also the question, and Amazon's taken some heat for this, that they provide kernel images and how quickly they can keep up with the vulnerabilities that seem to be coming out quite often in kernels today. Okay, one of the problems that you've got here is you can't just scan machines in the cloud. Even though Amazon say, so officially Amazon say no scanning in the cloud, it transgresses their EULA.  But one of them is a legal document and the other one is something that Amazon said. Okay, so right now scanning in the cloud is dangerous. So we needed a quick alternative cause remember the intention is we're trying to find other people's credentials so that we can use it. And so what we hacked together really quickly was a really ghetto scanner. And what the scanner does is it goes out, gets a list of all the AMIs and builds an SQS list with it, SQS queue with it. So SQS is just a normal queue except you keep it in the cloud and Amazon pay charge you a little bit of money to use their queue. They handle synchronization and all of that cool stuff. So we get this list of AMIs. We then fire up 10 images. Okay, each of those images go to the queue, pull down one of the images that's listed. It then fires up that image and then proceeds to scan that image. Okay, and in this case, we're doing really simple scanning. We're doing a NASA scan. We SSH'ing in and trying to steal stuff that looks interesting from their file system. Okay, so what we're looking for there is keys, passwords, bash histories, MySQL histories, stuff like that. We then dump the results to S3 so that we can grab them offline later. Okay, so the first thing is we were really surprised because we thought we'd find some stuff, but it turns out you actually find quite a bit.  Only marginally interesting, what's more interesting is those are all user credentials that were left on these images. Okay, so these are all Amazon.pems or Amazon passwords, and they either left clean on the system or people have left them in their bash histories while they were doing stuff. Okay, what you're seeing there are certificates and key pairs, okay, all just left on those machines. So at this point, they ours and we can be them on Amazon. So while we're stealing stuff, the quick question becomes, can we steal licenses? Also turns out to be yes. So if you go to Amazon, you get to boot Windows images. We then use the Super Elite Magical Jelly Bean. So it's just a utility to steal, to recover licenses from your own machine. At this point, we're taking Windows Server 2003 license, which it gives us. We then take this back to our house in South Africa. We put it on our own Windows 2003 server and it happily registers for us. Those machines even allowed the past genuine advantage, so they even allowed to install updates from Microsoft. So we now run Windows machines also. So if we stealing stuff, we decide not to stop there. Amazon also provides something called DevPay. So with DevPay, someone gets to put up a machine and then gets to register it with Amazon saying that they wanna charge for its use. Someone comes along and wants to use it, they pay the guy, they get a product code, they then get to boot this machine. Okay, I'm gonna quickly try to show you a video. So DevPay is really cool. Essentially, they're offloading a whole bunch of work that you no longer have to do. So if we look at it, and I'm gonna speed through lots of those videos because outstandingly, we shortened time again. So what you see here is if you hit Amazon, what you should see down there is a product code that I then pay for. We pay for this, we then fire up that machine and what happens is every time we fire up this machine, the original guy gets paid for it. Okay, so Amazon handle that separately and we don't particularly care about it. If you see down here, if I describe this instance of mine that's running, what you should see up here is there's a product code attached to it. Okay, essentially this just means that I'm getting charged extra while this runs. So what we do here is we quickly bundle this image which is a normal functionality on an AMI and once we've bundled this image, we upload this back into S3. Okay, so essentially I've paid for it once, I've then made a copy. What I'm gonna do for demonstration here is make two copies, imaginatively called copy one and copy two and we're uploading this to Amazon. Okay, once this is uploaded, we then go back to S3 and pull down that machine's image manifest. Okay, so the image manifest basically says this is what makes up the machine and if you look through the manifest, you see here it's got an ancestry. Okay, which basically tells it that this machine was once Nick's machine which we paid for. So at this point we're feeling quite proud of ourselves. We remove the manifest, we remove the ancestry, we upload it back to Amazon and we try to register it. Unfortunately Amazon come back and say that's an invalid signature, this is not gonna be allowed. Okay, it turns out there's not a lot more needed so we grab it again, we remove the ancestry again and then we use the tools that Amazon give you for bundling machines and we re-sign the now modified request, we upload that to S3 and this time it allows us to register so effectively we can now run that machine from now on and there's no tie to the original image which we should have paid for. Okay, so I'll kill that really quickly, go back to the presentation just because there's a lot of it and we're running out of time. So if that's Nick's deal, the other thing that needs to be considered really quickly is even though the cloud provides us with a lot of stability and high availability, Amazon itself becomes your single point of failure. Okay, and the normal response to this is it's Amazon. If anyone can handle DOS, they can. If you read Amazon's docs, they talk about DDoS prevention and how they're willing to stay up despite DDoS attacks but attackers are not DDoSing you like it's 1992 anymore. Okay, nobody's sin flooding to take people down and if they go down for that, they deserve it. So what Amazon does is they prevent you from firing up more than 20 machines.  Okay, so what we did, what we did, sorry. Okay, so I'll skip the video just because Marco says so. But effectively what we do here is it turns out you can sign up Amazon accounts without any capture or without anything stopping you. Okay, so a really quick tool script allows you to register hundreds of users. So really simply what we do is we take one script and that script creates 20 users and each of those 20 users go ahead and get 20 machines and each of those fire up 20 machines. And what you look at if you look at the graph of how that grows is by the ninth iteration, you're gonna be firing up close to 800 billion machines. Okay, and this is gonna cause them some problems. So thank you very much. So we want one more way to steal machine time and it comes from Amazon and that's basically when you get a machine, you don't know that that machine wasn't pre-owned before you got it. Amazon give you the six point bullet list but six points is not enough to know that your machine hasn't been owned. Okay, so what we do is we want to take an image, upload it and get someone to run it. The first time we do this, it turns out that we register our image, we upload it but it shows up really low on Amazon's list of machines. So I'm gonna skip through the videos and talk you through them for the most part but basically your image shows up like on page 200 and nobody's gonna run it. So what we do is we wrap that in a little script that registers the machine, checks the AMI ID that it gets. If the AMI ID is too high, it deregisters it and registers it again because those things are assigned to you randomly. The first time we ran it, we ran it overnight and by morning we'd gotten an AMI ID that now showed up in the top 10 which now means that when people go to the page, your image bubbles right to the top. Okay, the second time we ran it, we got a top five hit in under two hours so you can race it but that's not all. Because it turns out that, you remember I spoke about the name grab thing. Okay, because you can grab names as you want them, you can also make your image more attractive by naming it better. So what we do is we try to create something called Fedora. Fedora's unfortunately taken. Eventually you find names that work for you, underscores are cool.  Okay, so that thing bubbles to the top really quickly. At the time we did this, we did it at home or I did it at the office. By the time I drove home, two people had already booted our machine. Okay, and this is now our machine running in the cloud that we don't care about anymore. Amazon also don't do any outbound firewalling. People ask about it on the forums. People actually reply saying, but why would you want outbound firewalling? Okay, so welcome to 1990. So really quickly, I'm gonna touch on MobileMe. A long time ago, people figured out that MobileMe disclosed usernames. And basically if you go to the MobileMe page as Bob the cat, everyone on MobileMe gets a public page. Bob the cat gets told no such page. Fundavolt gets no such page. Shell Fundavolt, you get a public page. Okay, so we now know Shell exists on the system. You can now take all of Apple execs and start looking to see who actually uses MobileMe. You see Steve Jobs has an account which should mean you can mail him at stevejobsatme.com. But it turns out that one's not used. Notice that if you go to Steve, you actually see one with a 75 gig option and you can't buy a 75 gig option on MobileMe. Okay, so account password resets really hard problem to solve in the cloud because essentially someone who doesn't know you has to trust who you are.  So I'll go to my last demo quickly.  So if you go to MobileMe what you'll find is they have a password reset scheme that's basically based on secret questions. Okay, so once we find out that Nick exists, you hit his secret questions and so initially all it needs is his me at me at me.com address. Okay, so you don't even have to know the guy's real address, you just know his name. It then also gives you confirmation of his private email address. So you can confirm that it's the right guy you wanna attack. Okay, it then gives you secret questions. The first one is his birth date which almost everyone gives away free on Facebook on the Amazon wish list. Okay, and then it asks you a secret question and those things fall pretty quickly. So once we've got access to Nick's MobileMe, the question is what else we can do with it? Okay, because we can reset his password but shortly Nick's gonna come back and change his password. So what we wanted was permanent access to Nick's account and we found it in the stolen iPhone thing. Okay, we've gotta go. Basically what we do is we take an iPhone, sync it with his account except we also go into, we also go into iTunes and rename my phone script alert high so we rename my phone malicious JavaScript. My phone now syncs with his, we've gotta do some JavaScript taxery to get it right but essentially once we've gotten over those hurdles every time that Nick goes into his MobileMe page as long as my phone's there, my JavaScript runs in Nick's browser and when Nick tries to do a who am I he essentially runs our script and we own his MobileMe forever. Okay, so while doing this, we actually tested and found Steve Wozniak's account logged in to his mail just to show him how it worked. Turned out he was really cool about the whole thing. We've got conclusions which you can read off the slides. We in the room for questions. Room 103 for questions. We wanna say again, Apple were really quick to fix their stuff. So were AWS, so we only told AWS about it yesterday. They've already put in fixes for some of the stuff. Salesforce.com ready with their fixes. Other than that, you can get the stuff from our website. We should write up more of the stuff. Thanks for your time.


All right, welcome to our lightning round session on Big Talk from Small Libraries 2020. I'm Krista Porter, your host here at the Nebraska Library Commission. It is noon central time and we are going to start our lightning rounds. This is five 10-minute sessions, some quick information from some libraries. First up, we have Carrie Adams. Good afternoon, it's afternoon, good afternoon, Carrie. And she's going to talk about can a new library webpage overcome a small library challenges? And she is from Baptist Health Science Libraries, which actually their population served. I think they are the biggest one we have today at just 9,000, still on this smaller than what some people think is a small library. So I'll just hand it over to you, Carrie, to take it away. Thank you so much. Hi all, thanks for letting me speak to you today. I'm talking today a little bit about how we, as a small library, overcame some challenges using technology to support a large hospital system. Baptist Health is actually a diverse health system serving northeast Florida. We have over a thousand patient beds. We have five hospitals, two standalone emergency centers, physician offices, health center clinics, outpatient services, we're a magnet award recipient three times now, which is a gold standard for nursing professional practice and a grade A from the LeapFrog Hospital Safety Group. But we are in Jacksonville, Florida, which is the largest city by area in the contiguous United States. So our clinicians are very dispersed throughout the different locations. So the physical library isn't their source of information. The online library is, and a lot of times it's the only source of information or the only contact they have with the library or the library and ever. So we did need to do some changes because it wasn't very usable for a lot of our clinicians. And our clinicians have a need for immediate access to evidence-based information to support patient care. Our web team, our organization web team actually ran the library webpage. So it also made it difficult to do immediate edits or quick turnarounds and changes. This is what our original webpage looked like. It was very functional, but unless you're already familiar with what resource you needed or how to specifically do a search, you're really hindered. We don't have an easy way to do a general search of the resources, things like that. In addition, we have a lot of clinicians coming out of school. We have residents coming from med school and we're promoting our nurses to return to school to get their bachelor's, master's and doctorate degrees. So a lot of our clinicians are used to more of an academic field to their webpage with that one search box. So the process we undertook was first to survey our patrons, both our users and our non-users. We thought it was really important to survey our non-users to make sure we're missing something that was essential to their practice and that's why they weren't using it. So our current users were asked how to rate their satisfaction, what they've had challenges with in the past with the library webpage and the recommendations for improvement. Many said that they had problems accessing full text articles, which is really important for them, searching for information with eBooks and remote access from their personal devices. So those were all really important things that we needed to consider when we were deciding whether to undertake this project. They actually suggested improvement. Again, that full text access was really important to them but also better organization of the resources and easier search options. Those non-users we reached mostly through print surveys because they weren't coming online to use the library webpage. We did a lot of meeting attendance to try and reach them and they were asked why they didn't use the webpage and the majority of them almost half said that they didn't know it existed, which was its own problem and we're undertaking some steps to fix that right now. Others utilize other resources such as their school library and many said they just didn't have time. So we really needed to streamline the process to be able to get them the information they needed. And we asked them also what is most important to them in the library web pager, moderately split across the board on the options but they did have a slight preference for again that organization and ease of searching. We also undertook some usability testing with eight volunteers and we gave them specific tasks to try and locate information on the library and then ask them how they felt about it. And that verified the anecdotal evidence that with all the technical requests and service calls that we were getting and random help questions throughout the emails and processes that our super users were really adept at accessing the information they needed but even they had some issues with some of the tasks but our novice users found many of the tasks extremely frustrating and difficult to accomplish. We also asked for, we had a lot of open comments available on the survey process to fit to the depth of what the issues were. We actually had really high, pretty high user satisfaction responses, 70% that they were satisfied or extremely satisfied but the comments told us a different story. And the comments told us that they were confounding library services with the online library. So if you notice on that left side of the diamond you have a blue, pretty large librarian and at the bottom of the diamond another blue, pretty large carry. And a lot of the comments were saying if I can't get it, the light walk call the library. If I can't get it, carry can get it for me. I really appreciate the turnaround time, et cetera, et cetera. So they were really happy that we were able to get the information for them but they weren't able to get it themselves which was one of the big problems. So how did we choose? We could redesign internally with our library web team who were fantastic but that still wouldn't give us control over the web page but it would be technically free at least from a budgetary constraint for our department because it's an organizational cost it wouldn't hit our budget line but we would not get that single search box which we thought was really important and it would take a long time to get this turned around because we're in the middle of a lot of technical processes of revamping some different resources for our clinicians. So we also looked at the outside vendor service that would be a budgetary cost which was an issue and it could hinder buy-in from the information team. They don't often like to use external resources when we have them available internally but the turnaround time would be excellent and as we tested the different resources we actually did get buy-in from information services which was a shock almost but we actually were able to go with an external vendor and based on feedback and cost and the offerings that they had we went with the Avid Discovery service which was really well done we thought for our needs and a lower cost which was also important. So after we created the page we went through the process of spreading the word and how did we do that? We first started by sending a link to our super users to get their feedback to make sure we weren't missing anything that didn't transfer from the last page and we also did the same thing we presented demos to some of our more spoken clinicians to get their feedback. After that was done and we determined that everything seemed to be running really well and we got really good feedback we had a soft opening where we kept both the old webpage and the new webpage live for about six weeks the old webpage had a big banner information linking to the new webpage to try it out letting everyone know that it would be gone in a while and we also presented the information to our organizational magazine to reach those non-users again we had flyers printed and distributed both print and electronically with a QR code and we hit a lot of meetings mostly global meetings asking leaders to distribute the information also our shared governance nursing meetings so they could distribute to our nurses and our different interdisciplinary meetings so we could try and reach all of our clinicians and staff that would be using the resource. So what happened? We went fully live June 2019 and as you can see the usage went up exponentially if it stays we'll have to see in 2020 but we also had some excellent resource usage as well that went up our books actually went down a little bit because we realized that not all of the books made it over to the new page. We had some unintended consequences our document delivery actually went up we thought it would go down we made it very easy to request articles but we think that's helping with the frustration it took a lot longer to make personal accounts than we expected and we learned that relationships are important. Our help questions went down which is really important and our feedback has been excellent and we are able to put out information very quickly for example, we have the latest research on the coronavirus out right now as soon as it hit the news we were able to prepare our clinicians for any information and that's about it for me I'm happy to take any questions and thank you so much for your time. Yeah, awesome. All right, thank you Carrie. Yes, anybody have any questions for Carrie? We have a couple of minutes here where you can ask any questions type them into the question section of your go-to webinar interface. Nobody asked any questions while you were talking but that's okay. I'm glad you mentioned the coronavirus there that's something good you have there the people another place for people to have it something very timely and important. Yeah, it's interesting to it was interesting I think to hear the misconceptions, confusion people had about your website that was already out there. It's I think something that a lot of people everybody struggles with I think we are this and you don't know what we are how could you not know that? We've been here for so long. Well, yeah, it's being a solar librarian it's difficult to reach. Yeah, I mean we're not supporting we have 9,000 staff and employees but a lot of those aren't actually using library services because they don't necessarily need to but the ones that should be using it don't always know that it exists because being a single librarian be difficult to hit night shifts you know we're a 24-hour operation so it can be very difficult to spread the word so we take what we can get and try and get it out as much as possible. Yeah, and so do you maintain the website or yourself now or with somebody else? How's that being done? I have support with our Ovid reps that can help with assistance but I'm able to update and edit immediately whenever something strikes my fancy. That's much more control, much better, yeah. And then one other question did your one aftergraph show the database usage declined after the news site? Is that correct? What was that all about? It did go down slightly we think our theory it went down about 15% for the database searches but that's not including that single search box so we think that that's really had an effect to pull people from the databases when they need that just-in-time clinical information that's kind of what we're pushing it for versus doing full research and full evidence-based practice but if they have a quick clinical question that's where that one search box comes in and if you add in the usage of that one search box the usage itself actually went up 14% overall so it's there, that's our theory we'll see if it continues. So it's just change in usage but one that is more a positive one declined isn't always a bad thing depending on what's happening around it. Exactly, we definitely make sure that they know that they still need to use the databases for their full literature research and evidence-based practice but when they have this quick clinical questions like how do I insert a Venus catheter access device or how do I do this or what's the best medication for this that's where that one search box comes in. Awesome, all right, make sense thanks for the explanation. All right.


I'm back, what have you done to him? You delivered my wife yesterday, are you angry about that? You have no place in his body, he belong to Jesus Christ, enough is enough. She cannot give testimony, why? She has a light, oh she has a light, so does he. Now come out of him, come out, how long I've been living in him? Since birth, what have you done to his career? Everything is destroyed, his marriage, his family, who are you in the first place?  He is not married in this world, he's married to me. How you say what? He's not married in this world, he's married to me. Oh he's married to you? Yes. Right now Jesus Christ has come in to disconnect you from him, he belong to Jesus.    Out of Jesus Christ, he is the Lord of Lords, the King of Kings Bow. I command you in the name of Jesus Christ. Now go out of the name of Jesus Christ, out of him. In the name of Jesus Christ. In the name of Jesus Christ. in the name of Jesus Christ. But again, enter Him in Jesus' name. Thank you Lord. That's the end. He is free. Praise the Lord for this man's deliverance and his freedom. So he is free. Come my brother. Glory to God for the liberation of this man. We are seeing how the Holy Spirit, the Holy Spirit is destroying all the work of the enemy. So now you can go and get married now. Okay? You have a wonderful home. Before now, you cannot get married. Before now, because the demon will not allow you to get married. But now that the demon is out, this is your beautiful wife. Go and get married to her. Thank you John Sheehan. Thank you. Thank you Jesus. Thank you Jesus.


Okay, here I am and I'm going to show you really quickly this numerical calculations. This is an open office. I'm going to go fast, but all this stuff is online too. Okay, so I am going to start off, let's say I throw a ball up from y equals zero at three meters per second.  Units, it doesn't know any units, so you just got to tell it whatever. I'll call it velocity, I'll call it v zero, let's say it's four, I'm sorry, I wanted that zero. Okay, and then I need to know two more things, dt. This is the time interval between each calculation, and then I need the acceleration. Notice here that there are no units. You could put units over here if you want in this next cell, but don't put them here because the spreadsheet only understands numbers, and if you put letters in there too, it doesn't know what's going on. Now for each time step is going to be a row, and so the next step will be the next row and so forth. So I'm just going to put some labels up here, I'm going to call this a t, I'm going to call this y and v. So the first time is zero, so I'm just going to put zero. And the next time is going to be this time plus the dt, the time step. So I'm going to say equal, that means I'm making an equation, and then I'm going to click this cell, see I put a seven, that cell, a seven, and then plus this. Now in here I'm going to add a dollar sign. So what this does is let me go ahead and press return, and it did that, zero plus point one. Now if I grab this little square box in the corner, it's called the fill, if I drag that down then the spreadsheet says I get it, I'm going to now, if you look at the formula up here, take cell a eight, the one before it, plus b three. And it didn't change the three because I put a dollar sign in front of it. If I didn't have that, let's go back up here. Take the dollar sign out, press return, I get the same thing, but now when I pull it down I get something different. Because then it goes, if you look right here, it says oh I get it, you're moving down, so it moved down to b four instead of saying it b three. So let's go back up here and fix this. Get it? Okay. Copy that down one. Okay, at the first time interval, what's the y? Well, that's just equal to this. And again, I don't want that ever to change, so I'm going to put a dollar sign there. It doesn't really matter in this case. And what's the initial velocity? Well, here's the initial velocity. And why am I doing it this way? Well, let's say I have my calculation and I want to re-run it for a different velocity. If I change this to three, it changes. And this actually is going to make it better, trust me. In a later program, I could have calculated the acceleration in this final column, but that's not going to matter in this case because it doesn't change. Okay, after .1 seconds, what's the new position? Now here's where we're going to use the magic. The new position is the old position plus the velocity. Well, I haven't calculated the velocity yet, so I can't use that. So I'm going to cheat. I'm going to use this velocity. It's wrong. If my time's up small enough, it won't matter. So I'm going to say equals the position before it plus this velocity times the time interval, which is this. And again, I need to put that dollar sign there and return. Okay, so after it has .1 seconds moving at four meters per second at a constant speed, that's what I get, which is wrong, but close enough. Now with the velocity, again, I'll say it's equal to the velocity before plus the acceleration, which is this, dollar sign because it doesn't change, times dt, which is this. Dollar sign because it doesn't change. Okay, again, that's wrong, but it's going to be close enough. So now I have all these values for time, position, and velocity. I can just drag it down for as far as I want. Okay? So this, I'm going to show you this gives you better results, but look. How high did it go? Well, here, this is, look, what's the, here, it went one meter, okay? We can check that, we can do an analytical calculation to find out how high it would go and see that this isn't the right answer. But how long was it in the air? Well, that's when it got back down to zero around, somewhere around here, so about .9 seconds. Okay. Let me show you one quick thing. What if I make the time step smaller? I'm going to make it .01. First thing you'll notice is that it doesn't calculate enough. I'm only up to .5 meters, so I need to have more data. I can go down as far as I want. I want to get down to y equals zero. That'll be the full motion. Okay, there, I'm just about there. Okay, there. So this is t, it took .8 seconds to go up and back down. And then the highest point, I can just scroll up here and look for the highest value, here it's somewhere around here, 8.4, about 8.84. So the first calculation wasn't too bad, okay? So you can play around with this, you can make a graph, which I'm not going to show you how to do, because I don't want it to be too long. So there you go. That's a simple numerical calculation in a spreadsheet. It can get more complicated, but that's a great place to start.


Friends and thank you for stopping by. I am Yoshida and this is Norris Cove. Today we're in the Fubonichi, the Happy Nichi. Whatever you want to call it. So let me get to last week. I'm just jumping right on in. This was last week. I love this. So I'm kind of going back to the basics. I didn't pre-map it out. I thought about using my thin washi tape to make the lines which I think I'm going to do. And I have this washi here. So I'm just gonna start. I'm just gonna rotate these pages because you all know I will mix up some pages. So and our background is back. Okay you all. So let me zoom in just a little bit. I don't know. I'm stumped. I don't know what to put. But I think I'm going to use this. I'm just gonna rip this whole page out because I'm pretty sure it just kind of came to me. You all know how I do. I was like I don't know what to use. So I'm just gonna place this here. I believe down here at the bottom. Yeah I was stumped. Like I don't know what to do but I saw some blue in here and it just reminded me the blueish green that's in this purple. So we're just gonna go for it. Because I didn't have anything in mind and I tend to try to have things in mind. But I didn't today. I didn't. Well let me stop I never have. I never hardly ever have anything in mind. And I just create on the fly sometimes. But to me it's like better that way. Like if I just kind of create as I go along whatever grabs my attention. I plan to use all of these. So that's why I just took the whole page off. And then I'm gonna find something to go with it. I've been on Instagram pretty much the whole day. Well so today is Friday. And so if you follow me on Instagram I've just been showing out because I finally got a new phone y'all. So people can hear me now. So I'm enjoying posting and people can actually hear what I'm saying. So next I'm working on a new. I'm trying to get my credit up because I need a new computer. And I want one so bad. But I gotta pay off some debt. Let me know if you're following me on my debt journey. Well it's not really a debt journey. It is I'm doing a new series on my channel. It is for the self-employed. You know budgeting for the self-employed. And that's what I originally wanted to make budget kits for. But somewhere along the line I got lost. I'm just sliding this up a little bit. I got lost and you know I tried to make them for everybody. The everyday working person. And that's still fine. But I need to look out for myself first. That was the main goal. And then my self-employed people. So yeah so I'm starting budgeting again. I stopped the budgeting because I thought that I know I'm crazy. I thought I got a letter from the IRS. It was a little suspectish and I should have known. Well I guess I should have known because I still don't know. But I just said screw it. I'm doing my budgeting videos. You can't stop me. But I felt as though because I owe the IRS so then I was like you know people can nail just googling things they want to know about you. And when you google me I know my beauty channel comes up or what have you. So I just didn't want to be in no more trouble than what I am. You know what I mean. So yeah going together. So I just backed up off of doing those videos. Even though I backed up off doing them I still was budgeting but I wasn't. It's okay. So I was still budgeting but not the way I was when I was doing the check-in. I wasn't just keeping even though I write my budget down every day and I write down what I make and things like that. I wasn't more focused on my goal and I noticed when I was budgeting I had set a goal and my income actually was going up. Because I think I was just more focused like not necessarily on that goal but I was looking forward to the week ending to see how much I made. So yeah I have to go back. So I'm not saying screw the IRS. I ain't saying that because we don't want to say that. But I'm just saying you know it just is what it is. So this is all Lord I'm using. I hope I got some more of these because I have used all of these on this page. And I wanted to put some over there where we got a few to make it a little bit tight in. Okay so I have an extra sticker paper. Let's see if we can find some more of these banana leaves. I believe that's what they're called. This is going to be tropical. That's what we're going to do. We're going to make this real tropical. Now see if I knew my books I would know that where the other ones are. Oh here we go. Got some. Y'all I'm going to tell y'all in real life I'm just silly okay. Sometimes too silly. That's why I be laughing at myself.  I shouldn't put that there because I covered up the little piece that was there. But anyway sometimes I'd be trying to remain my composure online so y'all don't be like this girl is nutty. But I believe in being I don't care what you do. Be your authentic self. You know I'm not going to say I always have to learn the hard way. That's not what I'm trying to say. I thought about something. One day my daughter she to me has a big personality. I mean even from when she was a baby and I used to be like oh my god this girl is too much for me.  You know and you did you couldn't really you know be yourself. And I think so many times like kids um this will be so many times we shh kids. And I had to kind of realize that with my daughter like I want you to be yourself. So I was saying Lord I got sidetracked. We were in the grocery store one day. Hold on y'all I'm looking for my dates. We were in the grocery store and my daughter she loves to just break out dancing singing and um especially dancing. And that used to be me but I don't know what happened. I think it was just all that you know girls don't act like that calm down. And um so being that's the way I was raised. So I said to her shh stop doing that. It's calm down. And so one day this lady walked by and my daughter was doing that and the lady said um she said dance baby. She said I love to see um kids dancing and just being themselves. And you know what it took me a back a little bit because I was there trying to hush her. And it let me see that that's what's wrong with the world today. We're told so many things and we should just be our authentic selves. Like we should just why why did we stop. Okay you guys I can't find the date so let's take some marker that same marker. I should have used blue but this one too. I'm just gonna write the dates. I was looking for the days of the week and I know they're in my journaling book but I'm just gonna again write them in. Yo I'm just rambling okay. I was saying let your children be their authentic selves and let's practice being our authentic selves. Um I was saying that we have probably been taught to be fearful of so many things. We're doing the scripture writing on fear and for the things that I'm fearful of I believe may have been instilled in me to be fearful of things and I didn't really kind of get that way until I got a little older and was told to stop doing this don't do that. This is going to happen. That's going to happen. Let children not be fearful. Let them be themselves. So and let's be our authentic selves. So this is my spread for the week. I am digging it. It's giving me island vibes. And that's the Fovonichi for the week. Thank you all so much for watching. I hope this video wasn't too long. I've probably spent through some of it and if you enjoyed today's video you enjoyed what you saw and you want to see more please come back. I'd love to have you and welcome you to the Cove. Hit that subscribe button. Also hit that notification bell and I'll see you in my next video. Bye.


If this, as Sobhi pointed out, if China could get away with this, we will see the same model, same method, same repression, same camps all around the world. The Chinese government already, through global times and its embassy here in Washington, promoting this idea to solve so-called world's Muslim problem with a similar method. New York Times cited 18 countries already in the process of adopting Chinese surveillance technology. There's a police cooperation. As we speak, the Hong Kong police are learning from the Xinjiang police to suppress the protesters in the streets of Hong Kong. So this is a real problem. This is a global problem. So it requires a immense global reaction.


Picture this, a typical day in your life, everything is seemingly fine, nothing is out of the ordinary, then someone makes a comment or a facial expression or anything that might trigger you and in the blink of an eye, you can't breathe.  If you're sitting on a train or in a classroom or behind your desk at the office and it happens, you have to try to suppress it so no one gets alarmed or you have to dart out of the room as fast as possible to a quiet space so you can let it come full force so your insides don't explode from holding it back.  I've learned through the years of these incidents that letting the panic attack take its course is probably the worst way to handle it. You think in the moment that by crying and screaming for a few minutes you'll feel better, it will alleviate the pain in your body and mind and get it all out, in fact it does the opposite. By submitting yourself to the panic attack it gives it the power to grow and become stronger and more intense.  Anxiety is one of the most common sensations that humans experience, yet it can be detrimental in severe doses. Anxiety has helped us as a species to survive thousands of years through keeping us hyper aware of our surroundings, to avoid danger and be on our toes during an emergency. This means that now there are those individuals that experience anxiety at every little aspect of life. I am grudgingly happy to admit that I am one of those individuals who experiences way too much anxiety and therefore has what psychologists like to term a panic disorder. One of the hallmark signs of some of the highest levels of anxiety is a panic attack. Panic attacks are, at least for me, one of the most horrible things that a person can experience. If you've had a panic attack before, you'll probably agree. Panic attacks are terrifying. The best way I can describe my panic attacks is one of those heart attack scenes from every single medical drama there is. It's much worse than sweaty palms. Your entire body starts sweating. Sometimes things become cold. Whenever I'm at my worst, my breathing becomes so rapid that my throat hurts. Noises come out of your throat without your permission, and you don't even recognize them. I get the urge to drown in the panic and submit myself to the pain and terror that comes with it, which is the worst way to handle it. You're fighting with your mind and body to calm down when you don't even know why you're panicking in the first place. Like I said, one of the worst experiences ever. I've gone to various psychiatrists and therapists and psychologists who had all come to the conclusion that I have generalized anxiety disorder. They threw me on an antidepressant to help. As my panic attacks became more consistent and stronger despite the antidepressant, my doctor reexamined my condition and changed his mind. Panic disorder. The first time I heard those words, I felt like a freak. GAD is something a lot of people experience, so it wasn't that scary for me to deal with.  At first, my doctor upped the dosage of antidepressant as high as it could go, but it didn't help. It only made me want to sleep 24-7. So reluctantly, I was given that small peach colored pill called Xanax. It was a hard decision on both ends because Xanax is a known narcotic and my family has a history of drug abuse and alcoholism. I was terrified about becoming addicted. We agreed to give it a shot because it was a great solution for most people in my position. Key word, most. I took it a handful of times when I felt a panic attack coming on, but it just made things worse. I felt like I was drugged. I went from being super high strong in panicky to super relaxed physically and very slow mentally. There was one time that I was panicking because I had a big presentation that afternoon and I needed to both finish it and rehearse it that morning. So I took a Xanax, and immediately my body went into stoner mode. I wanted to sit around and do nothing, but my mind was still racing through the drugged out mindset I was in because I knew that I needed to get this done. In the end, I wound up drinking 3 cups of coffee in the span of half an hour. The combo of the pill and the coffee helped me get through that day. But after that, I went to my doctor and told him how Xanax made me feel stoned and how it made my attacks worse but in a different way. He tried lowering the dosage, but I still had the same problem. Finally, he took me off Xanax and put me on its sister drug, clonopin. The best way to describe clonopin is that it's a slower reacting Xanax. It does the same thing, calm your mind, relax your body, help panic attacks from occurring. But instead of the onset time being around 5-15 minutes, like Xanax's, it takes about half an hour. Clonopin was a lifesaver for me. Because the onset time was longer, it meant I had to learn how to deal with the start of the panic attack on my own, but it slowly helped it go away a lot faster. Since the drug sped out its components over the course of half an hour rather than all at once, it helped me learn to calm down and breathe through it. Through the help of clonopin and therapy, I have also learned the art of meditation. I found that when I feel a panic attack coming on, I take a clonopin and then stop when I'm doing and focus on my breath. Inhale, exhale, inhale, exhale. It's the mantra that repeats constantly in my head. If my mind starts to wander or I start to worry, I notice it and without judgment, bring my attention back to my mantra. I make it a point to notice my body, see what parts are tense, and purposely relax them with each exhale. I'll go up and down my body, starting from my forehead and ending at my toes, relaxing each and every muscle with every exhale. This helps my panic attacks go away even quicker and over time, I've become so good at meditating that most of the time I don't even need to take clonopin anymore. If I feel an attack coming on, I'll stop what I'm doing and meditate. If I feel like it's a big attack or the meditating isn't helping, then I'll take one. But, as I'm afraid of addiction, I'll try to calm myself down. Without the initial use of clonopin, I would have never gotten to the point where I can now stop my panic attacks on my own. It's been a long journey, and even though panic disorder doesn't have a cure, it's easy to forget if it's under control. When you have a panic attack, there's an obligatory feeling of doom. Everyone who has a panic attack has probably felt it. But despite that feeling, the world isn't going to end after or during a panic attack. Life goes on, and because of it, I've been able to make some form of peace with my mental illness. Do not let the stigma against antidepressants or benzodiazepines like Xanax or clonopin or the stigma of your mental illness label stop you from getting help. Although going on medication for a mental illness is scary, it does not have to be forever, and it definitely will not change who you are as a person. Mental illness changes who you are, and medication is the way to bring yourself back to normal. To give your brain the neurotransmitters it needs to function correctly, and it will help you be able to potentially cure yourself, like I have through meditation. Taking ways to harness the anxiety like some people can to focus during a speech is essential for someone with panic disorder to heal. It's a rocky road, and things don't always work on their first try. But one thing I've learned about people who suffer from panic attacks is that they're the most resilient people in the world. Even though hope seems lost sometimes, the people who suffer from the worst always find a way to grab hope by the horns and make a better future for themselves. For all of you who suffer from panic disorder, or other similar mental illnesses, or just those of you who experience panic attacks, know that you're not alone and that you can get help. Thank you for watching Psych2Go. Subscribe and comment below if this story helped you, or inspired you to find your own path to healing.