Jumping Squat. Warning! Has potential to cause injury. Put a barbell across your shoulders and lower yourself into a full squat position as in the standard squat. At this point, however, you should rise very quickly and jump slightly. Reps 8-12. Note. Decrease difficulty by using dumbbells or by removing weights altogether. Hey, thanks for watching my Bruce Lee training and workout video. There's a lot of videos in this series, so make sure you check those out too. If this is your first time here, make sure you click the subscribe button and get the latest workout, martial arts fitness, and self-defense and fighting tips. Alright, so we see you in the next video.


Hello and welcome to the Grand Line Review, your source for everything one piece. Today we have a manga review of chapter 914, or Kobore, the town of leftovers. In this chapter is what we've been waiting for, the great fusion between Western and Eastern media, as we have an appearance from none other than Batman. Although I have to say that the Dark Knight has really let himself go, and it's quite an interesting choice to have wings essentially spawning from his arse, but hey, to each their own. I mean maybe his smile for it was ingested as a suppository, but in all seriousness the gifters in this chapter are quite interesting. I was worried when they were first introduced because I really didn't take to any of their designs, I mean they all just looked a bit like fodder with miscellaneous animal parts. It felt a bit like mass-produced laziness, but the gifters in this chapter are actually quite cool and unique. Gazelle Man is particularly interesting, he actually looks a hell of a lot like a superhero, very flash like actually, if well the flash war fishnet stockings. At the moment I'm mostly glad that these gifters are actually causing some trouble with their weird abilities rather than just being easily defeatable nobodies. It lends a lot of credibility to Kaido's forces, because you know how it is in most shounen, the big bad super power will come in with some sort of army and their masses of people will just be entirely useless and a waste of our time. A prime example of that would be the lower ranking forces of Big Mom. It was kind of like you had the Charlotte children and then the associates like Tamago and Pecoms, and then all you had below them were the miscellaneous candy soldiers. There was no specialized mass force that was the equivalent of what the gifters are. So yeah, the fact that someone as low in the pecking order as Gazelle Man actually has a really cool ability to travel up to 200 kilometers an hour is a very promising start for a great adventure on the land of Samurai. But we do also have some bigger characters mentioned, a couple of new headliners by the name of Holdem and Speed, both of which are card game references to add to the ever-growing theme of Kaido's crew. Hawkins is also mentioned, so I think we should take that as a sign that Holdem and Speed are on about that same level of strength, which is incredibly threatening. Especially Holdem, who we saw an odor-style dark and silhouette of. At the moment, he looks an awful lot like a lion, although he could be any other manner of big cat as well. I'm really hoping that he isn't a gifter because ever since Rob Luchi's devil fruit was revealed, I've been pretty damn keen to see a lion or a tiger type zoan fruit. Of course, that's not the only explanation though because Holdem could also be a mink, and I take time to point that out because we know that there is more than likely a mink working for Kaido, due to the fact that Jack was able to make his way to zoe despite it being a phantom island. So if he were to be a mink, Mr. Holdem here would be the obvious explanation for that, although I am kind of hoping that it's a mink we've already met who was responsible for that betrayal because one piece doesn't usually get into that deep sort of double crossing, at least not on the side of the protagonists. So I think that would be quite interesting. Back to Holdem though, if I had to put money on it, I would say that he is a zoan type user, and that is obviously going to be the running devil fruit thread of Kaido's crew. I say this because one, yeah they're called the beast pirates for a reason, and secondly because I was going back on Whole Cake Island recently for the arc review series, and I noticed something I'd never really picked up on before. Every new devil fruit user we were introduced to during that arc and there were like 13 or so of them, but they were all paramecia users. So if Whole Cake Island was the showcase of paramecias, then I think that Wano will do the same for zoan types, and of course poor old logeers will just have to continue to receive little to no love. But another highlight of this chapter is definitely Kiku, during my review for 913 I said that what I really wanted for her was to turn out to be a badass konoichi, but hey I'm even happier for her to turn out to be a samurai. Of course it's not quite that simple all due to the use of one little pronoun, Sessha. This is an archaic Japanese pronoun that was used by male samurai to refer to themselves in essentially the same way that we would say I in English. Now at first I didn't think a whole lot of it, in my mind I assumed that female samurai weren't really a thing, and if they were they'd be impersonating men, so it would make perfect sense for her to use a masculine pronoun.  Turns out there were indeed female samurai, although they were referred to as honor bugesha. They were also given a female specific weapon known as an Arginata, which is sort of like a bisento, aka the weapon whitebeard used, but with a more compact and slender blade. And essentially all of this throws into question whether Kiku is actually a male posing as a woman. What I'm hoping is that it's just a weird speech quote, because we are this close to having an amazing female character in the series again, although there is another potential flag in this chapter that Kiku may be male, which is when she's tending to Zora's wounds and he says she's a huge woman referring to her height. And just find that to be a really odd piece of dialogue for Oda to throw in there, and yeah look it's definitely in character for Zora to blatantly state such a thing, but one piece only has so many chapters, pages, panels, and words to tell its story at this point, and there is no room for any unessential information. Everything that happens, or is said, needs to further the story or a character, which is actually done very effectively with Tama during this chapter. Her whole exchange with Suru might seem fairly pointless to us in the grand scheme of things, but the development of her character gives us a great insight into how the people of Wano have been forced to live. The plight of an entire civilization is conveyed through this one goofy little girl. Anyway my point is that these things are all done for a reason, so I hope that this purposeful gender questioning pays off. So the second half of this chapter flings us into action yet again, which I love because the last few chapters have felt quite slow due to the breaks, so it's nice to see the pacing going strong. And as a result, we get a couple of beautifully drawn panels, my favorite of which is definitely Zora blocking the arrow fired by overweight Batman. I love any time that Oda draws swords at that particular angle almost facing the reader because you generally get a fantastic view of the blade, but you also get to see a large majority of the crossguard. Also in this particular case, I really enjoy the shadow being cast by Zora's sword onto Suru's face. It's a ridiculously simple group of lines that create quite the wonderful effect. The other pieces of action I really enjoy here are Anytime Koma Inu is running. This fantastic creature is becoming dangerously close to usurping the south bird as my favorite creature in the entire One Piece world. But something we can no longer ignore is the appearance of one Trafalgar lore on the closing panel, and my god to see it look worried. Laura is usually the sort of character who keeps his emotional state under wraps, but he looks quite acutely aware of exactly why it's not a good idea for Luffy to be causing this kind of trouble, which fills me with a delightful sense of dread. One of the aspects I really loved about Whole Cake Island was the fact that Luffy and Ko couldn't just stroll in and wreck face like they had done previously in arcs like any slobby alabaster or dressrozer. They had to step very, very carefully because one wrong move essentially meant the end of them. So I like that we're developing a similar, if not more serious feeling here on Warner. Of course the inclusion of lore is very welcome because it makes the potential upcoming conflict a nice 3v3. Hold him speed and Hawkins versus Luffy, Zora and Lore. Or at least I guess that's how you'd anticipate any typical shounen playing out anyway.  But then again there's always the possibility that the straight thinking lore could get caught up in the enthusiasm of Luffy and Zora and be forced into a really cool if unorthodox situation. Either way it continues to be nice to see him and the heart pirates on Warner. So the last thing I like to touch on is rather unusually the cover story. I generally ignore them because they haven't been particularly relevant to anything lately especially the olombus portion which went on for far too long but this week something very unexpected happened and we have a bonus story of sorts in the ongoing tales of the self-proclaimed straw hat grand fleet featuring somebody who looks suspiciously like Bellamy. And if that is indeed the case then I am thrilled. I enjoy Bellamy as a character far more than any of the grand fleet members so sign me up for five or so cover pages following him. The cover also presents us with a very stunning location in terms of the sheer scale of all the flags and other assorted goods. And a great general rule for this sort of visual bombardment is to look very carefully because more often than not there is a little easter egg in there and that holds true here because if you look above the furthest right windmill in the foreground you can actually see part of the Jolly Roger of the red-haired pirates which is pretty damn cool. It's probably completely irrelevant but a nice little bonus regardless. As for why Bellamy may be here well given that this is a tale from the grand fleet he may be here to commission some sort of custom Jolly Roger for the grand fleet because when you think about it they definitely need some sort of common symbol and they can't use the straw hat Jolly Roger like the extended forces of most emperors. So hey the next time we see this force in full swing they may have some schmick new Jolly Rogers to show off or courtesy of Bellamy. If that pretty much does it for chapter 914 if you enjoyed this video then feel free to like favorite or subscribe and if you are in any way keen on supporting this independent channel then please do check out my Patreon, Discord server or Twitter the links to which are in the handy description below. This has been the Grand Line Review and I'll see you next time.


Hey guys, it's Nate, AKA The Foot Accountant. Welcome back to the channel. Today, we're going to be talking about the best trading methods to use when you're starting FIFA 22. Basically, how to trade at the beginning of FIFA 22 Ultimate Team when we get on the game in a few days. Because the most difficult time period of starting your account and the most difficult period of trading in this game is the first 100,000 coins getting off the ground from zero coins to 10K to 50K, up to 100K plus, that's the most difficult. And it basically just means you have to grind a little bit. Now, of course, you can get lucky with a pack pull, sell a player, and then have coins instantly. But for a lot of us, we're not going to make much from our welcome backpacks. We're not going to make much from the SBCs. So we're going to have to grind the trades. And that is what I want to take you through today, how you can make coins in that starter period. So we're going to be using FIFA 21 today and talking around stuff that worked in FIFA 21, because that is also stuff that's going to work in FIFA 22. But there's also going to be a little bit of a twist to it because we know how the market might be a little bit different this year. And I want to talk through some of those things as well. But one of the three methods I want to talk about today is trading with SBC solutions. This is the number one way that I made coins last year at the beginning of the game. Because again, what a lot of people, what I will be doing at the start of the game is going and doing these SBCs. But we can make profit off of people that are a little bit lazy. And I'm one of these people. I go to foot bin to find solutions. So let's say I'm doing the hybrid league SBC. I'm doing the whole nine yards SBC inside of that set. And I want to see what the cheapest squad is, right? A lot of people do this. You guys do this, right? You go in here to these squads, click one at the top and say, all right, these are the players that I'm going to buy to finish this SBC off for cheap, right? So a lot of people do this as well. And what happens is, since these players are quote unquote the cheapest and since that squad that I just clicked on was towards the top and it's showing us one of the cheapest right now on PS4, what actually happens is, these prices lagged behind. People are going and doing this SBC. Everybody is going and buying and copying these players to use for their squad building challenge. But what happens is, foot bin doesn't update these cards in real time. It takes them a few minutes. So what you'll see is it says that this Bustinza guy, like I traded with this card last year, this non-wear gold Bustinza center back, I would buy him for 700 coins and literally an hour later, he would be selling for 1500. It would be that easy. He would fluctuate like every couple of hours just because of this squad and how it would get cheap and then get expensive because everybody would start using it as they started the game and were doing SBC. So it's kind of like a natural fluctuation based off of how many people are using these squad building solutions on foot bin. So right, it's by nations, but this specific SBC is the whole nine yards SBC. It is by nation. So what I would often do is, I would look through here for a couple of certain squads. Obviously you see that a lot of these are Spanish based. They don't have all the same players in them, like this one has Diego Guarente and I think Angelina was different from the first squad that we looked at. But basically what you're gonna find is, it goes by, especially for this SBC, it goes by nations, right? So I would trade with Portugal players and Spanish players and one hour, the Portugal players would be more expensive. The next hour, the Spanish players would be more expensive and then I would go by the Portugal players when they were low and sell them when they went back up in the next couple of hours because again, it's just natural fluctuation where people are doing this SBC and the prices move around. So if you time it right, which is actually once you get the hang of it, it is really easy. You find the great cards to do it with because a lot of these cards will show up in multiple solutions. And if you find a lot of solutions at the start of the game of FIFA 22 that have the same guy in it, especially center backs, right backs, right mids, left mids, depending on the nation and what the rare positions are, you can make a lot of coins. So just to give you an example of that, again, I don't see a Portugal squad in here. I might be a bit off on this one. This one's got loyalty. We wanna stay away from ones that require loyalty because people will see those and they won't wanna be a part of them either. So stay away from those that do require loyalty. How about this one? This one's got some Argentines in here. Funes Moria, I traded with that card at the beginning of FIFA 21 as well. That's an Argentine card. I traded with a lot of center backs and a lot of right mid, left mids because it also depends on the position that are in the positions and the actual formation of the SBC. So if that makes sense, that is trading method number one, trading with the SBC solutions, right? Finding the ones that are not the most expensive on foot bin and actually looking on the market. And you can do some easy comparison of the prices. Like right now, these squads that are at the top, these Spanish cards, the Bustenza might actually be 1.2 to 1.3K at the start when it says he's 900 coins. But people are thinking he's 900 coins but he's actually more than that. But they're just blindly following the solution because it is the quote unquote cheapest. So again, that's how that method works. I made a lot of coins from that last year. You can even look at other SBCs, not just hybrid leagues, not just hibernations. You can look at some of the beginning SBCs as well. People will come use foot bin for all of these SBCs. So that's a no brainer. Number one trading method for me is SBC solution, trading with gold, rares, non-rares and silvers. That's number one. Now number two, we're also gonna be talking about gold, rares, non-rares and silvers but with sniping filters. And these are some of the most popular sniping filters from last year. Shout out to my boy B-Walds. He found a lot of these last year and tweeted them out and put them all into one place. Now this year, I wanna help you guys find your very own sniping filters. It's gonna be very, very easy to do.  You can sort by league or you can sort by nation but basically all you have to do is sort through some of these top nine nations. Like let's say France will go position, let's go French center backs and let's go, let's go gold. French gold center backs, how much are these right now on the FIFA 21 market? 500 coins for one card but you might say that at the start of FIFA 22 because of the SBCs, the cheapest French gold center back might be 1500 coins but a lot of people that are opening packs with EA Play where they have, they have FIFA points or whether they are opening packs from SBCs that they're doing, they're gonna list their players up and they might not know that that card actually sells for 1500 and they might list it up for 700 and boom. That is what we call a sniping filter where you can sit here and you can bid or snipe on cards that are inflated because of demand for SBCs. I think a lot of German strikers are really good for this German gold and silver German strikers and gold German strikers was a really good filter last year, same thing with the Argentinian right backs. So again, you can use this list as like a starting idea for where to look at the beginning of FIFA 22. This list will be great again but there's gonna be other ones that pop up depending on if they change the SBCs at all or if they just the pack weight of these cards change as well and of course we've had players that have changed its clubs, changed nations potentially too and that's gonna mean there's different players under each nation and position this year than there were last year. So what is a good sniping filter will be different this year than last year. You can also get on bids for these cards. It's very competitive. A lot of people like these sniping filters but if you have quick fingers especially with like a mouse or a touch pad and your keyboard on the web app sniping can be very, very, very effective with this method with silvers and golds. Not just golds, you can do it with silvers as well because you're gonna find some silvers that are just more expensive than others, right? Some silvers are just rare but people follow SBC solutions especially if it's a top nine nation or a top five league and they just buy the card no matter what the price is. So that's one way you can trade on the low tier as well. Now let me move up to the third. The third method that we're gonna talk about today is what's actually a combination of two, position change and chemistry style trading. Now of course when the full database is out which should be very soon hopefully what you're gonna be able to do is look through the entire database and look through a lot of cards that are gonna be used in multiple different positions and will be needing chemistry styles. Now obviously when you're chemistry style trading the most popular ones to trade with are the Hunter and the Shadow chemistry style but the Engine chemistry style has become so popular in the past year. I think that the Engine chemistry style might be one you can trade with as well. Now how does this work? If we're talking chemistry styles, right? Let's look at and Dombley was a card last year that I traded with with chemistry styles all the time. Now Dombley on his own, on the market, the cheapest and Dombley is 2,000 coins. This is just an example by the way. I traded with this card at the beginning of FIFA 21 he was like nine to 10,000 coins. Now how much is in Dombley? If we add a Shadow chemistry style on him or maybe a Hunter. Let's say if you're gonna play him as a midfielder you'd maybe go with a Shadow, as a Cam you'd maybe go with a Hunter. Now right now this is usually not how it is in the game but in Dombley with a Shadow is literally not even on the market. Okay, okay it's only as Todd's card and his informants on the market. Most people are probably using Hunters. So let's look at Hunters on in Dombley. He was 2,000 coins all by himself and this market is so rare in FIFA 21 that it doesn't show up. So that's a great example but what you're looking for is like in Dombley sells for 2,000 coins and you wanna find a midfielder to put a Shadow or a Hunter on an attacker to put a Hunter on or a defender to put a Shadow chemistry style on. And what you're gonna do is you're gonna see okay, does this card sell for more with that chemistry style applied to it? And there's a couple things you can do with this. Some people will say oh, in Dombley's 2,000 coins but they've already put a Shadow chemistry style on the card or a Hunter chemistry style on the card because they've used it in their team and they're just selling it and they're forgetting that the chemistry style makes that card worth more. So in Dombley might sell for 3,000 coins with a Hunter, right? But he's telling for 2,000 coins without one that person sees in Dombley is 2,000. They list their one up with a Hunter on it for 2,000. You can buy that and then resell it for 3,000. It is that easy. So you can snipe some of these cards, you can bid on some of these cards but it's all about finding a couple players. Get yourself a list. Nine Golan was one that worked really great last year. I had a friend, ChrisRM22 that was all about this Nine Golan card. He was the one that found him. This guy was a gold mine. As a center defense admit you could position change him as well. That's the other side of the coin. You can trade with the chemistry styles or the position changes. Like this, I believe this a Nine Golan card comes as a center attacking mid. But as you can see, a lot of people for squad building links for their formation, they're probably gonna move them to a center mid or to a CDM. He might sell for a couple extra 1,000 coins with that position change card applied. So again, that's what you're gonna be looking for. Now of course you wanna make sure that these cards sell, right? So Soko was another one that I traded with. He was like 20K at the beginning of the game last year. I don't know how many coins he is right now. It's irrelevant because it's the end of the year. But as you can see, people like to use a shadow chemistry style on this Soko card. So if you find an item, I think midfielders are some of the best to do this with. Just some early shouts that I would put out there would be Emery Chon. I think Emery Chon with a shadow would be what most people would use. Maybe an engine, but also Emery Chon position change to a center defense admit. Could be a good one. Rodrigo de Paul could be another one as well as a shadow or an engine card you could trade with. Chemistry style wise at the beginning of the game. Lucas Paqueta as a shadow card. I think 100% you're throwing a shadow on this. But the links to League One, people might use him in a starter team beside like Renato Sanchez or Aouar, right? So I would look at a card like this and then even some of your other attacking players and defending players, you can use Diogo Jota with a hunter chemistry style. I think would be a really, a good card to trade with at the beginning. Reach James with a shadow chemistry style would be a really good one. Sergio Regulan with a shadow chemistry style would be a great one to trade with early on as well. So for position change trading, look for the midfielders. For chemistry style trading, you can look for any certain position. Chemistry styles like the shadows, the hunters, the engines, bind a player that just sells for more with those chemistry styles attached to the card and boom, you have something that works. But I think the midfielders work the best because they have center attacking mid, center mid and center defensive mid. And depending on somebody's formation, they might need that player for chemistry reasons at any of those three spots. So that's why I love midfielders. And specifically like that nine goaling card and the endombole card the most, these cards were center attacking mid base cards, but most people played them as center mids. So that would be one thing that I would keep in mind and watch out for right away is that a lot of these cards, especially if they have a center attacking mid base item, a lot of people like to use them as center mids and center defensive mids. So they have to go buy those position change cards or buy the card off the market with that item already applied. So those are methods that I would use at the beginning of FIFA 22 to make coins. Again, I know we talk about this stuff every year and some of you guys might even think of this and be like, man, I already know I was gonna trade with a lot of this stuff this year, but it is a very good reminder of the basics of trading. And again, the number one thing I will say is you just have to put the time in, you have to grind, you have to be on the market. That's how you're going to make the coins. Make use of the companion app, make use of the web app. You don't always have to be on the game to do this. You can do this on the web app and companion app very easily. But those are some ways you can grind and make coins again at the beginning. Now real quick, I do wanna make one little caveat to this because FIFA 22 is of course different. And we've been talking about preview packs a lot, but I think as we talked about those silvers and those goals that you can fluctuation trade with, I think every day as people open their preview packs, a lot of people open their preview packs at the content drop at 6 p.m. UK time or 1 p.m. Eastern time, which is my time zone. Whatever the content drop time is for you, I think what you're gonna see most days, especially early on, is people opening their preview packs and that's gonna put some supply on the market for people that pack something decent. They buy the pack with coins or FIFA points and sell those players on the market to get coins. I think you're gonna see an influx of supply almost every single day around the content drop and I think that could be a very specific and a very important time where you just trade cards every day, buying them when they get cheap with the supply, especially if they're needed for SBCs, buying around that content drop time period and then waiting to sell into the evening as their price goes back up as they become more rare. So that will be only for the cards that are necessarily SBC fodder needed for those beginning type squad building challenges. Technically you could also do it with some of the meta items, like I mentioned some of those players like in Dombley or LR, if they get supplied but they're still in demand for starter squads, you still might see them rebound back up from that little bit of supply. So that would be one thing that would really, really, really get used to doing this year because those fluctuations with supply and with preview packs are gonna be a big way that you can trade in the early game and throughout this entirety of FIFA 22 as well. I wanted to mention that a little bit earlier but I couldn't end the video without talking about that because again, I think it's gonna have a huge impact on the market this year and it is gonna be a good way to read the market and make some coins. So if this video helped you at all, make sure you smash your thumbs up on it. Comment down below if you have any questions and of course, subscribe if you're new. It has been Nathan Foot-Accounting. I will catch you guys later. Peace.


Guitar and Excel spreadsheet creation mapping the path to fretboard enlightenment part number eight Get ready and don't fret remember the boards fretted so you don't have to be Here we are in Excel if you don't have access to this workbook That's okay because we basically built this from a blank worksheet, but we started in a prior presentation So if you have a blank worksheet, you may want to begin back there However, if you do have access to the workbook We got multiple tabs down below including the example tab the end result the final product in essence the answer key The starting point tabs tying into the starting points of the video presentations the blank tab where we started with a blank worksheet and are Continuing at this point in time quick recap of what we have done thus far We've listed out the musical alphabet with letters the traditional way here a a sharp a sharp being represented With an a and a b or b flat whatever you want to call it b c C sharp d d sharp e f f sharp g and then it goes to g sharp and then it repeats again So we've got the 12 notes and we repeated it two times over within numbered them And I'm going to call these absolute numbers of the notes They're not relative to the position in a scale or anything like that. These are absolute So that's a one we combined them together I can call it number one absolute note or an a or a one and then we built a scale from that We started with this for for the C scale and we used our major Our our major formula whole whole half whole whole half Which you can also say as two notes away two notes away one note away two notes away two notes away One note away, and then of course that repeats We've repeated it a few different times so that we can build our scale Which is going from C to C here and then it starts over C to C here and then it starts over and we can imagine it going up To infinity this way kind of like you can imagine a fretboard I mean a guitar a piano a piano board Going on forever although it goes up in octaves in the piano You can imagine it just repeating in terms of the actual notes And then we built our table on this side in terms of numbers so we can look at the Differences between the notes as well as this way so that we can now see our notes that are in our scale in this case The C scale we can see the Roman numerals telling us what kind of chord We should be playing related to it which would be either a major minor or diminished And then we built out the notes that could be in an Actual chord which are of course coming from the scale that the scale was built from the Absolute all of the notes in the musical alphabet these first three being What we would need to construct the major and minor chords in these columns and then we can add the other ones Which we would call seven nines thirteen elevens and thirteen Based on us skipping every other note as we can see I think most easily in Our circle over here, which is what we constructed next which is to say when I construct my actual Chords what I'm going to do is say this is the one and then I'm going to skip and so this three represents the relative position in our our Scale right so now I'm taking the three note in the scales So I skipped one I'm over here and now I've got the fifth so now we're over here So one two three four five right and then the seven and but then you get to the nine and whatnot That means we've wrapped around again, and we're starting over. That's why I think this circle Is a useful way to see it because instead of seeing the piano keys going on forever into infinity You can see a circle just repeating on to Infinity so now what we want to do is say I can I copy this? I want to see it not just for the major, but also for the minor and the other The other modes so let's let's so we can think of the modes two different ways and It's useful to say okay if I'm on the key of C. I can look at the relative Minor mode which would mean all the notes are the same But meaning all these notes are the same, but instead of counting it from C I'm going to count it from the relative minor, which is the six is an A and so we could we could see it that way or You might also when you're playing it's practical to then say I would also like to see C minor right C minor has different notes in it. It's not the same scale But you might be able to transition pivoting on C from C major to C minor or any of the other modes It's easier I think conceptually to first think about that first way to say I'm going to use all the same notes But I'm now going to just focus on the minor note I could focus on any other note like I could do the D that would be a Dorian We'll get to that later or the E and I could do either any of these notes and focus in on it I'm going to start with the minor though because that's the most common you go from a major to minor Those are usually the most useful transitions to be making so I'll do that first even though In theory you would think the next mode would be the Dorian, but we'll get to the Dorian next time So how can I do that? I want to what I want to do then is Basically copy this whole thing, but then think about it as though the a is like the number one and a Dorian Kind of mode so I'm going to say okay What what what I can do is I can try to copy this whole thing and then change Change the formatting of this table to represent The formatting of the of the mode of a minor. I'm not doing Dorian. I'm doing minor So let's try to first to copy the whole thing and say go What if I just start off by copying let's copy the skinny well not the skinny do I want the skinny? Let's copy the skinny going from the skinny all the way out to the end of our circle over here And then I'm gonna right-click and copy that as my starting point and let's see what we can do with it I'll put that over here on BB will right-click and paste it boom So now we've got the same thing and a lot of the relative information should pull over Although it's gonna get messed up sometimes when we use those absolute references and whatnot So we now we want to think about how we can kind of change this table. Let's first think about the table I'm gonna use the the relative Scales are gonna be the same meaning now I want to say this represents the relative one position of a minor now instead of The major so maybe I should change the title first here, so I'll say this is gonna be the minor or or a I think this is how you spell it Aeolian I hope which is the six Sixth note from our major That means a relative major in other words Now we're looking at the minor which you can also call the Greek term Aeolian if you're talking in terms of modes But major and minor we often use like the English terms I guess of major and minor the other modes We will use the Greek but you might not cure it called Aeolian especially if someone's trying to kind of confuse you or whatnot But it's gonna be this the sixth note So what I'm trying to reference here is that it's the sixth note from The relative major so a lot of times if you're trying to say I'm playing in minor It's useful to then think about what the relative major is of it and and so you'd have to then kind of work backwards We'll talk more about that in a second to figure out what it is the minor of right? And so in this case we're looking at an a which is going to be the relative minor of the C major All right now. Let's see how we can just fix this table So now I'm gonna say this table needs to be fixed So this four up top what I'm gonna do is say this is gonna be equal to and I'm gonna say equal and scroll over to my Table over here and I'm using the same notes as this table in the major But I'm starting on the sixth note which is down here. So now I'm starting on this one. That's gonna be my One note so I'm gonna pick up that one right here And then I'm gonna make this blue instead of green because this is not one that I want to change So I'm just gonna keep that as is and then I want to be copying my formula the formula can't be The same formula whole whole that's the major formula, but if I can copy the same formula from The same point over here, right? So this if I go over here, this is whole whole half whole whole half That's the formula if I started counting from The major position, but now I'm gonna start counting from the sixth position, right? So if I start counting From the six if I'm here the next step up is gonna be two so notice I'm gonna have the same pattern, but I'm starting from a different position So I'm gonna start here and then it goes whole and then then the and then the whole whole whole half again So I'm gonna pick up this two Instead I'm gonna delete everything below it And if I copy that down so that takes me that's right And then I copy that down so that looks good and if I copy that down to here I'm at 11 and let's go one more that brings me to one and then so now I've gone from a to a So that looks good. So now you can kind of see the the whole whole half in there But we're starting from note number six so you can see why we're basically doing the Same thing we're using that we're gonna end up with the same notes But you can think of the pattern being different because we're starting from the pattern from the sixth note instead of on the one note and Then the pattern will repeat now. I'm actually gonna do it a different way. Let's actually delete this I think it'd be easier to see this way I'm gonna pick up that one and then I'm gonna delete all of this stuff and Then say let's just copy this one down It's gonna copy from that relative position Down and so there now it's gonna be Repeating down here another one and now because I what I'm doing is I'm copying I'm gonna reference it over here so you can see where it's coming from I'm just copying those notes and the pattern is gonna be repeating because we're picking up all the same notes So I'll say Do it that way But if I keep doing this I can't go all the way down because I'm gonna run out of space So what I'm gonna do instead is I'm gonna say now the pattern is repeating So instead of putting a one here, I'm just gonna say this equals the one above it And now when I copy that down, it'll keep copying that same pattern down which should repeat and It just keeps on taking the relative position above it and now instead of me pulling over the formula pattern I can Create my formula pattern this way. This is gonna be equal to this Minus this so now this is two notes away. So if I copy that down, let's copy that all the way down Now now this doesn't work. Why because it's two notes away one note already two two one two And then we run into a problem here because we end up with this negative number So now let's try an if formula to fix that so say, okay, how can I fix that to make this? Work I could say let's delete this. Oh, not that. I'm gonna delete the whole thing Delete this and say, okay, I'm gonna say Equals if logic function we're gonna say if this Minus this let's put more brackets around it another set of brackets to make sure I'm picking both of those things up if that whole thing is greater than zero then Comma what do you want it to do just do that take this you can't see the cell but you could see Right, what do you want it to do? I'm gonna put it down here to take this minus This and then comma. What if what if it is negative? Well, if it's negative, I still want you to take this minus this But then add 12 to it So it's a negative number we add back the 12 because there's 12 notes and that should bring us back to the proper position So let's see if that works. Let's put our cursor here double-click on down So now you've got the two away Then one two two one and so on so there we have it now if you if you count from This position remember the relative. This is the six right if I look at my circle over here. I Had I was on four if I count that as the major the one now. I'm over here. So so now I'm going To the four right from here's my one if I go back to the four and I start from the four I'll see that same pattern, right? So if I start from This note then you've got the whole whole half whole whole whole half same pattern But now I'm starting from the six and starting the pattern there, which means you've get a you get a whole A half whole whole Half whole whole right, so it's just a so it's it's basically the same pattern You just have a different starting point You're gonna end up with the same notes and then you've got this formula, which I think is populating Properly Actually, it's not because of the absolute references involved. So this one is taking the interval From the root. So I want to see how far the absolute differences Absolute distance is From each note to the to the root. So I'm going to try to redo this. I'm going to say this is if brackets and I'm going to do the The test of another brackets and I'm going to say if this number Minus this number Closing up the brackets is greater than zero Then comma what do you want us to do? I just want you to take this number Minus this number But what do you want to do if it's less than zero? Then I want you to take again this number minus this number, but and you guessed it add 12 to it, right? We're going to add 12 to it and then we get back to our two I need to make some of it absolute because I want this number to move down But not this number up top. So I'm going to go up top and every time I see that The be two which is this one I want to make it absolute now if I make it absolute that will work here But I'd like to be able to copy this all to the right at some future point and not have to redo the formula again When we go to the dorian mode. So what I'm going to do is say I need a mixed reference I don't want this number to move down when I copy it down, but it can move to the right when we eventually do that therefore Uh, I want it. I don't want it to move down. So a dollar sign before the number Not before the letter mixed reference And so I'm going to put a dollar sign before the two over here as well And then a dollar sign before the two Over here as well and then enter and then I'll copy that down just double click in the fill handle this time And I think it's doing what we want now. So now this is This is uh eight away eight minus one And then 10 away and then 12. So I think I think it's populating the way we want it to populate So now let's look at our table over here And say we looked up these numbers And so so obviously this is pulling I can and I can use these tools up top to see where it's coming from I use this this is actually in the data tab and and uh, you can you could see where they're coming from by going To actually it's in the formulas tab formulas tab formulas and the trace and the trace depends and then the remove So you can kind of see where your formulas are coming from so that becomes useful So I can say okay, they're coming from here, which looks like I might have used some kind of absolute reference in here to do that So I'm going to go okay I'm going to turn that off and say if I go into here. I can see oh, yeah, there's the absolute reference that we had to use or that was used In order to uh to do those so I can see that so let's repopulate this so I'm actually let's just see if we can Uh remove this and just say I'm just going to delete this whole thing and try it again So that's going to be an equals an x Lookup and then I'm going to say brackets the lookup value is going to be this number Plus this number now. I don't have to say plus right there because this is zero But I want to pick those up because I want to be able to copy this across Whereas the next one's going to be this plus the two right this plus the four So then I'm going to say comma the lookup array. I want you to find that number excel Over here control shift down So there it is there and then comma and then what do we want to return? We want the return array to be for this one Just uh the numbers I'm going to just pick up the numbers to start with And then we'll do the letters are down below So that one and enter so it picks up The one which is the a let's bring it to back to a c. Well, that's the relative minor is an a I thought we were to say so the relative minor of the c isn't a represented by A one. All right. So that looks correct now. I want to be able to copy it So when I copy it, I want this part To be able to move to the right, but not this number. So let's see But you know what might be even more useful long term Is to try to have everything relative and then when I copy the entire thing And try to do the dorian and the other modes. I don't have to repeat this. So let's test out that So I'm going to do the long work this time Which might make the work easier when we copy this whole thing over next time So I'm just going to repeat every time this time. So we'll practice the x lookup Multiple times so x lookup tab. I'm going to say now it's going to be this Plus that one and then comma And the lookup array is going to be this control shift down And then comma the return array is going to be this one And control shift down and then enter and I'm just going to do this every for each one Which I know is tedious, but I think it might help us next time when we do the dorian So I'm going to say this equals x lookup and then And then we want the lookup Value is now this plus this and then comma the Lookup array is going to be control shift down comma And then the return array Is going to be here control shift down enter and then I'm going to do it again Equals x lookup tab lookup value is this Plus this comma And then we'll pick up the arrays control shift down comma and this one and control shift down and then enter And I might be able to just cop. Maybe I can copy these arrays And that'll make it a little bit easier. Maybe I can say copy the control c And then I'm going to do it here. This equals x lookup And I'm going to say this plus this comma control v pasting that in And there's our arrays. That's not too bad.  I know this is tedious x, but I think but again, I think it'll help when we copy it across this. There is it. We could use absolute references and whatnot, but that might be a short term. So we'll test out the long term solution. So this is x lookup. It's going to be this plus this comma control v tab. This equals x lookup this plus this comma control v tab. This equals x lookup. Let's do it the same way. This plus this comma control v tab. This equals x lookup this plus this comma control v tab. This equals x lookup this plus this comma control v tab. This equals x. lookup. This plus this comma, control V. tab. This equals x. low cup, tab. This plus this comma, control V. tab. This equals x. hookup. This plus this comma, control V. tab. this equals x lookup this plus this comma control v tab equals x lookup this plus this comma control v tab and we will repeat the process multiple more times and this lookup is brackets this comma control v equals x this comma this plus this comma control v enter this equals x lookup this and this comma control v this is equal x lookup this and this comma control v and this equals x lookup this and this comma control v this is now I have to have x lookup this and this comma control v and this equals x lookup this and this comma control v this is x lookup this and this comma control v this is x lookup this and this comma control v this is x lookup this and this comma-control-V this is x lookup this and this, comma-control-V, x look-up this and this, comma-control-V x equals x lookup this and this, comma-control-V This is x lookup this and this comma control V equals x lookup. This and this comma control V equals x lookup this and this comma control V. One more round. I didn't hear no bell equals x lookup. this and this comma control V equals X look up this and hold on a second is that right yeah this and this comma control V equals X look up equals X look up this and this comma control V and X look up I'm getting excited cuz we're almost there this and this comma control V and this equals X look up this and this comma control V and this equals X look up enjoy these last two cuz this is it and we're done we have to stop after that equals X look up this and this and then comma control V okay now hopefully I got that correct and note that when you're looking at these worksheets you could compare these to to an actual worksheet that you look up online right and just make sure that you have all your numbers correct once we get down here you can kind of double check down here to you know any worksheet that you find in Google to just double check your numbers I don't make any guarantees of not making a mistake as we go through this but we'll practice with those worksheets afterwards I'm hoping and then that'll help us to kind of drill down and fine-tune any mistakes and anything that we might be able to improve on possibly okay so now the other thing is up top we have these numbers now this one if I look at this this is my absolute distance now this one doesn't work again if I go here and I say okay what happened with this one and I traced this out it's like okay now it's picking up an absolute from over there that doesn't work okay so what I wanted to do is to take this minus this number which which should give me a three right so I'm gonna say alright let's let's try to do this again and I'm gonna say this one's always gonna basically be zero I don't even need this one because it's always zero let's just start at this one this is gonna be equal to and I'm gonna say an if function again so let's do an if thing so we'll say this is gonna be equal to if brackets and then I'm gonna put in another brackets around I want this number minus this number and if that is brackets if that is greater than zero then what we want you to do is just take that number if that's greater than zero then I need a comma then comma what we want you to do just take that number minus this number but if it's not what do we want you to do we want you to take this number minus this number and then add 12 to it because it'll be negative there's 12 notes in the key and the 12 should bring us back to the correct point so that comes out to a three that looks correct now when I copy this to the right I get to the same issue I'm like well I want to make it so I can copy it to the right but I also want to make it so that I can copy this entire sheet and make the Dorian mode where everything is relative so I kind of want to reduce the absolute references if I can so is there a way I can adjust this without messing it up so I can copy the entire worksheet over so for example this one I want this number to move to the right I want this number to stay where it is so there's I don't think there's any way I can really do that so that so that I can copy this over because when I copy the entire worksheet over I want it so I want the letters to move to the right so again I think it might be worthwhile to do the tedious thing here of of re-inputting it without absolute references so that I can then copy the entire thing over later so what I'm gonna do is just repeat this it's only a couple times this time so it's gonna be if brackets brackets this minus this I still need to do the logic test here because when I copy to the Dorian mode then it might work out that the logic test is going to be necessary so this minus this brackets if it's greater than the zero then we want you to take this minus the first one and if it's not then I still want you to take this minus the first one plus 12 close it up and then tab let's do it again equals if brackets and then another brackets this minus this if that is greater than zero then I want you to just do this minus this otherwise I want you to do this minus this plus 12 tab it's gonna close it up for me I say yes this is gonna be equal to if brackets brackets this minus this is greater than zero then comma I want you to take that minus that but if not comma I want you to still take that minus that but add 12 and close it up this time tab equals if brackets brackets this minus this close up the brackets is greater than zero then comma I want you to take this minus this comma if not though still take this minus this but then add 12 close up the brackets one more time equals if brackets brackets this minus this brackets is greater than zero then comma do this minus this but if it's not comma still do this minus this but add 12 to it and brackets okay so we don't have any absolute references so now when I copy this whole thing over hopefully it'll move over appropriately okay so I think I have every I hope I have everything laid out here properly so now if I move down here this whole thing should populate correctly because most of this is just pulling from the one above and now I'm looking in here now notice here it's it's taking the x lookup from this table from this table is that a problem not really because we are we're using the same notes in this scale as we are in that scale over there so it's not really a problem that it's pulling from that table and it won't be a problem as long as we're going to the right but when we start copying down then we're gonna have then we're gonna have a different table so it'd be better really if I can get it from this table there's two solutions here to make my copying easier I could take instead of using this table I could reference everything to the entire scale over here I can use this table because that'll work no matter what it's kind of nice to use the table relative right here if I could because that one it's easy for me to fix things because it's right next to what I'm looking at so I'd kind of like to use use this table to pick up this information so I'm thinking okay let's let's see if I can adjust these ranges so I'm gonna try to adjust these and try to do it as fast as I can here so and this will help me with the long term when we copy it down so what is this doing again all I'm doing is saying I want to look at this note up top I want to find it over here in this columns that one and I want you to return the 1a so that's an x lookup let's redo this one I'm gonna say this equals x lookup I'm gonna pick up this is the value I want to look up and then comma then the array the lookup array I want to be here control shift down and then comma the return the return array what do we want it to give us back then pulling this down can't pull this grab it without clicking on anything and then pull it down return array this one control shift down and enter so that's good now what I'd like to do is replace this bit in all of the other ones so that so that I don't have to use absolute references and then I can copy the whole thing across I'm gonna double click here I'm just gonna I'm just gonna re format this and say control V tab I should get to the same number double click and then control V tab double click and then this bit control V tab double click I'm gonna pick up control V tab double click and control V tab double click so again tedious work here but I think it's gonna save us once we start copying all the different modes so I'm gonna say this one control V tab this one and take this control V tab this one this bit control V tab this bit and we're gonna say control V tab ah k-passo this bit control V tab this bit control V tab this bit control V enter and then this bit control V tab this bit control V tab so you probably get the pattern here so if you want to fast forward you know you can but I'm gonna show the whole process just to be thorough like to be thorough don't want any un-thoroughness like you didn't show me how to do that step yeah well I showed you you just have to watch like 20 hours of stuff and you would see like in our 7.4536 that's where it was that's where you should have been able to find that and pick it up so we'll say this is this one and as my old school would say well you got it you know what you got to do is you've got to trim that problem down to under five minutes if you could just trim if you could just trim the whole process down to under five minutes that would be great that would be great well that I don't think I can do that because it's it's kind of it's more complicated than a five minute thing well yeah but you know the five five minutes that's what people's attention span is and you have to cram everything into people's attention span or else it's your fault that people don't know what that what's going on but that's that's impossible you can't do that no come on let's have a little optimism here five minutes you can learn everything there is to know and excel if you had any skill if you had any skill at all with your teaching capacities then that's then you could do it in five minutes and all of your knowledge would be given to someone as though they jacked themselves into the matrix like neo in the movie that's just a movie that doesn't really have you can't really do that oh come on come on five minutes okay so there we have it so so hopefully I did that right we'll check it out as we go forward but but in the future we'll and I think these all copy over relative as well so I'm gonna have to possibly change the Roman numerals because the Roman numerals are off now you'll note which is another kind of weird formula so we'll continue with that next time because we're going kind of long here


Hi, thank you for joining our talk. A decade after Stuxnet's print of vulnerability, printing is still the story to heaven. First, let's introduce ourselves. My name is Pele Gadar. I'm in the InfoSec field for more than 7 years. Currently working as a senior security researcher at SafeBridge Labs. My main focus is on Windows Internals and vulnerability research. Hi, my name is Tomer Bar. I'm in the InfoSec field for more than 15 years. Currently working as a research team leader at SafeBridge Labs. My main focus is on APT research, Windows Internals and vulnerability research. In this presentation, we will cover the following. We will demonstrate how a threat actor might have the ability to build the propagation part of Stuxnet 2.0. We will do that by walkthrough on the vulnerabilities which were used by Stuxnet. For each one, we will describe the root cause, describe the patch and evaluate the effectiveness of the patch. We will continue with a deep walkthrough of our print spooler research findings, including demos of the 2.0.0. Finally, we will suggest a new mitigation for the entire arbitrary file-write bulk loss. We will be focused on answering two fundamental questions. Is it possible to build equivalent propagation capabilities as Stuxnet capabilities? Second question, if I fully patch my entire Windows operating system, am I safe now? Last note before we start. We will use two symbols during our presentation. An error patch means that the patch logic is very specific and it was possible to re-exploit it. And secondly, a regular patch means that it solves the problem and had not been bypassed until nowadays, as much as we know. Now that we are ready, let's see the recap and the timeline of Stuxnet. Stuxnet is considered by many to be one of the most complex and well-engineered computer worms ever seen. It is believed that the project was developed in 2006 and lasted four years until it was discovered. Stuxnet can be described by the following three parts. The first part is the propagation to the target network by using three remote code-execution exploits and two local privilege-scholation exploits. The next part is the specially-version techniques, which allow Stuxnet to operate under the radar. The third part is the final payload, delivering specifically to Siemens PLC. In our opinion, a decade after Stuxnet, the most interesting part is the propagation capabilities, which is still relevant to almost any targeted attack. Let's zoom in into Stuxnet propagation capabilities. We will describe them one by one. Although it was a decade ago, it's still relevant to all of us, because according to a research posted in 2017, those capabilities were used widely after Stuxnet for attacking a wide range of organizations. Let's dive deeper, ending over to Peter. Thank you, Tomer. So let's start and talk about the LNK vulnerability, which was used by Stuxnet. It used it to spread via weaponized USB flash drive, traveling between internet-facing computers and internal network computers. So the attack vector contained a crafted LNK file, which is a shortcut file. Once it was displayed, an arbitrary DLL, which was specified as the icon file of the LNK, was executed. Here's a screenshot of a crafted LNK file, which exploited the vulnerability. You can observe that the LNK file contains the following. The path of the CPL, external file, and the icon ID, 0, which caused the code to trigger the execution of the DLL, every time the LNK file was displayed. So let's take a look at the exploitation path and how it was patched. The main problem was that instead of loading the CPL DLL file as a data-only file by using loadLibraryX, the code actually called the loadLibraryW function and also executed the DLL. We expected the patch to replace this call in order to avoid execution, but let's see what would actually happen. So the patch added two validations in order to mitigate the vulnerability. First, it checked that the provided CPL file was on Microsoft's white list and was allowed to be loaded. Next, the icon ID, which we control, would have been extracted and converted from a string. If the ID was 0, it would override the 0 with minus 1, meaning it wouldn't be loaded. The patch was very specific, because as you can see, the loadLibrary function still existed, meaning that if someone would have been able to bypass the validations, then the CPL could have been executed. So let's see the bypass which was patched five years later. In order to bypass the patch, we need to bypass the icon ID chat and transform it to 0. It can be done if you will be able to send the minus sign as a parameter to str2nw function. Let's see exactly how it was done. Because of a type confusion between a white car buffer and a car buffer, the original icon ID string was truncated. We can exploit it by providing a long enough buffer, so the icon ID will turn into the minus sign. Once str2nw will return 0 as the icon ID, our arbitrary CPL will be executed. The patch for this one was pretty simple. The truncation bug was removed. The call to loadLibrary, which was the actual root cut, wasn't changed. That means that if there's another way to trigger the loadCPLModule function, it would have been still vulnerable. And apparently there was. Two years later, a new vulnerability was discovered and patched. It called the loadCPLModule function by using another exploitation path which was left unpatched. So the patch for this one was adding the previous logic of a CPL white list. But loadLibrary still was not replaced. What's interesting here is that we have noticed that there is another last path to loadLibrary function. But we haven't seen any disclose vulnerability yet. So moving to the next propagation capability, next we will talk about the Stuxnet's RPC vulnerability, handing over to Tomer. Thanks, Pelik. On 2006, three years before Stuxnet's first non-infection, a new vulnerable RPC vulnerability was discovered and patched. According to Microsoft, it was a very limited scoped attack back then. But later on, a very similar exploitation path was used by both Stuxnet and KulfikerWarm, which became one of the most spreadable worm ever seen. RPC vulnerabilities were the main cause of global computer worms since 2003. Remember Blaster? So it's obvious that the cause of vulnerability in this mechanism is huge. Let's dive into the specific details. The RPC vulnerability root cause that we will present is due to your canonical path. So let's understand what is it, a canonical path. It's actually a pretty simple. It gets an absolute path and converts it to the shortest absolute path, in the meaning of string length. The most common usage of canonical path is for textual comparison of two different representation of the same canonical path. The original vulnerability was a type confusion which lead to a classic stack-based buffer overflow. The vulnerable function was copying a buffer which exceed the allocated buffer, causing memory corruption. Here is the exploitation path. The RPC request triggered a vulnerable function, remote, which lead to an out-of-bound write caused by WCScat function. Please notice the RPC functions name, and TnetPW, we will explain why it's important in the following slots. The patch added a proper buffer length check, which eliminated the original buffer overflow vulnerability. Two years later, a newer vulnerability was discovered in the same exploitation path. This time it was discovered in the RPC wrapper function, which is called NetPR. This function caused the original vulnerable function directly. Remember NetPW? Let's dive into the root cause. The root cause of the vulnerability is that the input path includes more slash dot dot slash cause than the number of prior directory entries. This will result in gaining control over the output buffer pointer, which will point backwards on the stack and will trigger out-of-bound writing after calling the WCScopy this time. So the patch MS867 replaced the WCScopy function with a safer function, StringCopyWorkerW. Let's dive into Stuxnet task scheduler vulnerability. But first, let's understand how the task scheduler worked. The task scheduler job XML file contains the metadata of a job, including which user will execute the job. The folder which contains it is writable by all users. To protect the integrity of the job configuration files and prevent user from modifying them, task scheduler calculated a CRC32 checksum on each created task XML. When it's time to start the job, task scheduler recalculated the XML checksum and compared it to the original value, if they matched the job executed. If not, it would have been ignored. The CRC32 algorithm is collision-prone, which may lead to data forgery. Stuxnet zero-day exploited this fact by forging an XML file of a job which was executed as anti-authority system. It had a custom CRC32 checksum, which was identical to the original task's XML, therefore it would have been executed as a system, resulting in a local previous relation. In the patch MS-1092, Microsoft implemented a second integrity check by using the SHA-256 algorithm, implemented by the compute-ash function, which is less collision-prone. Moving forward, nine years later, a new task scheduler vulnerability was found. The vulnerability abused the backward compatibility feature of the task scheduler mechanism, which provides the option of migrating all tasks from C windows task folder to the new task folder, which is system 32 tasks. In order to exploit it, the attacker would need to perform the following four stops. Step one, create a new job. As a result, an XML file would be created in the new task folder. Step two, override the job file in the legacy task folder with an R-link to the file which the attacker wishes to control. The third step is creating a new legacy task with the same name, and finally trigger an old to new task migration over RPC. As a result, the task scheduler service would update the security information of the file, which the attacker wishes to control, granting the attacker full control privileges on it. The attacker can now replace right to any file, gaining a local privilege escalation. So this is the exploitation path that was used. Let's see how Microsoft patched it. The patch makes sure that the file is not a symbolic link by using two different checks. The first checks verify that the original path is the final path of the file. If it's different, it means that it was redirected by a symbolic link. The second checks verify that the number of the file's NTFS links is not bigger than one. Okay, so let's see the fourth vulnerability moving over to Win32K. Actually, there were dozens of Win32K local privilege escalation vulnerabilities over the last decade. Here is the list of several options from 2020 which can replace the original already patched vulnerability in order to rebuild the Stuxnet 2.0 propagation capabilities part. The only capability which remained is the print spooler vulnerability. Let's start to talk about our printer spooler research and findings. We will start by presenting how we found a 20-plus year old bug by using 20 minutes of fuzzing. We have noticed that each time a print job is being created, it is represented by two files. First, an SPL file, which simply contains the data to be printed. Second, an SHD file, ShadowFile, which will be focused on. It is represented by the undocumented ShadowFile struct and contains the metadata of the print job. For example, printer name, printer port name, document name, and etc. We found that the printer's folder, which contains the SHD files, is writable by all users and that the SHD files are being processed once the service is started. So we asked ourselves, what will happen if we craft our own SHD file? So we started to mutate the SHD files and fuzz the service. After 20 minutes of fuzzing, we had our first crush. We have managed to crush the print spooler service by using a limited user and a crafted SHD file. It's appeared that the code was trying to dereference some part of our data. Treating it as a pointer to a security descriptor without any validation or sanitization of the data which provided in the SHD file. Microsoft did not fix this bug. We will show the response in the end of our talk. Okay, demo time. Let's see a demo of the crush in the latest Windows 10 Insider build. So on the left side, Johnny is a limited user. We can see that we are running on the latest Windows 10 fully patched machine. On the right, the user John is administrator and it is used only for convenience to avoid restarts of the OS instead will restart the service to trigger the vulnerability. So we are copying the crafted SHD file to the printer spooler directory. And now we will trigger the vulnerability by restarting the service and listing the printers via WMI command. As we can see in Procmon, we crushed the service. Ending over to Pelik. Thank you, Tomer. So the crush was cool, but we wanted more. Let's talk on how we got local privilege escalation, twice. One of them is still zero day. So in order to understand the next vulnerabilities we found, we will dive into the printing process in the Windows OS. The print spooler is the service which is responsible for creating and handling print-ups in the Windows OS. Accessing the print spooler is possible remotely, for example using a shared printer, and locally. We will focus on the local scenario. More specifically, we will focus on the fact that the spooler allows the user to print to a file by using a virtual printer. This is an important part, which our further slides rely on. A quick brief on the flow of printing to a file scenario. First, the user sends some data to be printed using an application, for example Notepad, and specifies which file he would like to print to. It means that the data will be printed, which means it will be written to a file using a virtual printer instead of printing to a real printer. The spooler service, spoolersv.exe, which is the RPC server, gets the request. Later on, the local print provider, which is responsible for printing data to files, will print the data into the file which was specified by the user. Let's start with the first print spooler vulnerability which was used in Stuxnet. This is the flow of the vulnerability which was providing a remote code execution. The vulnerability exploited the fact that the spooler allows the user to print to a file on a remote computer on behalf of System and has printed the malicious file to System32, which was a more file. So it was patched on 2010. The patch included two validations. A. Check if the printing job was dispatched locally on the machine itself or remotely. If remotely, it will override and ignore any requested file write operation. Second, it will check that the user have write permissions to the path of the file that he wanted to print before it's writing to it. Moving forward to 2020, we have found a way to bypass the patch locally using almost the same exploitation path. The first check bypass is obvious because we shifted from a remote code execution to a local privilege escalation. The second check needed some work, so let's dive into our print spooler research. We found that a limited user can do some interesting operations without any elevation required by just using partial commands. For example, adding a built-in printer which prints to a local printable, meaning it will print to a file. And specifying a path of the file which he doesn't have access to. For example, System32. Okay, interesting. So does that mean that a user can just print any data he would like to System32? Let's check. So apparently no, or that's what we thought. As we mentioned before, the MS-1061 patch has added a function which validates if the user can write to the path he asked to print to, which means that the user won't be able to print data to System32. So let's understand how can we bypass it. Every time the print spooler initializes, it processes the SHD files which are waiting to be spooled in the same directory for every user. A limited user can create an SHD file which represents a print job which prints to any path, for example, System32. Once the print spooler restarts, it will process the SHD file without being impersonated or aware of who created the print job. Therefore, it will operate as anti-authority system and will print the data to any file as anti-authority system, resulting with allowing the user to write data to any file on the system and gaining an arbitrary file write and a local pre-read escalation. This was actually the bypass of the second patch validation, specifically for the validate output file function. Because the spooler is running as anti-authority system, it has writing permissions to almost every file on the file system, so the check will pass successfully. So let's see a demo of the first local pre-read escalation we found in the print spooler. As you can see, we are running under the context of a limited user. We are using a Windows 10 machine from March before our vulnerability was patched. We are using Johnny which is a limited user. So first we will use PowerShell in order to do the following stuff. We will add a printer port which allows us to print to System32. We will add a printer driver which allows us to create a virtual printer and finally we will add a printer which is using the System32 port. Next we will use a pre-crafted SHD file which represents a print job which prints to System32 and we will use a DLL payload which we would like to write to System32. We will rename it to SPR and we will copy it by using our limited user to the spool printers folder in System32 which is writeable by all users. Now before we will restart the VM, I want you to notice that there are only three users in the computer administrator Johnny and John and that the following file in Windows 32 which is named exploited TXT does not exist. Next let's restart the VM by our limited user in order to... the print spooler will process our SHD file. Once we are logged in back into Johnny user, the print spooler service will process our SHD file will treat it as a print job and will write our file to System32. Next, Windows service will execute our DLL and as you can see we have been able to add a new administrator to the computer and he was able to write a file to System32 named exploited.txt. Now let's verify that we were actually added an administrator. We will open a command prompt which is elevated and we will just log in using our new administrator user. As you can see, the administrator's group contains our user. So we have been able to gain local previews escalation using the print spooler service. So now that we have coupled them all together, we reach our destination. We have found equivalent capabilities to allegedly build Stuxnet 2.0 propagation pump but our work is not over yet. After the first vulnerability we found was patched, we have been able to re-exploit it and we created it with CVE-2020-1337. Microsoft are currently working on a fix which will be deployed in the upcoming patch Tuesday. Therefore, we can't release any technical details right now. We will publish it once the patch will be deployed, but let's see a demo. So as you can see, we are running under the context of Johnny which is a limited user. We are running under a fully patched VM. Under the context of Johnny, we will execute our exploit which will bypass the patch of CVE-2020-1048. After we crafted our SHD file, we will copy to the print spooler directory. But first, you can notice that the exploited TXT file does not exist and that we have only three users as before. Now let's restart the VM. Once it was initialized, we will log in again toward limited user Johnny. Now, as before, the print spooler will process our SHD file and will print the data to System32 which is our payload which is a DLL file. Our DLL file will be loaded into an elevated anti-authority system service and we will gain code execution. Let's try and find the exploiting.txt file. As you can see, we've added the data to System32 and we have been able to add an administrator user once again to the VM. Let's execute command prompt which is elevated and let's log in using our new administrator user. As you can see, we have gained a local primary distillation and the code execution using the print spooler once again after the first one of the ability was patched. Ending over to Tomer. Wow, 1337, that's awesome. So going back to our second question, we would like to propose an additional possible solution as a second level for patching. We believe in a level security mitigation approach. So we reported to MSOC on each vulnerability we found but we still believe it's not enough. So we developed a POC for a real-time prevention of the attack. The main root cause of the arbitrary filerite bug loss in the context of local privilege distillation is the fact that a limited user is allowed to write directly to the following location. This is dangerous and can be exploited very easily and we found that it's actually not really needed for the regular use. Today we will release a mini-filter driver which restricts any far-right operation by a limited user to some of this location as a POC. This mitigation proposal is not specific to the spooler's vulnerabilities and can be used as a template for mitigating the arbitrary far-right bug loss. Please treat the driver as a POC and be careful not to execute it in production system before validating it for false positive. Let's see again. Okay, so this time we are running on Windows 10 RS1 an older version without the patch for the vulnerability we were going to use and as usual we are running as joining a limited user. Let's make sure that our driver is loaded to memory and now we'll present that a regular usage of printing is allowed so our driver will examine the filerite of the SPL and SHD file and we'll allow it. You can see that there are two files in the printer spooler folder with size which is not zero. And now let's copy the SHD and SPL file to the printer spooler directly. Now actually our driver examined the right and blocked it. You can see that the files are of zero size. Let's demonstrate the task scheduler exploit. This is a public exploit and you can see that our driver blocked the right. So for Microsoft's response for the spooler's local privilege escalation the additional vector for CVE-2020-1048 will be addressed in August 2020 as CVE-2020-1337 and for the spooler denial of service the technique results in a local denial of service which doesn't meet Microsoft's servicing bar for security updates. We would like to give credit for the following people for researching similar areas Alex UNESCO and Yaudenjo Fear, Dave Weinstein, IT Acker and Gingola Kia. Today we will list our repository which includes an exploit PLC for CVE-2020-1048 and an exploit PLC for the zero-day denial of service of the spooler service the driver for the arbitrary fire-ride mitigation and in a few days on August 12th we will release the CVE-2020-1337 superlit exploit PLC. Please check our repository. Thank you for joining us and let's go over for the UNI.


in this presentation we will discuss auditing revenue we're going to be discussing the revenue cycle and the approach of auditing the revenue cycle first thing we want to consider is the revenue recognition principle because obviously when we audit the revenue the timing is going to be one of the major principles that we need to consider first a word from our sponsor well actually these are just items that we picked from the youtube shopping affiliate program but that's actually good for you because these aren't things that were just given to us from some large corporation which we don't even use in exchange for us selling them to you these are things that we actually researched purchase and use ourselves bayer dynamic not sure if i said that right but this is the dt 770 pro 250 ohm studio reference closed back headphones i wear headphones basically every day for a large part of the day they are important to me therefore i've gone through many different kinds of headphones i've had these for some time and they've worked quite well they fit over my ears but i'm still able to put my glasses on under the headphones the headphones not pinching too tight on the glasses to give me a headache which is nice the quality of the patting is good and it has lasted for some time i've had these for some time now and they haven't gotten all torn up on me or anything like that i also like that i have a cord when i'm doing my recordings as opposed to a usb centered headphone because that frees up a usb port and i find the usb headphones to be less reliable they come with an audio jack that looks like this which is useful for me because that plugs into my audio interface however if you want to use the headphones for some other purpose i believe it's fairly easy to get a converter to other types of audio jacks if you would like a commercial free experience consider subscribing to our website at accounting instruction dot com or accounting instruction dot think of it dot com where we have many different courses you can purchase one at a time or have a subscription model giving you access to all the courses courses which are well organized have other resources like excel files and pdf files to download and no commercials with the auditing of revenue we therefore have to understand the accrual principle as it relates to revenue that's the revenue recognition principle now this is going to be a fairly detailed revenue recognition principle because we want to see this step by step as we can apply it to the approach for auditing revenue so revenue recognition principle just in general terms we might just say that we're going to recognize revenue when it has been earned but we want as opposed to when cash is received that's probably what most people would say as a revenue recognition principle but we want to be very specific in this and we want to be able to apply this to different types of businesses as well because we may have some businesses that sell goods inventory we may have other businesses that have services so revenue recognition principle revenue can be defined as inflows or other increases of assets of an entity so we're going to say there's some kind of inflow does it have to be cash did we decide did we define cash here no because another inflow it could be a counts receivable for example going up as we make a sale on account of the entity or settlement of liabilities this is often something that is overlooked it's quite possible that we make a sale and instead of receiving something instead of getting some type of asset a counts receivable or cash we have something that is a liability that's relieved in some case reducing a liability now that's not normal the process that happens usually a counts receivable goes up or cash goes up but it's quite possible that we could have a liability go down and that would still be revenue should be in the definition of an entity from providing goods so goods or inventory providing services so we're having services which would be non inventory related for a service type company or from activities that make up the entities of major operations so when we are considering revenue we're typically considering those major operations so for example if we're in the business of selling some type of inventory and we actually happen to sell some stocks and bonds some of our investments we're not a financial company but we sold stocks and bonds or we earned interest on stocks in the bonds and we had capital gains of some kind or interest income or dividend income this would be another type of income but it's not going to be our principal revenue recognition in the operations of the business so let's go through this one more time revenue can be defined as inflows or other increases in assets of an entity or settlement of liabilities of an entity from providing goods providing services or from activities that make up the entities major operations so what are we going to do in the auditing of the revenue approach within the auditing process we're going to have to understand the business what is it that they do in order to generate revenue we're going to identify the contract with the customers so what's going to be the contract that is involved with the customer with regard to revenue recognition what kind of contract is it is it goods or services that are being given is it goods that are being given or services that are being given or some combination of the two identify the poor performance obligations in the contract so what is the performance that has to be done we need to know that because that's a major component to the revenue recognition principle because that's typically the point in time when the revenue should actually be recognized within the agreement determine the transaction price so what's going to be the transaction price for the contract that's being involved for the major operation of the business allocate the transaction price to the performance obligations in the contract so we're going to allocate that out and then recognize revenue when the entity satisfies performance obligation which of course is in alignment with our revenue recognition principle revenue recognition fraud risks so as we go through this we want to be considering the fraud risks one type of fraud risk is side agreements side agreements are arrangements that are used to alter the terms and conditions of recorded sales so we're going to be altering the terms and that's typically not a good thing to do because it could be deceptive that's where the fraud comes into place so one more time arrangements that are used to alter the terms and conditions of recorded sales in order to entice customers to accept delivery of goods and services then we have channel stuffing which is a marketing practice that suppliers sometimes use to increase sales by incentivizing distributors to buy substantially more inventory than they can promptly sell and of course we can imagine this happening at the end of the year if you were if you could you could imagine a manager at the end of the year saying i need to increase sales to this level because i want to get my bonus and i have to get over this level before the end of the year the cutoff is that 1231 how can sales be increased well maybe we can somehow incentivize our distributors to purchase more before the end of the year in some way and and they're going to purchase more than they otherwise would thereby increasing the sales before the cutoff now in the long term of course it's it's not going to be a good thing because the increase in the sales of the cutoff would be just a timing difference that would indicate that you would think that sales would decrease after the year and it kind of distorts basically the numbers and it could actually decrease the amount of that is is going to be sold because you might have to have some type of incentivization in order to incentivize someone to have the the higher purchases maybe by discounting and or hurt the relationship with uh with the distributors in that in that way by kind of changing the normal terms related party transactions related party transactions transactions that are not considered at arm's length so for example if a company had something like a subsidiary and there was some type of related party transactions the subsidiary being in some way owned or related to the parent company you can imagine sales types transactions that would happen to the related party that could be another way that that a manager or a company might try to manipulate or increase their sales by basically making sales to uh related party at at terms that aren't on arm's lengths meaning they're not like normal market sales because they're at they're at related party uh level and then we have bill and hold sales bill and hold sales sales where the customer agrees to purchase the goods but the seller retains physical possession until the customer requests shipment so this is another thing that you can kind of imagine happening at the end of the year you can say oh well what if there's going to be some type of sale that's going to be agreed upon but the the company is holding on to the inventory they don't actually distribute the inventory until after year end so you can imagine the cutoff date sale happens but the the company is holding on to the inventory not shipping it till after the cutoff date well typically uh the the sales should be recognized when the service is done when the work is done when that relates to inventory goods that's usually at the point in time that they have been shipped or at the point they have been arrived whether it fob shipping or fob uh destination so you can imagine this type of situation invoice goes out accounts receivable bull goes up sales goes up they they say well this they have had purchase that has happened but the inventory hasn't been shipped yet and therefore it's just basically on the books as a sale at that point even though the transaction hasn't taken place revenue recognition process so what's going to be the cycle for revenue recognition if we're selling goods so if we sell inventory we're going to have purchases we're going to purchase the inventory that we're then going to mark up and sell then we're going to have the inventory we're going to be tracking the inventory then of course we'll have cash sale so this is the case if we sell it for cash we would have purchases you can imagine then us holding on to the inventory and then putting possibly into a store at which point we make sales for cash at the store point and that would be our cycle what if we had sales that were going to be made on account we may have then purchases we're then going to have the inventory that we're going to track then we're going to have credit sales so now we have a sale we can imagine basically a credit sale accounts receivable sale we didn't get cash at the point in time of the sale we expect to get cash sometime in the future and then of course that's going to be recording the accounts receivable now being involved now that we have this accrual process accounts receivable and then we're going to have the cash collection on the accounts receivable so most of the time when we think about basically sales on account this is the cycle this is the more complex cycle we would have if we make sales for cash we would have a more simplified cycle looking like this type of transactions related to the revenue process what kind of transactions are we going to be looking at we're going to have these sales of goods or rendering of services for cash or credit so obviously we're going to have the sales that will be taking place these are going to be the transactions that will be testing so when we consider revenue we will be testing these transactions our focus is on revenue but notice this full transaction that will be happening sales of goods or rendering of services which will include revenue possibly cash and we'll talk about the accounts involved shortly receipt of cash from customers in payment for goods or services we also want to test the receipt of cash from customers for the goods and services and then we're going to have the return of goods by customers for credit or cash so this is the other thing that could happen the customer could come back and return the transaction so we basically these are the transactions we're concerned with with regard to revenue recognition what are going to be the accounts then that we will be considering with regard to revenue recognition the revenue process now our main account is of course revenue but as we test revenue we're going to also be testing some of these other type of items to some degree or another given the fact that we have to as we test revenue note that that could be a good thing because as we go through this testing process as we go through these accounts we will be testing other types of accounts as we go which means we could possibly do less testing once we get to those basically accounts and those transactions because we would have already touched on them to some degree as we've been considering the revenue process so then these are going to be the financial statement accounts that will be affected as we consider revenue then we're also going to be considering these type of accounts because they're involved in the transactions the sales transaction will involve accounts receivable if we make sales on accounts therefore to some degree as we test the revenue process we will be testing accounts receivable we'll have sales or revenue because obviously revenue will be involved in the sales transactions allowance for uncollectible accounts this is going to be something that will be involved with accounts receivable as we consider the value of accounts receivable the allowance for doubtful accounts will be part of that net value and then and then the bad debt expense representing those receivables that are not going to be collected that's important with regards to the revenue process because really those bad debt expenses are our sales that didn't really happen it's really kind of a negative sale that happened when someone says they're not going to pay us then the sale never really happened and we have this bad debt expense is really kind of a negative sale in that sense so it's related to the sales transactions cash receipts transactions related to this revenue process we're going to be dealing with cash either with the cash sales or with the receipt from sales on account paying off the accounts receivable so as we test then the sales will also be testing cash so we'll do some testing of cash of course in that process we will be concentrated on cash in and of itself as we as we test cash at that at some point we're testing the bank reconciliation and whatnot but as we test revenue we also look at cash to some degree at least on the deposit side of things and then we have the receivables accounts receivables transaction because it will be going down as we collect cash on account and then we'll have cash discounts as well that we'll have to consider with regards to cash transactions then we have sales returns and allowance transactions so sales return and allowance and this is going include the sales returns and the sales allowances we want to consider these at the same point in time as we consider the revenue process because although these are broken out as separate type of accounts and they act kind of like expenses they're really contra sales accounts what that means if someone came back and said hey i'm giving the inventory back now well the sale never really happened then it's a it's basically a reversal so we don't usually decrease the sales account recall what we do instead is we make these other accounts with our which are kind of like contra sales accounts they're going to be credited they're going to be debit balance accounts that are basically revenue accounts that are debit balance contra revenue accounts and that's going to be the sales returns and allowances and then of course the accounts receivable also involved with the sales returns