You have me smiling. Hey, good afternoon, everybody. Tom Stewart here. I'm with Liz Trotter, our guest today, Honest to God, is one of the nicest people you're ever going to find in the residential cleaning industry, Mark Baker. Hey, Mark, how are you today? Hi, Tom. Hi, Liz. I'm doing great. Thanks for those kind words. I appreciate it. It's sincere. You are always finding the best in everybody and everything in kind words. And I know that you run your business that way. And it's just kind of coincidental, I guess, fortunate for us, because it's a new year. This is a new year. And we're going to be talking about building an awesome culture in your business. And I'm sure those attributes that we're talking about are a meaningful part of making that work. Yeah, 100%. And before we kind of get started, I just want to take a second to first just say thanks for having me on. I enjoy your show. And as well, I've had the opportunity to watch you personally speak, Tom, or several ISSA cleaning conferences and North American shows and Liz as well. And I really, really enjoyed it. So when I was asked by your team to come and be a guest, I'd be frank, I was very honored by that. So I really do appreciate it. And I'm hoping that tonight we're going to get an opportunity not to talk so much about high-level human resource policies that help build company culture, but more on the little nuances. So maybe what we can do is probably I can go with a very, very short kind of backstory about led to the big changes that I made and how it helped my provider return turnover ratio get in single digits. And maybe break some of that down and just kind of talk about it and obviously interact with the audience in doing that. Yeah, I think that would be good. Probably just start with introducing yourself and your business and how we got to this point. Sure, sure. Well, I own a company. I started the house cleaning business in 2016. And I was a solo house cleaner. And I actually came off a failed business as a basketball coach. Started a community basketball coaching program. And unfortunately, I had failed at it. And I lost everything. I had to start over in life. And house cleaning was something. And just cleaning in general was something that was kind of near and dear to me because my mom had done some commercial work. I had several aunts and uncles that had done residential commercial and institutional. So it was a little bit the type of conversation around the kitchen table when I visit my aunts was about the cleaning industry a lot. So something I knew. So I started from scratch. It was just me. I think I was about 42 at the time, 43, and started cleaning my first house. And I had a lot of challenges to get past. So I got past those challenges. I made 90 Canadian dollars in my first month. That was my total sales, 90 bucks. And it was a tough month. And not exactly what you want to come home to tell your wife you're in at the end of the month, $90. But we're in a small market here in St. John's, Newfoundland, Canada, maybe about an 80,000 person market, 500,000 people in our entire province. And I was able to work really hard and scale it up provincially to about $1.87 million in sales by November of 2019, doing all residential work. And there was a lot of work and it was very exhausting. And my goal was to go national. And it's kind of what I always wanted to do. And I kind of came back here tonight because that's not what this is about. But I was able to launch nationally. Hired just under 1,000 providers from the East or West Coast of Canada and got shut down for about 14 months by the federal government for the pandemic. So had to survive all that stuff. And I took that time to kind of look at a lot of the numbers. And I know like your numbers person, so to speak. And our turnover was probably industry standard to be honest with you, but it was 172% or something like that. So we were just turned over. Probably a little bit better than in the three standard, but... Yeah, it was really high time. And it was chaotic too, you know? Like we're generating a lot of revenue. And you know, that a lot of revenue allowed us to be blind to the reality of the chaos because there was lots of revenue. And you know, what happened was I actually went down to an ISSA show in Las Vegas. And I had five staff members in the office with me at the time. So they flew down with me, I flew down.  Like that's a big deal. I'm from a small place. It's kind of like amazing, going to Las Vegas. And we're pretty excited about going there because I had gone to the Dallas one the year before. And I knew how amazing this experience was gonna be. And I knew the round table was gonna be huge because I had a chance to sit down with all these different people who were really experts in different fields. Like for example, Paul Fried was there and he was doing the round table market. And you know, he lives and breathes and walks it, right? Yeah, he's got it, right? So what happened was we broke up in the individual group. So we tried to take in as much of these round tables as we can with the sole goal of plugging the holes and solving the turnover issue. And I came back from Las Vegas, you know, I'm really depressed to be honest with you because I wasn't able to find the solutions. And I remember sitting down in my office and you know, I had the people around me and we were talking and we were like, hey, look, we got to do something. Like we can't scale this way. We're not going to get what we want to go this way and just turn it over. And it's just chaos every day, right?  And then we got the feedback that we'd actually received. Let's look at ourselves honestly over the last several years and let's just be honest about what people want as providers, you know, professionals. What do they want from us, you know? And we do a good part of looking at ourselves and we made it a list of the things that, not that we think matters or what you're doing in business school matters, but it really mattered to people. And then we built a plan to execute it. And, you know, I'm happy to say that our turnover right now is only 8%. And we hire 100 people today. It was? Yes, Liz? Yeah, I got a question for you, Mark. So you said you came up with a list of things that really mattered to people. Where did you get the list? Well, basically we took a good hard look at the feedback that people had given us when they turned over that we were denying or I was denying. So from the- And how it, from the people who, yeah, it wasn't formal exit interviews or any of that kind of high level stuff. It was more about, you know, just like, so and so quit. And, you know, why do we think that is? And, you know, just analyzing the things that had happened over the past couple of years. And we had some amazing people come through our doors too, right? And then it was like, you know, why do we need to do to attract really good quality people of high character and so on and so forth? So, long story short, it's dynamic and there's not any one thing, so to speak. But what I can't hope to talk about tonight are some of those smaller nuances. And because like Liz, I know like, like I've seen you speak and stuff and I know you're really, really highly skilled in human resource management. And, you know, you know, I went to business school and, you know, you learn, you take human resources courses and you learn about different types of human resources practices, right? And a lot of times I find in the house cleaning industry, sometimes we're a little bit behind the time sometimes in some of these practices. And a lot of these practices now are coming over into our industry and they're being presented as these are new ideas that are really gonna be game changers. But it's really just part of the course and a lot of other industries, like say, oil and gas or something. And so that's kinda not what I wanted to talk about tonight. I wanna talk about just little nuances. And the main thing I really wanted to talk about was that we had a cultural shift in the fact that for us, our customers are not just the people who consume our products or our services. Our customers are the people who provide our services. And that's true in everything about us. As a matter of fact, I sat down hand-stakingly, 18 weeks, day and night, writing our brand values. You know, so they weren't just kinda words on a wall because, like, I remember working in the oil field and I worked on one of those oil rigs, you know, five and a kilometers in the North Atlantic off the coast of Newfoundland.  They'll have all these packets on the wall of the different brand values, right? And then kinda you're reading them while you're waiting to go in the OIM's office. And, you know, it's all just not true, right? That's not how they operate. That's not how they make decisions. And so for us, it was like, I needed to make these brand values and these decision-making systems that would allow us to create a culture that attracted great people and had them wanna stay with us, right? And that was hard and painstaking. And to be able to do that. And then once we did it, be able to live it on a daily basis. And I wanna be really clear too as we kind of get into this, is that like, I'm not, we all don't hold hands and see Kumbaya. Like for example, we used to do Christmas prayers, we don't, we don't do Christmas bonuses. We don't give Christmas bonuses. You know, we don't do personal loans out to people like we did.  And as this person was telling me how the tires were going bad and this is Newfoundland, right? Winter is a big thing here, right? We get a lot of snow, a lot of ice. And you know, and I remember saying, is 3000 enough? And the person saying, the provider saying, what do you mean? What is 3000 dollars enough to take care of the car issues and the tires and the person going, yeah, well, that's already sent to your account.  You know, these were the type of things we did regularly, right?  You know, we do all these nice things which these are things you would think would matter and show value and appreciation. But our turnover was just as bad as ever. And what's interesting is our turnover is in single digit now, but we literally don't do any of that. So the question is like, well, what's different, right? And- All right, so you've strung us along, you've got us, tell us what you do. Okay, so- Some are attention. So when someone is your customer, how do you behave with them? And so I ask you that question. So how do you, Tom? You know, how do you treat your customers? Well, you try to treat them well. You try to meet their expectations or exceed their expectations. Okay, so let's stop right there, stop right there. So meet expectations. Okay, so meet expectations. Okay, that's excellent. So what other type of things do you do with customers outside of trying to meet their expectations? We're just gonna gather one or two here. I mean- Well, like Tom said, he doesn't just try to meet them and he tries to exceed them. Sure, sure. So expectations is a general theme there, right? And I'll throw one out there to kind of get a call. And how about responsiveness?  We do measure responsiveness and how long it takes your people to answer phone calls, to respond to emails, to respond to tickets, or whatever way you guys communicate, sure. You know, and not just with the house cleaning businesses you're involved with, but like we've made central. You know, that's awful. We have all of these NUs or customers who run your house cleaning businesses and you have a ticketing system, I'm sure, to help in place in order to, you know, respond and manage their queries, right? Oh yeah, they're very responsive. Yeah, that's a metric that we measure, how long it takes to respond and how long it takes to get an issue resolved. Yeah. So let's just look at those two things. Consistency, Mark. Consistency, well, that's actually a really, really good one. So consistency, whether that's the quality of the work that your company does in the field or consistency in how you're communicating with your customers and consistency just across the whole board. Right. Okay, so let's just focus on those three. Okay, so those are three things. So we got expectations, we got responses, and we got consistency. So those are three things that yourself and Tom feel are really important to both of you with the different businesses you're involved with when it comes to your customer service. That's how you like to treat your customers, correct? Yeah. So now let's talk about different jobs you've all held over. Like I've been self-employed over a long time, but I've had regular jobs sometimes, occasionally, for short periods, until they would fire me from them. So I had become self-employed. And the only guy I get to, I got fired from PetSmart. It's bad. So, but no jokes aside though, right? So let's talk about jobs we've had and maybe you work somewhere. Okay, let's use this example. How about you get contacted by a customer who you clean houses for bi-weekly for three years. And even though your system sends them out invoices, they might have a customer dashboard, there's a record of accounts of the money they spent with you, maybe tomorrow they reach out to you and they're like, hey, I wonder if I can get a copy of my invoices and my spends from back in 2017. So now that happened in my company, okay? Well, the first thing that's gonna happen is however that communication came in, whether it was a web chat or text message and email a phone call, a social media DM that goes to a web chat widget, whatever the case might be, it's gonna create a ticket, right? A numbered ticket. And we're gonna respond to that person promptly, you know? Hello, Mr. and Mrs. Smith. Thank you so much for reaching out to us. We're really happy to get that for you. You know, we can expect to have that for you in X amount of time, or here it is now. Is there anything else I can assist you in today? Yeah. Right? I mean, that's how you respond. I mean, Tom, would you agree to say your company responds? We aspire to. I think from what I know of people who know you and actually are customers of yours who use your software, that's what I've been told, how you respond. So I'm gonna go with that, right? No, that's true. That's absolutely the system that you create. And that somebody gets in touch with you, they put into a docket, we've got a plan for how quickly we're gonna get back to them. Absolutely, and then we're gonna resolve their issues as best we can. Sure, resolve the ticket. We're gonna create a ticket, you know, make it escalate it, you know, there's lots of different things you do inside ticketing software to deal with this. Now, why do you get contacted by someone who is a provider? And I used to a term provider, but you know, house cleaner, cleaner, clean technician, not all the different terms people use in our industry, but provider is what we say. So what if we have a provider that reaches out and maybe that provider says, hey, you know what? I was hoping I can get a copy of this or a copy of what my total income was with you in 2017. What does, why do we think that the average customer company is gonna behave like? And I can say that it's my opinion from my personal experience, wanting a document from companies I worked for over the years, like, you know, that was self-employed, that I knew the minute I reached out that I probably wasn't gonna get a response. I definitely wasn't gonna get a prompt response. And I was never getting that document unless I fought for it and became a squeaky wheel. Right? And that's generally how it is with a lot of people. Experience. Really, yeah, I mean, I can see that happening. I can see that happening. I'm not even a big company, but not in a small business. I've worked for a lot of small businesses. That's not as common. Now, maybe at Jack in the Box, when I worked at Jack in the Box, I could see that happening, right? So it is. So, okay. So what my experience has been is that's generally is the way it is. And the experience of the people that we now speak to because we now, we do have proper ways of getting metrics and X interviews and all the things that that's a commonality, right?  Maybe you fired them for theft. Maybe you fired them for something serious. No, I'm being serious. This is a real use case. It happened, right? I'm like, that seems like something that would happen.  If you work in the residents of cleaning business, you know that happens. So. That's why I'm laughing. Yeah. So the question is, is that, well, how do you respond? There's going to be a lot of people are going to take that and they're going to say, you know, I may not get back to this question at all because of the history or, you know, I already gave you this information when you exited on your T4A. I don't know if you guys call it 1099s or something. Down in America, 1099s and W2s, I think is what you call the forms for employees. Those are tax forms that people get, yeah. We have T4s and T4As in Canada. So we probably, you know, would respond that way. But the reality is, is that we don't. We respond the exact same way. Hi, Mary, thank you so much for reaching out to us today. You know, we're really happy to hear from you. Here's a copy of your total income or that form that you needed from 2017. Is there anything else that can assist you with today? You know, and that person doesn't take the customer, so to speak, the person who wants a book with us, doesn't take any priority higher than the provider. So when does that start, right? I gotta check this. I gotta check because guaranteed, I don't mean thumbs down, that's the only thing that shows. I gotta check this because people are gonna ask this question for sure.  Well, the provider that, like, providers are customers. It's that simple. Now, the reality is that we have- You're not gonna answer my question. That's fine. No, I am answering your question. I am answering your question. I didn't say that we were more important. I said they were equally important. Equally, okay. Yeah, and one is not more important than the other because there's brand standards and the brand standards are this. Our customers are the providers and the consumers of our services. Without customers, there's no business. Without providers, there's no business. Everyone has all these pie-in-the-sky days when you start a residential cleaning company. We're getting business, that's generally the easier part. Getting providers to perform their work is, that's the magic, isn't it? So the thing is is that, right, you gotta have both and the harder one to get tends to be the providers in my experience. So that's a culture that we build. Now, maybe that use case wasn't a great use case. Maybe we should talk about someone who, you know, didn't have a bad experience or someone that is currently with us. So let's talk about that. So tonight on the way over, I was driving home from the office and it's like the next town over and going to get Scarlett May from the after school and make it here. And on the drive, I called one of our providers and I called someone who was about six weeks in. So, you know, they went through an application process and onboarding process six weeks in, you know, just got, I think the last paycheck was about $1,240 for a week, gross with online tips, no cash tips. And I said, hey, I'm gonna be on a show tonight.  And I said, give it to me, ask, is this guy's a good communicator? And I was like, what are the things about this company that you think are different culturally from your previous experiences, right? And this person had worked as a PCA with a big health institution with all the bells and whistles, right? And he said, the big thing he said, I find is the responsiveness. And that's what he meant.  Like, I can't get over it. Like, even if I had inquired about something and I didn't expect a quick response, it wasn't something that was pressing. Like, you were back within minutes saying, no, hi, so-and-so, thank you so much for inquiring. That's a great question. Yeah, and then he said, and then you always end up with like, is there anything else I can assist you with? Right? And then the next thing he says, he says, and here's the other big thing you do differently. He said, you guys say you're welcome. And so what do you mean? And he said, well, like, say we're communicating via text message. And I communicated and I'm talking to a support agent who's like, hey, you know, I'm in a property and I think one thing that happened to him last week was someone had jury rigged their chandelier with a rope and as he was dusting it, the jury rig came apart, the chandelier dropped, the chain caught it. But, you know, like, there was no damage or anything and it wasn't something that was his fault. Very. But he followed the policy, he sent in a photo of the picture into the app and he texted in and done the things he's supposed to do. And, you know, after we addressed it, he said, thank you. And then the support agent said, you're welcome. And he said like, that's unusually said because people don't normally say those things. Like, they're fine, like, they matter to me, like that you, like I know I can call this company, I can call the eight at eight number and I'm definitely gonna get somebody that I don't get someone gonna get an immediate callback.  And to me that little tiny nuance is huge because it's reflective of overall feeling of your interactions with your providers and how you value them. So like you can show them that you value them by, and I'm not saying there's anything wrong with a Christmas party, don't get me wrong. I'm just saying for us, right? You can value them by having a Christmas party or you can value them by treating them as a customer because when you're dealing with a customer you're gonna be responsive. And you know, like if you miss a phone call, you know you want to get that callback immediately and Tom would probably give you the stats on how that affects your sales. You know, if you don't call back within exactly 6.7 minutes you only have a 20% chance of actually, you know, getting this closed this deal because he follows that stuff. But what's the difference between that and with the provider? Right? I think what you're saying is there shouldn't be a difference. So there isn't a difference with us. And that was a huge part in going from almost 200% in turnover down to, you know, just under 10%. And... Under 10% on an annual basis. We hire 100 people today, and 92 of them are gonna be with us this time next year. That's awesome. That is almost unheard of. So what you're describing in terms of the responsiveness is, you know, good to set as a goal, you know? And the beginning of the year, you know? So we're all setting goals, right? And getting ready for the new year. The tricky part is executing on those goals, meeting those goals. So it sounds not only did you identify that that's what you need to do in order to provide the customer service to your cleaning professionals, but you also had to deliver it. So it says easy and does hard, I guess is what I'm thinking. How do you make the transition? Well, a big part of it was actually, there was one big part of it was just having an honest conversation. One of the things with it is we sat down and, you know, I sat down and said, come on guys, why are people quitting? Be honest, why are people quitting? What's the truth, right? And one of the things we did start off with is we talked about money straight up. You know, we talked about a living wage and we said, well, what is a living wage? You know, and then we, you know, we found a website called Living Wage Canada and we found out there's a whole movement and there's different organizations that measure the metrics when it comes to living wages and purchasing power. And we kind of, we figured out in Vancouver, which is like the most expensive Canadian city to live in, what a dollar per hour living wage would be and what's that exactly defined as, exactly. And then what we done is so, okay, well, we had to be able to at least pay a living wage, at least, right? And if we can't pay a living wage, you know, people are gonna be more concerned whether or not they can afford to get their breaks fixed if they're gonna have enough money to give to their child when they go to school for the book fear or whatever the particular needs are, right? And they're at work and they're really worried and stressed out on a constant basis on this kind of stuff. It's really hard to be focused on whether or not you get that last piece of dust off Mr. Smith's baseball, you know? And we just wanted to go from there, but when we worked a little living wage was and we looked at what we could charge in the different markets and stuff, emergence weren't very good. So then obviously we had to do a lot of work to try to say, well, how can we be a very lean company? You know, how can we operate profitably very lean on our end and pay out a lot more than everyone else, right? So like, I'm not gonna say that's not a part of it, but that's not all of it. Because, you know, when people get surveyed time and time again, they always say like, as you know, a customer will say, what's the number one thing? And they'll suddenly say price number one, price will be third or fourth, maybe. You know, they'll talk about quality, consistency, the character of the providers that come in their house, right? But all of these things would be things that matter to them, right? So, I guess for us, you know, we kind of took care of that side of it and learned how to get lean by, you know, leveraging our international employees and different things that we do to help us be lean in great software. Like we don't use MadeCentral right now, although, to be honest with you, it's up for discussion within the next few weeks, 100% for something we're doing. We actually have several different pieces of software we're using right now. And we're- Half of them are made central. Well, because we're finalizing something we're working on and which one would be the right one for us. So, but my point being is that, you know, leveraging our great software, you know, reducing our human resources car, like once we deal with that, it's like, okay, well, let's talk about onboarding. And that was a huge part of it was onboarding, the onboarding experience, right? And so one of the things we do is that, okay, so like last time we put a job ad out, I think we had like 7,000 people applying, okay? From across Canada. And so you got these big numbers, right? So the thing is not every candidate is gonna be a good fit, right? And sometimes it's like simple, like they don't have a vehicle. They have a, they don't have a clear criminal background. Well, especially if you have 7,000 applicants, of course, they're gonna be good. There's gonna be a ton of people that are not good. Right, and what I found myself personally, like I remember being a young man and I remember having kids and finishing college and struggling by and like needing a job really bad and applying for a job really bad. And then, you know, talking to my parent and I was like, I hope I get it and I think I should get it. And you need this job. You need to get working to make money, right? For your family and for yourself and everything. And then like you're waiting, you think like a couple of days, well, maybe I should call them, right? And you think, well, but I don't wanna be too eager.  And one of the things that we really proud ourselves in this is that we reply to every single person who replies with us 100% of the time. That's really, really important to us that we reply to everybody. Was that one of your employees that you're calling? No, I have a do not disturb list. I have a do not disturb list. If you have to answer that, we understand. We told you that. We have support agents who take care of that, thankfully.  I got, I got to do that. I got to do that. We'll do a conversation. Actually a fake one if you want, then we'll do that. We'll do some role playing. But okay, so I'll try to speed up and now I'm talking here. So, okay, so 7,000 people reply. Yes, it's automated. 100% of people get applied too. And we automate them. We apply this, you know, like, hey, thanks for applying. We really, really appreciate it.  And we'd like you to hop over to this website and actually put in an online application with us. Now, once that online application comes in, 100% of those applications get reviewed by a live person, a support agent. Now, the way the questions are posed, we don't got to spend time on it. Like, we know, like, yes, yes, yes, no, no, no. Reject, we know the answers, it'd be like that. But when we reject somebody, you know, we have canned responses, but we still reply to everybody 100% of the time. And we do it within one business day, always. Okay, so my point is that's where the brand starts because whether those people are a good fit or not, or wherever they're gonna be in our world, whether they'll be customers one day, whether they know people, you know, we have a person who works with us now whose wife started working with us. And it wasn't a good fit for her.  She went out and done a booking and we had to completely redo it. It was a Friday night, it was late night. I had to get involved in it. You know, it's fair with bedtime for Scarlett. It was just an awful experience.  And we started talking and like, you know, I wished her well and I thanked her. But thank you for really giving it a good honest go, right? And she said, you know, I was afraid of this phone call. What was it? What was it? Google Meet, right? I was afraid of this, this, this because I thought you would come down to me and you'll be hard on me and you would be rude to me and had a lot of anxiety over it, right? So what ended up happening was that, you know, she went down to, she's back in school now. She's pursuing a different career. So all of a sudden we get an application, like, you know, sometime later and it's the husband applied. And we didn't put together that they were married till after he was retained. And then we put it together. We said, I spoke to her about it. I was like, yeah, is that your wife? And I asked him why he chose us, right? And he said, you know, I've been watching this company for a long time, watching your ads, watching things. And I wanted to make this move. And, you know, I suggested to my wife, maybe she tried and I'll call up and he said, the way you treated her when she offered it, he said, that was what sold me. The way you treated her, even when she wasn't a good fit. And like that said a lot about you guys, you know? And so being responsive starts from the application. So then all of a sudden, you know, someone applies, we say, hey, we would like you to join our team. Okay, so we make them an offer. Well, in that offer, we'll embed six or seven videos. Okay, and those videos might be anywhere from a minute to six minutes long. And we ask them if they kindly watch those videos before they accept their offer, because we want them to get a really good idea of what it might look like if they become a part of our network of professional housekeepers. And we want them to really make sure that they learn as much as they can to see what's good fit for them. But before we even get into that, there's a welcoming video and it's me. I was like, hey, here's who I am. And first of all, thank you for applying. And it's really good to meet you. And I hope this works out. You know, your success is our success. And that's not just verbiage with us, but we really mean it. And I want you to know, and then we talk about a couple of the values very succinctly. And I said, no, look, you know, when in doubt, give your support team a shout.  So below is a Calendary link and it goes directly to me. And at any point in time during the onboarding process or any point with your tenure with us, if you want to talk to me directly, you can click that link and book a 15 minute appointment with me and I'll address your concerns. Like that. President of a company, or in this case, I'm the voice president of Morgan House Cleaners. I'm the president of the company that owns it. But that's unheard of, right? So like my point is, is that those little treating them as a customer starts right on the onboarding process by how you respond, how quick you respond, how professionally you respond. And then what about once they get working with you? And what if they run into problems? How do you respond to that? And how do you talk to people? And one more thing I want to mention is like, one of the big things that I'm very proud of and I think makes a huge difference because it affects culture. And we use train oil and we built out a learning management software inside of train oil and our support agents, they watch videos and do all kinds of training and testing to understand the culture, right? And how they're going to answer the phone. And it can get really easy when you see a call coming in the call center software and you can see that this is a provider and you know who that provider is, is easy to say, hey, Tyler, how you doing today? Or, hey, Mary, how are you? But you know what? Our job is to serve them. Right, our job is to serve them and to do a great job serving them. We can do a great job serving them. And we're not holding hands and seeing Kumbaya. I'm not saying anything about lowering standards because I want to talk about that. But if we serve them really well, so we answer the phone and the phone is like, hi, Tyler, Dominic speaking. How may I assist you today? You know, I'll listen in the phone calls and stuff and sometimes I'll listen, I'll urge you and I'll do different things with you. You know, I monitor what's going on with these calls and you know, I'll listen to it and I'll have a meeting with the providers, a support agent and it's like, hey, you know, like I noticed that I'm getting very comfortable with provider A.  And I love the fact that you're getting close to Mary. You're building a rapport. But let's not forget that Mary is a customer and you know, you need to treat her with respect. Like when we get someone calls in, hey, sir, how may I assist you today, sir? Thank you, ma'am, I really appreciate that. You know, it's sir, it's ma'am, it's not Bob and Mary, like we treat our customers and speak to our customers with respect, we're very lucky to have them. Without them, I have no job. Can I feed my family? This is very serious business to me. So these providers are the same. So, you know, although we don't say sir and ma'am, it's like how may I assist you today, Tyler?  So let me get this correct. So you're calling in today because you tried to clock in and the software didn't allow you to clock in, but you actually arrived at this time and this happened and this happened and that's what you're looking for help with. Yes, okay, great. So we'll help the person. And then it's like, okay, you know, is there anything else we can assist with today? You know, so like just that's a bit unusual. And they'll say, no, thanks, that's great. Oh, fantastic. Well, they might say, yeah, actually I'm really glad. One of the interesting things is when people first on board, if they haven't learned about us through people they know, what they'll do is is that they'll send an email in for something and we'll respond, you know, they're not a responder and, you know, get back and we're gonna get back to them. And maybe some tickets may take seven days to resolve because it just takes seven days. It could be, because that ticket could be depending on a third pair, right? You know, so, and we'll follow our tickets. We don't just leave them there and we'll touch base, but they'll kind of come back to us a day or two later and they'll almost press us for the resolution because they're so used to communicating with other companies and never get back to them or put them on the sidelines and they have to kind of nag, right? And we'll say, hey, you know, we'll call out.  But we have a 100% response rate. 100% of the time we're gonna resolve whatever you have. And they'll be like, it's a fact. The only way that we wouldn't is if there was a bug in the software and if so, well, we'll find it out and we'll flush it out and we'll find out where that bug happened and we'll resolve it. And what happens is is that then they start to learn that over time because the proofs in the pudding, right? You know, we deal with this issue and we deal with that issue and we take care of all the things 100% of time and they build a sense of confidence. So that they can just send us an email, send us a text, send us a communication and they can forget about it because they know that that's going to be resolved and these guys are honest. Lawrence has a question about working interviews. Is that something you've ever used? Does that fit into this framework? I was hoping I wouldn't be asked questions about interviews, Lawrence. We don't do interviews in our house to the individual at all. Lawrence, that's an awesome question then. Let's hear about those. How does this work? Yes, so tell us about this. I'll give it to you quick. Okay, so big five personality traits. Liz, I know with this, you do a lot of work on personality traits and whatnot. So conscientiousness is of the big five personality traits. Conscientiousness is the one that most predicts success, not just in professional housing but anything in life, really. It's like the big personality traits. So we try to hire for conscientiousness, okay? And- That's a big word. And I mean, there's an all sincerity. What, how do you define that? What? Well, I can pull up my brand values and actually read out what conscientious is for you on screen, but it's gonna eat up a lot of our appointments we have left to get that in the drive and pull it up. So I'm not gonna do it. So I'll give you kind of more of the simple version because we do the, because we define all of our, all of these things as it pertains to working with us. So like dependability, we all know what that is but what exactly does it mean in the house for the industry with us, right? So, but let's just say that conscientiousness is a general attention to detail and caring about the details and caring about the results. Just a very generalized version of conscientiousness, okay? Could caring or caring be synonymous with conscientiousness? Yes, absolutely could be. But it's a dynamic word and that's a very simplified version but that's the gist of it, right? I'm gonna end with that word because you're trying to make a point, right? You're trying to make a point that this is more than just caring. It's, yeah. And we, like I said, we can do a one hour just talking about conscientiousness and like, again, I can pull up our brand value and read out a paragraph that big and what conscientiousness is, right? But so we hire for conscientiousness. So first of all, when we put out a job ad, so to speak, we give the personnel, we're very transparent. Transparency was one of the big things when we talked after that Vegas trip and we sat down and talked, we talked about being more transparent. Now that didn't mean opening up our balance sheet and our income statement, but it did mean be very transparent exactly what this involves. Because as a natural salesperson, like I used to be a realtor way back in my 20s and they top 3% on earth for COA Banker Network, you know, I could sell things. And I found myself in interviews a lot of times selling the job to people and they'd better work with me. They're like, this is great. And they weren't a good fit and they wouldn't work out, right? Look at this big turnover because they just, they were attracted to me and how I was presenting the job. And I had to learn to just really present it exactly for what it is and not for what it's not and be very real in what they should expect or what it would look like if they did this job, right? So, you know, we obviously get that out to people once. Now, when they apply, okay, we send them over to another website. Well, let's say, let's pick random numbers, pick a thousand people, okay? So you have a thousand people apply and we say, hey, thanks for applying. It's so good to hear from you on Indeed or whatever platforms, Zip Recruitment or something. Would you kindly just hop on over to our website and put in a amount on application? Now out of a thousand people, about 400 are gonna do that. Okay. About 400 are gonna do that, right? So they're just not gonna reply. They just randomly apply everything they see or whatever the case might be, right? Okay, so that's conscientiousness. We asked them to do something. So they had to jump through a hoop, so to speak and they went over and they applied. Now when they apply, we ask them important questions we need to know. Like on our websites, like for example, you know, do you have a criminal conviction? You know, do you have a vehicle? Do you, can you lift a certain amount of weight? You know, there's obviously standard questions you need to know, right? And we know that we've got, and I can't remember what the order is now so I don't manage on a day-to-day basis. But let's say we need, yes, yes, yes, no, no, yes, yes. Whatever we need and then, you know, and if it's in that order, we make them an offer and we make an offer to everybody. So up to a thousand people, 400 come over, maybe 40, their applications rejected because of some of the questions are not answered where we need. So say we make like say 360 get an offer. We just made an offer to 360 people. We never looked at the resume yet. We never interviewed them. And we asked them to join our network. And yeah, people make faces like Tom just made and that's perfectly normal, but we're hiring for conscientiousness, right? So what happened? He puts your number. So now you just hired 360 people. No, I didn't say that. I didn't say it. I said I made an offer to 360 people. That's very different. Okay, so in that offer, there's a series of- Are you deeming that these 360 people to which you made an offer are conscientious because they went to the website to fill out a form? We don't know the level of conscientiousness yet. We haven't got to the bottom of it, but we're getting there. Again, we got one piece of that conscientious work. So we've made an offer. So we've made an offer. And in that offer, we ask them to watch a series of videos. Okay, and that's work. Now, if you're about to embark on this new career or maybe it's the same career with this new company and it could be potentially a life changing really great career, and you're about to embark on that. I think investing 30 minutes of your time or watching short videos to educate you on what this career is going to be really about for you is not a lot to ask from somebody, is it? Okay. Yeah. I don't think it is. And here's the thing. I know myself, if I was going to start a new career, say Tom came to me and said, Merck, I want to hire for this, but I want you to watch this thing for an hour first. And I got an opportunity to work alongside Tom and make some great money with Tom. I'm going to invest in that. That's not a lot to ask from me. So, and I'm being very sincere when I say that Tom, by the way, so you can hire me to do something later. But, but jokes aside. I love it. It's a line for a job, Tom. So, so, so, so, I'm not so worried. Let's, let's drill this down. So, so of that 360, how many people, now we asked them to reply. And we asked them to reply in a certain way. If you accept our job offer, would you mind replying would you mind specifically saying, I accept the job, I have read, I have received, I can't remember what it was now because I don't manage it any more. I just wrote it ages ago. I've watched it. But it's basically, I've consumed all the content and agree and blah, blah, blah, blah, blah. And, you know, basically there's, that's embedded into the video. You can't read that and know how to reply. So we know if they copy, right? We know it's almost like a secret code word, right? It's like, when I get someone to do something to be on fiber, right? I'll, you know, do some content on fiber. And I'll be like, and I'm only replying to people who say the word cat to me. And I'll embed that in there. And if they start off with cat, then okay. And if not, I don't look at them because I need to know they read the job description of what I'm hiring them to do on fiber, right? Kind of a same, same type of thing. Okay, so I've got 360. I would say probably 60 people accept our offer. 300 people never come back. Okay, so we had a thousand. Now we got, now we got 60 people. Well, hey, who doesn't want to hire 60 people for the cleaning company today? A lot of people do, right? That's good numbers. Okay, so now what we do is they come back, okay? And if they reply and they don't say what we need them to, we'll go back to them and say, hey, and this is all canned responses. This doesn't take a lot of human resources. You know, we go back and say, you know, hey, Bob, thank you so much for getting back. Unfortunately, you didn't acknowledge what we needed to acknowledge in the videos. Would you mind hopping on back, going through those videos one more time, consume all the content and once you do, come on back and let us know we accept this offer in the way we asked you. And guess what? So say we send back 10 of those people, leaves us with 50, one of those people come back. Now, if they come back, what we're doing with them is we're training them already before they even start at that, hey, like where's time there's not negotiation. Like when we ask you to do something, this is what we expect you to do. Like we didn't ask you, we have a policy that we're not gonna enforce, then we shouldn't have that policy. We need to carry that policy. So let's say we'll now take these 50 people that are left and we'll say, hey, you know what? Welcome to the team.  And you know what? You can do it as self-paced, you know, take a week. But when you're done it, now we know when they're done it, we know what percentage they are. We know the last time we logged onto the training portal. I mean, obviously we have the metrics, right?  Okay? Well, each day the support agent goes in it's like, yeah, this person has been onboarded three days ago and got 0% done. Okay, canned response. With notice you have 0% done, you know, goodbye. Basically a really nice way. We made a mistake, come back to us. And sometimes you come back, right? So once I saw the person that stole from you, you've got to be nice to them, right? You've got to be nice to everybody all the time. And today I really got challenged on a call if that escalated to me on that one. I had a customer being abusive to a support agent and it was really, really hard to be nice. I won't, but you've got to be nice all the time. So to everybody. So what happens next is when it's all said and done, maybe 10 people come back to us and they're like, hey, you know, I'm done my online trade, right? And then so up a thousand people, we got 10 people. And there's, you know what? There's a bunch more hoops they got to jump through to. Are there reasonable numbers? I mean, over 1,000 applicants? No, it's just 1,000 he said. Yeah, yeah. So again, it's across the entire country with 35 million people. Okay. It's not a two million person state. And even if you were in Florida and you got 23 million, I think Florida got 23 million now. I just read. Yeah, they're growing. They're the biggest growing state in America last year was Florida, right? Cause a lot of people moved over there that didn't kind of enjoy the lockdowns or whatever was going on in the country. That crazy country, this country is going crazy too. Trust me. But my point is, yes, Tom, it's a big country with millions of millions. So those are reasonable numbers. So my point is, is that for a thousand people, you might end up with 10 or five on the ground. Now, once we've hired them, they upload into a HRIS platform. So we send them more instructions. Please upload to our HRIS platform, right? So human resource platform.  They put in these things we need. Then we review it. And if it's not right, we send it back to them, make it do it again. We don't hold their hands ever. They have to do it themselves every single time. And that leads out to more people. And then finally, we see a picture of them. Now, they have to upload the criminal background check that they get from our platform, right? They use to click our platform as national company supplies a background check to go through all the things. But the thing is, is that we didn't get them to give us that earlier. We just, we just got them to say that they had it. I mean, we'll know that you get to the end. They don't have a criminal background check. We'll just put it off for them, obviously, you know. But my point being is, is that when do we see, and we look at a picture and say, wow, that's a six foot forward Sri Lankan guy along here. Or hey, that person has a tattoo of a spider on their hand. Or that, like we used to be almost predominantly women, and now we're 50, 50 down the board, men and women. Without any, like without diversity and all that kind of stuff. Literally just because people who have a natural aptitude for it, who have conscientiousness and are willing to invest a time and energy to pursue this career and pay attention to the little details on the onboarding, when they end up on the ground, they're more likely to be successful because they've proven they're conscientious. And what ends up happening is they just don't turn over because they're a good fit, right? It's not even hard to get this job. So I don't need to interview them. They've proven to me. And you know something, I went to business school. I know what the halo effect. I know what the similar me effect. I know about all these human resources practices. And you know something, I gave interviews and they were extremely high level of trouble. I gave the best interviews. Okay, they were the best, the better and all the other interviews. No, like literally, they were great interviews to follow in prostitutes and out of the eyes. And I was still wrong almost all of the time. And who I hired, I was always wrong because my turnover showed that I was always wrong. I think he's not talking about regular interviews. He asked in the question about working interviews. So you can see if the people have the, so it's great that they're conscientious but do they have the capacity to do the job? You know, like, do they have? Right. So we hired the person, they're on board it now. There was no actual interview. The interview was going through this process and now we have this person that works with us and we started selling them bookings. So we started selling them bookings. So they go out into the field, they do the work. Every single thing is paid attention to. If they don't click the on my way button at exactly 15 minutes before booking, they create a sport ticket, a sport agent calls and says, hey, we know what you didn't click on my way. Is everything okay? You know, we, there was supposed to clock in at 8 a.m. at 8 0 1 p.m. We're calling and we're calling them a bidding cocket. Gotcha. You know, like all of the things are very heavily automated and are to make sure that we know if anything's going off the rails and then you got the feedback. And then when the feedback comes from the customer, now then, you know, at the end of the first week, you have a face to face and you have all these success coaching to call it and regular meetings and all kinds of different things. Sure. As far as like out in the field, no, they completely train themselves. Like they train themselves 100% with online training. And then what we asked them to do is once they've done their online trading, we asked them to practice in their own homes, in the homes of their friends that played our checklist. And, you know, we liked them to get that done within a week, the practice part, but if they need extra time and we had people come say, you know, I've cleaned my mother-in-law's house, I cleaned my house, I've done your premium checklist in a friend's house. It took me seven hours and I'm like, that should have been three. And, you know, they go through all the things and we collaborate with them. And when they feel ready, like, I'm ready, I'm ready to go into the field, you know? And they go out into the field and then, you know, well, 92% of the time is a good fit since all this got changed. But, so that onboarding is, because remember I said at the beginning, like this turnover and how we treat them as customers. And I said it was dynamic, right? Yeah. Like, hey, there's a lot of moving parts. You got the living wage, you got the conscientious onboarding and all the different things. But also what it boils down to is that, for me, Mark Baker, trying to fulfill my life stream, you know, build a legacy that I can be proud of, that my three daughters will be proud of, you know, and all the things that we're trying to do with our lives. I really want this to succeed. Like, I don't want this to fail. And I just really, really understand how important the providers are. Now, look, we have a professional house cleaner who is absolutely fantastic. She's be loved by me, by everybody, by the support agents, but she's just, she's amazing. She's extremely dependable. She's just the quintessential perfect person, right? And, but coming out of Christmas, statistically, we do get a little bit more, you guys call them call-outs in America. We call them call-ins in Canada, believe it or not. It's calling in sick. You guys call it calling out. The first time I heard calling call-outs, I was like, what the heck is that? It's not a call-out. We have both. We have both. You know, it's calling sick, call-out. They don't use that in Canada at all, not to non-knowledge, so. But we get a little bit more call-outs or call-ins just after Christmas. And really what it pulls down to is your exhaust. You know, they've worked hard all year long.  Christmas is a big, big deal here in Canada. They get a rest. And it's sometimes it's hard to get the old mortar going again to get back to work, right after all the chocolates and the turkey and all the stuff. Yeah, you know, it happens. And sometimes it's easier to say, to give a platitude than to be honest. And the honesty is, hey, you know what? I'm finding it really hard to go back to work one day. I feel like I'm still in Christmas mode. And I just, I don't want to go. I want to take a mulligan. And if that provider had said that to me or to the person who brought it to me, I would have said, I get that. I told you, I feel you. Let's have a look and see what we can do here. It's just possible to do this for you, right? But when someone tells me they can't come in because, you know, they're worried about the brakes and the car all of a sudden, and a few different other things that I know are platitudes. And that's a hard stop. There's a face-to-face meeting. And that person needs to set the accountability that the fact that they're not meeting their commitment and not living up to the level of dependability as the company expects. Because it's our number one brand value is dependability above all else. And then during that meeting, this person was able to say, you know, yeah, you're right. And this isn't good enough. And it's not good enough to let a customer down and this and that and the other thing. So my point is, is that even though we are treating them as customers per se, right? And we truly believe that because I know they are my customers or how I make a living. And on the same token, that's not going to be mistaken with, like I say, you know, just falling hands, falling over. It's a business relationship. It's a business relationship that's clearly defined. There's expectations, like Tom said. We have clearly outlined the expectations of what they can expect from us. We promise no more than we should and no less. And we simply live up to what we do because I don't think as a company, I have to promise to sky the moon and the stars, so to speak. What I do think is I simply have to be very clear about what they should expect when they become a part of our network of professional house cleaners and then simply live up to it. If they're supposed to be paid Friday at three o'clock, make sure they're paid Friday at three o'clock. If you say your response time is 24 hours, then you respond within 24 hours. You know, just live up to what you're supposed to and that in and of itself, sets you apart from so many other businesses because you're not just competing with other house cleaning businesses for these providers, you're competing with other businesses that they can go work with in other industries too, aren't you? Other small businesses, yeah, absolutely. Sure, small or large, whatever. This is what I heard. I heard from you that you, so tell me if I'm close on your brand promise because this is the message that you gave to me. Be polite, be responsive, that you guys believe in being conscientious. I'm assuming that you don't expect them to be conscientious only, that you want them to be conscientious because that's part of your culture. You're going to also be conscientious. That would only be right, wouldn't it? Yeah, it makes sense with what you're saying too. Be kind of all and then hold accountable, hold people accountable. That's pretty much what I heard. I heard a little bit of transparency in there, but not entirely, I didn't add that one. But build that into your everyday practices. Build that in, and I mean, I know like there's different philosophies and it's not meant to be disrespectful but I do hear it more when I go to America than when I'm in Canada. Working for me, right? Working for me versus working with me. I hear that a lot more in your country than mine and I'm not, I love America.  Or in your company. But my country's better. No, I'm just kidding. But it used to be. No, I don't know what I'm saying. Canada's a mess, Canada's a mess. I'll move on from that. We are like almost at the top of the hour so like in the last minute that we have here, Mark, do you have any closing thoughts for us? Yeah, my closing thoughts would be take a good hard look in the mirror about what the real reasons are, what people are turning over and make little tiny changes, just tiny ones and how you interact with the people who work with you on a daily basis and implement them one at a time, incrementally and really small bits. And over time, that's gonna change your brand and how people view you in the marketplace, your chaos, your dependability. And also, give what you expect. Give what you expect. You expect the conscientiousness, you expect accountability and give it. When I make a mistake and I make them, I call the provider and I say, hey, we'll let you down and that's my fault and here's why it's my fault and here's what I'm gonna do with future proof that. And when I get that future proof, I'm gonna contact you back on this and I'm gonna let you know it's fixed permanently so it never happens to anyone else again. And you know what else? I'm really sorry about that. That's how you have to treat people and that's what you expect from people. Yeah, that makes sense. That makes sense.  Lot of ground cover tonight. Liz, I gotta say in closing, whenever I see you're small, look, I wasn't small today, I had a hard day today. And I see you're small and it's just something about you, something about Liz. All those teeth, all over the place, yeah? You just, I think it comes from the personality that you put out to the public and it's just something special about you. And I'm really happy to have, to spend some time with you tonight. You know, this was good, Mark. I mean, as always, you bring a lot of energy and a lot of good information. It's fun. I've got a couple of nuggets out of this. You know, you really gotta provide awesome service to former employees, even if they steal from you, because they have friends that might, what type of referral could you get? It's like, yeah, I'd go get a job with Mark's company because, you know, heck, I stole from them. They're still good to me. I mean- You only make it funny me a little bit, aren't you, Tom? Just a little bit. Well, I'm that serious. No, jokes aside, is that look, we take it seriously, we take responsibility seriously. This is not a promoter.  And just because they're not working for you anymore, they're hanging out with people who might, so. Well, we're about to relaunch Nashly again after having some trials and tribulations to do.  Now, okay, do it or die trying, so to speak, right? So the thing is, is that we're at the point now where we're gonna be able to send out vouch, which is a piece of software where they can answer short questions, click a button and give a video testimony on different questions as providers, right? And we're gonna use that for our marketing, we're about to launch and different things like that, right? And Liz is intrigued, so I'll send you a link on it, Liz. So one of the things is that because over time it consisted of able to hold that, we now know that this- They're producing it in my ear. Yeah, I'll pull up in under 10 seconds. We know now that we can use these testimonials from these people to show other people in the marketplace to come work with us that we're not too good to be true. That's actually how it is when you're part of our network. People do love that. Yeah, that's cool. That's gold. All right, y'all. So thanks everybody for coming today. Lawrence, he was really excited. Look at all these comments. We didn't pull them up for you, but he was very excited. You are speaking his language, Mark. Thanks, Lawrence. Appreciate the kind words. Yeah, we have a lot of people in here today. So thank you so much, Mark. And really you always bring all of the energy and you never just kick back and relax. Wait for us to do the work. Great way to start 2023. Thank you. We'll be back next Wednesday, five o'clock Eastern. You guys take care. Bye-bye. Bye, y'all. Bye-bye, guys.


Hello, Congress. Nice to see you again. And as usual, the only frontman of Scada Strange Live team. And I know there are a lot of guys who help to make this talk. So if it's OK, please give hands to all Scada Strange Live team. Traditionally, we start our talk from the battle map when we show how many ICS systems connected to internet. But this time, we will skip this because of John. John, who built the Shodan, this year, published excellent resource, icsmap.shodan.io. And you can download and check a lot of different ICS system connected to the internet. And because John said thanks to us, we say thanks to John because he is excellent guy. And thank you, John, again. But last year, after our talk, we received a lot of questions about this picture, about different type of connected system. And people said, OK, this is not ICS. This is some kind of honeypots, maybe. Or it's not serious. It's very small devices. And it's not serious at all. So we decide to go deeper and check first one. IPCA chip is a system on the chip which runs a real-time operating system with TCPIP, web server, and security protocols. We love it. So we start to Google, start from just a system name. We found that it have built-in CGI server with some built-in function. And during this assessment, we found interesting application of this chip, its solar rock system. What is solar rock? Solar rock is kind of smart grid, small grid, small scudder, which you can install in your house to manage TV plant, which you can install on the roof of your house. But it generates about 7 gigawatts of instant output. And at the moment, about 1 million inverters connected to this system. Interesting. Because this system connects to some kind of the cloud, you can use it to find installations. Now we are shown on the boring network scanning just visiting the portal and check it. So this is Germany. And this is different location of the installed systems. And also, it have some kind of, I don't know, social networking features. So you can take a picture of your house, of your PV plant, shave with your friend and say, oh, I'm saving energy. I generate it from my house personal power plant. But this is all about funny stuff. Let's go more deeper in the technique side of this system. OK. It doesn't work? It's working. Thanks. Well, first interesting thing, it's firmware. It's kind of software that gives you a lot of information how the device works. Obviously, I think you know what it is. And most interesting things in firmware, it's configuration scripts, file system structure, and so on. And firstly, to find out through, for example, Google Dorgs, in simple case, you can use just unique strings and grab, for example, in this case, to grab title. And as a result, through Google, you can find a lot of solar log devices connected to internet. It's about 65,000. Of course, all of them connected to internet and cached by Google. Well, and let's take a look on the authentication page of the solar log web server. Simply, it's poor authentication scheme, just only using password. All page using password authentication. But if you know appropriate full URL to download system backup, it's not a required password. Simply download, well, just simply download system backup file. And what's most interesting thing in backup, it's, of course, username and passwords. Well, on this picture, you can see simple encryption and all things that you need to decrypt. Another one, typical process for firmware and devices, it's firmware update. Well, following solar log update process, you can see that it's highlighted part. On the screenshot, you can give a full path to system. If you know what file system structure, simply it's a DOS operation system, like a DOS. Yes, sure. And you can override system files, configuration files, and so on. So it was fixed. It was fixed with collaboration with computer emergency response team of German government and FENQM. But because this is just a platform, I guess there are a lot of different producers, manufacturers, vendors who use this platform to build other devices. So I'm not sure that all of these simple bugs was fixed. It was funny story, but we forgot about it already for God. But one day, I saw this Twitter. And I understood that maybe solar panels not so renewable. And maybe we should use our power, our knowledge, to save sun. So we decided to understand a bit more about all this green energy. And if you want to get new knowledge, what you should do? You should go to Germany, to Hamburg, to Congress Center, but not at Congress, but to Vintenegy, Hamburg. So we virtually visited this exhibition and got a lot of information on different wind and solar equipment. And start from the simple stuff. Showdown again. We found a very common system, SunnyWebBox. As you can see, simple showdown search give us about 80,000 of devices connected to the internet. Alex? Well, first notice about SunnyWebBox default password was three years ago in full disclosure list. It was default SMA upper case password. It's first type of the password. OK, so we decided to read the first manual. Of course, and we noticed that username installer has a different, as previously mentioned, password. It's SMA lower case. OK, so we decided go deeper to read in the first manual. And we find out that it has user and installer groups, user names, and different passwords. It only contains numbers. OK, so what's the real, what's the true password at the final? And real researchers, real hackers, trying to give it by your hands. And we discovered interesting things in firmware that it contains not only user and installer password. It has also service and developer system accounts. And also it has interesting strings, interesting password mode, like hard-coded passwords. So we can't say what password is, because it's hard-coded, very hard. But what we can say that a quick Google search for these devices allow by analyzing of responses, because on the response you can find amount of energy generated by this device, allow you to find about 100 megawatts of energy. If we compare two different generators, like a hydroelectric station, it's like small, helping hydroelectric station near Selamze in Austria. So this amount of energy generated by Solar Rock can be found it via Google. But via Shodan and different types of internet scanning, you can find 20 times more energy if you need the power. But it's all about sun. Let's talk about wind, because you know always big stuff. I think it's killing wind. So simple stuff. Again, very simple stuff. I found very old storage Shodan search, which helps me to find about 300 of systems. The name of the system is Nordic NC2. Just a quick search of vulnerabilities as a system, and this system demonstrates that this system have a long story of vulnerabilities, starting from 2010 and finishing in 2013. What's interesting, I think those vulnerabilities are not patched. Why? Because if we check the response of this service, we can find that this server works on the system, which already deprecated. So it's version number three web server or web server, JT web server, current version number nine. Also, it works on the very, very old version of SCADA. Simple CVS detail search demonstrates that since 2002, people publish information about vulnerabilities in this web service. So I don't want to talk about vulnerabilities in Mama real-to-real recorder. It's even not script-kiddy stuff. But if you want to understand how it's looking real-life, I took two pictures from Google. One picture is Nordic's wind turbine. And second, it's management interface. Only for Google. It's not real. So how much energy we can get in this case? About one gigawatts. So if we compare it with different generation, it's absolutely the same. Like, help me. It's Stuxnet was in Iran on Bushair nuclear plant. The same. So anybody who knows how to read Adwinder, they can write on Stuxnet now. So just to finish with part of our talk, by simple, very simple vulnerabilities, we found about eight gigawatts of instant power energy. If we compare it with most famous, most powerful hydro-electrostation, it's number five on the list. It took two days after the war. So let's continue our saga. Sorry. And talk a little bit about our famous vendor. What the similarities between large hand-drawn collider and, for instance, gas pipe. It's a Sematic VNCC open architecture. It's very popular HMI, quite new system, but it's also have new web server. I think if you was on our previous talk last year, you can remind this picture. This is a history of bugs in Apache web server. Why are we talking about it? Because if you're going to write your own web server, please carefully review all vulnerabilities discovered during when other guys wrote on web servers. Just to remind the history of different funny web vulnerabilities, this was discovered several years ago. If you send incorrect HTTP request to web server without HTTP body, it can crash. This was discovered in year 2000 in internet information server. And you can use PIF traversal to read, write different folders. I think you can remind the vulnerabilities was related to one worm. And another one related to incorrect content land, so you can put big amount of data, but save it is very short, so you can never write memory. Why I'm talking about this old stuff now? Because I want to show you a small movie. Just a second. Here it is. So let's launch WinCC on the debugger to see all the process and submit very complex request with thousands of AAA, a lot of AAA. What we will get? We will get break with typical 31, 31, 31, 31. I think it's AAA also. But if you will send more complex request, what we get? Calculator. I think SCADA must have ability to calculate something. For sure it was fixed. We don't disclose zero days, but I like this command. So if CERN update to version 3.12 of Sematic WinCC OA, we can stop terrorist who clearly have a genius accessing launch hand-drawn collider and create a black hole that will show up the world. So we save the universe. Let's take time machine and come to the past to the Miami at the S4 conference. It's a conference dedicated to SCADA safety and security. And what we show on this conference? This slide, I think you also can remind it, demonstrate over age of the libraries included in WinCC HMI. So you can see that most of the HMI was compiled before the Stuxnet. And on this conference, we demonstrate how to find zero day using find. So you just get the list of the files in software and try to find most old one. And this we found OpenSSL, compiled in 2007. And we say to Siemens, guys, let's update your software. At this was a mistake. Why? Because old version of OpenSSL does not have hard bleed vulnerability. And after update, we get hard bleed vulnerability. And launch hand-drawn collider get hard bleed. Just to demonstrate how it's work, nothing special, but I'm sorry. So we're running a standard hard bleed handler, which require memory from the SSL server. And trying to authenticate with username and password and get username and password from the server because of hard bleed vulnerability. It's base 64 encoded. So we need to decode it. And let's try again with stolen username and password. It should work. Here it is. So simple vulnerability, everybody know about it, not so simple, but white know, yes? And what I want, why I show this demo to highlight one important thing. People can ask me, OK, first you say, please don't write your own web server. But after you said, please don't use third party components. What to do? I don't have answer. But anyway, if you decide to write on the server or to use third party components, please care about security. If you include, I don't know, OpenSSL or bus shell in your software, please update it plus check it, please care about it. Alexander? Well, so another one, vulnerability to its long story. About the scale injection that was first published one and a half year ago. It was simply a scale injection via arbitrary scale commands with unspecific vectors. Scale injection, unspecific vectors. Well, what does it mean? I don't know. OK, well, and Cisco give us excellent decision how to avoid this vulnerability. Simply deny connections to web server ports. Well, OK, it works. Sometime it works. But SCADA components, industrial control system components, it has a lot of protocols, communication processes, it depends on functionality. And in this case, VCC server has not only sync client, it also has a sync client. Well, it works on RPC protocol. And well, firstly, when we try to authenticate, we noticed clear text messages. As you can see, it's user year and next password year. Well, it's clear text. But we spent a few minutes. And after we noticed that authentication data goes to VCC server on the different port. And it's not clear text. Well, where is password? It's no clear text. Maybe it looks like some encryption. Yeah, it's kind of encryption. And I think everybody who saw our previous talk already know encryption key. You're right, this is my encryption key. But this was fixed. And it was fixed with new encryption key. And first of you who guess new lead encryption key give lead price or free beer from SCADA's Spanish Graph team. Secret key? No. It's lead. Good guess, but not right. Excellent transfer. But it's very lead. OK, first of you who said 32 new key and something else. Come on after the talk on the stage. I had a lot of souvenirs. But this is lead encryption key. But this was fixed again. We don't check it yet. And another one interesting story. It's about cookies. Once upon a time, we tried to discover interesting things. Authentication on a semantic, semantic PLC controller. And we discovered interesting thing that cookies contains constant parts and changeable, big part of the cookie. OK, so we decided to go deeper and to understand what's going on with cookies. And well, it's first big, biggest party of the cookie. It's MD5 of some value. Well, so what about its value? After spending some time to reverse engineering PLC controller firmware, we found out that MD5 is from the cookie, the 26 bytes of the cookie and 16 bytes of the secret. And plus two bytes of null. Well, what's about secret? Usually, secret generates. It's a typical practical approach. Secret generates after PLC start. And it uses PNG. PNG was a little bit harder than standard C PNG generator. And C was two bytes value. Well, it's time to brute force. But it's too much values to brute force because PLC is so tender. And what about seed? Seed very often. It's also a typical approach. It's very often depends on time value. And by our practical research, it was PLC start time plus some constant value. Well, constant value using current time. Well, next step was how to obtain PLC start time. It's obvious that we can use values from the web server page, its current value. And up time, up time, we can get through SNMP request. Great. It's time for Dima. And as a result. It's OK. Just a second. It started. Well, I'm not a master of movie maker. I should improve my skills. Well, let's imagine that attacker connected to entire network. Let's ensure that attacker on the network one. For example, and first of all, we try to find out devices that support profanet protocol. We find PLC controller. And you can see that it has a different than attacker side IP address. OK. Let's ensure that it's not accessible. Next step, it's using a Python script to change network settings on PLC controller using a profanet specially crafted profanet request. Well, we provide to Python script destination MAC address, our source MAC address. Well, it's a simple way to get your MAC address of your network interface. And provide network settings for new network settings on PLC controller. Simply, it's IP address, network mask, and gateway. Don't type too fast. Yeah. Well, we received answer. It's cool. Well, let's ensure again that network settings changed on PLC controller. Well, it means that we bring PLC controller to our local subnet. It's accessible. Great. So the next step, let's imagine it's one of the dependency of vulnerability that let's imagine that real user, for example, a SCADA engineer going through browser to PLC controller and simply authenticated using a Ligin and username. Real Ligin and username. OK. Who gets what the password? Star, star, star, star, star. Well, you can see that controller on the operating mode run. Next, so we see that cookies stored on the browser. Well, it's the next very important step. From attacker side, it gets very important values. From controller, it's C2 range. And the final step, it's run a Python script to brute force cookie. And we provide to the script C2 values. That depends on the how many times authenticated user on the controller. It can took from few seconds to some minutes. Well, let's prepare, let's clear our cookies. Everything real on this video. Well, we clear cookies and prepare to give, to put new cookie values. It's still brute forcing. It's only one cookie.  OK. It's typical scenario. No industrial process running at the small net, because people see brute force it, brute force it, brute force it. Yep, we found two real cookie values. And I like C kill to send process. And the final let's copy paste cookie value to the browser and reload the page. And ensure that we are authenticated user administrator. And stop PLC, stop some process. Well, as you can see, we don't need any username, password, and so on. Only connected to our subnetwork PLC controller. What I want to highlight in this vulnerability, for sure it was fixed. But here two points. First point, we found it because of Congress. Because on 29 C3, we participate workshop. And one of guy who was on this workshop say, OK, did you check the cookies? We say, no. I don't believe it on such small device, authentication process realized it correctly. So after this idea, we start working and find this vulnerability. It's already fixed with OK. And second thing I want to highlight, it's communication about SNMP communication. Started from January, we have a long story of communication with Siemens about SNMP hard-coded community. We say, OK, this is not issue. But in the end, we say, OK, this is issue. Because via this vulnerability, you can get the cookie. So what I want to highlight, if you make something, please care about basic thing. Everybody works on SNMP V3 and don't use hard-coded password. Why to do it on the new system like PLC 100, 500, or 1,500? But please don't think that we hate Siemens or something. We're speaking a lot about Siemens because now we're in Germany. If we will be in French, we will speak about Schneider Electric. If we will be in US, we will speak about Honeywell. And you know, really happiest day in my life when we get answers that vulnerabilities was fixed. It's emails from Siemens product sort. And I want to thank all the Siemens team and especially Siemens product sort for hard job. And please give them your hands. And guys, if you're here and I know you're here, please catch me after the talk. I have so many news for you. So this is our traditional slide with number of vulnerabilities discovered in different platform. For last two years, Siemens was the first. But now you can see with Schneider Electric, mostly because of Aquarium of Invencies, have a first place on the discovered and not patched vulnerabilities. And many people asking us, what is your approach to discover so many vulnerabilities? I have an answer because we're too lazy. This year, we decided to not discover vulnerabilities by ourselves. We built big testbed with real SCADA PLC's RTU system connected to a railroad. And say to everybody, guys, you can connect here and hack it. If you can make disaster, you will get price. If you will find zero day, it's your zero day. But please follow responsible disclosure. So for two days of positive half days forum, guys and girls found more than 10 zero days in Indusoft, in Sematic and IPC. IPC does RTU, it's Taiwanese, like on no name. So now responsible disclosure in progress, waiting for the fixes. So we're talking about vulnerabilities, and I want to talk about math. Sometimes math not so hard science. So in this case, we submitted about 10 vulnerabilities, nine vulnerabilities to vendor, and get response that all vulnerabilities is fixed. But in advisory, we found only two. I don't know, shall we trust vendor, maybe not. But what I want to highlight, sometimes is very bad idea to create a false feeling of safety. Because if somebody read with advisory, he can say, OK, is CVE 6.2, it's not very important. I will not update this system. But in reality, several remote code execution without authentication is here. So it's better to speak the truth. Post-crypto, very long post-crypto. Anybody here know the difference between picture one and picture two? OK, different question. What is bad, one or two? Green light or yellow light? Somebody? Green, OK. First, who say green have special price? I will say why. Let's talk about functional safety, because now we're speaking about vulnerability. OK, we root. But when you are talking with industrial people, they say, and so on. So what? OK, you root. I have a special system, I have special protection system, which does not allow disaster. I want to demonstrate how very simple vulnerabilities can lead to very serious problems. First, super heavy trains. I think you know what is super heavy trains. It's very big trains with several locomotives, which sometimes synchronize engines by the radio channel. One on the beginning, one in the middle, always the end. And they synchronize engines and brakes via radio channel. Why? They do it because they need to run synchronously. So let's imagine that somebody run a small radio jammer. And it's a very long device with several locomotives. And they start to run synchronously, and train just goes in different dimensions. So also, it's a very interesting answer. Typically, you can get it if you speak with industrial people about CO4. Anybody here know what is safety integrity layers? Thinks a lot of people, yeah. So when you say, OK, you have problem. We have CO4. We don't care. What is CO4? It's safety integrity layer. It's a demonstrate a probability of failure for different process. It can be a probability of failure on demand when you ask a system if it's continuous process, it's probability of failure per hour. You can see what this is very big number. So probability of failure, very small number. So if this system really have CO4, it should not break ever. But if we get root on this system in 15 minutes, does it still have CO4? My answer, no. And I have very interesting discussion with developer of one system. After demonstration, our team can change the road and manage switch on CO4 certificate system. He said, you know, this is not my system. I saw you upload wrong framework. You rooted and upload wrong framework. And now this is not my system. Before you rooted, it was my system.  Sometimes in a more special kind of mindset, you can do very bad things. But this is not you. And this, not my system anymore. So I think now we know the difference. The green light is bad. Why? Because of green light, train will go on high speed to the curve. And sometimes it can be very bad. On yellow light, it will drop speed and move more slowly. And real post-cryptome. I think a lot of people here know what is network convergence. So it's especially in telecom environment when different type of communication protocol goes to the same basic like IPv6 or IPv4. And PSTN goes to IP and mobile goes for 3G and so on. So all different system connected together using the same basic. But what we see at the moment, it's operation technology convergence. We see that modern smart grid use protocols and technologies from ICS, sometimes mobile connection, sometimes billing and payment to understand how many power you generate, and so on, so on, cloud technology. So we see like different technologies come together to maybe make our world better. And for last year, we had a lot of talk on different conferences. For instance, on Blackhead, we spoke about how to hack ATM. In Paxiak in Tokyo, we spoke about how to get root via SMS. And also, we spoke about the gray train cyber robbery on FOSIX. But you know all this about the same things. We cannot say at the moment. Why? Because we don't know yet. But what we know, our world now, it's very complex and very gentle things. So let's invest, let's use our power to keep it safe. Maybe not safe because it's too hard, but at least peaceful. Thank you. Thank you. Thank you very much, Sergey and Alexander. Now for the questions, could you please line up at the microphones here in the middle of the room? And as I can see, we have no questions from the internet. Nothing from IRC. Thank you, Triloda, for monitoring the internet or SignalAngel. How about questions from the room? Yes, microphone number one, please. Yeah, hello. My name is Tric Moebius. I'm working as a software developer in railway with technologies. And I would just like to add concerning the level four safety level. Yes, risk is against failure. Yes, everything which is currently in railway technology implemented is against failure, not against sabotage. If you would, maybe we can take later about that. I understand. Yeah, you're absolutely right. The safety don't think about the people. If you know how railway technology works, you can sabotage everything from Excel counters to point machines, you can crash any train. Yes, because at least you're going to the hardware and disconnect the wires. So it's about detecting failures, not about being able to prevent sabotage. Not yet we're working on it, but that's another talk. Yeah, I understood you absolutely, because you know what is why when I talk with people who work in the industrial system, with the industrial system, I prefer use not safety or security or information security. I prefer to use term cybersecurity. It's like a combination of safety, industry security, and information security. And you can demonstrate how information security can broke security features, safety features, put it on the, for instance, the room. Just let's talk after a bit. OK, thank you. Yeah. OK, thank you. Any more questions from the room? Nobody lined up at the microphone. Well, this is the time to say thank you very much again. Thank you. Alexander, Sergey. Thank you.


Hey has geek happy 10.  It's hard to believe Well, I think that's what it is right time flies we grow up and Yeah, we are 10 years old. So how did I first come across has geek? I think it was I Don't exactly remember the day or the month, but I remember sitting in the office and I got an email That talked about something called has geek and then I think it was Just around the time when Kiran and Xenom had started this and then there was a mail going out Or there was this buzz in the ecosystem somehow I picked it up because back in the days I was working for the Indus entrepreneurs in the Bangalore chapter And I was very privileged to have a lot of this information coming my way because You know people were talking and I would pick up on things like that And then I said, oh, what is this has geek? Let me now go and see this and I and I opened the you know The has geek website and then I was like wow I mean it was love at first sight. It was an instant fan moment, right? So It was it was bold. The branding was awesome. It was It was speaking the right language. It was You know, it was inspiring the right kind of culture And it was a radical statement so to say compared to a lot of other things that was going on in At that time and it was really refreshing and You know, it was an instant fan moment for me. I just really fell in love instantly about everything that they were doing There was there was something in it, right? There was something so Simple quirky sexy. I mean that's just a combination of all of these things That that's how sort of has he came to me and I I fell in love with has he come and it's just amazing You know to have found something like that at that time where I was In my life in the entrepreneurial and ecosystem development journey that I was going through Oh man has geeks impact. That's uh, that's a tough one to quantify. Trust me Uh, I don't think even has geek is you know, sort of knows or is in a position to quantify that So from my point of view a personal story is that From, you know, a professionally to begin with first. I think You know has geek Gave me a lot of inspiration, right? He collaborated on a few projects You know, especially at a time when one of my startups was really going through a bad patch Has he incubated us and sort of sourced through for a year? You know even sort of gave us a job and kept us in the system and then paid us money to pay our bills and it was a really tough time back in the day syndrome has geek sort of Helped us through and that's sort of a personal story to it, but professionally speaking. I think Has geek has inspired me personally in so many different ways Of looking at how to build a brand how to build a community How to collaborate with people and how to do things and keep things open So has geek has a lot of these things that it has done and inspired so many of us in the journey and it's just I can't imagine a Bangalore's ecosystem looking back in the last 10 years Kuala Lumpur's Indian ecosystem looking back in the last 10 years without having Has geek in it It's just impossible. Think about it, right? I mean, I don't see You know It has it has done so much. It has done so much culturally and for the community and for the clan and for the For the you know the geek community in general the startup community overall It's done a lot of Work to impact and create what we have today in India and to specifically in Bangalore Kiran, you know Zainab personally speaking are like family to us But then has geek, you know the way we look at has geek is Kiran Zainab has geek all together as one My personal association with has geek really comes from the point of view of the brand My love for has geek and the impact that it has had on me personally speaking is more of the brand because I'm not a technologist So I have not the first You know benefactor so to say of the impact the technology what they're doing But for me, it was how they were doing it. It was the brand and we're going about how they built the brand I think that uh was the impact that I had and You know, it was uh, it was okay to sort of be minimalistic It was okay to not confirm to the regular ways of doing things In India, right? I mean this you got to understand in India 10 to 12 years back things were very different From what it is today in the startup scene people were very conservative people You know did not take bold steps Let me just simply put it that way and has geek did take a bold step in a community development space for In India and I think it was the first company out in anywhere in India to have started something like this and then And in most in Bangalore, which created a lot of impact a lot of impact so yeah, so, you know The the personal story of the of the has geek people behind has geek which Is something that I'm pretty, you know inspired by as well as so how the husband and wife team Have been it happens to be husband and wife team, but you know, they're very professional I'm sure you know that They you know, you're doing a great job at it Bringing up a child in between all of these things building a startup and going through tough times I'm sure you're going through a challenging times even now It's not easy and I think it's a great inspiration To a lot of people out there So hats off to you guys for doing what you do You guys have you know, co-founders in each other who are sort of you know, a balancing A setup which is very refreshing to see and I only hope more and more Great work comes out of you guys I know it's not about you. It's about has geek but still there is no has geek without you guys so far So it's important to mention it Oh, okay What do I want to talk about? What do I want to tell has geek on its 10th birthday? Look has geek You're not a child anymore, right? You're growing up.  I know it's not easy but figure out Figure out how you can continue to be sexy quirky bohemian sort of a thing that you are For the community and stay open stay inclusive. That's the most important thing for you.  That's even a dna but I think the other thing is You owe it to the community because The struggle that you go through sometimes Are the struggles of the community too so You need to tell more about your story. We want to hear more about your pains. We want to hear more about your wins Importantly the the the impact that you have created in the ecosystem, right? It's just it's just sort of not documented well. I think we don't know enough about all the greatest things that you have created in the in the system today And I hope this video is one of those beginnings and you know, we get to hear more about all the great things that you have done I know you don't like to talk a lot about yourself But I think it's time because uh, not only are you going to be telling us about your story but I think it's also about inspiring more and more people in the country To come together to say hey, I'm a community builder. This is the challenges. These are the wins. These are the greatest highs This is the playbook. This is what things Work, these are things work. These are things don't work that story. I think Uh, has to come out. Uh, you need to tell us your story Tell us more of your story enough of uh, serious stuff.  I'm still in love with you and you're still very dear to my heart and Uh, uh Yeah, what can I say? Happy birthday. Have fun. Keep doing the great thing that you do and live Live happily


If you are a business owner, homeowner, renter or have a non-profit organization that was damaged by the July floods, the U.S. Small Business Administration may be able to help with a low-interest disaster loan to help fund the repairs that aren't covered by other sources. The first step is to register with FEMA at disasterassistance.gov. Then submit an SBA disaster loan application at disasterloanassistance.sba.gov before the September 12th deadline. In September, we can help homeowners and renters as well as businesses and non-profits with low-interest loans that go as long as 30 years to help make their payment affordable. And what's more, the first year the payment is deferred and there's no interest. So please be sure to file your application and do so before September 12th to get the help that's available to you.