Hey all, we're here with Physicians for a National Health Program. We're going to be talking about the future of US health care. Sit back and enjoy. Greetings. I'm Betty Keller from the Vermont Physicians for a National Health Program. We're all in this together and today we'll be talking about learning about health care reform. I'm really excited to have four interns with me today. The Physicians for a National Health Program is a national organization. Vermont has a chapter and we educate about health care reform and specifically trying to get an efficient health care system for the whole country and advocate for it as well. But the education part is really critical because people won't understand what the different options are and why having an integrated coordinated system is so much more efficient. It provides better care, better access, better outcomes at lower cost. And until we really educate people about that, we're going to have troubles achieving it. So we have an internship in the summer that is usually focused on having medical students because students will finish their first year of medical school and have a summer off before they go back to the classroom. And then after that, they're in the clinicals and they will not have a summer off again on the Philly books. But I'd like to introduce now our interns this summer. We have three from medical schools in Louisiana and one from a medical school in Arkansas. So Gregor Dierks is on my immediate left. He is from the Louisiana State University in Shreveport, but actually from Oregon. And that's what does is from the Arkansas College of Osteopathic Medicine and actually from Arkansas. Thank you for being here today. Siobhan Temple is from Louisiana State University in Shreveport and actually from Louisiana. New Orleans. New Orleans. It's different. Oh! Okay, great. And also we have Benjamin McMahon who is studying at Tulane University and from Florida. Thank you for being here today. So I'm going to start off with just first asking if you could be thinking about how did you happen to hear about the internship and what made you decide to follow up and apply for it? Maybe we could start with Benjamin, do you could speak about that? Sure, yeah. I mean my experience and to keep it kind of brief, I did a lot of research after undergrad clinical research. And within medical school there isn't a lot of health policy education. There just isn't so much time for the first two years. We're learning a lot of the aspects and basic sciences of being in a position. So I kind of wanted to spend the summer learning a bit more about health policy and specifically single payer, learning more about what that entails and becoming an advocate of it. How I heard about it, Tulane sent out an email. Betty here has reached out across the nation I think to get some of the most qualified candidates to join. And I would really appreciate of that. But yeah, really kind of just down from Betty to my school. And I was like, you know, it's a good opportunity to learn more about how I want the future of healthcare to look. Thank you, Benjamin. Jevon, do you have any comments? Yes. For me, I will, so I heard about the program via my email server because Dr. Keller emailed out, reached out to a bunch of schools. As soon as I saw the opportunity, I was like, you know, I wanted to jump on it because as Ben said, we don't get to learn about health policy while in med school for real. And it's a subject dear to my heart because I've had two young friends that have been, I don't know if I should call them victims of the system, but like have been affected gravely by the current healthcare system. And one has led in a death and the other has led in her almost going bankrupt at 28. So, you know, I really, it means a lot to me to like, you know, learn how to become a better advocate so we can really, you know, because we need a change. I think that's obvious. Thank you. So I heard about like PNHP just through the Twitter space, like Dr. Adam Gaffney is really big on that. And so follow him and check him out. But and so then I went on the website and for under Arkansas, it says so I just contact the home like the headquarters. So I just shot a brief email and I guess they just forwarded to Betty. And so then I got in contact with Betty. Yeah. Same story as everyone else. Pretty much I got an email from our school seemed really interesting. It was like a rerouted email from Betty and Siobhan and I had like just been talking about what we wanted to do for the summer. Got an email. We both signed up immediately. And I also feel very passionately that our current system is just embarrassingly broken. So we need something new and I think a single pair is kind of the way to go. Thank you. Thank you. So maybe you could talk a little bit more, Gregor, about what experiences have you made decide made you decide that our current system is broken. So I've probably won in this circle. I've talked about this before, but I volunteer. This is one example I volunteered at Mission of Mercy. Everyone on screen watching should all do it. It's dental. It's not medical. So it's a little bit different, but basically it's the three days leading up to Thanksgiving. And it's all free dental care for about 12 hours a day for those three days. Everything from teeth pulling, teeth cleaning to more, more intense stuff like implants and all that. And ensures and everything else. And so all of these people that come in are either completely uninsured or totally underinsured, which is essentially sort of the same thing as being uninsured. You can't use your insurance because it's too expensive. So you end up seeing the patients at their absolute worst rather than allowing them to come in regularly and get their teeth cleaned, get whatever needs fixing early when it's a minor issue. And then you see these patients coming in and their teeth are literally like literally crumbling out of their skull. You can take pliers and pull their teeth out without any anesthesia because they're completely rotten. And so that is sort of just a little window into if you treat people not frequently and their most extreme and worst state, that it ends up costing a lot more time-wise, commitment-wise, money-wise than if you just treat them early and give everyone equal access to care. And what you actually, in that case, you have worse outcomes because they also don't have any teeth at the end. They're using dentures instead of having fixed their teeth earlier. Right. And so most people are underinsured for dental care because they don't have dental insurance coverage. On most policies it's actually very uncommon. You should have to pay for additional dental insurance on top of your other insurance. Saswad, do you have specific experiences you care to share about what made you decide to be following Adam Gaffney? I mean the biggest one was so after Obamacare I was allowed on my parents' insurance plan until 2006. But my dad actually went down to Texas and got a job with Texas. And so his insurance plan switched and I obviously switched because I wanted to be under my parents because this is much better than what I could find. But the problem which I eventually found out was in my network since I'm in Arkansas the nearest primary care doc is three hours away from me. And so it's basically like having no insurance since I can't see a doctor. To be in network. Oh my God. Because he has a mostly Texas network rather than in Arkansas way. So that's interesting. So when people talk about oh, we want choice. We want to have choice in our, what are they talking about? Their health care? Their insurance company? Can you talk a little bit about that? Yeah, I think right now when we hear about freedom and choice people immediately think like health care insurance but there's kind of a disconnect between health care and insurance. So when you talk about choice, is it the choice of like what card you have, what color that card is, stuff like that?  And so I feel like a single payer actually gives people more choice rather than less choice because you're allowed to just go into a clinic. I have to look up which clinic I'm allowed to go to. Otherwise I'd have like a thousand dollar bill that I just can't pay as a student. And can I add on that really to let Ben speak about it, but we just experienced being up here that type of situation. Yeah, so I likely contracted Lyme disease. We're up here. I'm an outdoor person. So we had a long day yesterday and Gregor graciously drove me to the clinic to go and get my prescription that was filled by one of the physicians here. So we go there and I have my insurance with Blue Cross, Blue Shoot and Louisiana. And I'm a student as well, so phones are tight. So it's for doxycycline, which is very cheap to make. Not specific numbers, but... It's been around a long time. Yeah, very standard antibiotic. And so we got to the pharmacy and they said, oh, we don't accept that insurance here. I'm like, okay, great. How much is that going to be then? For a two week regimen, $75 for doxycycline. Yeah. And so it's the irony there. Thanks for the lead in Chavon. The irony is just, wow, I'm not going to pay that. And it's for the most routine antibiotic we have. And so having this private insurance choice for your father to buy the insurance plan at work, for instance, and in your case, having your insurance in Louisiana. Well, and so Sasswell spoke to under-insurance, which is a whole other issue too. And this could be an example of under-insurance, or it could just be a product of the confusing, convoluted system we have. And that's also kind of why we're here is it's easy to see, it's too expensive. It's easy to see people. We all have examples of it not working. Part of the reason why I'm here is it's just so confusing our system we have now. You might be able to pay for it, but you have no idea where you can go, who you can see, what it's going to cost. When you go to the emergency department, you get a surgery. Is this surgeon on my network? Are they here? How much is this going to cost? And I think it's just, it takes so much mental energy that we're losing resources, not just financially, just in productivity in our daily because people have no idea where they can go. Thank you for mentioning the drain on us as individuals that nobody in Canada, France, UK, Taiwan, Australia, Germany. None of those people have to worry about is this doctor in network or not. None of them, as far as I know, none have deductibles. In your studies, if you found that any of the countries that you studied had anything called a deductible. It's totally a product for the United States insurance companies to figure out how to collect your premiums and then only pay out after you've paid for most of your health care yourself and like limit the likelihood of you actually wanting to get health care because you can't afford the health care until you meet your deductible.  To provide you the product that you've paid for, they call it a medical loss and they're trying to limit their medical losses. Yeah, and even to speak on my experience, like I went to the doctor earlier, well I went to the doctor last year and I ended up getting a bill. And mind you, I'm in medical school, I'm swamped, so I kind of put off calling the insurance company. I finally do that. I was on the phone with them for maybe an hour and a half only to then have to get off the phone to call my doctor to tell them they coded the ICD code wrong. And then they're busy, so they're like, okay, well handle it. So like now I think six months have elapsed and I had to like beg the insurance company to not put this on my credit because like I can't help the doctor. Like I can't do anything about the code.   Is there anyone we should know where to go? Yeah, and we don't know where to go, so there's clearly a problem. Oh my gosh. So on the same vein, I was going in for routine, annual, physical, getting the normal things that women get. And as well as the tests like cholesterol, that sort of thing. And looked up in advance which things were supposed to be covered and also called my Blue Cross Blue Shield to see what other things they covered. But there's a difference between, oh, is it covered as preventive care that you get for free under Obamacare? Or is it covered by your health plan that it goes toward a deductible first? And when I was communicating with the billing and the lab and the doctor's office, they were all using the word coverage differently. And I basically came away believing that the things the doctor was ordering were going to be covered under the preventive care. And another study that is age-based, but my insurance company said that it's covered, but not until you, but it goes toward a deductible and the preventive doesn't cover until you hit a certain age. It was older than what my doctor thought. So they come away with hundreds of dollars of bills that you're not expecting. Ah, dear. So I think everybody's had a chance to talk a little bit about then some experiences of where you felt it was broken. So how would you like to improve our system? Sadist, what would you like to start with that? Yeah, so part of our internship, we got to study different countries and kind of how they were able to do it. And one of the countries I chose to study was Taiwan, which is a pretty recent phenomenon. They only changed it in 1992. So not that long ago compared to like the NHS, which is like a hundred years, and Germany with another hundred years. So like if we wanted to transition today, they would probably be the best example of the most recent transition in like our current times.  It's probably the least in the entire country. Their administrative cost is only 2% compared to our like ridiculous number because of just how much technology they had at the time. Kind of just learning from other countries that I've tried. And I think that's something important for us to look at is looking at other countries because the US healthcare system is just not working. And hasn't been working for a long time now. So I think it's time to start looking at other examples. I think Taiwan is really interesting because most of the other national healthcare services across other countries have kind of grown organically. And Taiwan was like a calculated, they brought in experts to do research. They compared a whole bunch of other countries. And all these people made a task, a literal task force to implement decisively the best healthcare that they possibly could give the information that they had. Right. So some people in Vermont may remember that we had Dr. Xiao come and assess how much it would cost to do a single-pair system in Vermont. And he had been one of the experts brought in to help design the program in Taiwan. Right. So you were talking about the administrative cost being only 2% in their system. One of the valuable things of looking at other countries is that whenever there's an argument that it's not very fact-based or there are people pulling out facts that disagree with each other. A recent fact that's been thrown around is the facts people have been throwing around have been around how much does Medicare cost to administer? And how much does private health insurance cost to administer? And numbers have been thrown around between 2% and 5% for Medicare and then scare about, oh, but that doesn't cover how much they do for this or that that comes from other places like, oh, the legislators, you should take a percentage out of theirs. And one of the arguments was you should take out 10% of the legislators' salaries and consider that toward how much it cost to run Medicare. It's like, you think they spend 10% of their time on Medicare seriously? And somebody wrote a rebuttal about the fact that, oh, the collections and the fraud stuff is actually built in to the numbers that Medicare says it spends. But if you're having confusions around that, you can also look at what other countries do and when they seriously only have one payer so they don't have to have all the administrative waste in the hospitals, in the doctor's offices, in the businesses with their HR departments trying to help their employees get their actual coverage after they have gotten paid for their insurance. All that extra administrative waste isn't even counted when you're talking about administrative waste in America. And if we would have the guts to look at other countries and say, well, if Taiwan can do it for 2%, are we not as smart? Are we not as honest? I mean, what is it that we can't do as well as them? I also think it might be important to explain a little more what administrative waste really is because it is a word, a phrase that's thrown around a lot, but it's hard to really see the dollars where that is. So just for example, I think when you go to the doctor's office and you go to pay your bill, there can sometimes be six or seven people dedicated to working with different insurance companies, Humana, Blue Cross, Blue Shield and a litany of them. So on salary, those people are being paid to then deal with you with your BCPS to go and fax that and deal with that company. While you have six other people on payroll just waiting to deal with the other company. And I think it's important to realize that's where this waste is coming from is so many resources dedicated to all these different companies, both from financial and just a confusing aspect of this too much. Like it's just too much going on and with a single-payer system, it's streamlined. And just a little bit more with the financial aspect. Yes, taxes go up a little bit. I'm sure we'll detail that in a bit. They inevitably will have to. But administrative costs go down because if you're going to see the doctor goes down, you can see the doctor more often. So I think it's really important because it's always, especially with the debates going on. They say taxes will go up. You'll pay more. Not really. You'll pay more a little bit in that initial statement, but then you won't when you're going to see the doctor. Well, there's a big point, though. This may want to speak to your taxes will go up, but what will go down? Yeah, your premium costs. And that's what I was going to mention. And the money going towards health care. Like right now our health care, what is it, 18.6 GDP, whatever it is, it's high. And a lot of that money doesn't even go to adequate health care. We still have poor health outcomes. We have the highest maternal mortality rate. Of the developed countries. Of the developed countries, yeah. And the highest medications and like paying for diabetic medications or whatever medications have you. Our life expectancy is going down. Other countries are life expectancy going up. And ours is going down. Yeah. And that money, a lot of that money is going to like, you know, the administration and the insurance companies, but not to our better health care. So like that is another thing to talk about as well. The money should be used for us to make sure our health care is like efficient, efficient system. And like the multi-payer system clearly is not doing that right now. Or the for-profit insurance companies are not doing that. So does somebody want to talk about all the different places that we spend our money right now that goes toward health care? I'm even not asking that in a very good way. I mean, we can just start listening to things. Obviously, you're going to spend your money in health care on like actual health care.  But then there's also this huge other bubble that we spend our health care pharmaceutical companies that make huge profits. All the insurance companies when we pair premiums deductibles, like the profits that every insurance company makes, all of their staff, all of their workers. And not only that, but then you have like in the doctor's office, people that can like bill all the billing that's done since every insurance company is like different. So you still have to get training and then all the coding that you have to do and all these other, especially if anyone else wants to mention. So even outside of that health care realm there, if you're looking at your family budget, where else is money paying for health care? So for instance, when you're paying your property taxes, when you're paying your property taxes, you're paying for the town employees, their health insurance. And the school employees, all those teachers, we have all those negotiations around health insurance. Those negotiations would go away if they all had health insurance. You wouldn't have teachers striking over their health insurance. Are you familiar with other places? How about when you're purchasing products? So say you're buying a car. A certain percent of that is to pay for all the health insurance for all those employees. So our prices higher on our cars that we're competing with other countries. Yeah, Dr. Debra Thur was talking about that yesterday. And I didn't understand that. Like I remember she was saying property taxes would go down, but I didn't understand that component that you're explaining right now. Right, because you're not paying for the teachers. And how about car insurance? Right now you have car insurance that pays for replacing the car. If somebody hits your car and your car is totaled, but how about your health care? You don't have to worry about whether they did or didn't have good car insurance. You can still get your health care. And when you're buying your insurance, you don't have to pay extra for all that amount for comprehensive in case you hurt somebody because they'll be covered. And workers' cop will go away too then. Absolutely, right. So there are many places, and also of course on your paycheck, they take away the Medicare and Medicaid expenditures to be collecting for the system. So there are many places that you're paying for health care already, but you're just not... You don't know it. We don't think about it like that. You're paying for all this health care for so many people. And in your taxes, you're paying for all the great health care that the senators and representatives get and the president gets. I don't even know whether they have deductibles. What they do is probably very lower than maybe they have second-year insurance, but they have excellent health insurance. And we're paying for them to have great insurance on our taxes, but we still aren't getting good insurance. And then, yes, you mentioned all these different aspects, but another thing is small businesses that have to cover their employees. If the government funds that, then that's a huge tax break to the small businesses as well. And they can do however they see fit. Wages can go up. And they can give it to workers and actually have money to spend. I learned that we can't negotiate wages right now because we're paying so much money in health care that premiums keep going up. Well, premiums keep going up. And if your employer is paying part of that for you, then you can have more wiggle room to negotiate raises and wages. What would have been your raises actually just paying for? It's going to your health interest. People think even with their good insurance, I'm sure there's still a lot of issues with it that they might not necessarily be aware of. Right. So when the moderator on one of these debates asks, so as a candidate for the President of the United States, would you force everybody to go on a government-run plan or would you still let private insurance happen? What do you think about the language that they're using when they do that? They're clearly painting the government plan in a kind of a negative light. And so we have this whole idea of the free market is the best place, like the jungle for creating the best products and the best care and all that stuff, but it really doesn't apply to health care as far as market economics is concerned. But the language is always geared towards putting down the government plan, which is strange because people love Medicare, right? I was going to say, and the other thing is, they're always saying abolish private insurance, but then if you look at any of the single-payer proposals out now, it's like the private insurance system still exists. It just can't compete and cover the things that the Medicare, improved Medicare would cover. So it would still be like a supplemental like for cosmetic surgeries or maybe like any other thing. Oh, for things that are not going to be based on services. Anything that's not something you necessarily need, you can still buy insurance. Right. But you don't get the savings of the single-payer insurance, single-payer system if you have multiple competing insurances for those basic health care needs because you're still having all that administrative waste behind there. So for the things that are covered by the public plan, and we used to always call it public, it's a new thing to call it like new in the last 20 or 30 years since the insurance companies did surveys and messaging and trying to figure out how can we taint people's feelings about public health care like Medicare. Are you saying they use rhetoric to sway public opinion? Oh, they purposely do. Really? Not actual facts? Yeah. Yeah. And so just to use the word government run and compare that to private insurance is already tainting it because you should say publicly run and private insurance or you should say government run and corporate run because that would be a more fair comparison. Government run or corporate run. Something where you have some control and some transparency and accountability or corporate run where you have no control. Yeah. Or no transparency at all. Right. The transparency is a huge thing and that would be important and if we do get a when, when we do get a reasonable health care system, we will still need to be making sure that it's transparent and accountable because you could certainly make a corrupt system that didn't meet our needs and have the good outcomes and low cost that we're looking for. So we just have a little bit of time left. I'm wondering, do any of you have a last thing you wanted to make sure you said here on our show today? No, I don't know. I'll go for it. Okay, thank you. So we talked about if health care is a right or not and that's something you have to decide within yourself and we've been considering it over the past four weeks, I think and we've sorted to do so with an American health care system right now to live is a right. To put an example to that, if you have a catastrophic event and ambulance will pick you up and take you to the ER and you'll live but getting better is not a right in the American health care system. All the other places, you have the right to get better. You have the right to not worry about finances and access to both live and improve your health. Here right now, they say, oh yeah, ambulance will pick you up, you'll survive that heart attack. You'll stop that bleed but we can't control your diabetes which we know you will die from if you don't have access to help. We can't, you know, if you can't afford the chemo, sorry, I mean take it out of your grandchildren's budget.   Chemo calls her not to be able to work anymore.  It's not just like the poor, like it's your middle class person, it's your neighbor, you know. Thank you so much all of you and thank you for your time. Thank you. Thank you. Thank you for listening. I hope this was informative. If you have any questions, please visit pnhp.org and healthcare-now.org.


Welcome back, everyone. Before we really get started, I wanted to give you a demonstration of how hackers can hack. It's not really a demonstration about how to hack, necessarily, but just talking about some techniques that hackers can use to take over systems, to get access to systems, what they can do once they actually take over those systems. Yeah, so I just wanted to give you an idea of kind of how easy it is, but also sometimes how hard it is to be able to really take over somebody's computer and be able to use somebody else's computer to do different things or still information or whatever. So what I'm using to, I guess, take advantage of a browser is in Kali Linux, there's a tool called Beef. And it's the browser exploitation framework project. Most, or let's say, a lot of applications are becoming web-based. And that means that people are using browsers as kind of like the main tool for accessing their data, accessing information, communication, all of these things go through the browser now. We don't really download a lot of different applications onto our computer and then run those applications. Some people still do, but a lot of apps are now available online and they can be accessed from a browser. Because of that, the browser has become a very common target for hackers to basically get access to things. So one exploit I'll show you, basically I chose this because hacking really isn't very visual. Looking at lines of code or looking at the command line by itself doesn't really show you anything. You can just see commands going on and most of the time the commands fail. And yeah, so it's not very visually interesting. So I hope what I'm going to show you now is visually interesting for you. So the situation that I have set up is basically taking over someone's browser and then running different code on their browser to be able to basically just run commands on their computer, use their browser to do bad things, steal their credentials, like logins, passwords, things like that. So I just wanted to show kind of how this is working. So I'm using in Linux, in Cali Linux, which you can download. There's the beef control panel. Yeah, and it's fairly relatively easy to use. I'm using it inside VirtualBox as one of my host systems. And the IP address for this system is 1010237. So this is on my internal network. If you try this, don't try it on random people's computers. Set up your own local test network and try it on your own computers. Do not hack other people without their permission. So 1010237 is my local IP address for the, let's say the hacker's computer. I have a web server running on the IP address 1010232. That's where a web server on my internal network, 232. And then I have a Windows 10 computer. And it has an IP address of 1010233. Now, to be able to do most of these attacks, or to be able to do a lot of these attacks, the victim's computer has to be able to connect back to the attacker's computer. So I need the victim's computer to be able to connect to 1010237. So inside the Windows computer, I'm going to do ping 1010237. And what ping will do is basically send traffic to the computer at 1010237. So 1010237 is a special unique identifier for this computer. And if I can ping it, then that means they can communicate both ways. And I can. So most of the time, the attacker's computer would have a public IP address. And that means that any computer on the internet would be able to connect to it. On my internal network, I just need to make sure that the victim's computer can contact my attacking computer. So inside beef, basically this exploits different types of browsers.  So basically the hook that it wants you to add to some website, whether it's your own website or whether you've hacked a website or taken over a website, you should add this particular hook in there. And this IP address is the IP address wherever I'm hosting this hook.js software. And this is just JavaScript code that basically gets injected into a web page. If you don't know about JavaScript, you don't really have to know how to code JavaScript. But the point is that whenever you load up a website, code also gets loaded with that website. So what we're essentially doing is adding this code or this script to a website. And once we do that, then we can use that code to kind of take over the browser. That's the goal at least. So whenever I start up beef, it gives me this hook script location. And then I have actually, let me show that real quick. So I've created a web page on my server called Test HTML. And Test HTML, if you can see this, let me blow it up a little bit. Test HTML is just HTML body. And then this malicious script pointing back to our attacker's workstation on port 3000 to hook JS. And then just some text that says this is a bad web page. And then it has a link to a website. That's it. So next, we need to basically, once I have that web page up, I need to get somebody to actually visit that web page. And once they visit that web page, then if they're using a vulnerable browser, then they will be attacked. So I have actually Internet Explorer. So on Windows, this is Internet Explorer open. And I'm using Internet Explorer specifically because a lot of Koreans still use Internet Explorer. And yeah, a lot of websites require you to use Internet Explorer, but it's still quite vulnerable. So really, websites should be upgrading their software. So users don't have to use Internet Explorer anymore, and at least can move to Edge. But Microsoft Edge and Internet Explorer are actually quite different. Internet Explorer has a lot of vulnerabilities. But yeah. So anyway, I'm using Internet Explorer now just to illustrate hacking, essentially. So we need to go to the malicious website. So 101232test.html. So this is the malicious web page. Now, if you just went to this web page, this is a bad web page with a cool link. But it just looks like a normal web page, actually. You don't see any malicious code. Nothing is really going on. Nothing too strange, right? But you notice, back in our control panel, we now have online browsers. We have a browser that's hooked, and it looks like a Windows browser, Internet Explorer, and we get some information about it. So if I click on this, that means that because we've hooked it, this browser can now be controlled from the beef control panel. So if we look down here, beef gives us information about the browser. So browser name, Internet Explorer, version 11. So Internet Explorer 11. The UA string tells us quite a bit, or I thought it did. No, I was looking at language. So for example, ENUS, that's the default language. There's a shockwave flash installed. Looks like it's on Windows. So flash, yes. Web sockets, yes. No web RTC. Session cookies, yes. Persistent cookies, yes. And then a little bit more information about hooked, about how it's hooked. So this is just giving us information about the browser. And all the user had to do was go to this web page. So I can send, let's say I shared this web page on Facebook. Maybe a lot of people would have clicked on that link. And now, as long as they stay on this web page, I potentially have access to a lot of their browser functions. So now we can start to try to do things with the computer. So I will go to, now that I have the browser hooked, I will go to the Commands tab. And under the Commands tab, let me expand this a little bit. So under the Commands tab, there's a lot of different things we can do. So first, we'll look at browser. And we can try to detect a lot of different types of software installed on the computer. And the reason I might want to detect different types of software is because I might want to take advantage of a vulnerability in that software or send a file. So for example, if I can detect Microsoft Office is installed on a computer, then I know I can send data, I guess, to that computer or an attack to that computer that might compromise the system. So next, let's see, detect toolbars. I can see if there's any vulnerable toolbars on here, VLC, a media player. We can do browser fingerprinting, remove hook, try to get access to webcams. Again, I'm in a virtual environment, so that kind of stuff doesn't really work. Detect ActiveX, that might be useful if I want to send an ActiveX attack or vulnerability. Detect pop-up blockers. So if a pop-up blocker is installed and enabled, then certain types of attacks won't work. So I might do, I might run these commands very quickly to just make sure or kind of get more information or intelligence about the computer and how it's connected. We can also try to get cookies for the domain, which is information about, for example, log-ins potentially, session storage. Yeah, let's see. So what I want to do next, what I want to try to do is Chrome extensions, we're actually attacking Internet Explorer, so we don't need to use Chrome extensions. If we look at exploits, exploits mostly deals with taking over different types of firewalls, home routers, things like that. NAS devices, ActiveX command execution. So if ActiveX is installed, if this browser has ActiveX installed, then we can do that. Taking over cameras on the local network, not camera in the computer, and then a couple other things. Let's see, I was looking for hosts. So again, more intelligence gathering, trying to get the location, getting the internal IP. So I might be able to get the internal IP of the computer, and then I would know what IP range is potentially to attack. OK, so once the browser is hooked, we can go through and get some intelligence information about the browser, about the computer. And one thing that I want to do is, if, or want to say, I guess, is if the user, let's say, they click on this link and they browse away from my web page, then eventually, if we refresh this, if we refresh, then the browser should go offline or it should show up as offline. That means it's no longer hooked and I can no longer take it over. Right. OK, it's going to take a while before it registers. So if we go back, so now the browser is on the web page, again, the infected web page. So we still have the online browser. One of the things I want to do is to be able to keep some sort of persistence, right? So what I can try to do is go to browser and hook domain and then do something called redirect browser. Let me try to expand this. Redirect browser with an iframe. OK, so redirect browser iframe and then give it the IP address of this local computer, which was 237. So <IP_ADDRESS>. And then we want to redirect to, let's say, koreatimes.com. koreatimes.com. OK, so let me pull this over a little bit. Now watch what happens to the test web page whenever I click execute. So this is the attacker's computer. This is the victim's computer. So if I click execute, then you notice that it's redirected the victim's computer to koreatimes.com. However, if you look in the address bar, you can still see the infected or the malicious website. So it just redirected, but it's using something called an iframe to show koreatimes.com while still giving the attacker access to the system. So now the attacker or the victim, I should say, can click on any of the stories and view all the stories. But look, the domain is still the same. So if I'm the attacker, I can still run any of these commands against the suspect. So now that I've kind of got the victim, now that I've got the victim in, I guess, a bad place, I've taken over their browser and I've redirected them to a website. So now hopefully they'll take time to read a story and I can try to take over their system while we're doing it. I can go in and try to do things like looking at the host. I want to detect if this computer is actually in a virtual machine. So is the victim running in a virtual machine or not? Now, why would we be interested in that? If I click execute, click on the command, result, virtualize. So this computer is in a virtual machine and we know that because of the height and width is non-standard. So the reason I might want to do that is because maybe somebody is going to my website like an anti-virus company and testing my website for malicious code. Well, if it's in a virtual system, if it's in a virtual machine, then I can know that something strange is going on and not run the attacks. So we can do a lot of different things. Let's see if the tech software shows anything interesting. Probably not, because there's not really much installed tech software. Yeah, OK. Physical location won't work. System info might work. Yeah, it's not going to work. OK, so there's a couple of other things that I can do. A lot of these will only work on maybe older browsers or specific types of browsers or particular plugins in a browser. So we've already so far taken over the browser and then redirected the user to a web page that just looks like a normal web page. They can browse around a news website or Facebook or whatever it is.  I could still be, I guess, attacking your system. So what I really wanted to show was social engineering. So imagine that you're viewing this news website and everything looks normal. And this is a little bit suspicious, but I would use a different name or domain name if I'm looking at this. And you're reading this story about Indian Head Peak. I don't know. You're reading some story. Then all of a sudden the user wants to try to steal your Facebook credentials, your Facebook passwords. So we can do something called simple hijacker and then choose the template we want. Oh, where was it? Let's do fake flash update, actually. So maybe Korea Times uses flash flash. So we can do something like <IP_ADDRESS>, wasn't it?  And then this is basically a program that we want the user to download. So while the user is looking at pictures of rocks and things like that, then we can execute this command. And then all of a sudden Adobe Flash Player is available. Do you want to install it? Well, you click Install. And then whatever program I put in this location, the user will download it. So if I just call it Adobe Flash Player, then most people would save it and install it onto their computer. But it's actually a virus. So this is called Beef Master Zip. Obviously, that's not something that a user should download and install. And it could be called Flash Player. So it looks like it's a legitimate download. Again, let me execute that. I'm going to cancel this. If I execute that again, look at how realistic this looks. I mean, this looks like it's probably Facebook. And most people are trained to just kind of install. So most people would install this. And really, they shouldn't be downloading and installing that. But if you're just browsing this web page and that pops up, you'd probably install it. Let's look at another one. So let's say Google Phishing, for example. So again, I need to put in the attacker's IP address. Most of the time, it's not going to be the attacker's actual computer. But 237, OK? Gmail logout, OK. Execute. And then it has redirected us. So let's say it went to the news website. And then after a little bit, you got redirected to a Google Mail login. So then you have to put in your username again. And I'll just say Test. And then Password, Test123. And then sign in. Would you like to store your password? Nope. And then enter your email or phone number. And this is actually at Google.com. So look at it before. It was at 10-0-1-2-3-2. Yeah, well, now I need to go do the thing again. It was at 10-1-0-2-3-2. And it was asking for your Google credentials. So now if we click on this, you can see result. Username, Test, Password, Test123. So if somebody actually put in, they were trying to access a web page for a news website. And they got asked for their Google login information. Now the attacker has it. And then it redirects you to real Google. And most people wouldn't be able to tell the difference. So now that the user is actually back at 10-1-0-2-3-2, now I need to actually redirect them again. All of this can be scripted, but I'm just going through and showing you kind of how it works. Hooked domains. I want to redirect browser to iframe. Again, put in the attacker's IP address. And redirect them to creatimes.com. Execute. So now they're on a malicious website again. Now imagine that I could make a blog or a website. And that blog or website could basically point to a malicious web page that automatically redirects you. So in that case, anyone who goes to my initial web page and clicks a link would automatically get kind of hacked. And then I could redirect them to different websites. Again, look at the domain. The domain is the giveaway here. And it's actually creatimes.com, but the domain does not match. So we go to another web page. Let me go back to attacking and go to, for example, pretty theft. Pretty theft is a funny one. Because let's say we can choose from Facebook, LinkedIn, Windows, YouTube, Yammer, iOS, generic, whatever. And if we do Facebook, for example, most people have a Facebook account. Now, stealing a Facebook account by itself maybe isn't that interesting. Because Facebook does a lot of checks whenever you're trying to log in from an unknown IP address. But if I can use your browser, if I can take over your browser, then maybe I can log in as you from your browser. That might be possible. So 2, 3, 7. So now, again, I'm looking at news. I don't know what news this is. I'm looking at it, and I execute. Then it asked me, Facebook session timed out. And this looks legitimate. And a lot of news websites have Facebook. Like Facebook, the icon is right here. So it kind of makes sense. Like the user is just thinking, oh, man, I need to log back into Facebook if I want to use this. And if I click anywhere else, it doesn't go away. So I kind of have to enter it. So I just put in test and test 1, 2, 3, 4. Log in, and then I'm back to the web page. No problem, right? So it doesn't seem like anything happened. But if I go back to the suspect computer and I look at the command, then the answer was test, test 1, 2, 3, 4. So now I have your username and password. That's why two-factor authentication, like, for example, phone numbers or key fobs or one-time passwords are so important. Because if I can steal this information, I can log in as you, unless you have a second factor. Then I would also have to take over that second factor, and it's a little bit more difficult. There's a lot of other things we can do in here. Those were kind of the most visual, so I thought I would show them. Notice that a lot of these social engineering ones, there's a lot in social engineering. There's a lot that takes over, if we look at exploits, there's a lot that takes over wireless access points or the kind of the gateways that are very common and tries to change passwords or turn on services that let you take over the gateway. If you can get remote access to a gateway in a network, then you can potentially take over all of the computers in that network or redirect traffic or whatever it is you wanna do. So there's a lot of different attacks that we can do and a normal user would just browse the website like normal and most of the time wouldn't really know. So then if they're just browsing through, all of a sudden, Facebook login pops up and they would put their information in and that would be it. Now, there are some things that websites can do to try to prevent this, but obviously, Korea Times doesn't block iFrames and things like that. So there are things that websites can do to try to block this kind of thing, but this is very common and most people wouldn't really think about it whenever they're just browsing through the internet or if they're sent a link, maybe even from somebody that they don't know, the link might point to a malicious website that redirects them or does an iFrame that redirects them to a legitimate website.  So there's a lot of frameworks that let us do a lot of different things basically. Let's see if we can get it cookie, maybe not. So there's a lot of frameworks, oh, yeah, okay. So that's just the beef hook cookie. So there's a lot of frameworks that help us to be able to take over and kind of manipulate users, especially through the browser. Another thing that I wanted to show, but I don't think I have time, yeah, I don't have time. Another thing that I wanted to show is a tool, let's see, social engineering tools. So social engineering, it's called the social engineering toolkit, really, I guess, easy to use, and it can do a lot of attacks as well. So for example, select what you want to do social engineering attacks. Yeah, we wanna do social engineering attacks. So let's do one social engineering. I wanna do a infectious media generator. So basically generating files with malware inside of them. So I click three, and then the type of exploit that I wanna run is a file format exploit. So one, IP address for the reverse payload. I entered the attacker's IP address. And then the payloads that are currently available are all of these. Now, some of these will work better than others depending on who your target is or who the target is. But for example, maybe Adobe PDF embedded EXE social engineering. I can tell you that Windows, what was it called? Windows Defender, Windows Defender. Yeah, Windows Defender does detect Adobe PDF embedded EXE social engineering. But basically what this does is creates a PDF with an embedded executable that is malicious. So if you open up that executable, then, or if you open up that PDF, then your computer will be kind of infected and the attacker can take it over. So let's just generate that because if somebody receives a PDF, they're very likely to open it, right? And if they don't have an antivirus installed or some sort of way to check it, they'll probably fall victim to it. So we'll do 13. I can use my own PDF for the attack. So if I already have a document that I wanna send somebody, I can use that. Or I can use a blank PDF. People will probably open it either way. So I'm gonna generate a blank one. And then this is the type of reverse shell that I can create or the type of connection back to my computer. So what this does is basically says if the victim opens up the PDF, make the victim's computer connect back to the attacker's computer, that way the attacker can maybe upload files or steal information or whatever they wanna do. They basically get full access or almost full access to the computer at this stage. So let's just do a normal reverse TCP shell. Then I put in the suspect's password again or an IP address, sorry. And then the port that I wanna connect back on and 443 is for HTTPS. So it's expecting kind of encrypted data and a lot of firewalls don't block 443 outgoing or don't even check 443 outgoing because it's very common that traffic is flowing over 443. So we'll keep that. And then now, hopefully my virtual machine doesn't crash but it's generating the PDF with a malicious executable inside of it. Now, like I said, if you're using a halfway decent antivirus on Windows, then this malware should be caught. But that being said, if you're using an older system, if you don't have an up to date antivirus, maybe it won't be caught. And that means that whenever you run it, especially if you're using Adobe or an older version of Adobe Reader, then your system could be taken over. So now it's generated the PDF inside our root.set folder. And yeah, we can go in there and it says, do you wanna create a listener right now? We'll say yes. And then it will open up Metasploit and start a connection. And then it will just sit there listening for connections to come in. So now, once that's ready, all I have to do is let's go back. If I do, I'm in the set directory. So if I go to auto run, there's this auto run IMF. So if you put this on a USB stick or a CD or something like that and give it to somebody or drop it in front of their office, then whenever they insert that USB stick into their computer, then auto run will automatically open up this PDF. Or you can just email this PDF to them. It might get flagged by an antivirus, but you can email it in some way to them. And whenever they open up this PDF document, then their computer will make a connection back to your or the attacker's computer. And once that connection has been made, then the attacker basically has full access to your computer. So these attacks are really common. Basically people generate these malicious files and then they just sit there waiting for people to click on them. And it works pretty well, actually. Another way is to take over a vulnerable website and then inject some malicious code into that website. So that way anyone visiting that website, you can take over their browser just like we did before. Just like we did before. Yeah, so what can the users do about this? Well, not much really. I mean, some of this, like for the PDF, for example, the thing that the user can do is not open PDFs from people who they don't know or make sure that they scan every PDF before or open PDFs on maybe a virtual system, not your main computer. So if you're getting emails, for example, from a public email address for sales or something like that, then have a virtual computer that receives those public emails that you can open up documents in that's non-persistent. Then any information that's actually needed, you can forward that on whenever you need to. In terms of browsers, the best thing you can do is install a browser that automatically updates like Chrome, like Firefox, maybe even Edge, but make sure you're always using the newest browser. Chrome has a lot of built-in security features. All of them are thinking about security a little bit more. And I think Chrome, through a couple of the tests, Chrome usually comes out pretty, pretty good in terms of security, although it is vulnerable to certain types of things. Also be aware of different vulnerabilities inside plugins for each type of browser. So browser plugins can leak data, they can have errors, and instead of attacking the browser, we can attack the plugins instead. So going over all of the different types of attacks that hackers can do would take a very long time, but I hope you've gotten an idea of basically how attackers somewhat can manipulate your computer, even if you're not necessarily going to really bad websites. If they can take over a website that you do go to, then they can still potentially get access to different parts or information on your computer. And it's relatively easy to do, and all the tools I used were also free. I'm not condoning going out and hacking people, but especially for security researchers, you have to know at least generally how these kinds of attacks work, okay? So I hope that was kind of an interesting introduction into basically what some of the things that hackers can do are, and some of the tools that are out there. So thank you very much. If you like this video, please subscribe for more.