That's the one thing you can be sure of. Nobody actually believes in capitalism or freedom anymore. Like Donald Trump was the opposite of capitalism. And Boris Johnson is the opposite of capitalism. There's no freedom anymore. That's the one thing that's not. So whatever happens, it's not capitalism. It's not global capitalism. Now, you asked about China. For variety of reasons, I don't believe China will invade Taiwan anytime soon. You can write that down and call me on it if I get it wrong. I didn't think Putin would invade Ukraine. So I admit that I get stuff wrong sometimes. I think China's plan for Taiwan is longer term. I think we're looking at 10, 15 years. The hope is that they can integrate it peacefully because they can convince the Taiwanese that they're better off under China. I don't think that'll work for them. So ultimately, they'll invade. But they're waiting partially because their military is still too weak. Well, I don't think that'll work for them.


So, hi. Welcome to my talk on mining for bugs with graph database queries. It's been a while since I last talked at CCC, and I actually planned on submitting every year, but it then turned out last time that I submitted that it's actually been five years already. You probably, so most of the people in the room probably did not see the last talk, but to make it short, it was mostly about hard-earned bugs, meaning staring at code for a very, very long time, trying to find bugs and exploiting those bugs in the code. And since then, my interest has been in making this process just a little less painful. And what I'm presenting today is the results of that. So, I want to give you the big picture first of what I actually want to achieve on the long run. So, what I'm trying to do here is I'm trying to combine two, well, my main two interests, which are on the one side, the kinds of things that we see at conferences like CCC a lot, which is bug hunting, exploiting bugs, things that are nicely represented by the books that you see there on the top. So, the shell coders handbook, the bug hunters diary, the art of software security assessment, and in the back, you see a frack shining over all of this, right? And then it becomes a little more academic with principles of program analysis. And with these kinds of methods that are proposed in principles of program analysis, have in common is that they are very, very exact. Now, my other interest is in pattern recognition and machine learning, these kinds of methods. And they are actually very inexact. So, they approach problems more from the engineering kind of perspective. And the idea now is, can we take the tools that we have down there, the pattern recognition tools, and kind of build tools to recognize bugs? You know, looking at bugs, looking at code similar in the way a person auditing code would look at it, and then just, you know, do an inexact analysis, but which scales very well. Because the problems that you have with these exact methods is that scaling them to really large code bases, like the Linux kernel, for example, is really, really hard. Now, doing this, I want to have tools which are realistic, you know, not those static analysis tools that give you, like, thousands of fits, and you can't really tune them or do anything like that. But instead, I want something to assist auditors in their daily work. Now, zooming in a little, what you're going to be seeing today is I'm trying to look at two very different topics and showing that they actually have something in common, that they actually fit nicely together. So one of them is good old computer science compiler construction, and the other is the shiny and new graph databases, or as some people like to say, big data, right? And we're going to see that they actually fit nicely together. That's what I want to achieve in this talk. Now, to start off with, let's take a look at an example bug. So this is a bug found by Stefan Esser and presented in his CISCAN 13 talk. And, well, in his talk, he presented a lot of different bugs, and this one is certainly not one of those, well, this is more of a site finding, I would say. But it's interesting for us, as you'll see in a moment. So the one thing that's already interesting is that you see these kinds of bugs like these all over the place. So it's like a, it's not a very unique bug, it's something that you will see again and again and again. Now, as you see, there's this variable, 32-bit wide called name len, and it's produced by taking this pointer data and then converting from network byte to host byte order. So that kind of tells you this data is probably attacker controlled because it comes from a network and you would not be converting from network to host byte order if it didn't come from a network. Now, what happens next is that there's an allocation. So this buffer called exit signal is being allocated and they use this variable name len that has just been initialized by the attacker and they add one inside the allocation. And clearly the problem is if name len is the maximum size of an unsigned integer, then this will overflow and actually something close to zero bytes will be allocated. And now finally, there's mem copy operation and we copy into this buffer which is close to zero bytes and we copy name len bytes into there, so that's about four gigabytes. So there's a typical heap-based buffer overflow. Now, what's interesting is how we found this and that's why I took this example. So in academic research, there are a lot of different methods being proposed on how you could find this kind of stuff and they all sound very advanced. So you hear things about white box fuzzers enhanced with symbolic execution and the machine learning powered animal detectors, maybe theory improving or model checking, but in practice he used a regular expression for grep. That was pretty amusing. So with all the advanced methods that you could use, he chose to do this. Now, I think this tells us a lot. So first of all, I think it tells us that if you use it right, even primitive tools like grep are very, very powerful. You just need to make sure that the person auditing the code can actually introduce his knowledge into the process. Now, the second thing that becomes clear is that these kind of queries, so things like this grep regular expression, they actually encode knowledge. So I'm going to go back one slide. Yeah, if you look at this regular expression, you see what it tries to match. So it tries to look for an allocation and inside there, there's some sort of arithmetic operation, so plus, minus, something like that. And in a way, you could say, this is a model for different kinds of bugs where he's saying these kinds of things happen all over the place, so let's just search for these. And then finally, it kind of shows that false positive rates for bug hunting, that's not so much of a problem. If you have like 50 hits and in there, there are 70 days, well, then that's fine. You read a bit of extra code, but who cares? I mean, yeah. So that gave me the idea of, well, maybe we can build like a search engine for source code that can be used to find bugs. And that's what this talk is about. So overall, it's supposed to look like this. You take source code, and you stuff it into some robust parser for the language, and then you import it into a database. And then the analyst, the auditor, sits at one side and is able to query the database, see what comes back, and then eventually adapt the query to make, well, to actually find what he's interested in. Now, in the back, you can also use this database for different kind of pattern recognition tools, but this is something that we're not going to be discussing today. Now, the prime question is, if we want to build a good search engine, what does our language need to be able to model? And overall, I think it's the following. We need to ask, what does the statement look like? And can we get from one statement to another? And how do the statements affect each other? And we can, of course, take a look at how people who design compilers have tackled all of these problems, since when you try to write an optimizer or something like that, you need all this kind of information. And in compiler construction, well, they essentially have different graph representations of code. And all each of these highlight some aspect. So, for example, there's the abstract syntax tree that you see here in the top, the AST. And this gives you like a hierarchical decomposition of the code into all of its language elements. Then there's the control flow graph. You probably know this. That's essentially what you see in tools like Ida Pro, which tells you, well, the statements have been collapsed, right? And you see how you can get from one statement to the other. And on condition nodes, you see whether the condition needs to be true or false to get to another statement. And then this thing here, this is not so well known, this is called the PDG, the program dependence graph, and this has edges to model data flow. So this says a variable that is being produced at one statement reaches another statement, so it's not changed on the way. So there's actually data flow from here to there. Now, as I said, they all highlight some aspect of the code that we want to be able to model in a search query, but none of them can really do it all, right? And another problem is if you take a look at a typical query, then it's going to sound a bit like this. Find a call to foo in a statement where data flow exists to a statement that contains a call to bar. That means what you're actually doing here is you're kind of transitioning from one representation to the other, right? So first you're in the syntax world, first you're saying find a call to foo, which means, well, in the syntax tree, there needs to be a node which is call to foo, but then you want to take a look at data flow. Now you want to see, can I get from this statement to another statement? And here the abstract syntax tree fails completely, and instead you want to use something like the PDG. So you want to transition from the AST to the PDG and then again to the AST. And what we wanted to have is a representation that can do all of these things. And the primary observation here is that in all of these representations, the CFG, the PDG and the AST, for each of the statements, there's actually one designated node, right? So if you look at this index equal source, there's one node in the CFG, there's another in the PDG, and also in the AST. Here it's just a declaration node. Of course, there are some nodes beneath that, but that doesn't matter. So why not try to join these data structures at statement nodes? And that's what we did. So this is what we call the code property graph. And what you see here is, well, you see parts of the AST which are still there, right? So those little trees. But you can also get from one of these statement subtrees of the AST to another statement via data flow links or control flow links, right? And now the idea is maybe we can describe vulnerabilities as walks in this graph. Now, once we get that data structure, the question was, how are we going to store this? And it actually took me quite some time to realize that, well, if you have a graph, then, you know, trying to map this to a classical relational database management system is not going to be much fun because you need to map a graph to tables. And it took me even longer because there are actually a lot of great reverse engineering tools which do exactly this. So for me, it seemed like the right way to do, right? And then I started to look at different kinds of databases. And I looked at document databases and mapping graphs to documents also kind of fails. And then I realized mapping graphs to graphs succeeds immediately. Now, why are relational database management systems not the right choice here? Well, as I already said, the underlying data structure that's being used here is the table. And the most obvious problem is that if you want to create relationships between nodes, as you have in a graph, right, just arrows from one node to another edges, then what you typically do, so pretty much all you can do is create a so-called join table. And in this join table, you will associate tables from items from a table on the left and a table on the right. And the lookup time will scale with the number of relationships. But what you really want is you want to be at one node and you want to have immediate access only to the relationships that are outgoing there. And that's what a graph database gives you. Now, I know that when you hear big data and cloud error, no SQL, you're probably thinking, no, this can't possibly make sense because the only people who use these kinds of words are the guys in the suits. But this actually makes sense from a technical point of view. And that's what I hope to show in the next couple of slides. Yeah. So the native storage format for graph databases is a so-called property graph. That's different from the tables. So property graph is just a graph, really. But there are properties attached to the nodes, which just means, well, you can think of it as having Python dictionaries attached to each node or Perl hashes or, yeah, just a key value pairs, really. And also the edges, and this is important for us as well, they're labeled. So it's not just there's an edge from A to B, but there's an edge labeled as nodes or created or something like that from A to B. And that's all that a property graph really is. And that's the native storage format of graph databases. But now the nice thing here is, once you have your data in this format, you can make use of different languages which have been designed specifically to query these property graphs. And there are two languages which are currently very popular. One is the Cypher query language by the Neo4j guys. This is not so well suited for what we want to do, most of all, because the Cypher query language doesn't allow you to have like the equivalent of stored procedures. And we really want to have this, as we'll see. Now, the other one is Gremlin. And Gremlin is really awesome. I hope to show this. So a typical Gremlin query looks a bit like this. You say, choose a set of start nodes. Then you have some start nodes in your graph. And then you describe where to walk the graph from there. And if that's possible, then the nodes that are reached in that way will be returned. So as an example, return all objects created by people over the age of 30. So it looks like this. So here's the Gremlin query. So you begin by saying, take all nodes where age is bigger than 30. So here in the example, that's Josh was 32, and Peter was 35. And now take all outgoing edges labeled by created. And then you reach this and this node. And now the nice thing is, once that you've created a walk like this, you can give it a name, right? So instead of always saying, filter it age is bigger 30, out created, you can now save people we can fire now. And then you can reuse this again and again. Yeah, and this is what a definition like that would look like. So it's very similar to a stored procedure. It means you don't have to ever write it again. And this is what we're going to make use of. Now, of course, for social networks, this is extremely useful. And the best example is Facebook graph search. So they actually made a UI where people can click together different kinds of graph database queries. So you could look for people who like English defense leak and Kerry, for example, or you could look for mothers of Catholics from Italy who like Durex and stuff like that, right? But the amazing thing is, you can store other useful things in graph databases, right? And the code property graph by definition really is a property graph, right? So you can store it in a graph database. And now we can use this trick here, you know, this taking walks in this graph and giving them a name to define domain specific query language for vulnerability discovery. That's the idea. And we did all this and made it open source so you can play with it. So this tool is called Euron, the robust code analysis platform for C and C++. Don't be fooled. It's mostly C. But if you throw something like Firefox at it, which is, let's say, nice C++, then it will also work for you. But if you throw something like the STL into it, then it will fail miserably. Anyway, by definition, you get an extensible query language because you have gremlin, right? And we provided a lot of different traversals, they're called like these pipes that you can immediately use. It's scriptable via Python because so many people like Python. And I also wrote a couple of shell utilities that you can use for like day-to-day auditing work. And it's known to work on other people's machines, which I'm very, very proud of. Okay. Yeah. You can download it here. Okay. So let's take a quick look at what this tool looks like. So you have an importer. You start to import code. That's here. Okay. And then it creates a database called EuronIndex. And this is then stored in the graph database. And then all you need to do is start the database server. And it will open up. Well, it will make a REST API accessible. This shows this kind of stuff comes from web guys, right? Now, to make sure that you don't ever see that there's web stuff underneath, I wrote a library called Python Euron that you can just include in your scripts and it will just communicate with the REST API for you. And then you can run your scripts happily. So this is a complete working script, except for the query, right? Here you insert your query. So you connect to the database. You run the query. You print the results. That's all. Alternatively, you can use the shell utilities. Now, let's test this on some real projects. So the first project we're looking at is the VLC media player. And it's just a short disclaimer about this. If you audit people's code, then that doesn't mean that you hate them. And it also doesn't mean that you disrespect them. Mostly, it means that their code base is interesting in one way or another. So the fact that this is popular made me want to audit it. I think the VLC developers are doing a really good job. And all of the bugs that are going to be disclosed now have actually been fixed now in the JIT version. And we'll probably then be fixed in the next versions as well. Okay. So let's make this practical. You run the importer. Euron on the VLC code starts importing the code. You start the database server. And you can then point your browser to port 7474. And you get some basic statistics of what's inside the database. So you can now see, for VLC, it's created about 2 million nodes, 5 million properties, 4 million relationships, and so on. And it uses about 700 and 5 megabytes. Yeah. So it's durable. So all of these experiments are being done on a laptop. So you don't need a server farm to operate this kind of stuff. Now, if you look at the Euron index, the database that has been created, you'll see that there's actually an Apache Lucene index here. Apache Lucene is just something that you can use to... That's actually document database. And this is used as part of the graph database to give you fast lookups of nodes by their properties. So you can say things like, give me all calls to malloc. And you'll immediately have them. So this takes up about as much space as the graph database, you could say. Now, let's start using this. So here's a very simple query with the Lucene query language. So as I said, there are shell utilities. Euron lookup is one of the shell utilities that you can use to quickly pipe a query into it and you'll get the results. And here it says, give me all the files where the file path contains the word demux. So all demuxers. And of course, you could have also done this with a find, right? But now it gets more interesting. You can also insert these Gremlin queries. And here I've created a custom query known as a custom step known as query node index. And you can pass the Lucene query in here to get a start node. But instead of just returning those nodes, we can now start traversing the graph starting from those nodes. So we can say things like, from those file nodes, go out and filter all the functions. So this will give you all the functions and print their name. So suddenly, you're going from files to functions and you get all the functions in files named demux. Yeah. That's what that looks like. Now, let's see how much time I have left. Okay. Yeah. So of course, you're going to be asking, okay, nice, but how do I know what's actually in the database? So how do I get from one node to another? And the nice thing is, if you work at a university, you eventually have some master students and one of our master students, they wrote a tool to visualize the graph database contents. So you can get, this is of course printed in a way that you probably can't see from the back. The point is just in those nodes, you see all the properties and you see the different edges between there and you also have the labels and also attributes on those. Yeah. So, yeah, you can use these tools. You can plot, for example, here we say, give us the data flow edges and the control flow edges and then it will print nice things that you can put onto slides or study to actually know how you can get from one place to another. Now, let's take a look at bugs finally. So I first wanted to look at things which are in a way similar to the lib ssh bug that Stefan had disclosed. So I usually begin this by formulating in words what I'm looking for. And in this case, this was get calls to malloc, where the first argument contains an additive expression and the call to mem copy is reached by data flow, where the third argument, st amount to copy, also contains an additive expression and the two additive expressions are not equal. So these are the kinds of things that you can easily find with the tools that we wrote here. And now, as a query, it looks like this. This is a custom step get calls to and, well, you'll find a lot of different ones. There's, for example, get definitions, get functions by name, stuff like that. This gives you the start notes. So get calls to malloc. From there, walk to the first argument. It's zero because we're computer scientists and we start counting it zero. And as a side effect, store the code that you see there. That's the first argument. Store it in a variable called cnt. Now, from there, look for an additive expression. And as I said, if there's no additive expression, an empty set will be returned here. So those will be filtered. And then from there, from all those mallocs where there's an additive expression in its first argument, go up to the statement that encloses this. And from there, follow data flow links, right? To calls to mem copy where the third argument is not equal to this cnt that we just stored up here, right? And there's an additive expression inside. And that's it. And I can imagine that if you see something like this for the first time, it looks really complicated, but you'll get very fluent at this kind of stuff. Then we just pipe it into your own lookup. We sort it unique. We get the locations, your own location, right? And we have a file containing locations that match. So cutting that file gives us four hits. And I immediately said, oh, wow, okay. MP4 looks nice. I have some MP4s. So let's look at the MP4 stuff. And then you can pipe it into your own code, which will give you the code. So this is what you find. You find a function called mp4 readbox name. And well, yeah, I would have asked you how to trigger the bug, but I wrote it in the title of the slide. So it looks very similar to the bug that Stefan found. So here you have inside the malloc, there's an addition. You add one, you subtract eight, so you're subtracting seven, really. And down here in the mem copy, you're subtracting eight.  So you allocate something close to zero bytes. And here, if you insert seven, seven minus eight is minus one. Cast to unsigned integer is max int. And there you go. You have your buffer overflow. So this is in the MP4 demuxer. Let's see. Yeah, okay. Now, an interesting question to ask here is, well, how do you come up with ways of, so what am I going to search for in this code to actually find bugs? And there were some wise words set in the Art of Software Security assessment. And I'd like to quote this. So they say, in fact, two of our authors typically start reviewing a new code base by finding the equivalent of the util directory and reading the framework and glue code line by line. And I found this really helpful. You know, if you start auditing a new project, take a look at the language that's being spoken in this code base. And those are the utility functions. So in this case, in the case of VLC, I took a look at vlcstream.h. This is the API that they use to analyze data streams of all kind. So if we find fundamental difficulties in using this API, then we're going to find bugs. Now, what I found is there's a function called stream size. And as you might have suspected, it returns a 64-bit integer. That's because a stream, a data stream, so this might be just an mp4. Of course, you want it to be bigger than 4 gigabytes, right? So any good HD movie is going to be bigger than 4 gigabytes, something like that. So the problem here is that on 32-bit platforms, well, you can't really store 42-bit in a register. So the size of the stream is going to be larger than the intmax on the platform. And that means that all allocations that depend on stream size, you're going to have to be very careful with those. And it's realistic for intact because, you know, if somebody downloads a movie of a file sharing application and the caption is right, then people won't be thinking, oh, this is 4 gigabytes, I'm not going to start this, right? So it's 4 gigabytes because it's a movie. There you go. So again, formulating this in your head, you get give me statements containing calls to stream size and the symbol int64t, where Dataflow exists to statements containing the symbol malloc, right? So you get allocations depending on the stream size. And this query looks, well, the sentence is not so long and the query isn't either, so it's, again, get calls to, which you just saw, stream size, and then go up to the statement. Now you're leaving the AST part. And now filter all those statements which contain int64, and then follow the Dataflow to statements that contain the word malloc. That's it. And you don't get so many hits, so those are all the hits that you get. And, well, they're all not so interesting, but this one is nice because this is the updater. So I read plus one depending on stream size. So let's take a look at this code. So this is the VLC automatic updater. This is the thing that checks in the background whether new updates are available. And you can see it connects to some URL. We'll see which one. And then it calls stream size and stores this in I read. And this is a 64-bit integer. Then it calls malloc on I read plus one. Now on a 32-bit platform, I read plus one, well, this will first succeed and they will do calculation with 64-bit most probably. But then, no matter what happens, this is going to be truncated to 32-bit, right? Because the size T on a 32-bit platform is 4-byte as opposed to 8. Now, if I read is max int, then, again, you get a buffer close to the size of zero. And now they call stream read, which is an API function that is similar to mem copy in a way, but much better as you'll see in a moment. And the read, I read characters into this buffer. So again, you have an overflow. Now you're going to be saying, yeah, but your update is going to be verified, right? Here's the nice thing. They actually do signature checking after they've downloaded using HTTP only. But this buffer overflow happens before the signature is being checked. Great. So executed before verification, nice. This could be something that we could be interested in. Now let's look into the binary and we'll see, okay, this is a static URL, update, video, and so on. And this here is, yeah, if you follow the link, you'll see this is the call to stream size. It's been inlined. And here you see the truncation in a very obvious form. So here the return value is actually stored in two registers because you can't really do it differently on a 32-bit platform, right? But then as they add one, they really just add one to one of the registers because they're going to be using a 32-bit value anyway, so they might as well truncate it here. And then this flows into the malloc and there you go. You have your integer overflow leading to a heap-based buffer overflow. Now I set up my little web server and pointed EDC host to update, pointed update video LAN or to that web server and created a file that is four gigabytes long and contained all ace. I attached a debugger and I checked for updates. And here's what happened. So that's very convenient because typically from the crash you need to do all sorts of work to actually get EIP equals your value, right? So this is 41, 41, 41, 41, meaning it's all ace. So you control where the program jumps next. And the nice thing is if you have this, then arguing in favor of patching just gets very much easier. Okay, so some notes on exploitation. Streamread is your friend. I just said this already. It's like mem copy, so copy state into your buffer, but much better. So first of all, the size depends on the content length field. So you don't have to actually transfer four gigabytes of data. All you need to say is I am eventually going to transmit four gigabytes of data. And here's some data. The attacker fully controls the amount of data to actually copy. And you also control how data is fragmented into different blocks. And now the nicest thing of all, and this is why we control EIP on this, in between those copy operations, streamread dereferences a function pointer. Okay? So if you overwrite this function pointer, then you control EIP. Now ASLR and TEP is enabled, but there is a bit of position dependent code that we can use to build a small ROP chain for the exploit. The downside is this is not so stable at least for my POC exploit. So I'm going to show you a POC exploit now, proof of concept, but it's, well, I only took a couple of days for this, so it's not very stable, but it will work at some point. Let's see. Okay. So this is the platform. Now I start VLC. And then I use the automatic updater. And it didn't work. And I tried again. And it didn't work. Also, POC exploits have stage fright, as you know. And it didn't work. Okay. Give me five tries. Almost. That's very close. That's very close. Just a second. Yes, there we go. Yes. So the reason this didn't work straight away is I didn't know sorts of work to ensure that the heap is in any, you know, controllable state. This is really just, you know, these were a couple of luck shots and then eventually it hit the right address. Yeah. I mean, it shows that you can execute arbitrary code, so this has to be enough to patch it, right? Good. Next. Yeah. So our second test subject was the Linux kernel. This is also well suited for static analysis, because there's a lot of drivers in there. And to actually fuzz these drivers, you would actually need to have the hardware to fuzz this stuff. So you find a lot of things statically as well. And also it's a large code base for a lot of users, so it's interesting. All right. Now here I want to show you something, and I know this is a lot of text on the slide. Here I want to show you that we can take very complex, we can define very complex traversals and then just hide them in a single word, which in this case is unsanitized, and then reuse them again and again. So for unsanitized, what I want to do is I want to be able to find cases where I have a flow from a source to a sync, but certain checks are definitely not in place. All right. So if you formulate this in complete form, it's the traversal returns attacker control sources, if and only if, there's an if missing, if they meet the following two conditions. There exists a path from the source statement to the sync statement in the control flow graph, such that no code on the path matches any of the sanitizer descriptions. So these descriptions are something that you pass in there. Now a second, a variable defined by the source and used by the sync reaches the sync via the control flow path, i.e., the variable is not redefined by any node on the path. So that's pretty complex, right? But you can implement it once and then put it into your step called unsanitized and reuse it again and again. And that's what we did here. So here you see a typical, so we say a tank style query. Here we look for buffer overflows in right handlers. So we start off by characterizing the syncs that we want to reach, like the sensitive operations. So get functions where the name matches right, okay? And from there on, go to the arguments or ith arguments it is now and yeah, no, go to calls to copy from user or mem copy and to their third arguments, yeah. And now filter those for count, right? Because count is typically something that's a variable you control in the right handler. And then here comes the unsanitized step. That's the important part. So the unsanitized step, here you characterize the different kinds of checks that you want to filter. So if this stuff occurs, then you don't care for this sync. So one of them is, is there some sort of comparison in here? We call this is check. Or does the code contain alloc? That means that the buffer is probably allocated to have the correct size. Of course, we don't know this, but let's filter all of these. Let's look for the cases where it's very clear that this is a bug. And min is not used. So min is often used instead of having a check. Yeah, so filter those as well. And make sure that the sources match count. And we have a similar one. We're not going to go through this in detail. But again, the unsanitized part is exactly the same. All we do now is we have a slightly different characterization of the syncs and the sources. And we ran these two queries. And, well, we had seven old days and 11 hits using this. So that was very cool. Now here's one of them just to show you what these kinds of bugs look like and what you can use this unsanitized step for. So this is an IOCTL handler of QF, that's an Ethernet card. You see here a call to copy from user, which is being used to initialize the variable recLen, so requestLen. And that means that this variable here is controlled by user space. Now, there's an allocation here on the way, but it's absolutely not concerned with recLen. Instead, recLen is next used in this copy operation down here as a third argument to mem copy. And this buffer, well, the size of this buffer has nothing to do with recLen, and it's a static buffer. So you have a classical stack-based buffer overflow. And the nice thing, this is why there were only 11 hits, is that we were able to actually filter those cases where there are different kinds of checks to ensure that this kind of stuff doesn't happen. So stack-based buffer overflow, we did not write an exploit, but looks pretty exploitable. Now, for the practical evaluation of all this stuff, I mean, I was just able to show you a couple of samples here. We did a larger evaluation, and Nico worked on this for a great deal. So he used this at, well, in a real company for Qualcomm, and found about 100 issues in an internal audit. Now, I don't know exactly what an issue is here, so can't comment on the quality of those findings. But then we also did an evaluation. So he did most of the work with this on the Linux kernel mainline. And we formulated different kinds of queries. So two queries for buffer overflows, you just saw them, although they were slightly rewritten, but yeah, you just saw them. Then we had zero byte allocation, memory mapping box, and some memory disclosure box. This one was rather complicated, and I need to publish it at some point. Yeah, and we found a lot of bugs. Kind of proud of that. So, yeah. And they were also acknowledged by the developers. So that's always nice to know that actually, these are not just bugs for security folks, but actually, they would also say it's okay. Ten minutes. Yeah, that's good. Okay, so conclusion. Yeah, I showed you a system to mine code bases for vulnerabilities. On the long run, well, here, I've already built a bridge between program analysis and graph databases. On the long run, it's the larger effort of this is can we have typical pattern recognition data mining techniques to discover vulnerabilities? And this is one part of this. And finally, as I just said already, we found real exploitable bugs. So, yeah, it seems to work in some cases. Thanks. Okay, thank you very much. As usual, we have some time for Q&A left. So we again have four microphones in the room. Please, all the people in the room who have questions, line up behind the microphones. And for the people on the stream, we also have a signal angel in the room who takes your questions on Twitter, IRC, and all your online, what it means. And we're going to go with the first question from the room for microphone number two, please. Yeah. So, do you have a database with queries ready? So I want it to be a good idea to integrate this in continuous integration system. Now, do you have a database ready with such queries? And is there any way to annotate code? So if I go and check if this reports a problem, can I annotate it in some way that we'll skip it next time if it goes through it? We currently don't have a database of like a lot of queries. We have some examples, right, that you can look at. But we definitely want to have this. This is more of a question of time that you're able to invest into this. But I also think that the idea that you're, I mean, essentially what you're saying is, if I understand correctly, can we not build a database of things that we know that have broken in the past, right? So that we can immediately scan the new code for this kind of stuff, if I understand it correctly. Yeah, this would definitely be very awesome, but needs some work to be done just writing queries. And the annotation part, I mean, can I mark some code that this was checked in its safe so it doesn't go again through it? Yeah, I have something interesting to say about this, but I'd rather take this offline because it's concerned with the work that we haven't got published yet. But yeah, about the annotation. Yeah, maybe we can discuss this after the talk. Thank you. Okay, next question for microphone number three, please. Yeah. Given that you support CNC++, I assume you're obtaining the AST from Clang Compiler, for example? No. Yeah, this is another story, but I was asked by several people to skip it because it's a bit boring. The thing is that if you, I said something about a robust parser, right? So the problem really is the job of compilers is to also check whether the code that you're giving it is actually correct. That means in C that you need the complete code base and you need a working build environment with all the libraries and stuff like that. I wanted something that's more like a search engine. So I actually built a parser for C that does robust parsing. So it assumes that the code that you give it is valid C++ in some weird dialect, some place on earth, right? And then it will just parse the stuff that it understands and stuff that it doesn't understand, it throws away. That's part of the project. Yeah, the problem that you have with LibClang, I mean, you could definitely write an interface for this. But the problem is typically as soon as it sees some code, like a definition it doesn't know or so, the rest of the source file is not parsed and we don't want that. Okay, another question from number three, please. Hello. Are there any errors that one would intuitively think one should be able to find using this method but which are not possible or too hard, too expensive? Do you have any interesting examples of that? Well, in a way, if you take a look at this, this is actually pretty intuitive. And I would have thought that it had been found a long time ago. I think that what's problematic here is maybe that you can only trigger the bug if you insert a seven. So if you take a fuzzer to find these things, and I think most people fuzz this stuff, then you're probably not going to hit the seven. But in a way, I think this looks so intuitive, but we still see that using these simple methods, we can find bugs. So I don't know if that answers your question. Probably not. Yeah, I think you answered the other way around. Okay. So I think that the system is good at. I was asking for things that the system is surprisingly bad at. Surprisingly bad at. Well, I mean, they are very obvious limitations, right? You were not really evaluating the expressions at all. As I said in the beginning, it's more like you try to model what people do who look at code manually, look for additions inside allocations or stuff like that. But you don't really evaluate the expression to see, yeah, that's still very abstract. I can't name anything concrete. But I mean, that's the biggest problem, especially if you compare it to like exact methods, such as symbolic execution or so, where you actually calculate what the real values could be, which we don't do here. Thank you. Okay. Next question from microphone number two, please. Oh, that's okay. I can just put my hat up. Thank you. I'm wondering, we have now seen that you evaluate code being C or C++. Well, or you said better C than C++. Is it that that you kind of used the grammar to parse when you said you wrote your parser? Because I'm mainly working with Java and I'm interested in searching for bad coding and possible bugs in Java. Yes. So we wrote a grammar for the Antelah for parser generator, which is a really awesome tool. So if you compare it to stuff like Flex and Bison, then I mean, with Flex and Bison, you spend lots and lots of time making Flex and Bison understand what you want to parse with Antelah. It's really simple. And yeah, we've also had somebody take a look at adapting this to Java. There are people actually using this for Java right now, but clearly, well, yeah, you're feeding Java to C parser. So yeah, most data flow inside the function, for example, that works very well. But if you want to take a look at class hierarchies and stuff like that, it would probably be a good idea to just adapt the parser to Java. Okay. I question for microphone number three. Can you say something about performance? Do you need to tweak the queries to make them fast or is it okay? Yeah, so it depends a lot on the amount of start nodes that you choose, right? Because if you have a lot of start nodes, what you need to start to do, and this is also in the documentation, is you need to start to chunk this because it will run all of these, it won't run these queries, well, it will run them all in parallel, because at some point it could be that you want to merge the results again. So you need to split this. The queries that we had here, those we presented, the slowest took about five minutes to execute on my laptop. So I guess that's acceptable if you do an audit. The part that takes most of the time, that was this unsanitized step where you actually start traversing the control flow graph again and again and again to see if there's any path, any reachable path that you're interested in. For simpler stuff, like this bug here, for example, or also the updated bug, this is pretty instantaneous. So it takes, well, maybe not instantaneous, it takes 10 to 15 seconds or so. Cool. Okay, I see we don't have any more questions from room. Is there maybe a question from the internet? Okay, no. So please thank you again, Phaps, for your very interesting talk.


Good evening everyone and welcome. This is Melissa Armour with StocksWish and I'm here today to review BABA. Let's just take a look at what this did. So yesterday it had a down day and actually I talked about this in the webinar last night. Yesterday should be the worst day that this has if you are still in the options for this out for a September night. It should have been the worst day yesterday. Okay, and what I wanted to do yesterday was close above 95, which it did. It closed better than expected 95, 65 and in an ideal world I saw it drop down yesterday. I wanted to close at 95. I wanted to gap up this morning and open at 95, 50 and it closed over 95, 50 and over 95. So that was a good sign. So then today this morning it actually opened at 95, 59. Actually, that was a gap down. Just seeing this, but this is a neutral. Neutral today in the gap. That's why it didn't really follow through in the rally today. I'm just seeing that now. But we actually closed over the close of yesterday, which is a good sign. They closed at 95, 74. So tomorrow morning we should gap neutral or up in BABA. Okay? Neutral or up, follow through the next level that we really have to get over to get some momentum going. This is really 97, 97, 98 and after 98 we should never look back. But I was talking about this in the trading room today. When is it going to hit up over the level that I wanted to see? The ideal level. The reason I didn't take the trade out on the day after the earnings, which you could have. It had volatility and had momentum, but I had the option out for so long and I paid up for it. That I wouldn't have paid up for the option if I wouldn't want to hold it out to the next number. I would have gotten a less of a price, got more contracts, paid less for the price and got out the Friday the day after I took it, which I took it here on the Thursday. I did it because I wanted the bigger move. The bigger move is where? Over 100, over the top of the high of the day of the IPO open. This is just a huge number of people and it's not even coincidental that the high was 99, 70 and it's 30 cents away from the $100 diet buy point. Okay, so which is like right here, there. That is really it. Wow. So today we just didn't follow through, but now I'm just saw here tonight that the reason we didn't follow through is because we actually did not gap up today. Very slight and very interesting and didn't even see that this morning and we were green today in the day and I wondered why we didn't hit over this area. Market was red into the clothes and that was part of it, but not really. So we'll see what we do, but tomorrow we should open right around here or here in ideal world. We'd open up here, here 95, 79. Well, that's one tick. So we've got a lot of time left and the reason I'm holding this is to get the second move. If you were in the option and you want to do the first quick move that I call in the trades in the rent room or in the ladder, then you just take it out of the first wheel. This is huge volatility. Went to the dream target, lots of money do it, but if I hadn't done this, I would have done it not out for as long as I did a month or more. So I want the second move and that's the one that's really going to get the going and there's many different targets, but the bottom line is that I just don't see the stock breaking 95. In ideal world, the stock does not break 95 holds, holds in every day, but it trades between now and the time that it goes and the worst day was yesterday and I don't think we see that again and I was still leaving up money in it yesterday. This is, this is, I'm taking a risk, holding this for the next big move with a certain money, the absolute sure money, the definite money was the day that it actually ran up and went the day after I took it in the option because I took the option here. But sometimes and every once in a while and you don't do this every single trade and you just don't, not every single trade is the same, not every gap is created equal, not every gap rates the same. That's why I have a 26 point system and the gap has to rate 20 points and more so there's a six point cushion. So highly rated gaps that rate higher than others or better quality gaps to warrant holding to better bigger targets or dream targets or with more risk. In the case of this I kept my same risk but I am holding this to a bigger target for the secondary move. So in an ideal world the stock actually has another gap up for a real reason, news generated or whatever it happens to be and in an ideal world it actually does the gap at 98 or 99 or even over 100 and runs. I'm not saying that's going to happen tomorrow at all but I'm saying it could trade, trade, trade, trade, trade up and then all of a sudden one morning gap up. Gap up to this area right about here and just go, go, go, go, go, go and that would be amazing and everyone in the world would bind this over 100 and more institutional money that even bought the gap. And I have so much conviction in the fact that really the gap itself, the gap that had the earnings gap which was back here, even it was right on the day was really a great place to go along and that's why I went along the optional and stayed and I did the call and it paid immediately huge. I just am holding it to the next movement but it's just the point that this is a corrective gap. So the stock was not in an uptrend until this day and on that day the stock became an immediate uptrend, institutions were buying it and this is why it's going to continue. So I got three weeks left, we'll see where it goes. Hang on to your skirts everybody. If this is a good one, again not all gaps are created equal. That's why if you actually, actually, actually learn the system, you will be able to decide, I call it perfect and not perfect. In fact, I'm coming out with a scale. I have to do the video soon. I'm coming out with a stock swish scale. I'm going to be using for the television show. It's a swish scale that everyone is going to see and it's going to be on the show and I'm going to say the different scales. This would be on the stock swish scale of five swooshes. I can't wait to tell everybody about this but it would be five swooshes. This would be a five swoosh. So you would have seen this on the show, on the television show that's coming out soon. I would have said five swooshes. Five swooshes is perfect. So perfect means perfect. Hold it to the dream target which it went to as a day train. Longer term train, dream target too. So this would have been a five swoosh point scale system. Perfect. And that's why I'm in it. And the day that I took it actually before it even did this. I'll just go back one more thing. I'll everybody go this thing here on the day that I took it and I said I am not getting out of this train till hits over 100. That's my target. I'm not getting out of it till hits over there. That's why I bought it out for so long, which I normally don't do. But I went to get myself the time and I paid out for it. I said I'm not getting out of this to 100 or more and that's it. And so I'm following my training plan and I'm doing it. And we'll see what happens. So good luck everyone. Good luck. Email me at melissathestoxwush.com if you want more information. If you're in Baba still with me. This isn't doing anything wrong. It's perfect. Beautiful, beautiful. Just notice that we actually did not gap up today. So it's fine the way it closed. Everything looks good. Neutral a gap up tomorrow in the open probably most likely we'll see. And we'll see where we go. Have a good night everyone. Email me at melissathestoxwush.com if you want more information.


Hi friends, welcome to my channel and welcome if you're new here. My name is Jen. I'm a certified weight loss and nutrition coach And I'm on the WW or the Weight Watchers blue plan. Happy Monday. It's another meal prep day I have three fantastic recipes for you and I mean absolutely Delicious breakfast lunch and a sweet treat that I know a lot of you have been waiting for So if you're excited for another meal prep give this video a big huge thumbs up And don't forget if you're new or you haven't yet subscribed to my channel I'd love to have you here hit the subscribe button and don't forget to ring the bell next to it So you never miss a single a video. I do upload a meal prep every single Monday So you're always getting new healthy WW low calorie recipes, so definitely make sure you're subscribed check out the description box down below for all of the recipes They are on my recipe website. I will link that at the very top of the description box I also offer nutrition coaching where I personalize your macros and calories to help you reach your goals Absolutely number one essential important to know your macros and calories and then I offer one-on-one coaching as well Also, you'll find links discounts to all of the products that I shared with you today As well as all of my other favorite things and last but certainly not least you're going to find my Facebook group head on Over and join us there. It's such a great wonderful supportive community. We'd love to have you be part of it as well So let's jump into this week's meal prep for my breakfast this week. I am making apple coffee cake I've been craving coffee cake and this is a really low-point option I'm going to pair this with some eggs, so it'll be a really well-rounded breakfast So to make the coffee cake you are going to need one egg Baking powder baking soda pecans if you would like now, I'm adding pecans to mine I will give you points with or without pecans It really doesn't save much in points and I think that that crunch will be a nice addition So these are just some chopped pecan pieces from nut stop I will link them down below with 10% off for you guys not an affiliate link Just get you 10% off if you want to support them as you guys know I've been using their products for a long time Affordable and they have tons and tons of options. So I'm going to use their chopped pecans some granny Smith apples vanilla extract cinnamon salt Brown sugar alternative. This is the Lakonto I will also link Lakonto down below with a discount You can order anything off their website with the discount. So that's really nice to have handy You'll also need some all-purpose flour rolled oats non-fat Greek yogurt and light butter the first thing we're going to do is make up these streusel topping for the coffee cake So in my bowl here, I have a quarter cup of all-purpose flour I'm going to add one quarter cup of rolled oats One quarter cup of the light butter a quarter cup chopped pecans a quarter cup of the Lakonto brown sugar One half of a teaspoon of a baking powder. This is a quarter teaspoon. So I'm going to add two and Then a teaspoon of cinnamon I'm just going to eyeball that and then take a fork or your hands and mix that together Until it resembles a crumbly texture. So here is the streusel topping this smells Incredible. So let's get started on the coffee cake. I'm going to wash peel and dice up four small granny Smith apples. So here are my four small chopped up granny Smith apples to that I'm going to add one large egg One cup of all-purpose flour One quarter cup of light butter three-quarter cup of the Lakonto brown sugar half of a teaspoon of baking soda again This is a quarter. So I'm going to put into Cinnamon a pinch of salt a teaspoon of vanilla extract and one half of a cup of a non-fat Greek yogurt With your handheld mixer, we're going to mix this until everything is mixed together and it's nice and fluffy I have about an 8x8 baking dish that I sprayed with some non-stick cooking spray. Look how good this looks We're going to add the batter to the baking dish Then we're going to top it with the streusel We're going into a 350 degree oven for about 35 to 40 minutes or until it is baked through But this already looks absolutely delicious I just pulled the apple coffee cake out of the oven my house smells like a bakery, which is super exciting I am going to allow this to cool for a little bit. We'll cut it into slices I'll show you serving size and give you points and calories So I went ahead and cut the coffee cake into nine servings. Who else takes the piece right out of the middle? So it makes nine servings total. Here's the slice of the coffee cake It looks really really delicious and that is a good size slice for breakfast Like I mentioned, I'm planning on just pairing it with some eggs Maybe some fruit. So let's go over points and calories. So as prepared with the pecans It is only four points per slice on both the blue and green plan and three points on purple because you don't have to Count for the oats. Now if you skipped the pecans, you would save one point So it'd be three points on blue and green and two on the purple plan 162 calories with the pecans. So again, I'm excited for this It's a little bit of a decadent breakfast But you can make it a nice healthy well-rounded one by adding a little bit of protein and maybe some fruit I'm making shrimp tacos. I have been wanting to make shrimp tacos for a very long time So I'm excited for these all week long for lunch. So of course, we're going to need some shrimp. This is my favorite This is the private selection brand. This is a Kroger brand Fred Meyer brand I'm going to use the Argentinian red shrimp. You're also going to need some cilantro Now the original recipe calls for corn tortillas and like I mentioned in my grocery haul I tried to find the mission extra thin corn tortillas and Walmart didn't have any So instead of having two or three corn tortilla tacos, I'm just going to make one Soft taco shrimp. So that way I'm having one tortilla per day if that makes sense Also some cabbage a fresh lime lots of seasonings cumin paprika Garlic powder onion powder chili powder Minced garlic. This is avocado oil white vinegar 0% Greek yogurt and a coarse salt. So let's get started making some shrimp tacos We're going to add the juiced lime one tablespoon of oil Avocado oils what I have a teaspoon of ground cumin a teaspoon of smoked paprika and a teaspoon of chili powder and Then we're going to seal that Ziploc bag up and give it a good shake We want to make sure the shrimp gets coated in the lime juice oil and seasonings I'm just going to toss my shrimp in the refrigerator while we put together at the sauce for the sauce You'll need a small blender fruit processor. I'm going to use my magic bullet This is actually the perfect size to blend up all of the sauce ingredients So to that I'm going to add three quarters of a cup of non-fat Greek yogurt two tablespoons of white vinegar an eighth Of a cup of avocado oil about a half of a teaspoon of coarse ground salt One quarter cup of the chopped cilantro quarter teaspoon of onion powder about a clove of minced garlic We're going to blend this up until smooth that way we have a nice sauce for the tacos Look how good this looks it smells so good. So I'm going to pull out the coleslaw We're going to mix the sauce in with the coleslaw to a bowl. I'm going to add my bag of coleslaw We want about two cups. This is a nine ounce bag So that's going to be pretty close to two cups and then we're going to add the sauce and Stir that until the coleslaw is coated We're going to go ahead and cook our shrimp just until it's cooked through It should only take a couple of minutes once it's cooked through. We're just going to remove it from the heat So the shrimp is done the package says it makes four servings six shrimp per serving That's perfect because my shrimp taco recipe is also for servings. So these are nice and cool So I'm going to show you how to put together the shrimp tacos So the first thing I'm going to do is add some of the coleslaw now that big batch of coleslaw Only makes four servings So you really want to load up that shrimp taco with that coleslaw mix and then we're going to add six shrimp It is six shrimp per taco and then I'm just going to top mine with a couple of leaves of cilantro I really like cilantro. You can definitely skip this part You can add really any topping you want to these shrimp tacos Avocados pico de gallo you could do cheese. You can also do the chopped Cilantro like I am that coleslaw is nice and creamy So I think that's going to add enough texture and flavor to the tacos, but this looks Absolutely delicious. So I'm going to package up the leftover coleslaw and the leftover shrimp for the rest of the week And then we'll go over points and calories So let's go over points and calories for the shrimp tacos now This is using the La Bandarita Tortillas if you used a higher point or higher calorie tortilla You would definitely want to refigure your points, but as mine sits here. It is three points That's it for the entire shrimp taco on all three plans 234 calories and this looks so delicious. I don't know what I'll pair with this Maybe some chips and salsa. I'm thinking I'm going to add avocado to it But you can really like I said at any toppings you want, but shrimp tacos is what's for lunch for a sweet treat this week I'm making snickerdoodle bars. I'm excited for these. I love snickerdoodle cookies. Wait until you hear the points on these bars They are Incredible for such a sweet treat. So for the bars, you're going to need some all-purpose flour Sweetener alternative of your choice. This is the loconto monk fruit. It's my go-to. It's my favorite one As always loconto is linked down below with a discount for you light butter eggs Vanilla extract cinnamon sugar blend or you can do some Monk fruit and some cinnamon and make your own cinnamon sugar blend I'm just going to use this because I have it on hand some cream of tartar and some salt So let's make some snickerdoodle bars So to start the snickerdoodle bars were mixing all of our ingredients together Other than the cinnamon and sugar. So first I have two and three-quarter cup of all-purpose flour two teaspoons of vanilla extract One and a half teaspoons of cream of tartar I had to put it in a bowl because my little measuring spoon does not fit into this tiny jar quarter teaspoon of salt one and a half cups of the loconto monk fruit sweetener one cup of room temperature Light butter and two eggs. We're going to cream this together with a handheld mixer We're going to lightly grease a nine by 13 baking dish and then we're going to add the mixture and press it into the bottom of the baking dish with our hands until we form a crust and Then we're going to sprinkle the cinnamon and sugar mixture right on top We're going to bake for 22 to 26 minutes at 350 degrees Make sure not to over bake these so we're going to watch them insert a toothpick until it comes out clean Snickerdoodle bars are out of the oven. Oh my gosh, they smell so Good, I'm going to let them cool again for a few minutes. We'll cut them into servings. The pan makes 24 Snickerdoodle bars and then I'll share points and calories So here are the snickerdoodle bars. Just don't forget the baking soda in your bars They taste really good. I did try them Mine just ended up being as you can see just a little bit more dense because I didn't add that leavening agent But they still taste absolutely incredible So you can see the size of the bar is a pretty good size These are only two points per snickerdoodle bar. That's it 78 calories per bar Super doable to work into your day a perfect sweet treat 2.78 calories You can't beat it and again the batch made 24 bars. Thank you for joining me for another weekly Ww meal prep. I hope you are as excited about these three recipes as I am I can't wait to eat this all week long. I'm actually looking forward to breakfast lunch and a sweet treat So if you enjoyed this video, give it a big huge thumbs up and don't forget if you're new or you haven't yet subscribed I'd love to have you here hit the subscribe button and ring the bell next to it So you never miss a single video Don't forget to check out the description box for my recipe website nutrition coaching links and discounts to my favorite things and of course my facebook group Thank you so much for hanging out with me today. Happy monday. Have a wonderful week and i'll see you all in my next video Bye


Well, good afternoon everybody. It's my favorite stage of all the fireside stage kind of cozy. It's beautiful Isn't it? It just makes me feel like I've finally arrived in Helsinki when I see this in front of me It's amazing to be here. I'd love to just for the first couple of minutes Let Stephanie and James really tell you a little bit more about what they do so that you've got a better understanding of that And then we'll we'll start digging into the questions and speaking of questions Make sure that you have the Slido app open I'm hoping that this session in particular is going to cause quite a few interesting questions So we're gonna look forward to that Stephanie tell everybody what what you do Sure, so I'm Stephanie Ellis. I'm a co-founder of mystery vibe. We design developed manufacture and sell luxury pleasure products So smart vibrators So yeah, and I also I consider myself a sex futurist I do a lot of research into what's gonna happen in the future when it comes to sex technology and intimacy And I also host a podcast called the curious nature of sex where we talk about all kinds of topics Including sex robots fantastic and James. Why don't you tell everybody about itself? Yeah? I basically have begun a journey of exploring my personal potential Physical relationship with technology in the future in terms of kind of augmenting my body with this kind of canvas I have from my missing limbs and that led me to Be in contact with the BBC and since I met them I've been exploring also the kind of emotional level that humans can interact with technology and And that's led me to that can robots love us film and I kind of look to the ways that Technology can maybe fill in the gaps in some of the ways that humans aren't providing for each other in modern society Potentially so we explore that from like mental health to sex to companionship and stuff like that Fantastic, I mean, let's let's talk about that for a moment So, you know, we're obviously at a moment in time where the technology itself has as caught up to the point where we can now build sex robots and We have artificially intelligent sex robot called harmony that's just been launched Inexplicably has a Scottish accent. I can't quite figure out why It talks dirty to you in Scottish Not sure about the design decision there Of course, we have other robots that are making the headlines all the time Sophia is the first citizen of Saudi Arabia first robot citizen It's you know, where are we with the technology? How much further can we go? What's possible right now? And what does the future look like? It's super simple right now. I don't think we'll have a fully functioning robot that can Fulfill every desire that you have for quite a long time In fact, the only thing it really hurts at the moment is your wallet because they cost a lot of money But I think in the future, it's quite interesting for me because we talk about sex robots as if that's all they're gonna do Whereas I think what will actually happen is we will build robots who can fulfill many different tasks needs Whatever and having sex might be just a small part of what they do But we always focus on the sex because it's the most controversial. I don't know Do you think that's kind of a driver for the technology advancement though? because often we find that sex drives so much change in our society and especially I've heard from The people that I've met in the film that there's so much money behind it people move from jobs in tech with like deep mind and IBM and just go and work on trying to create a more advanced sex robot Just for the wages. Yeah, no, I kind of see it the other way around I think porn has been very much a driver of technology in the past but in terms of hardware We've actually been lagging behind for a number of years So, yeah, I don't know maybe yeah, perhaps, but I Feel like when we're thinking about robotics There are so many exciting things that we can talk about but everyone always focuses on the sex Yeah, I mean, it's quite difficult because we don't for example have bipedal robots already in the home assisting with with anything and to imagine that then we suddenly have robots that can do sexual relationships with people It's gonna take a while. Yeah, it seems crazy. I mean, that's a that's a really good point I mean, we've been talking about robots for a very very long time Consumer robots that are gonna help you with all of the chores in your house. I mean, I remember You know advertisements that were shown. Well, I don't remember them. I wasn't alive, but you know shown in the 1960s and They were shown this wonderful house of the future where there are robots running around all the time doing things for you We're not even there yet. We don't even have consumer robots So what chances are there that we're gonna end up with with sex bots even in the next 20 years that are reasonable I think one of the interesting Aspects as well as that when I say the word sex robot I'm sure for many people sitting out in the audience the thing that you picture will be a woman Probably a slim white woman because that's what media is showing us in film across news Like for example with harmony as well But I think when we're talking about robotics in this space We don't have to talk about one something that is human to something that is gendered There are already some really interesting robotics being developed that have That have no gender and no kind of physical form as a human at all There's one guy out of the US who's developing for example robots that Help elderly people who are alone or can like stroke you in your hospital bed when you're when you're unwell So I yeah, I I think another myth to bust is that sex robots are gonna be a human shapes to Gendered why do they need to be do you think it do they need to be because of our history our evolutionary history of growing up and Having sex with each other we don't tend to have sex with other animals and creatures I think we are starting to move beyond that I mean if you look at the sex toy industry for example years and years ago if you walked into a store or you'd be able to find our Dildos a vibrator shape like innocence landscape powers now Actually, the majority of developments and things coming out aren't shaped like that at all. They're much more economic They're very beautiful to look at they you could leave them on a fire side and no one would know what they were Maybe not on the fire. That's probably But I'm on the bedside table and people wouldn't recognize it straight off. So I think we're kind of going beyond Gender and phallic shaped objects. Is that because those things are Sex toys and their tools, but if we talk about sex robots, is it they want to kind of not just be doing this one task where they're just vibrating in a certain pattern, but they kind of We want to imbue them with qualities of humanity and give them kind of the ability to direct their own behavior And therefore kind of be mysterious and in that sense if we Create a humanoid robot. Do we miss out on all of the subtleties of what a human can do and is that needed? Do you think that's needed if there's a robot that we make that's like a big purple blob that has various ways to interact with you I'm sure someone would enjoy that. So we don't have to do it for everyone Everyone has different likes different dislikes different kinks different fetishes. Um, so to create something that is so narrowly Minded and I think actually it's interesting that when you first said I think one of those changes was the fact that you had More women joining the sex toy industry and that really pushed the design of new types of products So, yeah, I'd love to see more women developing robotics in this space as well Do you in your experience? Do you think it's like a narrow-minded male gaze then that we're just going yeah Well, this is what we want only that at the moment. Uh, at the moment, yeah I quite like the idea of a purple blob, you know, for somebody who's got a fetish for Barney the dinosaur I'm sure there's someone out there. There must be somebody So, I mean to talking about that interaction piece Big in the news for the whole of this year every single week. We've been talking about artificial intelligence artificial intelligence aligned with you know conversational user interfaces like You know Alexa and Siri and Google assistant natural language processing natural language Understanding that understands context and can actually interact with you in a proper way now, you know How is that going to impact the the sex industry as we move towards sex robots and any other type of sex Toys in terms of providing maybe that almost human interaction that is currently being used in customer services But you know could be adjusted and used for for the sex industry, right?  How's that gonna work are we gonna use AI in that way I think it well it already is I mean the guys who are building harmony are trying to put artificial intelligence behind her I guess some of the very interesting questions that we that we come across There are so many ethical questions I think at what point do we consider some kind of robot a conscious being at what point does it need to consent? Who owns the data around it? Or for example, if you and a partner owned one who owns the data if you break up There are a whole bunch of interesting questions that we could start asking That we're just not talking about now. Well, I don't mean now because we're talking about it now But society is not talking about But yeah, absolutely artificial intelligence will play a big role in pushing forward robotics and sex robotics I mean, that's that's an interesting point right now We can actually customize advertisements to you based on your Fitbit public profile Are we gonna have advertisements being customized to your your sexual performance profile? Well, it's interesting you say that as there's in the UK There's a bill going through parliament called the digital economy bill and it's gonna bring in something called age verification So I think it's from April next year in the UK if you visit any porn site at all Be it free be it page You're gonna have to verify your age and the majority or the way they think they're gonna do at the moment is through credit card details So you'll have to create an account with your credit card details And it's gonna give one company which currently owns the majority of free and tube sites a lot of information about what? You're searching for what you're watching how long you watch it for which bits you watch Even where you're from quite specifically said that kind of data collection is already kind of happening And we're gonna have to be very very responsible with the way that we use that data obviously and what happens in the UK I think we'll set a precedent which unfortunately It's not a good thing But yeah Yeah, well, how do you feel about data collection? How do you feel about AI and you know what that could mean for the future of this? Um When I think about interacting with AI today If we can call the AI it's kind of very To me you're frustrating limited even if I go home and ask Alexa to turn on the lights She doesn't always get it right so to get the level of complexity where you've actually forming companionship with a robot and Having sort of I think the goal that people want is to have like a meaningful connection with these sex robots So I don't know how long that is going to take because that's the surrounding technologies away from sex I'll just not good enough. I feel like the sex robots that we see today That's it's kind of like we've seen the sign that the ball is rolling, but they kind of feel like Kind of if you think of a The the ideal sex robot as being like a Boeing 747 something that's like polished up and has all I don't know miles and miles of wiring and complexities and systems I feel like what we have now is like a paper airplane because if they've just put the shape of something that does something You can put your penis in it. That's it I feel like that's the stage you're at and also between now between a paper airplane and a Boeing 747 You're gonna have a lot of like airplane crashes and lots of crashed by planes and probably are horrible repercussions, right? I mean you talk about you know making a meaningful connection if we look at say Japanese society They've been making meaningful connections with technology for a while through video games and what they have That's led to it's very much a Culture where the kids are just not going out and meeting each other. They've become socially inept The you know birth rates have dropped massively You know, what do you think the sex robots are going to do in terms of that kind of future are we going to end up? basically just not meeting each other and Propagating potentially, I mean we kind of see if we just think about modern technology that already affects us and our relationships you can look at something like tinder and How that kind of changes the way that people behave with one another one another because they're just swiping past kind of in a gamified way maybe not even being there kind of being a fake self being not their best self and it's changed the way that kind of People are almost disposable because they're just it's an endless stream. So if sex robots come in and Initially if they have this female form, I feel like already that is quite dangerous because there's the potential that people are Maybe these reclusive people having sort of a one-sided relationship where they're taught that this robot just does what they want It just gives them what they want. It doesn't there's not a two-way process And I wonder really what that would do to someone if they Learned that that's how you interact with something that is humanoid. And so how will that change their behavior in the real world as well? I don't know It's an issue because me actually I kind of want to take a straw poll out of everyone sitting in the audience Who would have sex with a robot if I offered it to you today? If you have not very many Just think Clearly they're not popular But I think I think you bring up a really interesting point around intimacy as well And I'm interested in your take as well having spoken to people around the kind of mental health aspects Because I think when we when we talk about sex robots Very frequently we talk about it in the media as if it's just weird people for fulfilling weird fetishism weird kinks But actually I think they could really play an important role in in the kind of caring sense as well So you have for example a robot called paro which is a cuddly like seal toy that helps all people with dementia or You could use some kind of robotics for people who have some anxiety people who excluded from their community To kind of help them bridge towards more human connection. So in that way, I think robotics can help us kind of Reclaim some of our humanity almost Yeah, it's and by the way, you mentioned tinder for robots actually somebody who's calling themselves anonymous in the audience I hope that's because they don't want to give their real name and it's not the infamous hacking group They're asking is there a tinder for robot? Actually, I think there's a tinder for bots because most of the people that match with me are clearly not real There's a better question here. Do you think we can create robots that humans will really fall in love with and What are the implications for human kind then? I mean, how do you feel about that stuff? I think people empathize with their technology at the moment And actually that concept of love is it's one the question that comes up time and time again And you'll see it explored in like as anyone seen Westworld Great TV series if you haven't seen it I highly recommend watching this love concept always comes up and I think I don't see a problem with people falling in love With robots every question is kind of robots fall in love with you too, and they program to do that. Are they conscious? I mean, maybe it's just a forever unrequited love with robots hmm, I mean it also brings to My mind the fact that the population I mean maybe in some locations They feel like their populations aging they not have enough a high enough birthing rate Compared to the rest of the world So they feel like they're losing out potentially in the future as as a country But globally we are becoming overpopulated So what if sex robots are some strange creepy blessing that kind of shifts the way that humans Exist on this planet and like reduces our burden on the on the earth What if what if we strategically launched them in countries where they're needed? Yeah in very horny countries countries Nobody's ever said that in a panel discussion before you heard it here first so, you know What what is coming next? As far as you know, the entire industry is concerned because we we're clearly not At the sex bot stage. So let's talk about some of the products that are Available right now and the way that people are interacting with them and what's coming next just in the next year or so But might start taking us baby steps along the line to you know the full-bones sex robot experience It's an interesting one Because most of the products that at least within the kind of sexual accessories space All right, most of the products that are coming out at the moment or the the biggest growth space in the industry is for couples So I think we'll see more stuff coming out around around that I think there's some interesting things happening around for example, telly dildonics So the idea that you can have sex over distance some kind of haptic feedback And that's something that I'm I'm working on and releasing and over the next few months You'll also start to see I think more data-driven smart products So one of the things that we're really keen to do with our products is Start to use sensors to understand the body and once we can understand what turns you on we can curate a whole bunch of content For you and create a real experience So it could be your smart lighting your smart heating your Spotify Even like sensory in terms of smells is very important So I think you'll start to see a lot more data-driven products coming onto the market Especially as there is a pattern That will run out from the US that is to do with any internet connected sex product So as soon as that pattern runs out, I think Kind of middle of next day. You'll start to see a lot more interesting products surfacing like the question of Perceiving someone's physical state I find really interesting because if we got to a stage where technology advanced So much that if we did have a humanoid sex robot in our homes. I Think about something like the Microsoft connect camera that you can use to it can detect your heart rate through the kind of flushing of blood in your face Is there the potential that in the future we could have robots that are able to perceive So much about us just as we kind of walk into our home They can kind of tell how your day was and you they probably tapped into your phone They've seen all your conversations. You've sent the entire day.  I don't know. I think I think some people might prefer robot sex. Some people will prefer human sex. There'll be Differences and I want it diverse. So that's so valid and it like a lot of the discussion the media is like the sex robots are coming They're gonna ruin the world coming but right But essentially it's not for everyone is it we're not saying everyone has to have one. No, no, no And with all of this as well, you know, I worry about what happens when we've got to all of this data We have these connected devices like telly dildonics, for example, what happens when anonymous who's asking all questions here Goes and hacks into all of the devices around them. I mean is that a worry or we are we concerned about what happens when people hack into These devices. Yeah, I guess hacking is always a concern and I kind of say that in these days Nothing is unhackable. So it's all about the contingency that you place around how you store your data What data you store and the fact that it's anonymized So even if someone did hack into your data The most I'd get is a few like squiggly lines and graphs that doesn't really mean anything and isn't connected directly to you So yeah, I guess that's kind of how you go around the data point But yeah, it's it's definitely an interesting question and as products get smarter Guess the thing is that sex is still such a taboo topic if it wasn't as taboo in society Then we wouldn't be as worried about I mean Do you care if someone knows that you had a wank last Monday a robot wank or a normal one Would you mind I guess if society has less taboos around sex full-stop, which I think it will do over time Then people won't mind as much sharing the data and but the most important thing I always find is that you have to ask for consent consent in sex is the most important thing and it really needs to transfer to sex and Technology you have to make sure you have people's informed enthusiastic consent to give their data Which is why I'm concerned about things like the digital economy bill in the UK, which is pretty much going to force you to opt in Yeah, absolutely. Well everyone and a final word on that Joe I'm just thinking about like an Regenerated offline world of pornography Just nudie mags everywhere because no longer you have an ornament anonymity of online Yeah, yeah, it's weird. I mean creating closed loops that aren't linked to the cloud is one way of getting around kind of sharing data But yeah, maybe everyone will go back to porn max. That's over it. Well, you heard it here first We're gonna see a resurgence in porn max fantastic. Thank you so much to James and Stephanie It's been wonderful. Please give them a huge round of applause. Thank you


In-house councils like all legal professionals face a variety of ethical dilemmas and challenges. Here are some common ones and suggestions on how to deal with them. First, confidentiality. In-house councils often have access to sensitive company information, balancing the duty of confidentiality with the need to disclose information to prevent harm or uphold the law is a common ethical dilemma. How to deal? Well, in-house councils should be aware of the exceptions to confidentiality and have a clear understanding of when and how they can disclose information and what can and cannot be disclosed. Second, conflicts of interest. In-house councils might face conflicts between their duty to the company and personal interests or duty to other clients, especially if they were previously in private practice. How to deal? Establish clear conflict of interest policies within the legal department. In case of a potential conflict, disclose it immediately and seek guidance from a supervisor or an ethics committee. Transparency is key. Remember that. Third, ethical corporate governance. In-house councils often advise on corporate governance matters, balancing the interests of the company, its stakeholders and the law. It can be a challenging proposition. Now, how to deal? Stay updated on relevant laws and regulations. Advocate for ethical corporate practices within the organization and ensure legal compliance. Be willing to challenge unethical decisions, yes, and provide guidance on best practices. Four, pressure from management. Very important. In-house councils might face pressure from the management, CEO, CFO and MDs to provide legal advice that aligns with the company's interests and even if it might be ethically questionable. Now, how to deal? Uphold your professional integrity. If you face pressure to act unethically, document your concerns and, if necessary, escalate the issues to the higher management or the board of directors. In extreme cases, consider consulting external ethics advisors. Fifth, cultural and legal differences. Well, in-house councils working for MNCs, multinational companies might face dilemmas due to differing cultural norms and legal standards in various countries of operations. How to deal? Now, understand and respect cultural differences, but always prioritize compliance with the highest ethical and legal standards. Consult local legal experts when necessary and ensure the company's global policies align with the strictest applicable laws and ethical guidelines. Sixth, important, technology and data security. Yes, with the rise of technology, protecting client data and ensuring the ethical use of AI and other legal technologies is a growing concern. Now, how to deal? Well, stay informed about data protection laws, implement robust cybersecurity measures, understand the technology being used and ensure that it aligns with ethical guidelines. Regularly update skills to understand emerging tech-related ethical challenges. Seventh, balancing legal and business goals. Again, very important. Now, in-house councils are not just lawyers, but also strategic advisors to the business. Balancing legal requirements with the practical needs of the business can create ethical dilemmas. Now, how to deal with it? Well, communicate effectively with other departments. That's very important. Strive for a deep understanding or a deeper understanding of the business goals and work collaboratively to find legal solutions with regard to these objectives, staying abreast with ethical needs. Now, in all these situations which I just narrated, an ongoing legal education and commitment to ethical conduct are crucial for building a strong foundation within the legal department with regard to ethical compliances and navigating all the challenges connected therewith. Thank you so much. See you again.