Council and representatives of the realms and territories, Alderman and citizens of London and others, do now hereby, with one voice and consent of tongue and heart, publish and proclaim that the Prince Charles Philip Arthur George is now, by the death of our late sovereign of happy memory, become our only lawful and rightful liege Lord Charles the Third, by the grace of God, of the United Kingdom of an Ireland, and of his other realms and territories, King, head of the Commonwealth, defender of the faith, to whom we do acknowledge all faith and obedience with humble affection, beseeching God, by whom kings and queens do reign, to bless his majesty with long and happy years to reign over us. Given at St. James's Palace, this 10th day of September, in the year of our Lord, 2022. And let's cross now our live to London, where we're joined by FSN correspondent Jill Gibson. Thank you very much for your time. So many formalities, very strict protocols. Let's begin unpacking it all in terms of the events today. What else is expected, Bill Gibson? Well, of course, we're now in the social media age, aren't we? Partly the Queen's death was part... Can you hear me okay? Yes, yes, please go on. Well, as I was saying, we are now in the social media age, aren't we? The Queen's death was announced on the Royal Family's Twitter account, partly, but now we are still seeing these ancient ceremonies, all this pomp and ceremony that is so associated with the United Kingdom really now starting to take place. We've seen the Accession Council formally proclaiming... formally Prince Charles, now King Charles III. He didn't take part in that part of the ceremony, and then he arrived for the second part, which was the meeting of his privy council. The very first time that's happened, the privy council being a group of very senior politicians, former prime ministers, that kind of thing, who advised the head of state on matters of state. And I think we got a real reinforcement about this change that we are now seeing right in front of our eyes, because that group of senior politicians, the privy council, shouting, God save the king, of course, that has not been shouted in this country since 1952. Yes, definitely, in the end of an era, you know, all the cliches are very much applicable to describe the momentous events we're seeing today. What more can you tell us about the ceremony we're seeing now still underway? Is King Charles III still there? So he joined for the second part of this ceremony, the meeting of the privy council, and we saw him give a speech. We saw him, of course, on Friday, give his first speech as king to the nation, remembering in much of it his mother and talking about his grief and the grief of this entire country and really people around the world. Now we saw him speaking once again. He also referenced his mother in this speech. He said that he felt an irreparable loss about the death of his mother and Queen Elizabeth II. And then he talked about his sense of duty and this role that he is now taking on. He said he is deeply aware of this great inheritance. In terms of what happens next, well, King Charles will now be travelling around the United Kingdom, because, of course, so much of the pomp and ceremony, so many of these events have been taking place where I am in central London, but he is now king for people all over the United Kingdom. So he will now travel to Scotland as well as other parts of the country to visit the sort of different corners of the country that he is now king of, as of just a couple of days ago. FSN correspondent Jill Gibson for us in London. Thank you very much for this, and no doubt not much time for King Charles III to grief over his late mother's passing. Let's take a listen to the words of the king himself a short while ago. My mother gave an example of lifelong love and of selfless service. My mother's reign was unequaled in its duration, its dedication and its devotion. Even as we grieve, we give thanks for this most faithful life. I am deeply aware of this great inheritance and of the duties and heavy responsibilities of sovereignty which have now passed to me. In taking up these responsibilities, I shall strive to follow the inspiring example I have been set in upholding constitutional government and to seek the peace, harmony and prosperity of the peoples of these islands and of the comoros realms and territories throughout the world. In this purpose, I know that I shall be upheld by the affection and loyalty of the peoples whose sovereign I have been called upon to be and that in the discharge of these duties, I will be guided by the council of their elected parliaments. Yes, an event in London still underway and we will of course continue to bring you live images from the scene, but let's cross now live to our 24 News Europe correspondent Jonathan Sashadati. Jonathan, I hope you were able to get some sleep after those turbulent days there in the kingdom. As mentioned earlier, so many formalities, but the protocols are very clear cut. So let's go over the events planned for today, what we're seeing now and what is expected in the coming hours. That's right, Ellie. This is obviously a moment of intense grief for now King Charles, previously Prince Charles. King Charles III grieving the death of his mother, but of course the show must go on effectively and as soon as one monarch dies, the next one is in place. There is never no monarch, so he is now the king and we've seen that official declaration today. That's part one of the process, let's say he stayed overnight initially at Balmoral and then came down in the morning yesterday, came to see the public outside Buckingham Palace and received well wishes there, shaking hands for a good 10 to 12 minutes outside the palace before he went inside, perhaps showing that he wishes to start as he means to go on, which is to say in the mold of his mother as a servant leader, that's going to be an important part of how he paints his monarchy from now on. He's going to want people to give him the same level of support that they gave to his mother when she was monarch. And going forward, there are these 10 days of mourning, which will culminate in the state funeral. The precise date and plans for the funeral haven't yet been announced, but that is imminent. And what we're seeing now in this ceremony, seeing the firing of guns and the like, this is all historic, this is what happens to spread the word around the nations as the new king is acclaimed and the old queen is dead. And naturally the first time these ceremonies, long standing ceremonies are being televised live as we speak, the times are indeed changing. And speaking of, before we dive perhaps further into what is expected for the king, let's go back to Bill Morrill. The queen's casket is quite a journey, Jonathan, not directly back to London, right? Right, the casket will make its way really around the nation and there will be the opportunity eventually for lying in state in Westminster Hall in London. These arrangements are so that people from around the nations can come and pay their respects to Her Majesty the Queen. And that's all part of what's going on. In fact, that's why we'll see a gap between today's proceedings where King Charles was officially proclaimed the king and a coronation. Just as there was when the queen became the queen, there was quite a gap of some months between when she took to the throne and when the actual ceremony took place for the coronation. The same will be true with King Charles III. But in the meantime, there is this important business of mourning for the family and for the country. And that will also see King Charles touring the nations as well. He goes on an extended visit really from not just London. He will visit all the different nations so that he can be proclaimed king in all of them and recognized in that way. And really, I think this is showing the continuity that is in place with a constitutional monarchy like this. It's gone on for a very long time that Queen Elizabeth was the queen, the longest time in history, but it does pass on. And now that she's gone, this is all a process that nobody can really remember seeing before. It's been so long that she was on the throne. Right, right. And now perhaps the most evident motif, if you will, and the two speeches that we've heard from the king in the past 24 hours or so was this attempt to demonstrate a sense of reassurance to the British public and the citizens of the world, if I may. Let's do talk the funeral a bit, Jonathan. So we don't know the when, but we do know the what, perhaps, what will, what are we to expect, rather? And do we know of any foreign leaders already confirming their pending attendance? Well, I think we can expect to see foreign leaders from around the world. We have heard that Joe Biden, for example, will be there, that's been confirmed. And it will be an enormous state funeral, the like of which none of us will have seen. Prime Ministers get state funerals too. It will perhaps be the biggest since Winston Churchill, no doubt bigger. The death of a monarch is something again that has not happened for over 70 years. So it will be quite spectacular to watch and certainly it will be watched from around the whole world. It would have been planned for decades in advance. I mean, the Queen was 96 years old when she passed away. So every detail of it is something that's been prepared and planned for. And those plans have even been leaked in the past and published in the press, Operation London Bridges Down. The fact that she also died in Scotland will mean there'll be elements of Operation Unicorn, as it was known, which is for planning what to do when the Queen might have passed away as she did eventually in Scotland. And we'll see much what you're seeing now on screen, but just times 100. The ceremony is one of passing over the monarchy to somebody else and saying goodbye to the old monarch. And therefore it will involve the military and ceremony and all of the things that Britain is so well known for in these moments. And just as Britain celebrates royal weddings in quite spectacular style, and those are watched around the world, this funeral will be even more so. I think it will be a once in a lifetime, once in a generation piece of history that the British people will watch from wherever they are. Yes. Glutus screams perhaps an understatement in describing what we're likely to see there. And obviously, as mentioned, Jonathan, her passing resonates around the world here in Israel as well. Before we talk about the potential ramifications, let's take a listen to the British ambassador and his take on relations between the Queen and Israel. It is a very sad day for the British people. I think we all feel very personally attached to the Queen. I've met the Queen myself several times and I serve formally as her ambassador. So it's a sad day for me personally. But we have been very moved by how many Israelis from the president and the prime minister to friends and neighbors who've expressed sympathy and condolences and said how much the Queen meant to them as well. So that's at least something that gives us support at a difficult time. The royal family has a strong attachment to Israel. King Charles, as he now is, came to Israel two years ago to the event at Yad Vashem and he received President Herzog in Britain last year. So there's a strong link between Israel and the royal family and that will continue. So Jonathan, let's talk relations with Israel. Obviously not a political figure, but the Queen never visited here despite a warm sentiment to an extent and did visit in Jordan and Egypt and elsewhere in the region. How do you explain that? Yes, Ali, that's absolutely right. The Queen visited most nations of the world, certainly very many in the Middle East including dictatorships. And yet she never did visit Israel, which is notable, especially for the Jewish community. They say that that was not down to her personal preference, but down to the foreign office, which dictates where the monarch should go and visit. And that traditionally and historically, they didn't think it would be a good idea because it might anger Israel's Arab neighbors who were allies of the United Kingdom. Of course, things have changed quite a lot in recent years and decades, but still we never saw that visit coming, even though there were of course, people trying to push for it in the past. Lord Pollack spoke about it in the House of Lords just yesterday when he was remembering Her Majesty the Queen and how Prince Anne had once said to him that it was something that the royal family would be willing to do. But of course that never came about. We did see Prince William conducting the first official royal visit to Israel just a few years ago. Of course, we covered it here on I-24 News and we have seen Prince Charles go there not necessarily on official state visits but also for other reasons like funerals and also there is of course, a royal family member buried in Israel and she is known as having helped Jews to survive during the war and is one of the righteous among the nations. So maybe we will see King Charles III at some point making an official visit to Israel. We'll have to wait and see if that's on the agenda sometime down the line. We do know that Prince King Charles III is holding, maintaining very close ties with the Jewish community in Britain have a very clear cut take or policy when it comes to Bedia. So definitely interesting in this respect to wait and see how things unfold there. And generally speaking, Jonathan, how will it affect the Commonwealth? Well, King Charles has already been decided to have been the next leader of the Commonwealth. That's not necessarily done in the same way as the decision of who follows as monarch in the United Kingdom. But that was something that was decided upon by the Commonwealth. And so that's taking place now as well as we speak and that will therefore be quite a smooth transition too. And I think what we're seeing today in today's ceremony as well in the United Kingdom is just symbolic of the history of all of this. Once upon a time, it wasn't necessarily given that it was a smooth transition. The history of the United Kingdom shows that. So a lot of the remnants of those previous tensions are still there in the procedures of today. And that's why we see things like him reading out the declaration about the Church of Scotland. This is in order to make sure that the Church of Scotland aren't in any way threatened by the new monarch who is the leader of the Church of England. And so all of these complicated features are reflected in the proceedings and the legal proceedings and the various different forms and statements that were signed today. And the same is true for the Commonwealth. But I think for this time we'll see that he is welcomed as the leader of the Commonwealth going forwards. Okay, Jonathan Sashadadi for us in London. We will obviously get back to you throughout today closely keeping tabs of all the events currently underway. Thank you very much, Jonathan Sashadadi in London. And now let's take a deeper look into the... I don't think there are any titles that can describe truly the life, extraordinary life and service of the later Queen Elizabeth. Let's take a look. December 1936, a moment that forever shaped a young girl's life. After ruling less than a year, King Edward VIII abdicated the throne to his brother. A new reign began in Britain as the Duke of York was crowned King George VI. Making King George's eldest daughter, then Princess Elizabeth, known as Lilibet to family, next in line to the throne. 10 years later, marked a marriage. The couple would go on to have four children. In 1953, Queen Elizabeth II was crowned, the first to be broadcast live on television.  The Queen kept a busy schedule of diplomatic duties, traveling across the globe more widely than any other monarch before her, meeting with just about every US president since being crowned. With no political power, the Queen wielded the influence of a figurehead. In her private life, things weren't always easy. Her 40th anniversary on the throne, marred by separation, divorce and estrangement in her children's marriages. This is it from the I-24 Newsdesk. For now, we'll be back with more throughout the day.


I'll take a five minute break just let us know. But in any case, welcome everyone to our Schubert seminar. Today we have Juliana Tomasco from Smith College who's going to talk about which has some varieties are you can. All right, thank you. So I've sort of taken, I took you at your word about creating a talk that was accessible to graduate students, even a sort of wide range of graduate students. So, so that's how we're going to start. And here's the basic plan. First, I'm going to talk about what our Hessemberg varieties, what is the GKM approach, and really why our Hessemberg varieties. So then we're going to take a break. And, and come back and talk both about tourist actions on Hessemberg varieties, and this sort of question, which Hessemberg varieties are GKM, which at that point will be, it will be natural to sort of think about that question really as a partial list of which Nelfoten-Tessenberg varieties are GKM. So, let's see, I'm going to start. I'm going to start. I didn't know Bill would be here today. So, I feel like a postdoc again. So I'm going to start by situating Hessemberg varieties and situating them very concretely. So they are sub varieties of the flag variety. And for me, for today, everything is in GLN. So like everything that I draw will be in C3 actually. So a flag is, you know, a line that contains the origin that is contained in a plane that is contained in a three-dimensional space. I can think of it as a vector contained in a choice of a vector that spans the line that I then add another linearly independent vector to span the plane that I then add another linearly independent vector to span the three-dimensional space. And of course, this is, well, so this is fully accurate, but somewhat inconvenient because it is, it leads to a lot of redundancy in the choice of spanning vectors at each stage. So motivated by this sort of desire to pick some unique representative, I would basically do Gaussian elimination. And so like on the line, I would pick, depending on your conventions, you can pick a different way, but I personally would choose to rescale the line so that the lowest non-zero entry is actually one. So in this case, just dividing that vector by two. And once I've done that, once again I have a lot of redundancy in my choice of the plane, because actually not only, I mean I really need to Gaussian eliminate, not only can I rescale my second vector, but I really want to sort of eliminate the all these sort of appearances of the first vector in the second vector. So subtract off, so that the lowest non-zero entry that I had in my first vector, so that entry is now zero. And then I would have, I think if I just subtracted, if I have not done anything wrong, if I just subtracted, I had to have this vector zero two two and then I rescale and get zero one one. So I keep doing this process, all the way through, coming up with some sort of more unique-ish set of representatives based on whatever sort of conventions I decided to pick at the outset, in terms of which entry I'm going to normalize and so on. So, great. So I can make this more concise just simply by stacking up all of these vectors into one matrix and just sort of summarized by choosing good representatives for the flags, partitions flags into sugar cells. So, for our purposes, we will think about our sugar cells as a permutation matrix with free entries above and to the left of the pivots and zero everywhere else. And if I wanted to sort of think more intrinsically about what's happening, I am picking coset representatives for double cosets of the general linear group. I imagine taking double cosets with respect to the Borel subgroup of upper triangular matrices. So the permutation matrix that shows up in the middle is the pivots of the entry when I'm doing Gaussian elimination. And it's always also just this sort of index set of this double coset. That's where Heisenberg varieties are. So to think about what Heisenberg varieties are, I'm actually going to start with a thing that is not completely, it is a Heisenberg variety, but it is not all Heisenberg varieties. So I want to just start by picking an n by n matrix. And the thing in blue is the one that we're just going to start with. And we're going to ask the question, when does X preserve a flag in the sense that X sends the part of the flag into the right part of the flag for all I. So the way for this entire talk, the way we're going to really approach this is the idea that we're going to test it on individual Schubert cells. So in other words, we're going to take X, that's the matrix on the far left there. And we're just going to multiply it against a Schubert cell. Yeah, there's there's a Schubert cell, the one that we were kind of identifying before. And so I could do some matrix multiplication, I did the matrix multiplication ahead of time. There it is. And what it means in this sense for X to send the part of the flag into the part of the flag is the following. Right, so I need this first vector. So this first vector 01 a should be a multiple of the first vector here. So that's X sends V1 into V1. And then I need the second vector. So then I know that the first vector is contained in the span of the first vector in order to make it so that the span of the first two vectors is contained in the span of the first two vectors. I just need to add the condition that the second vector is in the span of these first two vectors here. So, so you think of this as a sequence of, or this is a sequence of just vector equations where I've got a particular vector I want to ensure it's in the span of one vectors another vector that I just test to see if it's in the span of two vectors, and so on, and so forth. So like, in this case, actually we can furthermore look at this first column and look at that orange vector that I marked out. All right, so the, the first column on the right hand side there 01 a is in fact not a multiple of of one AB, because the pivots are just like in the wrong place. So, so here, like, not true here. So that x vi is contained in vi. In fact, it's a perfectly fine exercise to go through this process. And I sort of feel like if I had graduate students here, I would ask them to try to find me a shoe itself. Which any part of the shoe itself satisfies this condition that x vi is contained in vi. It's a small calculation, right. So, this particular variety that we're looking at is called the Springer fiber. Some people would call it Springer growth and deep fiber if you use, say, an arbitrary matrix X on and like there's a quite literal sense in which the line. This is the line of the Springer fiber when X. So the line of the Springer fiber is satisfying the condition that X V1 is contained in V1. In other words, it is giving you an eigenvector of X. The Springer fiber itself is on some level giving you this eigen flag of X. It's a fairly restrictive condition, especially with the X, the choice of X that we started with there. But there's a lot of different kinds of both combinatorics and interesting geometry of various sorts. I suppose if I have extra time, you could stop me and ask more about that. But for now, I'd like to move on to saying what Hessenberg varieties are. And to start with, actually, I'm just going to go and give you exactly the same slide that we had before. But what I would like to do, I'm still going to pick this end by end matrix X. So instead of asking whether X preserves the flag, sending VI to VI, I am going to actually broaden this condition. I'm going to say that X sends VI into the H of I where. So I still want it to satisfy the sort of flaggy conditions. So H is going to be some function on the indices. I'm going to ask that H of I be both greater than or equal to H of I minus one. And greater than or equal to I. So that first condition is sort of like a non decreasing condition. Since my flags already have the property that VI is contained in the I plus any dimension. So I sort of really do want my function H of I to have a condition like that. That second condition that H of I greater than or equal to I will. We can see that we can revisit that in a moment or two and we'll have to revisit it a little bit later on. But that second condition is something that you really could get rid of and some interesting things happen when you get rid of. We're just not going to today. If we do this, I'm going to pick a specific, a specific function. All right, so we're going to take H of I equals I plus one. And H of three equals three. So, so we're going to test on this specific Schubert cell, this specific set of containment conditions. So here, we're asking does X send the I part of the flag into the I plus first part of the flag. And let's just sort of go through what it's saying. I for each of the vectors. So on the right hand side, we have X times the different spanning vectors for the flag. So what we want is for this. The first column to be in the span of the first two columns of the flag itself. And then we're going to want the second column to be in the span of the first three columns. I'm just going to observe right now those couple three columns span all of C three. And in particular, I actually see the vector 001 right in there. So that second condition is just sort of vacuously satisfied. So what about the first condition is the vector 01 a contained in the span of those two orange vectors. I'm going to pause for a second. And pause actually and just sort of wait for any sort of comment here, including to the very specific question of is the vector 01 a in the span of those two column sectors circled in lunch. So for me. I'm going to use this sort of nightly just when you're algebra Lee check whether a vector like this is in the span of these two. First by sort of noting that any multiple of the vector one a B is going to produce some non zero entry in the bottom row, which would not produce a zero in the bottom row on the left hand side. Unless I were actually taking a zero multiple of that first column one a B. And then I then I would say okay 01 a is in the span of 01 C. If and only if a equal C. So on the one hand, I'd like strictly relaxed the conditions from the springer fiber, I've like expanded the number of flags that satisfy the condition as well as the number of Schubert cells that are represented in in the Hessenberg variety. But on the other hand I've also got sort of visibly some conditions on the entries that can in general yet quite complicated. So this sort of is our first answer of what is a Hessenberg variety. So they generalize springer fibers. They have the property that Schubert cells intersect Hessenberg varieties in these affine pieces. So I've got a little asterisk there because there's some sensitivity to how you've chosen your basis relative to the linear operator X. And I'm not claiming that to be true, but it is possible to choose your basis. Nicely enough, so that the intersection of the Hessenberg variety and the Schubert cell is affine like homeomorphic to C to the D for some that D and furthermore, these affine pieces are going to form a paving by affines. Chapologically speaking, it's like a CW complex in the sense that the closures of these cells, these affine pieces, give you the co-homology or homology. But the closures are more sensitive and in fact they're like quite perfectly mysterious in most springer fibers and like almost all of the Hessenberg varieties. So springer fibers, so springer fibers were first developed as an example of a geometric representation. So their co-homology carries a natural action of the symmetric group SN. It's quite beautiful. And there's multiple different constructions. In fact, they're not all equivalent. Sometimes springer's representation is used alternately to refer to a particular association of springer fibers with irreducible SN representations or the dual, depending on exactly how you've constructed it. And sort of consequently, there's a lot of interesting commentatorics around the cells of springer fibers and standard young tableau and inversions and certain sort of limitations on inversions. When you add Hessenberg conditions, you are sort of gaining some systematic, the ability to systematically limit what kinds of inversions you look at, including getting sort of narrowing on particular classes of inversions like descents, for instance. And we'll say a little bit more. Once I've said a little bit about what use GKM theory. So I think of GKM theory as sort of a computationally feasible way to construct co-homology combinatorially. A priori, I'm going to start with more data, but at the end of the day, I will have a module basis that is also a co-homology basis. I will have some sort of like fairly routine mechanism to go from the equivariate co-homology to the ordinary co-homology. It only works if you start with varieties that are relatively well behaved. This is usually the world in which I live. And part of the point of this talk is to sort of try to figure out which of the Hessenberg varieties are also in this world. So the basic setup is that we have some sort of tourists that's acting on a variety well. I'm actually going to say very little about what well means, except to observe that it is true in the spaces that we're going to be looking at. So largely, if it acts well, then we can get a graph from one-dimensional and zero-dimensional p-orbits, and moreover, we're going to get some sort of labels on the edges of this graph, namely the weight on these one-dimensional t-orbits. So one of the details that I am not mentioning about with well is that the tourists will act nicely enough so that the one-dimensional and zero-dimensional orbits form a kind of nice combinatorial graph. Again, we're not really going to worry about anything that's not a perfectly good finite graph without crazy loops or multi-edges or anything like that. So I'm going to elide all conditions and refer you to a different talk if you want to hear more about that. So then the results, the GKM result, Keresky-Kowetsch-McPherson, is that if you've got this nice setup, then the Equivariant Comology can be described as a way of labeling the vertices of this graph with polynomials, so one polynomial for each vertex, satisfying the condition that any two adjacent polynomials need to be a multiple on the label on that edge. So back to flags for a second. So here, and really for the rest of the talk, when I think of my tourists, I think of diagonal matrices. So we could just sort of like inspect what are the weights and zero and one-dimensional orbits in the flag variety. So to do this, I'm actually just going to multiply matrices. So I think that I'm multiplying this correctly. And then I'm going to count on my assumed audience numbers to correct me if I'm not. So I just multiplied. And the issue as I see it is that this matrix on the right is not in my preferred form. On the other hand, I can do some Gaussian elimination. I'm just re-scaling columns, which is to say multiplying on the right by something. And it just normalize those bottom non-zero entries. So if I do that, I end up with something that looks like one and then I have to divide this first column by T3, divide the second column by T2, and then divide the third column by T1. And now, so now I have a matrix that is back in the cell in which I started. So these weights, so the weights are coming from this, the way that the tourists is acting within each cell. And I'm usually going to linearize them as TI minus TJ, especially when I'm thinking about GKM theory. So these are the same variables and just look at context to figure out whether I am looking at one of the linearized weights or thinking about the actual group action. So in terms of identifying the zero dimensional or that's doesn't matter. In this case, you can sort of like invisibly see when I am sitting inside of a Schubert cell, if I have any tourists whatsoever, then I am going to be moving around somewhere inside that Schubert cell. Which is to say the zero dimensional orbits have to have A, B, and C all equal to zero, otherwise I am being moved. So it's just going to be the permutation matrices. So one dimensional orbits. Well, if I have more than one of those non permutation entries non zero, then, then again, I will be moving around in different parts of the Schubert cell. So the one dimensional orbits only have one non zero entry. So other than the permutation. So consequently, we're sort of like seeing the one dimensional orbits, seeing the zero dimensional orbits, and on each one dimensional orbit we can actually just like concretely multiply and identify the weight. So, so what is the flag. Sorry, what is the graph. So the graph is going to have vertices that correspond to the zero dimensional orbits. So the two dimensions are the one dimensional orbits, we can see in this example up here that I, that if I take any one dimensional orbit, and then sort of do I can, I can, I can sort of use my tourists to shrink the variable a say and make it as close to zero as I can see. So I can see there's one permutation flag in the closure of that one dimensional orbit. Conversely, if I sort of use my tourists to push the entry a really close to infinity, you can see it's sort of having the effect of making the line look very much like the vectors zero one zero. And the plane remains the same span of two vectors that it was been of two permutation vectors that it was to begin with. So, I, that's a hand wavy way of saying that these edges are going to be connecting to permutation flags that differ by a exchanging two of the columns. And then finally, the label. So the label is going to be ti minus Tj, where I and J are the two columns that were exchanged. So we can just draw this. I'm going to write things out just conflating permutations using using simple transpositions to concisely describe my permutation matrices and just sort of conflating the matrix with the permutation itself. So, here are my. Permutations and I'm going to draw these red edges. So these red edges are labeled by T1 minus T2. If you go across a red edge, so left multiplication by s one will take you from one end point to the other end point along a red edge. Blue edges to indicate T2 minus T3. So left multiplication by s two takes you across those blue edges. And I'll create some green edges. The green are T1 minus T3. So this is sort of left multiplication by the transposition that exchanges one and three. Or the permutation s one s two s one will take you across those green edges. So great. Let me just take this graph for a second. Move it down here. All right, so I'm going to. So, so if we are using to create the equivariate comology, and I am looking for all possible ways of solving a sort of system of modular equations in polynomials. And I'll just label some of these vertices. In a way that satisfies the orange condition. Whenever I go across an edge, the polynomials on either side should be a multiple of TI minus TJ. So T1 minus T2 across the red ones T2 minus T3 across the blue T1 minus T3 across the green. So let's see, I'll take this one. So I'm going to put zero on these two vertices. I'll put T1 minus T2 over here. So that bottom red edge. I know I need to be a multiple of T1 minus T2 on the top of it. And so T1 minus T2 will work. So, if I keep going up. So this second vertex on the left is also above zero across a red edge. So it needs to be some multiple of T1 minus T2. And in fact T1 minus T2 works. It also satisfies the condition of the left most green edge. Moving up on the right hand side, the vertex S2 S1 requires us to put some multiple of T1 minus T3 in order to satisfy the condition that you can put zero right below it over a green edge. And now if you look at this edge, this blue edge right here. The difference between the end points here is T2 minus T3, which is in fact a multiple of that blue edge. So similarly, I can put T1 minus T3 up at the top and all of my GKM conditions are satisfied. This is in fact a GKM class and in fact it corresponds to a Schubert class. There's cool things connected to this graph, which is to say that like actually I did not have any choice at all. When I sort of first decided to put T1 minus T2 at the bottom at S1 and zeros below it, if I once I set those three values into place and if I require that I am just going to put a homogeneous degree one polynomial everywhere, then this is like the only way to solve this. So, I could say more, but I will not. Yeah, I could say more, but I will not. So, so we can like just from GKM theory, once you have an adequate torus action, you can get this sort of beautiful combinatorial construction of all of the, of like the whole equivalent biology. So back to this question, why said he hasn't heard varieties. So, there's a sort of well known result that effects is regular semi simple, so diagonal with distinct values along the diagonal that hasn't heard varieties are GKM on both the equipment ecology and the ordinary technology have these like a beautiful SM actions that it inherits really from sitting inside the flag variety. This representation shows up in combinatorics in sort of multiple ways in in active and evolving theory. So, I'm going to show you what the graphs are for the regular semi simple. So, I'm going to show you what the graphs are for the regular semi simple. The graphs are like, dual to what you're going to see me construct for hasn't birth varieties. So, without saying more about why, I'm just going to like actually show you what the graphs are for the regular semi simple right. So, here's my sort of flag variety graph. And try this going to paste a couple more copies in here, smaller and smaller copies in here. Right. So, my hasn't heard variety comes with a function. Let me give you almost every function, almost every function that for n equals three. All right, so the thing on the far left, the full fly variety that is a hasn't heard brunch variety it corresponds to the function h of i equals three, which is determined by each of one equals three. The thing on the right. So, all, all of these regular semi simple hasn't heard varieties have the same. So they actually all have the same fixed points every permutation works. But if I make the hasn't heard function as small as possible, I erase all of those edges everywhere in the graph. I, if I allow myself a little bit of wiggle around each one. And I'm also going to be erasing edges. This time, I erase almost all the edges. Now, if I take this function h of one equals to h of two equals three h of three equals three. I'm just erasing the middle edges. And then finally, on the left, I have all of the edges that I started with. So, sort of, if you think of it as moving from the full flag variety to the right. If you take a step to the right, you erase precisely one green, one red, one blue edge. It's actually determined. Exactly by the conditions of the Hasenberg function. And it's determined by which, which reflections you are right multiplying by. If multiplication determines which edges you remove to get your regular simple Hasenberg varieties on and just not that I'm going to be saying anything about this really, but just very quickly. I can. Yeah, just very quickly. I take it back. I will not say anything about the permutation action, except to observe that since all of my vertices of the graph are permutations, since I have what at least visibly we can see is a sort of very symmetric conditions on the edges. You can actually permute the classes, the equivariant classes in certain ways on and get other equivariant classes. So it's like super combinatorial really just based on the graph. And, huh. Great. And that's time for the break. Oh, wait. What did you think? Let me actually just say so. This is the question that will leave for the breaks. Which other Hasenberg varieties are GKM. Great.


Those are medieval robots. Nutter Butter Girlie, also known as Eva, is an animator that existed in the depths of YouTube back in 2010. She was a 20-year-old woman who had an average emo persona, speaking with very bad grammar and a cutesy voice when she had her microphone on. The usual stuff one would expect from someone participating in YouTube's early trends. She was well known for her AMV edits, short webcam videos, and most of all, her animation memes made with Flash 32. In March of 2010, Ed posted a webcam video where she talked to the audience in her silly persona voice about her favorite anime and the most recent episode of it. It has been rumored that the anime she was talking about was hard to catch pre-cure, as one of her animation memes involved a character from that show. Suddenly, an older man, presumably her father, can be heard opening her door and walking into view, face and shown. He starts talking to her in a mildly annoyed tone about how she didn't come watch a movie with him like she promised. Eva, still remaining in character, responds to him saying that she is currently recording a video, which results in him telling her to shut it off when she's done and to come to the living room. She then leans into where his face is now shown to the camera, and attempts to kiss his daughter on the lips, holding her by her cheek. She backs up and pushes him away with her foot, telling him to stop, before getting back to her commentary. This video was titled, pre-cure was very fun, and the description of the video had her inform the audience that she's fine and her dad was just, being weird. The original description read as follows. Hi. Ignore my dad, he confuzzled me too. Eva would move on to her regular posts afterwards, consisting of anime music videos and songs animated in flash for the time being, up until May of 2010. At that point in time, Eva's most recent videos would have her speak in code to her audience, either through the animations or her descriptions. In one animation, titled, Walking on the Sun, it has her character doing a walk cycle with rave lights flashing in the background. In the video, text would appear for a millisecond as the video's song played, reading, look at her she's by herself, on the bottom right. Judging by the comments section at the time, no one seemed to notice. The next video, titled, Goofballs at Mickey D's LOL, involved her doing a vlog with her college friends at McDonald's. One of her friends would arrive back, commenting that he found a quarter in the toilet. Eva would recoil and tell her friend to go wash her hands, and that he shouldn't touch anyone after reaching into the toilet. As he walks back to the restroom, she turns the camera back to herself, and comments about it, saying something tantamount to, just like a certain someone we know. The next several videos afterwards seemed to be somewhat normal at first glance, until the descriptions of the videos were put together. Every video after these five didn't link back to the code. First video's description. I hope you enjoyed the AMV. Been getting really into fruits basket lately. Second video's description. Have you ever had Pocky? I sure did, tasty stuff, love it. Third video's description. Nobody in my friends group ever talks about this show, but me. Fourth video's description. To talk to Luffy and hang out with him would be awesome. Made an AMV to appreciate this dude. Fifth video's description. Help, ah, I'm gonna pass out, I'm so proud of how this turned out. I was happy with the other animations I made, but this one takes the cake. Putting every video's first words together would form the sentence. I have nobody to talk to, help. Weeks later, she would post a comment in her most recent video telling everyone this. Get ready for a surprise, since none of you get the memo. There was no punctuation, but strangely enough, there were no spelling errors, as if this was the best way she could make it clear that something serious is going on. After this comment, she went inactive for four weeks, with some of the comments asking if she's alright. Allegedly, her college friends came into the comments section asking where she was as she wasn't in class for a long time. It isn't known whether or not she called in sick to her college, let alone what college she went to. Finally, on July 24th, had a post in her final video, the title being, Psycho Teddy Animation. The thumbnail being of her character with a comically disturbed expression, making a peace sign to the viewer. The video in question was an animation parody for the song of the same name. In the video, as the song played, a person drawn in her style, with a cut out jpeg of her father's face replacing the head could be seen singing to the viewers. It was clear that this person was meant to personify her father. As he sang, the video would cut two clips of him chasing Eva's persona and hugging her really tight, and then gradually get worse with clips of him forcing himself onto her character. Once the just squeeze me line is said in the song, a real photograph of Eva and her father would pop up on screen for a very short interval, before cutting back to her character standing in a picture of her real room and playing the do you really really really really want to lines. Her character is now staring at the viewer, her mouth smiling so wide that her gums are showing, and the space where her eyes are supposed to be has been replaced with a single black bar. Once the I'm a psycho psycho teddy line is said, the do you really really really really want to line is repeated over and over, not stopping in the slightest. Her character walks out of her room and through photographs of her house as this happened, each background transitioning with a zoom out and hard cut. Eventually she reaches a photograph of a kitchen, with cooking ambience being heard. The depiction of her father can be seen, with a pen in hand, frying an egg. The line, as mentioned before, is still repeating, but this time, it has simply been reduced to, do you want to? Eva's character stands next to her father, with her father looking to his right, looking at her. Suddenly she grips onto the handle of the pen, and the scene cuts to back. Various blurry pictures of her real father would fade in and out of view, as low quality muffled screams of a man could be heard. The pictures ranged from her father just as he was hit with a pen, to Eva herself holding her father's corpse by the head to the camera with an innocent smile. The video would suddenly end, cutting off the song and homicide audio when they weren't finished. The comments had everyone frightened and in a frenzy to find out why Eva did what she did. One comment, rumored to be from one of her classmates, threatened to call the police on her home and referred to her as Eva, hence the mentions. The day after the video was posted, her channel was suddenly deleted, but before that happened, she edited her video's description to give one final message. A message that explained everything in just a few words. He loved me a little too much.


So the Patriots are always well known for offense, but this year their defense amazing Allowing 14 points 276 yards per game. They have 36 takeaways. They have 47 sacks Give me the guys making this Patriots defense go. I mean really it's it's at every level of the defense, you know up front It's it's Danny Shelton who man's the nose tackle spot. He's a big strong wide-bodied guy He's tough to move Jamie Collins at the linebacker spot. He moves around to a lot of different positions Same thing with high tower and Kyle vanoy. Those three guys are they're really interchangeable in how they use them and how they Either send them or drop them into coverage to to affect the offense in the back end. You've got you know Devin McCory, you've got Patrick Chung guys that had played a lot of football and then Stefan Gilmore corner Who's having a you know player of the year type season So it's really every player on that defense that they kind of intermingle and twist To create confusion and they're and they're being super productive. What must the Titans offense do well against that talented defense? I think it starts care it starts off with taking care of the football, you know, we've got to take care of the football We can't give them their offense Tom and the boys Extra possessions and staying on track offensively. It's about Establishing the running game setting up the play action pass Maintaining the pocket, you know when we've got a drop back and throw the ball for Ryan to throw it and the Proceivers getting open and catching against man coverage against Brady and against the Patriots offense What must Dean P's Titans defense do well? Well, I mean, I think it's it's stopping the run, you know, they've got a good back in in Sony, Michelle Their line is big they can move move guys off the ball and then they've they've got pass catchers at the skill positions They'll sub those backs and whether it's James wide or whether it's Burkhead, you know Edelman in the slot You know the rookie to kill Harry's doing some good things and then you got Philip Dorsett who can really stretch the field vertically So they challenge you at a lot of different levels So we've got to do a really good job of executing the defense other keys to a Titans victory in Foxborough Well, I think you know we talked about it offensively. It's about you know staying on track It's about run the football making plays when they present themselves taking care of the football staying on track offensively executing the defense


Hello and welcome to the session. In this session we discussed the following question which says, if the area of an equilateral triangle is 81 root 3 centimeter square, find its perimeter. Before we move on to the solution, let's recall the formula to calculate the area of an equilateral triangle of side a and this is equal to root 3 a square upon 4 square units. This is the key idea to be used in this question. We know that by Heur's formula, the area of the triangle is given by s into s minus a into s minus b into s minus c where a, b and c are the size of the triangle and this s is equal to a plus b plus c upon 2, that is c, semi perimeter. Now, in equilateral triangle, all the sides are equal, that is, a is equal to b is equal to c. So in this case, s is equal to 3 a upon 2, that is a plus a plus a upon 2, that is 3 a upon 2 and so we get the area of the equilateral triangle equal to root 3 a square upon 4 square units, that is, we got this by substituting s equal to 3 a by 2 in this formula and replacing a, b, c by a. Now, we move on to the solution. We are given that the area of an equilateral triangle is equal to 81 root 3 centimeter square. Now, this gives us root 3 a square upon 4 is equal to 81 root 3, that is, using this formula for the area of equilateral triangle of side a. We get this and from here we get a square is equal to 4 into 81, that is, a square is equal to 2 into 2 into 9 into 9. Now, this gives us a is equal to 2 into 9 equal to 18, that is, the side of the equilateral triangle is equal to 18 centimeters. So, we get the perimeter of the equilateral triangle is equal to 3 a, that is, equal to 3 into 18 equal to 54 centimeters. So, this is our final answer, that is, 54 centimeters is the perimeter of the equilateral triangle. This completes the session. Hope you have understood the solution for this question.


Due to the delay in aid from the US, Russian attack aircraft are approaching the front line. Forbes. Due to the blocking of US aid to Ukraine, Ukrainian air defense systems began to run out of missiles to repel Russian attacks. As a result, some Russian fighters can fly much closer to the front lines and attack with short range of missiles rather than 25-mile glider bombs. Forbes writes about this. The publication recalled how recently, during fierce fighting on the edge of Chasovoye, four Su-25 attack aircraft of the Russian air force fired at Ukrainian positions at low altitude from a distance of only a few meters from them. It is noted that Russian air raids targeting Chasovya have dialed up the pressure on the city's garrison, which includes the 67th Mechanized Brigade and, closest to the edge of the city, the 23rd Infantry Battalion. Back to back, Russian assaults on the 23rd Battalion's positions dearly cost the Russians, but at least a few Russian troops have entrenched along the outermost city street, Zelena Street. Urban combat operations may soon begin in Chasovya, the Ukrainian Centre for Defence Strategies, noted. Forbes says that a shortage of artillery shells, a crisis Ukraine's European allies are scrambling to resolve, is the biggest problem vexing the Chasovya garrison. But a shortage of air defence ammunition is a close second. It doesn't help that Russia has escalated its air raids on Ukraine's biggest cities, compelling the Ukrainian air force to concentrate its best air defence batteries around these cities. That leaves gaps in frontline air defences, gaps the Russian air force is exploiting. These gaps will get bigger as air defence ammo runs low. If they keep hitting Ukraine every day, the way they have for the last month, we might run out of missiles. Ukrainian President Volodymyr Zelensky warned the US Speaker of the House, Representative Mike Johnson, has pledged to hold a belated vote on fresh US aid to Ukraine potentially this month. A successful vote could pay for the Pentagon to speed more air defences to Chasovya and other besieged frontline cities. Ten regions of Kazakhstan have declared states of emergency after strong floods hit the entire northwest of the country. The flooding was sparked by a sudden and early period of warm weather that caused huge amounts of snow to melt and overfill numerous rivers across parts of Kazakhstan and Russia. Massive floods in Kazakhstan that began in March became the largest natural disaster in the country over the past 80 years, country's President Kasanjomar Tokyev said. A natural disaster has occurred, the likes of which have not been seen for many years. This may be the largest disaster in terms of its scale and consequences over in the past 80 years, he said, according to Tokyev, due to the floods, a local emergency situation has been declared in 10 regions of the country. The President noted that following his criticism and instructions, the government boosted efforts to reduce the consequences of the flood and is taking appropriate measures. According to the latest data from the Ministry of Emergency Situations of Kazakhstan, since the beginning of the floods, more than 3,000 private residential buildings in courtyard areas have been flooded and 70 settlements remain without transport links. At the same time, more than 72,000 people have been evacuated. The National Army has been deployed on rescue and aid missions across the regions. Over 8,600 people and 1,700 pieces of equipment, 411 water pumps and 65 watercraft, as well as 10 aircraft are involved in rescue operations.


For many sailors, the first time they hold a weapon is at Recruit Training Command, Great Lakes. It is a feeling of excitement coupled with responsibility. It is their first tangible glimpse into our Navy's warfighting capability. The responsibility of safe use not only falls on the recruit, but is entrusted to their instructor. We always start off every session that they're with us with a classroom safety brief and instructional time. And the first thing that we emphasize is safety. That's the biggest goal here. It's not to make sure that you come out like Rambo and awesome. We want to make sure you come out of this alive and well with a new experience and knowledge. If you think you have what it takes to inspire the next generation of sailors and be a recruit division commander, speak to your detailer for more information on how to apply. Stay tuned to All Hands Magazine for an in-depth look at RTC's weapons training.


So this was supposed to go on at 10, and I was totally supposed to get like another hour to sober up This is gonna be a really interesting black ops not only is this the first black ops that I've done exploits This is the first black ops where I have been kind of sober. Oh No, no, no, no, there's lots of people here providing booze. Let me tell you So what are we here to do? We got an hour from now Who am I you should know by now? What are we here to do so like last year, you know, I had like one topic just DNS It was kind of fun, and you know left the whole ADD thing alone. Um, yeah, we're back to ADD It's fun. We're gonna talk about a whole bunch of stuff. We're gonna kick MD5 We're gonna play with some IP fragments. We are going to mess with intrusion protection systems, which are being really really abused We're going to do some DNS poisoning, which again is about the most black hat thing I've ever done And if that didn't help we are going to send about four billion packets onto the internet I I have a new toy.  I have no idea what it is, but it is cool Usually it's just I have no idea what it is It just ends there And finally, you know watch some TV Attacking MD5 Instead of going through all the background Here is the webpage for Lockheed Martin Fun company some of you might have heard of it Here's the webpage for Boeing another fun company. You might have heard of it Let's see what the hashes of these two pages. I did it Let's see what the hashes of those two pages happen to be Do-do-do C0F380 C0F380 Hmm these two web pages have the exact same hash How could that have happened?  MD5 is supposed to be basically a data fingerprint, you know You got one some file however big it happens to be the end result supposed to come down to a hundred and twenty eight bit Signature and the whole keyword the magic word is Computationally infeasible to find two files with the same hash and we've known since about what was it 96 97 bullshit and You know about two thousand you know two thousand four Jiang Yun Wang over in China said hell yes bullshit Here's two files with the same hash, and you know what the response was from a lot of people Yeah, there you have two hashes, but you could never use that for you know actual production data that had any kind of real life Meaning, you know absolutely not Okay, hi beside I do actually try to have some technical data, so here's what the story is MD5 it's pretty simple You start out with some initial state and they use like magic numbers like pie and you know six seven eight nine one You know numbers decreasing whatever I'm too drunk to go nine eight seven six five four three two one I've got a problem more than that I Got a drink. Oh the way this works at my talks I like questions ask a good one and you get to drink and if I can't answer I have to drink and And you know if I'm not done drinking unless the drinking game So MD5 basically is really simple start with some state You loop over all your data five hundred and twelve bits at a time and it shuffles that state and at the end You end up with some value you mix in like the amount of data that you did some made of data And you end up with what's called the MD5 hash now the idea is Anything's different in the input data. It should change a single bit should cause half the output bits in the hash to change half it's a big number What we have here is a visualization of the internals of MD5, you know, we got 64 sub rounds and three rounds and Half of those things are supposed to be flickering now Maybe you can't see the flicker half of you see those little dots There's supposed to be a hell of a lot more But you know when we've got the Chinese girls so you know guess what almost none of them are different You know first round second round by the third round nothing is different that's this big advance of this you know this new MD5 attack and What's interesting is once you have two files with the same hash because it operates 512 bits at a time Once you do end up at an alignment You can add new stuff and it's not like you know back in time back to earlier in the file Say hey wait It was different earlier in the file because you're never supposed to have a collision because that's what the whole point of a Hash is so in mathematical terms if MD5 of x equals MD5 a y MD5 of x plus q That's gonna equal MD5 a y plus q so that means if we have two files with the same hash We can append anything we want to it including web pages Funny thing about web browsers who here has written a crappy web page.  Oh, there's a programming environment. We got JavaScript speaking of turds so The browsers accept everything and they are programmable so guess is what we're gonna do By the way graph this is the code to use all this. It's freaking cool. So what we do is we take some file This is x. This is why these are our two files of the same hash We are going to prepend our file with one of these and we're gonna put some extra crap on remember We can put anything on it'll have the same hash Here's the where'd my mouse go Here we are. Here's the first web page Lockheed Martin.   I was put on x. Okay, Lockheed or hey look I just put on y shows bowing and that's your output and so that in a nutshell is how Lockheed Martin and bowing can have the same MD5 hash That was a lot of stuff that had nothing to do with packets. Okay.   Yes, you put my talk at the same time it said in the schedule I P fragmentation and I quote fragmentation an interesting early architectural error that shows how much Experimentation was going on while IP was being designed quote by Paul Vixie someone who I truly expected to kick my ass when I first met him But it turns out he's about as fucked up as I am sweet So what is fragmentation all about now IP packets can be like 65 kilobytes long Okay, there is no physical network that can send a 65 kilobyte packet. Well, okay, none That's actually used in common usage So the idea behind IP fragmentation is we can take these ginormous packets and shrink them down into little chunks fragments It's fairly straightforward. Why is this a problem? Whole idea with IP is that it's supposed to be stateless. You got a packet.  Hey, you know, you can send fragments and not have to worry about it But when you receive them you have to store these things because you get one fragment and later on you might get another and another And maybe you will and maybe you won't but the point is you got to keep this stuff around in RAM. That's annoying Not as annoying It's about 98 Tim Newsham and Tom Pacheck actually show Look, we can get around like every ideas out there by just doing strange games with our Fragmentation we have overlapping fragments. You know this fragment says it has the same data as that one Which one is going to be? You know, what is the correct interpretation the RFCs are just like if I know and Then frag router comes out.  This is old shit, right? But IP's been picked clean. There's a reason I moved on to DNS because like later three and four are done So I thought In the crypto realm, you know, I did a lot of stuff with open SSH You know, we've been dealing with timing attacks lately all this crypto is all vulnerable to like how long things take and I'm thinking about this I'm going I wonder if I can apply timing stuff to IP and it turns out. Oh Yes, it turns out there's an IP fragment reassembly timer It turns out that there's only a certain amount of time. Are you pointing at me? What are you pointing me? Oh, now you're the middle finger. What is this shit? I'll take this opportunity. So speaking of pointing. There's all these shirts that have me pointing that say scan ran motherfucker and it's done by the tour con slots and Hey, you got a new title. Would you rather be a goon should have had a better t-shirt? Tour con is absolutely right.  Well, it turns out we can fingerprint operating systems with that value You know some things will wait 30 seconds some things will wait two minutes, you know boom OS fingerprint But that's easy. That's cheap. Let's go ahead and do some more hardcore stuff. All right What if you have an IDS an IDS may very well have a different idea of how long a Fragment can live before it just gives up on trying to reassemble it. In fact, this is actually true Linux and free BSD have a 30 second timer snorts frag 2 timer will wait 60 seconds Now if the timer was less that the IDS was gonna keep fragments around for less time Well, hell, you know, we just send fragments too slow for the IDS, but fast enough for the host What if it's the other way around what if the IDS because it's all hard core and you know It's gonna keep things around for as long as it possibly can What if the IDS keeps fragments around longer who we can do some stuff? The problem is it's keeping stuff around longer. How how are we supposed to make the host see one thing and the IDS See another well our problem is the IDS is keeping fragments around for too long our solution Make the IDS drop our fragments. Well, that sounds really easy. How are we gonna do that? Well? There are two ways a fragment leaves the reassembly queue either a it times out or B. It's reassembled against something I Like that B. I like the idea that it's just gonna work, but not the way it plans to Watch this Here's what we're gonna do right look take our payload up to 65 kilobytes We are gonna split it into a whole bunch of fragments. We're gonna take the even numbered fragments We're gonna make a copy of them.  Oh and indeed it is useful Because we go ahead and we send the odd numbered fragments and the odd numbered fragments go to the host The host has nothing so the host holds on to these odd numbered fragments and says well You know I gotta wait for some stuff in the future IDS no IDS has been holding on to some crap So the IDS has crappy even and good odd it reassembles It's like what the hell is this and it drops it on the floor But now we send the legitimate even numbered fragments and The IDS well it already dropped all that stuff from before on the floor so the IDS now has to keep in its new cache Has to keep in keep it in its cache But the host host has legitimate even host has legitimate odd host reassembles just fine and Then you win and now my favorite line it gets worse Right now.  They might alarm. They might be worried. Is there a way we can instead of giving it crap Can we make the IDS see something completely different?  No, no, we're actually not that's later. We're gonna send the good stuff first Good stuff goes first. You know why because I want the IDS to see some good stuff Okay, why don't we give some happy nice feelings?   She's cool But the host the host still has at this point in time Where's the host app the stuff in his header and then you know the just the header packet because it already dropped the good stuff But it has the header and now we give it the evil packet and what happens when the header meets the evil packet Reassembles a sequel injection exploit you win What's up? Quite a few So what about checksums a prop there's a problem our hosts may actually go ahead and You know sequel injection should not have the same checksum as get slash, right? I mean there's 65,000 possibilities. Why would the things match up? Well turns out there's this great look It's called a TCP IP lean by this guy Jeremy Bentham This is hardcore like I ain't saying it's hardcore like the guy debugs ethernet with an oscilloscope that kind of hardcore So look, he's got this thing. He's dealing with hardware that doesn't have enough RAM to have an entire packet in RAM at the same time holy crap So he talks about how you do this stuff.  You don't want to have to go and go over all your data and How do we go ahead and stream out a packet and not have to worry about the checksums? Well, the idea is you put in the wrong checksum, but there's a funny thing about IP checksums.  They're just the ones compliment. They're just like adding numbers, right? So it's a really funny thing you can do at the end of your payload and be like wow I'm like 32,000 off from what my checksum should be and so you like, you know add a little bit of a comment fix by 32,000 and it works So you just do that and now you're you're you're you can have a constant check some for different different payloads We can actually backport this attack to all the original mechanisms used by Pachec and new Sherman song It turns out what we can do and I haven't built this one yet because I really fucked up my arm be happy I'm here at all But it turns out you could actually send a series of packets such that they is on Linux They assemble into a Linux exploit and on Windows They assemble into a Windows exploit and all because there's a whole bunch of different ways that IP stacks can Reorganize data and you could actually and I haven't built this yet I'm fully honest you could actually create a sequence of packets such that when they arrive on the host the Particular host being used will reassemble it into a way that is relevant for that host And you don't even need to get any kind of feedback back. That's kind of cool Now hitting the brakes.  That's not nice. And not only is it not nice There's not a lot of people who are gonna be able to do that.   I blocked you. I stopped you. I got in your way I'm telling you I'm here and I'm getting in your way Yo, that's a fingerprint It turns out that any time an intrusion detection system or a firewall gets in your way It has actually identified itself because there's about a million different ways that these things can go ahead You know, do they block invalid checksum? So they block invalid options. They block invalid ICMP types How about HGP? How about sequel injection? How about sequel injection of this type? How about invalid DNS packets?  Oh, you sent a TCP fragment out of order We're gonna drop you on the floor because we don't like RFCs. They're overrated, you know Or checkpoint. Oh, you're using DNS sec. That's never gonna be feasible Point is you can go ahead and identify pretty much every firewall and every intrusion production system based on whether in a given session if you do something it doesn't like if it kills your session and it turns out you can find out the Precise hop that the IDS and IPS is at by using Mike Schiffman's fire walk method Which is basically you go ahead and you send your nastiest off one hop before the firewall And then you send it one hop after if your session dies one hop after you know the hop where the firewall lives at Hi, how you doing? Not that this is anything wildly new. This is a slide from like 2003 and It basically shows you how you detect a pics firewall and Not giving any details, but if anyone ever tells you it's ever impossible to remotely detect a firewall I do I've been doing it for like two years So I can't say what that's in reference to but you can always detect a firewall remotely There's just too many different variations on how the protocol can be broken so IP shunning Turns out a bunch of intrusion protection systems.  Oh, nobody ever does that Let me tell you why it's a really bad idea to block traffic that comes from random IP addresses on the internet Anyone ever type dig, you know that whole like domain Internet Gropor DNS thing Here's a couple hosts. You might have heard of them. They're called the root servers. If you can't talk to them.  It's like, hello internet Here is my firewall rule set. Would you like to submit new rules? By any chance would you like to knock my stuff down?  I'm 128 8 10 90 I'm trying to slammer you but oh, I Can't stop here. I can't stop here because it is too large-scale and more importantly I thought it was all cool, but it's been whispered about for years And you know, I can't go ahead and take full credit for something people have been talking about So let's do a little bit more elegant attack again. It gets worse I've been investigating DNS poisoning. I've been investigating a lot. Did anyone here know? Well, hang on. We'll do about that later, but I've been investigating DNS poisoning quite a bit four billion packets quite a bit Is it possible given these networks that implement automatic network shunning to not just like knock them off the network But to poison their name servers to go ahead and redirect traffic from their network arbitrarily. Oh Yeah Well, it's a funny thing. I showed you before we will block you from the name servers and that's nice But let's do worse. Let's block them from individual name servers Not the root but say hey large ISP She's that big bank all your customers go to yeah We don't want them to do that and how can you do that? Well block the communication between the name server at the ISP and the name server at the bank And there are two sides. You can do the blocking you can cause the IP at the IP the ISP goddamn Humber think I believe I am out. Hey, I drank everything that was there. I think you need to drink So there are you can block at the ISP side you can block at the bank side both ways. Oh No, so only if I really screw up In which case you're having a shot with me up here So General theme is the block communication between any two name servers can block it either server or the client side All right, let's say you spoof malicious traffic from the client network to the server network So say the big bank no longer likes podunk ISP All right, that means podunk ISP sending out requests and nothing's coming back All right, you know, let's think about that for a second. We got about Assuming a fixed port. We'll talk about that in a second. We got about 65,000 possibilities for what the transaction ID is going to be the transaction ID of course controls whether or not when I Spoof a packet it actually is going to get blindly accepted Well kind of funny. There's usually it's called a race condition. I would have to get my My fake reply back before the real reply comes back But you know what happens when the intrusion protection systems are in place. Well, it's a race, but I Took a bat knocked out the other guy's kneecap. So he's not running anymore So I got about an average of 32,000 packets to do and instead of in about like a hundred milliseconds I can do it like about as long as I freaking want More all the story do not automatically shun IPs But you know, I can do the other side I could also spoof malicious traffic from the server network to the client network So, you know, you some podunk ISP and it's like holy crap. The bank is trying to kill me. I paid my loan man Well, so there's a little difference here because you think if the ISP is no longer talking to the bank Well, you know, the ISP sends out the request and the reply comes back and the reply is blocked But if the reply, you know, you think well when I spoof stuff, oh, it also has to be blocked, right? Funny thing about IP. There's no affinity and by that I mean IP addresses, you know You can actually return a DNS when you send out a DNS request about 15% of the time some other guy replies and it works That means the legitimate host can't send you back replies But the entire internet can be spoofing replies back They'll all work if their transaction ID is correct Oops again, do not implement automated network shunning But there are people who like it and I'll go ahead and I'll say okay Make sure you can talk to name servers See if you can make it so your outbound communications override any automatic shunning and you know again Do not touch name servers But seriously, don't do this stuff. There's just 80 million ways that automatic shunning you're giving They're giving you guys access to the firewall table. What is wrong with these people? So don't do that Go to the next slide. But what about complaint emails?  You can't send mail to that domain anymore Oops Now what would I know about complaints? Well, when you send four billion IP packets people can tend to notice I've been working with these guys called prolexic and what's up? All right, look so Basically none of these like third-party spam filters, you know, they get your mail and you know They send you the good stuff.    I Tried it was out in an hour.  So seriously? I can't emphasize this enough I'm doing this because there's a little problem with you know large-scale network attackers having better intelligence on the network Then like I do that's not cool But yeah, don't do this at home. I've set up, you know reverse lookups and I've said I'm an Aaron There's Dan Kaminsky security research. How rad is that? Like abuse mails someone has hacked in your box. Yeah, dude.  I wanted to go ahead and find you know Google's taken out by some DNS poisoning attack You know who's actually hit by this thing? So, you know, we scan the world the entire world and we find somewhere between we find actually nine million Name servers, but after the scan only about two and a half million of them would actually talk to me shit I Want I need to find because it turns out you had to have a Microsoft server talking to a Windows server I know excuse me Microsoft server talking damn it Okay, the problem with this plan is like the more I drink the more mistakes I'll make Okay, so I'm totally getting that ever clear So look you have to have Windows servers who are linking to bind eight servers fairly obscure situation, right? Okay, well, how do we find that one server is linking to another by linking? I mean instead of going out and resolving it itself. It asks its buddy. How do we find these links and The bet the way that I ended up using is basically to just ask Everyone hey, you know Hey you go ahead, you know, what's your name? You know Bob go ahead and look up Bob dot madness dot net and madness is a domain I own If some guy named Charlie walks up to me, okay I know Bob asked Charlie to look something up So I know there's a link between those two domains and those name servers. That's how I did it What were the end results? Well, we got about two and a half million verified name servers meaning they were still talked to me and Of those two and a half million we Used the tool called fpdns fingerprint DNS and we fingerprinted every single one of them. Oh I got some emails out of that one Okay, there are a lot of ideas. These are like you try to check version. How could you possibly do that? You know your attack is detected by 100% You know it without fail Like seriously people did not like it, but you know what we're dealing with security and you know We found about 230,000 hosts that are possibly broken 13,000 that are definitely broken and you know what? I'm gonna be sending some emails and we're gonna get this problem dealt with and Incidentally scan was done in under a day It's good to be the author of scan Randison packets fast. Fuck. Yeah. Oh, oh, who said that? Who said oh? Hell, yeah, well, maybe not Hey, someone get him that shirt I'm not replying So look Kind of a reversing the thing normally with an exploit.  Let's ask everyone So I'm like, you know, I wonder, you know, there's these transaction IDs And if there's a known transaction ID you can DNS spoof on demand I wonder is anyone using the same transaction ID when I make a request today You know when they go out to the outside world does anyone use the same thing because I'd be really insecure.    I need to do the drinking game All right, I'm liking this. I mean do all my talk smash Hello, sir. I'm drunk. I don't know how we never noticed this before You know how in TCP you can scan for servers Well, UDP is a little different. There really is no difference between a client and a server How did we not realize until? 2005 that you can scan for client ports as well Name servers very often have fixed ports that they send all their requests from they use a single socket and It turns out you can scan for this client socket You can find out who they're sending requests out to and I'm like, well, what are these ports? I bet there's lots of servers that send out questions from a source port of 53 But you see that's I think the nice thing about having assloads of data is you can know Let's look at the data. Oh look at that 823,000 times the source port was 32,768 on an outgoing request and 195,000 times it was 32 769 and 54,000 times have it.   It just accidentally came back. Hey, by the way, we're spoofing these guys You're what? And it turns out there's all these like systems that automatically investigate what the hell you're doing When you are sending four billion packets, but when they investigate they have no idea that the investigation comes back to you So I've got like traffic from really really dark networks. We're such like Hi, there's no one within the rest of my class a but who are you? No, no, no, no. Who are you? So um As long as we're sending ass loads of traffic Can we make some pretty pictures because you know people like that? and so I've actually generated a methodology that goes ahead and Create maps all internet routes in about a couple hours it's really really fast and You know rather than just like hype this I'll show you the raw data as it's collected and Before anyone from Defcon has a heart attack the scan is happening from the 170 gigabit pipes So we go ahead we go into it Hi internet. How are you doing? We're sending out about 20,000 packets a second right now and Work trace routing in this massive Uncontrolled manner and lots and lots and lots and lots and lots of hosts are talking to us. That's a mouse, right? How are we going to filter it? Well?  Oh look on the way to twelve dot ten dot forty one dot one seventy eight Here's all of our hops and here's hop one hop two hop three hop four what you were seeing before was wildly Disordered and now we have it in order and how do we define that two things are linked? Well if that number is three and that number is four then 67 you know this host is probably connected to this host mind you we're scanning the internet over a range of like two hours so this is actually kind of cool to see it in some degree of order and What is this crap look well hang on? What does this look like when we actually get it said and done? Finally I get to show some pretty pictures. I know I'm well aware so this data has been around for a while but being able to zoom in on it is kind of new and Being able to like tilt it down and you know Raise it up and like fly around Everyone you know Hollywood really wants someone to do this so fine here. I'm flying around the internet ain't that rad Now the eventual goal and this will happen sometime in the next couple of months. Yeah, I really broke my arm But the goal is that we can go ahead and we can take live data and we can go ahead and plot it So this is all black and white and as you actually use the net goes you're going over this path They're going over this path. Here's all the constraints and all that kind of stuff And that's the kind of data. I want to be able to you know collect It turns out when you do this kind of large mapping. There's a couple things you can do extra Whenever you know we have to scan up to a certain range if we actually find someone you know At the you know the farthest away possible. We can go back fill in the gaps We can actually go ahead and you know put out senders all over the internet and have all the trend all the reception Reception happen at the same point. So you can say here's how the net looks from China Here's how the net looks from Japan Here's how the net looks from Abu Dhabi and all of it will come back to the same collector and we can go ahead We can integrate the data And the results look pretty cool, but there is there is a weakness Yeah, how are you gonna make this useful and beyond that I don't want to have to do this big pre-processing phase I would like to graph live data. How could I do that? Well, there's these guys They wrote some code in C++ It makes my nose bleed, but it's really really cool It's really really cool to the level of like it will handle like two million node networks and be like, huh sweet You got more It's really cool. It's called the boost graph library. It's rad and not only is it rad But their developers are like, okay, we're going to support Dan Sweet They're getting like updates like here is your code here are the answers to the test like struggle with this stuff Like four days and then a male here you go so What kind of stuff can we do now that we have like, you know real graph logical stuff? Hmm, let's see here This is a router trace on a small network. That's a little dark, isn't it? We'll set the next one to be a little lighter This is a fairly large-scale network and Actually, this is a router trace. We're watching traffic and It's actually animating out in front of us in real time and we're watching basically nodes that aren't talking to anyone else Here's a cluster right here. That's just one server talking to lots of hosts. Here are servers that have a multi-tier relationship This is all very early code written in the last week or two, but whoo, it's pretty and The idea is you can actually like stream random data in if I had any faith in the networks at these things I could actually do live TCP dump with all interrelationships shown on that kind of map And is this useful? Well, I made a discovery on it I took all my DNS interrelationship data and put it into that graph and what did we find? Interestingly enough.  There's a whole bunch of hosts that are all coming back to one That I expected what it did not expect and it'll take actually a few seconds for it to show up on this But you'll just have to believe me my expectation Was that you would have you know lots and lots of hosts that were actually went to one back end that talked to me What you actually see is a pretty complex multi-tier relationship one name server We'll talk to another name server. We'll talk to another name server to talk to another name server This was something that I Would not have expected. I actually don't know the layouts that create this but Having seen the data having seen it visually I could now Build my systems around that assumption the goal of my adventure of all of this is that when I do mass Internet scale scans every time I send a packet. I can know the route that packet is going to probably take I can know the routers is probably going to go over. I can know what the bandwidth implications are I can look at my pipe as a water hose as a not a hose as a pipe of just high-pressure water And I can go ahead and build taps on that based on what the implications are on the underlying network So I can say here's a t1 packets who there can only go at this rate Here's an OC 48 packets on here can only go on this rate and most interestingly I can put monitors on every single router that I'm sending traffic through and the moment those monitors I call it canaries you send five or ten packets a second to each router You expect to go through as soon as these canaries stop responding.   How can I resist? We anyone got shot glasses I get some shot glasses up here. What's your name?  No cuz I'm trashed. I am so fucked. Hey, I am drinking Alright, we're here.   Dude, we have a third shot glass. Any chance?   I'm drinking ever clear.  Thank you so much for coming here Billings was actually working.      Come on. Come here. All right. What'd you got man? Do the IPS is the ear aware of are will they auto shun their loop back interface? I Had totally not thought of that That would I seem to have nothing to drink you guys are falling down on the job. I bring you here What you want me to drink sir? Okay?    What do I need to put custom firewalls rules in for the internet will be giving me firewall rules Actually, honestly, probably a lot of IPS has already have blocks against one two seven and have blocks against RFC 1918 space But I'm sure there's one that doesn't because there's some really crappy IPS is out there What's up hang on hang on him you have you're trying to kick my ass and so of course I have to give you the mic What happens overlapping segments then what do you mean? What happens to overlapping segments? What happens to the segments the timeout values with the sevens are overlapping then? Ah, yes Yes, yes, that's one of the things I pointed out. There are some very good. Okay There are some relatively good IPSs because they're all shit, but there are some relatively good IPSs that will notice Hey look this they basically will go ahead and have their timing value for how long the fragment can live But fragments have a particular IP ID associated with them and there will be a separate timer a much longer timer that notes Hey, I may have flushed this from my queue, but This is a fragment on a session from an old This is an old fry. This is a fragment that could have be applied to an old session In other words, someone could be trying to mess with me. Hmm. Why would I try to be messing with anyone? Yeah, I guess they can bust me those Those IPSs are really easy to fingerprint and there is a problem in this industry. There are vulnerabilities in security code itself Really, I am so screwed in TC baby drinking game. Hey come up here Well, you definitely are a girl new comment Later all the fragmenting stuff does that work if they're filtering fragmented packets? No, it doesn't but that's a problem because fragments are a legitimate part of the IP spec. They're actually No, there's quite a few networks that are tunneled inside of tunnels and they end up with much small You know in the multi tunneling end up with packets larger than the MTU because there's a lot of packets that will be sent with an MTU of 1500 so Fragmentation happens it's supposed to be limited by TCP's MSS value But sometimes it really does happen and it does happen entirely legitimately now small fragments This is very obscure But small fragments at the beginning of a packet should not happen and those things are legitimately dropped and that's good As I've seen networks that do that they filter out the fragmented packets. What are they missing out on and what? Is there anything interesting about them? Well, there's an interesting thing a lot of people say hey You know I can drop one percent of traffic no problem It's just you know one percent, but you get you know this one percent this one percent this one percent And suddenly the internet doesn't work very well anymore and that happens and that's ultimately you know We have this thing called like congestion collapse when there are too much there's too much traffic that doesn't back off There's another kind of collapse It's firewall collapse when there's too many overlapping rules from people who think well are one little variation on the IP Spec is okay, and you know we're just going to do it and you know who cares if we drop one percent of traffic and then the internet no longer works and Tipping point. I'm talking to you. I can't remember the general service attack is it's either new dawn or teardrop where it's based on Fragmented TCP packets. How would that work against a IPS? The fragmented packet that I dream up paying a death Maybe where you have a packet that or that reassembles larger than the maximum IP size the TCP packet reassembles and it's broken and it causes the It causes various problems at this point, you know, it's really sad. It's 2005, right?  Okay, so so very well-known vendor that screen actually goes ahead and has like in you know on their thing We blocked this many teardrop attacks Dude, it's the 21st century.  It doesn't work even if it's unblocked We're not running Windows 95 So I don't know. I mean teardrop. I mean it's a great brand.  Um Docs par Because I do Docs para network Docs para research and Docs par caused me all sorts of problems Especially when the variant happened Docs par dot a You bastards All right other questions What? Hey, uh-oh, what do you think of the recent ICMP base attacks? There's so much over.  He's right They still work and they shouldn't His stuff about slow it. There's this guy. He has this stuff about slowing down networks. Why am I drinking?  I can reduce a session down to one packet cent per round trip time So BGP sessions, I don't know if you guys know they're about three kilobytes a second Three kilobytes a second. Okay, so um you reduce the session down to one packet per round trip time on a session that has somewhere between one millisecond and a tenth of a millisecond Latency.   So who here's from Europe? Dude, you're all guys. I'm coming out to you guys most. That's the plan so T2 I didn't intend to give him props because Torcon is the shit, but Yeah, T2 should be good. Hey, someone get these fucker's drinks.  Okay, go ahead. You have a good question. No, dude. Hang on. I want this guy to ask a question You said that your one-year tax is based on the difference between IDS timing and host timing Well in Linux and free VSD isn't it possible even in extreme situations just to rebuild the stack So if you know your vendor in advance just to match your IDS timings and your host timings Man gets a book. Man gets both books That is an excellent point Those of you who are very smart admins can go ahead Adapt your host to your shit-ass IDS and make things align perfectly absolutely correct fantastic point Are you advocating we break our host to match our IDS?  Thank you very much. Absolutely What's up? And I think unless there's any more questions. I think I am done here. You guys are fantastic I love you guys as a note.  I cannot even say thank you so much for all And oh, there's one last thing that is really important that you all know I have an insane network pipe and I'm taking proposals for how to use it If you have an idea for what will help secure the internet I will take the shit of spreading it everywhere Talk to me Don't do it yourself.  Thank you