Today we open this entire box in search of Ghost Rares. What's up guys, we're back with another epic video and today we have another box from EX Gamer. This is box number three, technically four if you count the giveaway. Second to last box that he sent us last time we achieved his goal of pulling the ancient fairy dragon. Now we just need to pull him something else awesome but first we have a giveaway. I'll be giving away this sealed. Elements will hear a wild heart. This is the misprint one where there's no secret rare but it has the secret rare lettering where it's silvery. All you have to do is like this video be subscribed, turn on notifications and let me know what you think about this box. I don't know what's going to be inside. I assume more Ghost Rares. I mean like we've been doing so, let's see. Inside we have yet again more Ghost Rares packs. So of course Ghost from the past too. We have seen much of this but we've never pulled him a Ghost Rares. So let's see if we can pull some out of there. We have a legendary duelist Synchro Storm booster box. We already pulled insane out of there and got him the Ghost Rares out of that. And then we have generation four special editions. Very nice. 10 total of those. We're going to open up all these off camera like the actual boxes and get to the packs. Okay, we got all the generation force out. Maybe we will actually pull the Leviathan Dragon this time. Ghost Rares we've never pulled it before. And also this has a really good promo. It has absolute zero as a super rare which is ended in spore of course. So you don't want that one but absolute zero is pretty nice. I think it's split five and five which is always nice. No six to four. So four absolute zeros. Definitely a nice promo there. I think we are going to keep this one sealed and send it back to him unless he really wants it open in the final opening because we already pulled the Ghost Rares and the Baron out of one box last time. So that's all you really need to pull out of here. So unless he wants more Baron maybe he'll tell me but we're going to save that for maybe the final video or send it back. And also it's, you know, it's Synchro Storm. So we've already pulled the best stuff. Let's see what we can pull out of these Ghosts from the past two and this can we get him the Leviathan Dragon before I get the Leviathan Dragon? We also have to get him I of Tamias out of here. Classic best Ghost Raer out there. All right, let's do this guys. We have a lot of packs to open. Since we're not opening the Synchro Storm it'll be a little bit less. So probably not as long as some of the other videos but still a decent amount of time. We've got a Crystal Beast Rainbow Dragon, very nice. We've already pulled one Ghost Raer multiple times. Can we pull, pull, pull two Ghost Raers at least once? You know, can we do it here on the third box he sent us? What can we pull? The last one's the fourth box, the final box. Can we get that Leviathan Dragon? I've opened many packs for Generation Force and we have not pulled it. So let's see if we can do it here and pull it for EX game. We've got the Geer Gana. That was a Rux especially you didn't even notice cause it was so smooth. Windup we've got the Phantom Magic, the Bright's Future and the Sambelle the Summoner. That is not a Ghost Raer. Let me know in the comments. I wanna hear what you guys think. How many Ghost Raers will we pull? Did I even put a giveaway question? That's the giveaway question. How many Ghost Raers will we pull in this opening? Because right now we have zero but all these packs have potential to have Ghost Raers. Really good chance to pull out a Ghost in the Past 2 compared to like this cause this is one out of 12 boxes. Ghost in the Past 2 you could get up to seven in a single case. So maybe it'll happen. We got a double or nothing. Crash Bug Y, Sleep of the Switch, Master of the Flaming Dragon Swords. Reasonable, a Resonance device, a reasonable device. Sorry, the device is very reasonable. Let me tell you. Leviathan Dragon would be pretty cool. I still need to pull one. I have not pulled one. I still need to get a First Edition near men. I believe Master of Vapor. That is nice. We got Elemental Kiro Absolute Zero and Master of Vapor. Kinda have the exact same pose going on there except instead of holding nothing he's holding a spear. So pretty cool and that guy is a cape but very similar looking stances they got there. We've opened much Ghost in the Past. I'm still not tired of it. I know some people are probably tired of it. I'm not tired of it. I just really enjoy opening it. It's so fun when there's nine different Ghost Shares and almost all of them are cool, especially Eye of Tamias because that's what we're gonna get for EX Gamer. We really want him to be happy and get Eye of Tamias. And the reason I really wanna get him Eye of Tamias is because during the live stream when he first started this, he jinxed me into getting three Eye of Tamias. So I'm trying to get some revenge here and pull him a Ghost Share Eye of Tamias. So far though, no luck. No luck jinxing him. He has not even pulled a regular Ghost Share out of there. We got Pinky and Goblin. All we've done is like pull the Ghost Share he actually wanted. The Gym Elephant and Skystar Ray. I guess we pulled the one out of Synchro Storm. I don't know if he wanted that one or not either, but it's a Ghost Share. You want it, you know, it's pretty awesome. Speaking of Ghost Shares, I think you guys are seeing this on Friday. Tomorrow, we are giving away a Ghost Share in tomorrow's video. A Ghost Share Dark Magician Girl. Yeah, you heard that right. Ghost Share Dark Magician Girl being given away to one of you guys. So make sure you guys check out tomorrow's video. It's gonna be pretty awesome. So go check it out. Make sure you guys enter the giveaway there. We got the Ghost Sharing and today of course. Giveaway winners were announced last week. So go check out the YouTube community tab. I have not shipped every order or not order, but giveaway yet. I did about half when they first announced it. We got the Quill Pin of Gildos. Very nice super rug. Also, we have uploaded a new video on Poker Rucks. So go check out my second channel, Poker Rucks. If you guys wanna see that. Also, all those videos are coming from stuff we're doing on Twitch Streams. So go check out Twitch. I've been streaming five days a week for the most part. Occasionally, we have a canceled stream, but you know, four to five times a week. It's a lot. So go check it out. Hope you guys are enjoying that channel, enjoying this channel. We've got a lot going on here. Double nothing. This could be the Leviathan Dragon. It's an XC's monster. And it is the Leviathan Dragon Ghost Rare. We finally pulled the number 17 Leviathan Dragon. Let's go. Yes. It's the unlimited, but yet beautiful Ghost Rare. Number 17. Leviathan, look at that. Oh my goodness. That foiling looks amazing. Do you see any scratches in there? Look, I'm in there. Hi guys. EX Gamer, you sent us the loaded packs to open for you. And yeah, this has been quite the opening over the course of these few videos. We have pulled Ancient Fairy Dragon, Leviathan Dragon, and we have pulled the Synchro Storm Ghost Rare, which I can never remember the name. It's like Crystal, Crystal, Dragon, Rainbow, Ultra Crystal, I don't remember. So now we just need to pull in the Ghost in the past two Ghost Shares. And that pretty much puts the cherry on top. We have pulled the card. I've opened tons of those packs and I've not pulled a Leviathan Dragon. Probably like, I mean, I would say several hundred at this point in terms of that, we should have pulled it based on the ratio, but we haven't pulled it yet. So there you go, EX Gamer. Huge congrats on pulling that, man. That is, that's big. That's awesome. I think you'll be pretty happy. So I remember what I said, you had to let me know. In fact, in mail there it is. How many Ghost Shares are we gonna pull? How many Ghost Shares are we gonna pull out of these packs? We pulled one so far. Will it be two? Can we finally get a two Ghost Share opening? I'm in this video. No, not that time. We have Tyrant's Tummyache, past image, Jim Elephant, Sea Lancer, and Skull. A good icon. Very nice. The Kraken has been cracked. Let's see. Does this have the Dark Magician Girl? The Eye of Tamias would be even better, even more epic. We got the Reptia Egg and the Necro Slime. Okay. Also, I think tomorrow should be Saturday. So that means we will be at Chicago, the national. So if you guys are in the area, if you guys are going, make sure to say hi. I will be there hanging out. So come say hi to me.  I don't know if we're gonna be dueling or not, but trade, check out some cards in the box. I'm gonna bring a few cards, hopefully, so that we can check it out. If you guys have your collection, check it out for the blog or whatever. Make sure you guys come say hi. Double or nothing about the asleep. We got the master. Oh, fish and a fly thing. All right, damage vaccine. Not bad. But wait, 50% of you guys are not subscribed to the channel according to this graph. So go down below and click that subscribe button. We're kind of flying through these, but there's still a lot to go. This is a lot of packs. We've already pulled a ghost. I want to pull a second one. Let's go. I'm a zero Nios Clugger. A lot of elemental heroes so far. We've already pulled the ghost here in Leviathan, but that doesn't mean that we can't pull another one because in these packs are from special editions. There could just be another one. There's no sort of ratio. That's just pretty cool. Okay, not bad. Not bad. Ghost from the past too. What shall we pull then? We have number 38. We have Crystal Beast Wayne Boadwagon. Whistle Beast Wayne Boadwagon. Let's see what we can pull next. Will it be the Crystal Beast? We have Explosive Urchin, Gusto, Cracking, but the painful return and a cha-cha archer. All right, all right, very nice. Next up, Ghost from the Past. Here it shall be and there it shall go. All right, we have another Crystal Beast Rainbow Dragon, very nice. Let's see what we shall pull here. Will it be a second Ghost Share? Also, the Ulti would be pretty cool. It looks really nice. The, oh, it was Submersible Carrier Arrow Shark. Okay, Super Rare. Had that in my water deck for dual links for a while. I'm just barely ever used it, but it was in there. It was in the extra deck. I didn't actually get used much. We've got Chronicle Magician. All right, I'm super hyped about that number 17. Literally guys, it's been a couple of years of trying to open that and I have not pulled it. So it's pretty cool. Absolute Crusader. Now we can add Leviathan Dragon to the Ghost Share list because remember when I said I wanted to pull every Ghost Share, we're adding another one to the list. I mean, at this point, we've pulled at least 20 because we've pulled nine out of Ghosts from the past too. So that kind of cheated a little bit, but oh, number's 97, all right. But we are making progress. I mean, we've pulled in just this. I never pulled, no, I had pulled Ancient Fairy. So I guess just one new one for me, Xgamer stuff, Banshee. But we have done pretty well overall pulling. We had already pulled Ancient Fairy. There's a lot of 5Ds that we still need to pull that we haven't pulled yet and definitely the GX stuff. The GX stuff, we have not pulled many of the Ghost Shards because like, or any of the Ghost Shards actually, because there's, let me think, rainbow, oh, we've pulled Rainbow Dragon. There's no, we haven't pulled the Rainbow Nios out of, what is that? What is that? Is that Phantom Darkness? We haven't pulled Honest. We haven't pulled, obviously the MISPRINCE. That's gonna be insane to actually try and do that. I don't know if it's possible. It's possible to pull them or at least the, well, I guess both of them are technically possible, but yeah, it's probably not gonna happen. But that's the goal. It's a one day do it. We got the Nios Kluger, very nice. I feel like I'm forgetting one. I don't remember what it is though. Let me know in the comments which one I'm forgetting from GX that I haven't pulled yet. Final Filament, painful return. Crash Bug X, very nice, very nice. Also make sure you guys, I've been posting shorts a little bit more recently and I'm posting them on the main channel instead of the shorts channel because I feel like nobody was really seeing them on the shorts channel. So if you guys wanna check out the shorts, appreciate it. If you guys do that, just trying to make some shorter clips and stuff like that that'll be fun to watch or whatever. Aqua Jet, we got a wing toward us and a Char Char Archer, very nice. Oh, we dropped it. Ah, Ghost from the Past 2. Okay, Ghost from the Past 2. You are letting us down. So far, Generation Force has already gotten a Ghost Share and you have yet to get one. You just have to step it up and pull one. Come on, let's go. Vision Hero, Deco Targaryen Soul. Let's pull it, let's do it, uh-oh. Oh, we're losing the packs over here. They're going all over the screen. Next up, Leviathan Dragon, number two. Can we get the Ultra and the Ulti as well? Losing this. Ultra, Ulti and Ghost in the same video. Let's do Double or Nothing, Crash Bug Y, Sleep the Switch, Infected Male yet again. Pull two of those, why can't we pull two Ghost Shares? I'm just asking, I don't know. Is that a thing? You can't pull two Ghost Shares? I don't think so, because we've done it before. So I know that you can pull it. Let's go. Galactic Soldier, that's a good card. So many Ghosts from the Past. These like five packs, like five card packs. You stack them up, doesn't look like there's that much. There's just a hundred packs in there. There's so many. I want to know like how much Ghosts from the Past do you guys think we've opened at this point? Like 20 cases or something? Double or Nothing, Eroica and Thunder Short. We have opened by far the most of any set that I've ever opened. Like, oh, but a lot of Ghosts from the Past, one, Dawn of Majesty, stuff like that, but it's not anything compared to Ghosts from the Past to we went crazy. Outburst Dragon, very nice. I'm still looking for that Ghost Share. And so far, we have none had luck pulling one out of here. We've got Sky Cavalry. We have pulled, of course, Leviathan Dragon. Really, man, that card is beautiful too. Just as beautiful as I imagined when we pulled it. Master of the Flaming, we've got the Goblinberg. Smashing Horde of Seeker Rare. It's been a while since we've had a high rarity card, but we got the best one. Smashing Horde is not a good Seeker Rare, but it is a Seeker Rare though. You know what I'm saying? It's just, I flipped it over just to flip the wrong one because I had two in my hand. What a mistake. Rookie mistake. We have number 97, Jagooblion. All right, Jagooblion. I see what you're doing there. Give us something good. Protector of the Agents, Moon. Back to the Gen Force. The Generations of Force. We have Gusto Kodor. Let's leave it to the Switch. Go, go, golem. Oh, and an Ultimate Rare. Elemental Hero, Nova Master. That's an awesome Ultimate Rare. So we've now pulled the Ghost Rare and a Nova Master. Not just an Ultra, an Ulti. What a special addition. Oh my goodness. PXGamer, we should just open all your packs from now on. Because at this point, we are pulling insane, dude. We are pulling absolutely insane. That's a great pull. Nova Master's really cool. It's one people forget about. An Elemental Hero that's been in here for a while. We've got Destiny. We've got Amonju. Nice. Well, we get onto Gen Force. We have Past Image. Gem Elephant, Cracking. The Great Emperor. Oh, Fish. Poke Draco. Very nice. Ghost from the Past too. Come on, Ghost from the Past too. We've got Tatsunekro. Mystical Sand. Mystical Shine Ball. Very nice, very nice. We have 3D New Uniform Novel Clature. The Go-Go. We've got the Oh, Levee-R, the Sea Dragon. And this is a great Ultra rare. This in Ulti is over $100. So this is still an awesome Ultra as well. Wow, this is a great special addition. So we hadn't hit anything in a while after the Ghost, but now we're hitting some fire stuff. Woo, oh my goodness. This is an opening, guys. This is insane. This might be the best one yet, honestly. Well, I guess Ancient Fairy is like $200. So it's probably worth more than all of these. But second best, just because of that. Now, the Ghost from the Past has been awful though. We haven't pulled the Kriss Tarnaka Firebacks, a Luber. We've pulled Heat Soul a couple of times, which isn't bad. I think it's only like $2 or $3 now because there's so many on the market, but still a good card at least. Let's see, what else could we possibly pull out of here? We're pulling everything. Gusto Kodor, we got a Sleep of the Switch, Resonance of Ice, and Fly Fang. Okay, not bad at all, not bad at all. Ghost from the Past 2. We have Yang-Zing, Brutality, Advance, the Dark Alligator. Let's keep it up. We have Despion Comedy, Primath. Oh, and a Luber, there it is. Okay, we brought it up and we pulled it. So a Luber's a great pull as well. Yix Gamer, we have pulled, like every video has been crazy pulls. I don't know what it is.  Wow, pretty nuts, man, pretty nuts. I can't believe how good the pulls have been over the course of all these packs. Like the one Synchro Storm Box that had both Baron and the Ghost Rear. Now we've pulled, out of one special edition here, we pulled a Ghost Rear Leviathan Dragon. We pulled the Levear, the Sea Dragon, and an Ultimate Rear Nova Master. I mean, other than Ghost from the Past 2, which has not been very good. Everything else has been insane. Really crazy, actually. And then of course the Ancient Fairy. Don't forget about that. We've got the Windup Magician, which is the whole point of this, all these openings we're doing for him. Cause he needed the Ancient Fairy or he wanted it. All right, let's see. Reptia Egg, nothing there. Man, these Ghosts from the Past are really letting us down. Oh, really letting us down here. Double Warrior. Oh, and there it is, the Dark Magician Girl. No way. Speaking of the Devil, we're giving one of these away. Ghost Rear Dark Magician Girl. In the same video as number 17 Leviathan Dragon, dude. Our luck is unmatched right now. It's unreal, unbelievable, dude. Unbelievable pulls. All right, last few packs, guys. This is insane. This is insane. Oh my goodness. Absolutely insane. We are pulling fire right now. Like, I just need to open more stuff because we've had so much good luck today. Explosive Virtue, we've got the Gusto Kodor, Blue-Blooded Oni, that's a super rare. All right, we'll take that. Man, this is unreal. Shout out to EX Gamer, congrats on these pulls, man. This is crazy. The Ghost Rear Dark Magician Girl, Leviathan Dragon, Ancient Fairy Dragon, Crystal Clear Wing, Synchro, whatever it's called. So now four total goes. So he's not gonna be upset. Okay, three is where he said that he would be super, super happy in one video. Or maybe it was total. Did he mean total or did he mean one video? Maybe he meant total. Because if he meant total, I feel like that makes more sense because three in one video is pretty insane. So we've crushed his three that he wanted. We've got four now. And we've got a whole another box to open. We've got Bright Future. This is insane. This video is nuts, man. All right, we're gonna save the last two for Gen Force. Let's see if we can get another ghost. Galaxy Soldier. Galaxy Soldier's pretty good. We got a few of those. Let's go to the second to last pack. We didn't even open the Synchro Storm Box. That probably has a Ghost Rear in it too. Not knowing this luck. Legendary Windup Key. Okay, final pack, guys. Free EX Gamer. This is the third out of four boxes. So there's one more box to come. If you guys wanna see that final box, make sure to let me know in the comments. I mean, our pulls have been crazy. I don't know what could possibly be at the end. Let's do the pack trick for the final pack. We have Poseidon Wave. Underworld at Clutch. We got the Mill of the Temporal Magician. Explosive Urchin. Gusto Kodor. Double or nothing. AnaVision Hero Trinity, not bad. Okay, there's still two other cards. That was not the right pack trick, but a nice Super Rare. Oh my goodness, guys. Let's just take one more quick look. One more quick look real quick. Just one more quick look. Oh my goodness, EX Gamer. Congrats. If you guys enjoyed this video, make sure to subscribe to the channel for more epic videos like this. Shout out to TCG Trust Cards Tome Fo Show, Tomato Juice, Daxer JT Chill, Puffins of Doom, Ernesto D'Anda, Squirtle, Flexi Boy, Dizzy, Stanley, Mike Nance, Mimic Gecko, Ian Musa, Junior Barney, John Nolan, and Untie Show, Thomas McLean, and Seth Fisher. Thank you guys for supporting the channel, and I'll see you guys next time. Peace.


They say Hollywood is all about the numbers, box office receipts, record sales, overnight ratings. Well, with this year's Oscar nominations finally announced, all sorts of records were broken. Oscars so white, more like Oscars done a bit more right. Am I right? Now let's take a look at both the surprises and the snubs and break it down by the number's famous entertainment style. Number 10 is Meg, leading all the nominees with 10 nods including best picture, director, actor, and in a category which sees Amanda Saferi scoring her first nomination best supporting actress. Interestingly enough, Saferi is the second member of the Mean Girls plastics crew following Rachel McAdams to score an acting nomination. Sorry Lins, why don't I know you? At number nine, a record nine people of color are nominated this year in the acting category. These include Steven Yun, Riz Ahmed, and the late Chadwick Boseman is best actor. Viola Davis and Andra Day as best actress. Daniel Caluya, Leslie Odom Jr. and LaKeith Stanfield as best supporting actor. And Yun Yu Young as best supporting actress. LaKeith is also double nominated both for acting and songwriting in the same year, joining recent double nominees Mary J. Blige, Lady Gaga, and Cynthia Arrivo. At number eight, the long overdue Glenn Close scores her eighth career nomination landing in the best supporting actress category for the critically panned Hillbilly Elegy. While some critics have praised her performance as the real-life matriarch Mama, she's had a hard road ahead as she's also nominated for a Razi for the very same performance. If she pulls off the Oscar win, she'll make history.  At number seven, the number of personal snubs we found amongst the list of confirmed nominees. Take a seat, this may take a while. First off, Regina King in the best director category for One Night in Miami. If nominated, she would have become the first black woman ever nominated in this category. Still, this is her first directed feature film, so she will have many chances in the future. King continues to be our queen. Delroy Lindo and best actor for The Five Bloods. Despite rave reviews and awards from critics for his performance as a Vietnam vet in Spike Lee's Netflix film, he failed to score a nomination adding to his Golden Globe and SAG Award snubs. Bill Murray and best supporting actor for On the Rocks. Some thought the funny man would score his second career nomination for his performance in Sophia Coppola's family comedy. Instead, the On the Rocks buzz has officially melted. Just pour us another one. Ma Rainey's Black Bottom. Despite a 90% fresh rating on Rotten Tomatoes and nominations in the leading acting categories for front-runners Chadwick Boseman and Viola Davis, Ma Rainey's Black Bottom failed to top the nominations for best picture. Aaron Sorkin as best director for the Trial of the Chicago Seven. A previous Oscar winner for the social network screenplay, this was Sorkin's best chance yet at a directing nod. But all is not lost, he still has a very good chance of winning his second screenplay statue for Seven. Jody Foster for best supporting actress for the Moretainian. Despite her surprise Golden Globe win in this same category last month, the two-time Oscar winner failed to add a fifth career nomination for this political drama. Foster's Oscar hopes are officially in memoriam. And finally Michelle Pfeiffer in the Best Actress category for French exit. Last year some Oscarologists speculated the three-time nominee could possibly maybe finally win for this quirky comedy. But then well the film opened to mix reviews. She lost the Golden Globe to Rosamund Pike and very quickly the French exit star exited the race. Maybe Bruno Mars can include her in another song to cheer her up. Okay back to the actual nominees. At number six is the number of career nominations Sir Anthony Hopkins now has thanks to his best actor nod as an Alzheimer's patient in The Father. It's been almost 30 years since his first tasty nomination brought him what is still his only win. Can you guess what role that was Clarice? He really chewed the scenery. At number five the number of nominations that the uncompromising drama promising young woman received including best picture best director and best actress for transformative Carrie Mulligan. Despite its candy-colored veneer this indictment on culture is thought-provoking and continues to linger long after our first viewing. At number four Viola Davis makes history as the most Oscar-nominated black actress scoring her fourth career nomination as the title character in Ma Rainey's Black Bottom. With this nod the Oscar winner surpasses her help co-star Octavia Spencer who has three career noms and if she wins she'll be the only black actress with two acting Oscars. At number three the late Chadwick Boseman will become only one of three actors to win a posthumous statue if he succeeds in the best actor category. If Boseman does win he'll join previous winners Peter Finch for best actor in network and Heath Ledger for best supporting actor in The Dark Knight. It'll be a fitting tribute for a legend lost too soon. At number two just because two separate achievements. First two is the number of female directors nominated this year Chloe Zhao for Nomadland and Emerald Fennell for promising young woman and while we are happy to say that this is a historic showing sadly it's only two. Still progress continues to be made with Zhao the favorite to take this category. Also at number two the number of black women nominated in the best actress category Viola Davis and Andra Day. The last time this happened was almost 50 years ago when the late Sicily Tyson and Diana Ross both competed. Interestingly this year's day and 1973's Ross both played the same legendary singer Billie Holiday. At number one two separate number ones both nominated in the category of best actor. While most of us best know Stephen Yun for battling zombies for many seasons in The Walking Dead it's his touching turn as an immigrant Korean father raising his family in 1980s America in Manari that is garnering raves and awards attention and makes him the first Asian actor to be nominated in this category. Also in the same category Riz Ahmed. The Star Wars Rogue One actor also makes history as the first Muslim to be nominated for his performance as a punk metal drummer experiencing hearing loss in sound of metal. While Chadwick looks to be a lock in this category we think Riz definitely has an opportunity to surprise and if he does the Emmy winner will be adding an Oscar to an already quickly growing award show. What do you think about this year's nominations and about our favorites? Did the Academy get it right? Will you be tuning into the Oscars and how many of the nominated films have you already seen? Be sure to like this video and leave your comments for us below.


First of all, I would like to say thank you to GRNPP for organizing this very important event and inviting me to the board for this opportunity. GRNPP is the first international partner for Cambridge Institute and the first international organization who gave us the fund for research in Chinstay. It is the one, the first one from whom we receive our research funding. The title of my presentation, the title of my presentation, the forgotten majority itself imply that in Chinstay the majority of people, especially young people and women are excluded from the political sphere and political life. Before I go into the presentation, as I mentioned about the relationship between Cambridge and GRNPP, as GRNPP being our first international partner and international platform for Cambridge Institute, we started our research on political representation and participation in Chinstay with GRNPP funding in 2019 and it was completed in 2019. And we, the Cambridge Institute has a very high commitment to continue to work on Chinstay Parliament and political groups in the same area in Chinstay for the coming years, including this year. In Chinstay, in this presentation will be three key issues. The first one is the constitution, how it is to limit the participation of young people in the politics. And the second one is how the political party system we enforce the exclusion of young people or women in Chinstay and the social norms and cultural practices and the cultural representation in Chinstay. The presentation will hold a focus on Chinstay. In the 2008 constitution, we see a lot of age restriction. For instance, if we want to become a Bidu Loto or State Loto member, we have to reach at least the age of 25. And if we want to be a Mudo Loto MP, we have to reach at least 30 years of 30. So this is from the foundation limit the opportunity for young people to be able to participate and play the key role in politics in Chinstay and as well as in Myanmar. This was the fact that the participation of young people is limited by the constitution and the law is often reinforced by political party structure. I would like to take Chinstay for democracy, CNLD as an example. This is the strongest, the most powerful ethnic minority body in Chinstay. CNLD doesn't have a proper membership system and the fact that it doesn't have the proper membership system means that young people cannot play a political role within the party nor neither have a political decision making power because the easy, the as a guilty community is composed by all people and whom of them, the majority of them are men as well. So this limitation excluded from the system, the structure that this restrict young people, women to be able to have a say within the party system. This means that even in the near future, young people or women will have less chance, opportunity to be able to run in the election and to be able to have a say within the party. If we go to the social norms, yeah, in Chinstay, to be honest, I don't have much thing to say the social norm in this term, but in Chinstay, older people, older people are destined to be more respected and they are given priority over young people. So this has allowed other people to play, to have much more say in political sphere compared to young people. And women are also restrict their rule to the household life. So it is often assumed that women should participate in the politics. So it is the norm, the societal value within Chinstay. If we see the data from 2015 election and 2020 election, we'll see how women and young people excluded in the parliamentary or other politics. In the out of 2019 MPs in 2015 and 2020 parliament period are women. So this is a very less compared to the number of men MPs. In Chinstay, there was no single women MP at Chinstay parliament for this period. In the 2015 general election we see 21% of women running for election and in 2020 it was reduced by 2%. So rather than a progress we are seeing a decrease in the number of women in electoral candidates and election. Many political parties including the Chinstay National League for Democracy promised to include more young people, to invite more young people in the election, the coming election, 2020 election. But the result we have seen the result in 2015 only 2%, only 2% that is five people out of the total 201 candidates are men, sorry, young people below the age of 36. And in 2020 the coming election only 19 candidates out of 211 candidates in Chinstay are young people below the age of 36. So we, although we see very small progress, this is a still very low number of young people in the politics. So the fact that the executive committee of the National Chinstay National League for Democracy for instance are all people, many all people mean that young people cannot have more opportunity within the party politics. So the election candidate in fact are elected by the political party executive committee member only. Many of the young people identified themselves in Chinstay as a member or a supporter of Chinstay National League for Democracy, but they don't have a say, they cannot vote for electoral candidate in the primary party election. The last point, cultural representation, I think who is being represented, represented or participated in the politics is important, just like what, what or whose is represented as well. For instance, it can be a cultural element or a history. This is a new Chinstay Parliament building. So, the language is in Burmese and in English, but in the top we see a home view about a Chinnish and about. So this is a progress for the Chinstay Parliament in terms of cultural or symbolic representation. This Chinstay Parliament building, new building is open in February 2019. This is the entrance point of Chinstay Parliament new building. So here we see a rubber statue wearing different Chin traditional dresses. So this song much more, this signify or imply that Chinstay Parliament embarrassing Chin culture and history in making more visible within the Parliament. And this also is a very important picture in the Parliament building. This is a hardship rigged lake. It is located between, located near the border with Chinstay, at the border with India. And yeah, this is one of our very famous tourist destination and it has a very important history for Chin people. And the next one, we have a closer look here. Here we see a pattern. This pattern, look, if this is not a Chin pattern, still it look very similar to Chin dress pattern. If we look here. So this we can say is Chin pattern. So this is the pillar of Chinstay Parliament. So this also indicated there's a progress in terms of representativeness in Chinstay Parliament building. So this is a very famous Chin bridge student, the democracy study students and Chin Statehood to the beauty director. Taking a picture of the role play of the parliament. And here the pattern, here is this pattern, however, doesn't seems to be related to Chinstay or Chin people. This pattern look like more Burmese than Chin elements. Similar to this around the parliament building within the parliament building. But if we look at the corner right and the corner left, we also see Chin patterns. So there is a state of progress in term of visual representation in the Chin built the Chin State Parliament building. I hope in term of the exclusion of minority ethnic group, young people and women will come to us to be deeply rooted in our society, as long as the law and the system like political party system that impulse for the political exclusion or a chance. And then I personally really hope that there will be more representative cultural element representativeness in the Chinstay Parliament in the coming parliament period as well. Thank you so much.


American Shore and Beach Preservation Association, ASBPA, is an organization of coastal practitioners. We work both on science and policy to advance efforts to build and restore our nation's shoreline. We often think of beaches as important for recreation, but beaches also provide a critical function of protection and protecting the communities that are behind those beaches from coastal storms, from sea level rise, from the hazards that come with living along the coast. And unfortunately, those beaches are often, many of them in the Gulf Coast, are eroding. We're seeing a loss of sand, a loss of sediment. And so groups like ASBPA and our partners on the ground are working to restore those beaches to maintain and build those, the protective beach and dune structures that provide community protection. What do you need from federal agencies in order to protect our shorelines? The most important things that the federal government does is provide federal appropriations. So the annual appropriations bills that fund the Army Corps of Engineers, that fund NOAA, that fund the U.S. Geological Survey and the Bureau of Ocean Energy Management, these are bills that need to be passed every year.  Increasingly we're seeing the funding for coastal resilience come out of disaster supplemental bills. So bills that are coming out after a disaster that are funding the kind of resilience that should have been done before the disaster. So it's sort of a backwards situation. However, that is the one major source of resilience funding that is coming from the federal government right now. So those disaster supplemental bills are essential. And then the other big source of funding that is really critical is going to be a federal infrastructure package. And critical part of that is maintaining our coastal infrastructure and critically our natural infrastructure. So we need to make sure that beaches, dunes and wetlands are part of any infrastructure package. Lots of other bills out there that can help supplement this effort. There's a Living Shorelines Act that was recently introduced. There's a Coastal Communities Adaptation Act that would help coastal communities adapt to the impacts of sea level rise. So other good legislation out there.


there is an argument on the internet about whether or not as a linux user you should learn the terminal and there are Very good arguments on both sides of this debate on one side You have the people who say you can use the GUI to do anything and they're right on the other side of the argument You have the terminal people who say yeah, but you can do all the stuff you can do in a GUI oftentimes faster Easier and more efficiently. They're also right. So the argument between these two camps is an argument that is really Not an argument at all because if they were to have a race, they would still come up tied How you use your linux computer really doesn't matter. You can use all GUI applications You can use all terminal applications. You can use a combination of them. It doesn't matter. However Your workflow is best suited for you is how you should use it And I don't think that anybody would really disagree with that now You will have the fanboys on one side of the other telling you that you should do it their way But you should ignore those people and just do it the way you want to do it The question becomes is there an advantage of doing it one way or the other? So should you use the terminal or should you just stick to using a GUI program and The answer to that question is is there an advantage to one way or the other is? Unfortunately complicated and it's for multiple reasons for one if you stick to just GUI applications You're going to get everything done that you want to do. That's just the way it is There's no problem with using a GUI application no matter what some of the to the term terminal urge will tell you and Chances are you'll get all of your work done in a way that doesn't require as much Knowledge as which you would have to have in order to use the terminal now That's not always the case sometimes doing things in the terminal is actually easier and you can it can be proven to be easier But that's not always the case and I'd say most of the time. It's not the case There's a friction to learning and doing things in the terminal The oftentimes just don't exist when you're using a GUI application simply because the vast majority of people have been trained Ever since they started using computers to use GUI applications They haven't been trained to do things inside of a shell or inside of a Bash-scripting language or whatever it is and that friction is always going to exist until they push past it and make the effort to learn about how to do things inside the terminal and not everyone has the interest or Capability of actually doing that learning so to go back to the question Is there a advantage over doing it one way or the other and the answer to that question as I said before is? Complicated because there is it is an advantage to having things be the way you're used to them being done So if you've been trained over the course of your computing career to do things in a GUI That's an advantage because chances are even if you come across something that you don't know how to do you can use your experience in previous programs to kind of navigate your way through the new thing and that's not something you can do in the terminal because Every terminal application is mostly different now There are some common threads like you can use the dash dash help flag in most applications or man in for most applications And that will exist But beyond that flags are going to be different the way you run programs are going to be different There's no set way because there's no buttons, you know if that makes sense So there is an advantage for the GUI folks now the question is is there also an advantage of learning the terminal? And the answer to that question is also yes So as you can see that's the reason why I said it was complicated Because the thing is is that if you use Linux long enough, you're going to come across a situation where you have to use the terminal Now I know what I said before like you can use GUI all the time and Never have to use the terminal and that's the case for 99.9% of the the situations you'll find yourself in that's just I mean it's true There's gonna be that one moment where you're expect experiencing a problem And you have to fix it and the only tutorial on the internet tells you to go into a terminal and do Whatever there's no the there's no GUI. I mean there's chances are there is a GUI way of doing it But there's no documentation on how to do it a GUI way The only way you can find a documentation to do it is in the terminal And if you've dedicated yourself just using GUI's and have never learned anything about the terminal You're going to find yourself in it edit this advantage in that situation situation. There is also an argument to be made That by learning the terminal you learn more about Linux Then you do if you stick to using the GUI Applications all the time and I think that this argument is true simply because if you learn the terminal You're gonna learn more about your file system. You're gonna learn more about where files are placed on your system You're gonna learn more about how even GUI applications save configuration files You're gonna learn so much more Inside of a terminal then you'll ever will in a GUI at least that's the way I feel and as someone who Likes the fact that Linux kind of forces me to learn new things all the time I think that the terminal is good for that reason is that every time I Discover something new in the terminal I feel a sense of reward in that process now Maybe you don't place the same kind of value on that experience as I do but I do think that there is some value in Learning new things Beyond all that there is an argument to be made that the terminal can provide you with more efficient and easy ways of Doing certain tasks moving files around navigating the file structure Renaming files batch renaming files Converting files all this stuff it can be argued that doing it in the terminal is actually more efficient efficient simply because You can use multiple programs with inside the terminal Whereas you'd have to have Several different applications to do all those things in a GUI environment. Also, there is the argument that The terminal will actually use less resources. It doesn't have to draw a lot of stuff on the screen So a lot of times terminal applications are faster Actually faster than GUI applications at doing things.  Where should you be? What what should you do? And the answer to that question is something that I said at the beginning of this video Use whatever you want to use use whatever fits your workflow the best. That's the way Linux works Anyone who tells you you have to do this or you have to do that is Barking up the wrong tree because that's never gonna fly with me. It's just not the way Linux works It's not the way Linux should work. You should use Linux the way you want to use Linux You're not on Windows anymore. You can do things a number of ways and there's no correct way of doing it No matter what anybody else says so a little bit of a rambly video Thanks everybody for watching if you haven't already hit the subscribe button and the like button I really do appreciate it if you have comments about this topic or any other topic You can leave those in the comment section below You can follow me on Twitter at the Linux cast You can support me on patreon at patreon comm slash Linux cast before I go I'd like to take a moment to thank my current patrons today Devon Patrick all Primus Marcus Meglin Jack and Nick and tool Steve a cyber girl in X garret Mitchell archsenter carbon-dated Jeremy Sean Oden Martinie Merrick camp Dutch really J dogs Peter a crucible dark minute six and flat a thanks everybody for watching. I'll see you next time


Okay, let's get going. Hi, everybody. Today we're going to talk about security and hacking Drupal. I'm Matt Korstaff. I lead a team of Drupal developers at FFW, formerly Blink Reaction and ProPeople, where the largest Drupal shop in the world, about 400 people now, and we built enterprise Drupal applications for large corporate clients. We're based all over, but I work from the Princeton, New Jersey office. Today, I'm going to talk to you about the Drupal Geddin SQL injection vulnerability. This was a major vulnerability in the Drupal database API that affected all Drupal 7 and 8 installations and a handful of Drupal 6 sites. This bug allowed a skilled attacker to inject arbitrary SQL into your Drupal database, and in many cases, take full control of your web server. This is widely regarded as the worst bug ever discovered in Drupal, though. Now that the storm has passed, I think we can reasonably assert that little real harm was done. One of my personal websites was affected by this attack. This is whaleocalypse.com. This is where I post my cartoons about whales in a post-apocalyptic future. This is actually why I got into software development originally, not because I specifically wanted to be a software developer. I did, but mostly because I needed some place to post my cartoons about talking whales and talking fruit and parody real estate ads. So Drupal was the natural choice. Anyway, this is a plaything for me, so it really didn't matter for me that it got hacked. I just kind of shrugged and restored from backups. There was actually a tremendous upside to being hacked, and that was that it allowed me to examine the artifacts left behind by the attackers. I spent a long, long time looking at these artifacts, and I was able to use them to reverse engineer the tools these attackers use to break into my site. You can view these tools on GitHub, along with a set of files to help you defend against this and similar attacks. In this talk today, I'm going to show you how these tools were used to attack my site. I'm going to show you in detail how to use them, and more importantly, I'm going to show you how to defend against this and similar attacks. And if you want more information on this, you can get effectively the same talk on my blog, which is matcorpestoff.com, and it's linked off of GitHub. I'll put a link to it on the DrupalCon website. A couple of disclaimers before I begin with the technical portion. First, I'm going to reveal how this hack was pulled off in very, very specific detail, including a large amount of fully functional exploit code. If at any point you feel yourself going, hey, wait, stop. You're telling people how to hack my site. I'd invite you to stamp that feeling down. If you were still vulnerable to any of the techniques described here today, I'm sorry to say you were already hacked months ago. You've probably been hacked several dozen times by different individuals, and there's a very good chance that your server is now part of a botnet being used to send spam. The simple fact is that we need to be able to have honest, frank, detailed discussions about security in public in order to educate ourselves and prevent the next Drupalgeton. Because if we don't have that conversation, someone else will, and that someone probably has malicious intent. That means releasing the exploit code, and it means letting people use that code from learning and penetration testing. By the way, this is not just an academic exercise. You can literally go, I'll show you right now. You can go to exploitdb.com, and you can find five versions of this that are way worse than anything that I'm going to show you. These tools exist, and they are freely available, and pretending they don't exist will not make them go away. We need to learn how they work so we can defend against them. The second disclaimer I want to offer, this one's kind of more of a joke, but I'm going to confess it's just some really terrible things that I did on whaleoclips.com that let people break in. It should go without saying that these are huge risks that I took on a plaything website. I would never take these same risks with client work, and neither should you. So let's explore this bug a little bit. The bug specifically lies in the Drupal database abstraction layer. That's the layer of Drupal that allows you to connect to a MySQL or some other type of database server, specifically in this expand arguments function. This is part of Drupal Core. This is database.inc. This function you would never have occasion to use unless you were actually doing Drupal Core development, and otherwise you probably wouldn't even have occasion to know that this exists. This is a normal boring utility method that does some pre-processing on database statements before they're sent to the MySQL server. I'm going to show you exactly what it does. But the sort of key thing to realize is that this is a thing that flew under the radar because no one ever uses it or touches it. A normal Drupal database query. This is about as simple as a Drupal database query gets. What we're doing in this query is we're getting the title of a node whose ID is 123. We don't pass 123 directly into MySQL. Instead, what we do is we supply a token that will be replaced in the Drupal database abstraction layer, and the reason we do that is ironically, as you'll see for security purposes, because these tokens get sanitized for us. It was the sanitization itself that had the bug in this case, which is what made it such a terrible bug. So this is a pretty simple database query. You can get slightly more complex with a database query. You can use a token as a part of an in statement, and you can replace it with an array of values. The problem is there's no straightforward way to pass a PHP array into MySQL. MySQL only understands strings. So at some point in the preparation of this database statement, this array has to be collapsed down into a comma-separated string. That's what expand arguments is for. So expand arguments is going to do one completely simple straightforward thing. It's going to take NIDs, and it's going to change it into this. NID 0, NIDs 1, NIDs 2. It does nothing else. The problem with this implementation, and this, by the way, makes total sense, this is a completely sensible way for PHP to interface. It's a completely sensible layer on top of PDO, which is itself pretty cumbersome to use. The problem is that these keys, NID 0, NIDs 1, these are not sequentially assigned. What these are are the array keys that we defined ourselves on the line before. So I would ask you to consider what would happen if you could get Drupal to run a query like this. Digest this for a moment. You can get Drupal to run a query like this. There's a number of ways to get Drupal to run a query like this, and I'm going to show you how to do that right now. So let's hack into a website. This is a Drupal website. It's running on my localhost. It's running on this computer right here. Version 7.31, the last vulnerable version of Drupal before the bug was discovered and patched in 7.32. This is incredibly simple to do. So I'm going to put a breakpoint in my code. I'm going to start listening for debug statements. I don't need any programming capability in order to do this. I'm going to do this completely from the WebKit Inspector. What I want to do is replace the normal user name input form with one that has some SQL in it. And because I've created two of them, I'm going to turn my input from a string into an array, the first of which has this delete statement in it. So if we take a look at the flood table, we can see I have a number of failed login attempts. That's what flood is for. It tracks failed login attempts, and then it's used to ban users if they go over. What I'm going to do is... So we've stopped the code. Oh, I meant to do a conditional breakpoint. So this might be a little hard to see if you're at the back of the room, but we've built a query that's simply a string that says select star from users where name equals name token. Name token is supposed to be replaced by admin. Admin is supposed to be a string. But by creating two user login forms, I've turned my input into an array. And I realize this is kind of small, but one of the array keys is some SQL. So if I step one, two, three, now here we are on line 755. This is where the substitution occurs. Boom. Injected. We've now injected some SQL, and this is going to be passed directly to my SQL with no further sanitization. And if I allow this to run to completion, we can see I have, in fact, injected some SQL into Drupal. I've deleted records from the flood table. Oh, no. Any questions about how that works? There's a lot more detail coming soon, but that basic premise? Okay, great. So that's cool to truncate the flood table. That allows you unlimited login attempts. So it enables a brute force attack, but there's a lot more that you can do with that. So using the same vector, I trivially worked up a little Drupal-getting SQL injection client. It's pretty much the same thing. It just sends a... Again, this is on GitHub. It sends a post request to the Drupal user login form and does a little character escaping for me that's difficult to do with just typing manually. So I'm going to use this tool. I call it the Injector. I'm going to use this tool to give myself additional permissions that I don't currently have. I'll visit this site as an anonymous user. And of course, of course, anonymous users do not have the ability to create content. If I navigate to Node-Add, I get an access denied. So what I want to do is I want to inject some content into the role permission table. This takes about four seconds to run. And now when I refresh this page, you can see I have the ability to create any content type. So let's put some spam on the home page. Boom, we have front page content created in two Unix commands. So that, in fact, we only... And we only need one of them. So that's about as bad as a hack gets, but we're going to take this a lot further. Another thing that I, as a spammer, want to do is I want to run JavaScript on this site. Now I'm an anonymous user, so I don't have the full HTML text format available to me. So let's... I might as well be an admin, so let's just flip that on. I'm going to insert a new row into the role permission table, giving myself the ability to use full HTML. Refresh this page, and you can see now that I have full HTML available to me. And of course, of course, what I'm going to do with that is I'm going to run. And you can see what happens, even before the page finishes reloading, is now I'm triggering for every user that views the home page or views this render node. In fact, it's like hard to get rid of, even as an administrator, because it comes up so quickly.  Because the MySQL database is so central to the Drupal application, and sensibly so, there's nothing wrong with connecting to a MySQL database so long as your connection is secure. Because the MySQL database is so central to the Drupal application, and all configuration is stored in it, once you get access to that system, you pretty much rule the entire application. You can do anything with it. So it's all well and good to understand what sort of damage is theoretically possible with this power. But what I was mostly interested in when I started doing this research is how the real hackers who attacked my site in the real world actually use this power. And I can answer that in tremendous detail now, and I'm going to show you exactly what was done. And I should note, the variety of attack that I'm about to show you was, according to data released by AQUIA, the same variety that was experienced by 68% of users hosted on that platform in the first week after Drupal Geddin was discovered. The remaining were some mix of people putting PHP in blocks and people changing the user one password to be like 1, 2, 3 or something, or adding a user. Those are all pretty obvious and easy to understand. This one is a lot more exotic. What we want to do now, you and me, we're in a hacking collective together, and what we want to do in our hacking collective is three things. First of all, we want to inject some SQL. That part's easy. We know how to do that already. If there's time, I'll show you the code that allows us to do all this, but we want to get arbitrary code execution, which we want to be able to run any PHP that we want on this server, effectively making it into our slave. And finally, we want the ability to upload any file that we want. These three things together are pretty much all the things our server does. It holds files, executes files, and connects to the database. So the particular style of attack it took me a really long time to understand, but I get it now. The first step, the SQL injection, it happens in the menu router table. The menu router table is where Drupal stores routes or pages. So if you take a look at the menu router table, these are all... I know this is hard to see in the back, but these are all the... when you implement hook menu, a cache of that goes in here. So when you navigate to example.com.admin.app this access callback, user access, will be run. That's the name of a PHP function, user access, and if it returns true, then you get access to the page. So what this attacker has done is he's inserted a new row. It's just kind of randomly named. It's XJFXIA. But the callback, instead of returning an HTML string or a render array, the callback is file put contents. So when someone navigates... navigated, because this did happen in the real world, when someone navigated to whaleocalyps.com slash XJFXIA file put contents run ran, and we know what file was putting in where because those arguments are supplied in the access arguments column. So they wrote out a file to the pull module, random selection as far as I can tell, and the contents of that file was some PHP. I'm going to show you what that PHP does in a minute, and going forward, I'm going to refer to this as backdoor.php, because it's impossible to keep straight if you use these random letters. So once that file is written to disk, it becomes a backdoor that allows you to execute any code. So the hacker navigates to this URL, and the act of navigating to this URL creates this file, backdoor.php, and then they never need to go to that URL again. They can, but they have no reason to. Backdoor.php itself, and I can I'm going to run this exploit in a minute, so I'll show it to you, is a single line of code that's deliberately obfuscated, but what it does is it listens for a cookie. It waits for someone to send it a request of a particular format, that it needs to have three cookies in it. These are just randomly named KCQF3, these don't mean anything. The first two, Base64DCode and CHJ1, these are effectively just passwords to prevent an unauthorized user ironically from getting access to this backdoor. The sort of meat of what's going on is this long string here. This is a Base64 encoded PHP string. What the hacker does is he Base64 encodes the code that he wants to run and he packages it up in a cookie and he sends a GET request to this file, module slash pull slash backdoor dot PHP, and then the server will run that as though it was its own file.  It's nice that we know this, that we know that this hacker got the power of arbitrary code execution. I'll show you in more detail how I know that he did this later, but what I want to know is again, in the real world how did this hacker actually use the power of arbitrary code execution against my site and we can answer that in a really interesting way. This is one of the artifacts that I found left over on my web server. This was like some random set of letters dot PHP. This is not my 404 page. This is the attacker's 404 page. Now my best guess at what happened here is that the attacker sent a request to backdoor dot PHP to execute some code that requests out to another web server which holds a secondary exploit file. What this code does is download the bigger exploit package that we want and save it to disk somewhere. As near as I can tell, on one of the occasions, and he did this on six or seven times in different spots on my server, but on one of the occasions that he attempted this, his server was down I guess, and all I got was his 404 page. In fact, now not only do I know what he did with this backdoor file, I know the name of the village in Romania where he lives because his IP address is right on there. It might be a proxy, but here it is. You can still go to that if you want. That's his website. DDoSing him, right? I'm actually pretty impressed. Good on him. It didn't really hurt my life and it was a pretty exotic hack. So when we take this file and we compile it down to HTML which by the way the first time I did I was super scared and I disconnected from the internet before I did it. When we compile it down to HTML what we find is that it's a file upload dialogue. So he got arbitrary code execution power and he used that power to create a new tool on the system that allows him to upload files and now he owns the whole system. He can really do anything that he wants and I will show you this one unfortunately takes about 15 seconds to run so this is the full exploit package that we're going to run and while it runs I'll show you I'll show you the code that we're executing. This is my best guess at the actual exploit that was used against mine and tens of thousands of other sites. If you want to check it out on GitHub it's really super commented up even if you're not a programmer you can probably follow it pretty well but the gist is I give it a URL it injects the SQL we want it gets this arbitrary code execution and then it uses the arbitrary code execution right here so here we send our cookies to the server it uses that I'm actually going to grab from the internet his uploader form and write it to my server so that should be finished by now yep and if I now navigate to backdoor.php I can see that the end of backdoor.php is just PHP info so you can learn a little about the system that you're trying to break into and if I were to ping this with the proper set of cookies which is actually pretty easy to do I would get the server to run any code that I want and then the other backdoor is uploader.php this is in the Bartik theme which actually because I'm running the Bartik theme gives us the convenient ability to change the site logo and there we go we have a fully exploited website and just to be to be clear what this particular hacker almost certainly had in mind was not to change my logo and be like HACK! GOT YOU! what he's almost certainly doing here is compiling a database of thousands upon thousands of exploited sites so if you want to exploit example.com just look in my database row 10 million you can go to example.com slash qpdl47.php presumably he sells this along with a set of instructions because it's really hard to figure out how this works otherwise as far as I know and as far as I can tell it was not interested in changing any content on my site and I really can't imagine why he would it's pretty low traffic so before I move on to the defense procedures and how you can protect yourself from this and similar attacks does anyone have any questions about the attack procedure yes sir the question was what were the direct repercussions on my pull module I don't understand what you're asking, I'm sorry what were the directory permissions on the pull model oh the directory permissions I'm going to get to that, that's one of the defense procedures and that's also part of that disclaimer I offered at the beginning as like don't let yourself turn into me but they were they were poor they were either 775 or 777 or something like that they were right to it which it shouldn't that's coming up that's what this slide is about but yeah good thinking yeah sure yeah it's very hard for me to say what makes an exploit kit marketable on the black market presumably he knows his customers and they want that, I don't know why but you're right that would be to me more terrifying any other questions about the attack payloads okay let's move on to the defense procedures and these are kind of in priority order of how important they are so if you are running Drupal 7 version 7.31 or lower or Drupal 8 beta 1 or lower your site's already hacked so just kind of be zen about that be okay, it's been hacked for a while now so don't get all stressed right now you've been living your life and you've been happy for 7 months with a hacked website it hasn't been so bad you gotta upgrade because you're spamming a lot of people right now that's very important it won't undo the damage that was done for that the only solution is to restore it from backups if you don't have backups that's a very challenging situation of course but this isn't really so much I've been doing this presentation for 6 months now it's not even worth talking about anymore the first time I gave this maybe you could save yourself by upgrading but at this point if you haven't upgraded you're hacked so go and do it be snappy about it next time the second most important thing that you can do to secure your site against this and similar attacks is to set proper file permissions in your code base so Apache the Apache web server never needs to write to your PHP files never needs to add them to them it never needs to change them it only ever needs to read them and for this demonstration I'm running the most insecure file permission that I could which is anyone can do anything and in fact if we're on the same IPLN right now you can probably get into my computer right the second because Apache is accessible to the outside network so this is very simple to deal with there are tons of there are tons of scripts available for automatically setting proper Drupal file permissions that I like this is on github but I'd also encourage you to do some googling on that, google Drupal Unix file permissions there's lots of different schemas depending on your hosting situation what you're trying to do with Drupal exactly but the gist of this is this is going to iterate over every directory in Drupal and set it to a proper permission scheme the files directory which is like where user uploaded images go different treatment than executable code and the settings at PHP files going to also get slightly different treatment but there's a lot of different variations on this and they all work fine for different use cases so I'll simply run that code it runs really fast and now you can see that the only person with the ability to write to to write to my my code directories is me and then my Apache user is called staff and he can only read if I had taken this one simple step this 10 seconds to paste this script in and run it I would have been totally safe from the that step where you navigate to backdoor and it creates a new file for you would not have been possible so that's a very simple thing that you can do that will secure you from a large variety of attack vectors the third most important thing that you can do is host with professionals and I mean specifically one of these four organizations and I'm calling these four organizations out as being as having a high security game because all of them were patched at the system level or put some remediation in place before full public disclosure of the Drupal get-in vulnerability I know there's a lot of hosting vendors here so I'm always looking to add to this list if there's other groups that had a similar similar experience that's awesome you just do your due diligence make sure that you're dealing with people who understand Drupal if you try and host on like digital ocean or rack space or something that might be fine from a perspective of load and cost but you also have to balance that with like how bad would it be if this site got broken into and if the answer like me is no not that bad I'll go write a talk about it and pitch it at DrupalCon like then by all means host yourself but if it's something that you're doing for a big client who's giving you money and that you're making guarantees to host it with someone who knows what they're doing this is not exactly a defense procedure it's more of a disaster recovery procedure but you want to make sure that you're taking automated nightly backups and that is true by the way even if you're on some platform as a service system that makes backups for you because generally those backups on a PAS system will run not as often as you need them to this is incredibly simple if you don't know how to how to set up Cron it's literally one command I'll make this a little bigger clear that crontab-e and you can look up Cron syntax but basically basically what this says is zero zero minutes and two is two hours so every day at 2am I'm just going to make a full dump in reality I would like gzip this or something but make a full database dump from my web root to a non-web root directory my backup scheme is that I make a backup every night at 2am I keep that for 30 days I make a backup every week which I keep for six months and I make a backup every month that I keep forever really easy to do it's a thing a lot of people delay on like it would be hard but it's really not it's also very important to store your code in version control you don't have to post it on github you can have a locally versioned copy of it you can see here I just it was one command to do or two commands I made one single commit ever for this codebase what it allows me to do is I can see it's hard to read I can see very easily the files that were injected into my codebase so if you find yourself hacked it's actually pretty simple just copy down your codebase put it in the same directory as your .gith folder and diff it so this becomes for me really really easy to undo and I got rid of all the exploit files like it was nothing that doesn't help with the database the database you're still going to have to restore from backups but the code should be very easy to recover in a circumstance like this a matter of minutes and in fact even though I wasn't like preparing for disaster recovery just because I just version everything I do because I find that easier it was pretty trivial for me to just back this out another important security measure is to make sure that your Drupal I'm not talking about your Unix Cron your Unix Cron is running even if you don't know about it usually possible that it's not but it probably is I'm talking about Drush Cron or Drupal Cron which is the process that gets executed when you navigate to like yoursite.com cron.php you can execute it from Drush here I have it running twice an hour so every 30 minutes and the reason this is important is that even when you have proper file directory permissions set Apache still Apache still has the right to edit or delete any htaccess files in directories for which it has right access which blew my mind when I learned it because basically what I'm saying is there's no way really to deny Apache right access to your htaccess file which I didn't believe when someone told me about it so that's actually what this helloworld.php is me confirming that that's in fact the case so the way Drupal deals with having a writable directory inside of your codebase is even if you don't know how to read htaccess you can see we just turn off php inside htaccess someone who is able to drive Apache on your web server is going to be able to delete this file it gets restored on cron that's why it's important to have cron running because if you have cron running actively they'll have a pretty small exploit window in which they can run code out of your files directory it's important to take php security releases as seriously as you take Drupal security releases and the reason I say that is that anyone running php 5.5 or higher was immune to the most common type of exploit the one that I showed you here today and the reason they were immune this is backdoor.php or it's a version that I reverse engineer in dobfuscate the original was like all named weird things all on a single line but backdoor.php which just a reminder this is the file to which you hand off a cookie and it executes any code that you want it does that by taking advantage of a vulnerability or not a vulnerability but a feature which has since been removed in pregreplace which allows you to evaluate a search subject as php so I can pass php into into pregreplace and it will be evaluated as though I were passing it into the eval function that's gone in 5.5 so just make that upgrade it's pretty painless to do in most circumstances php is pretty good about reverse compatibility within major versions this one is a little more controversial and it kind of depends on your use case but if you have a site that is low enough value that you can't afford to staff it full time which would certainly be the case for my post apocalyptic whale cartoon it's probably low enough value to suffer the minor risk of breakage during security patches so you can apply security patches automatically with Drush it's pretty easy to do that's the first line if you're versioning it's a little more complicated you should be versioning so the trade off here is that you might pull down a security update which breaks the entirety of your site that's something that you have to have to weigh for yourself certainly if you're choosing between having a site that's maybe hacked and having a site that might go down from a bad security patch it makes more sense to apply the patches that's my opinion the best case scenario is to just have a staff of professionals who will monitor and apply security patches and then test that they do the thing they're supposed to do but if that's not an option for you you really have to think about how bad your day would be if you came in one day and you found that your site was now hosting a bunch of pornography and it had sent an email to everyone in your database by pornography from mysite.com if that's a risk that you're not willing to take then just take this other to me smaller risk of your site might go down but it probably won't I've never had a set of security updates break any feature on my site ever and this is the last I don't know that this in most cases this will make no sense to do but in my case where I'm the only person logging in or where you have a small group of maybe 15 or 20 people logging in maybe even they're all in the same office you don't really need to let post traffic into Apache most of us are probably running Apache behind the varnish caching layer so you can do some pre-processing on the request that you get before passing it off to Apache and therefore PHP so one thing that I like to do is if the request is a post request which it would really have to be to do any SQL injection of any complexity and it doesn't come from my IP address at my house just drop the request I'm just not letting it through I can demo that for you if you want but I think it's probably pretty clear the meaning there so you put these lines in your VCL file and these lines in your HT access file so if someone tries to navigate directly to Apache they just get they just get a 403 and if they try to navigate to your site like a normal way go to yoursite.com and then try and log in they get this 404 so the last thing that I want to I want to touch on and I open for questions is this event is very scary for our community it was really the first of its kind it's been the Drupal security team was founded 11 years ago and this is the first vulnerability of anyone close to this magnitude that they've uncovered so it's the name Drupal again which admittedly I've been a very big user of it's easy to imagine it was easy to imagine while this was occurring that the world was ending but as we look back on it we look at the real functional results of this exploit it seems rather clear to me that it wasn't actually that big of a deal I mean it was a really bad bug but like honest to God show of hands did anyone here like lose money for data as a product of Drupal again I'm sorry that happened to you and that really sucks but here we are at Drupal and there's two people and that sucks that's bad I don't know that it warrants an analogy to the literal end of the world so just when we consider these facts that anyone who had proper directory permissions configured which probably nearly all of us did was immune to the most common attack anyone who was running PHP 5.5 or higher is probably about a third to a quarter of us are was immune from the most common attack anyone hosted on the four biggest Drupal hosts was immune to the most common attack and probably all attacks to be honest the amount of real world damage I think was just not that big and the learning experience was really important so in answer to a question that I was asked on the last time I gave this presentation do you think this was really Drupal again, do you think this was really going to kind of destroy some aspect of our community my answer is no so that's all I have for you and I have about 15 minutes for questions if you have any yes sir, the question was how was this vulnerability discovered and so that's kind of a complicated history but it was it was first reported maybe a year or maybe a little more before it was acted upon and it was reported in like it was reported in some queue like a usability queue that not reported as a security issue and I don't know who on the Drupal security team ultimately found the issue and decided to act on it but there is an official group of in fact we have one of them here with us today if I thank you for coming but I think you saw this presentation before there's an official group of people that are have the task of identifying security fixes and releasing advisories and assigning them an urgency so I actually don't know how this got into their hands but there have been a number of discussions about sort of improving the security issue reporting process as a result of this because there was someone in the world who knew this was possible one guy for like a year before any action was taken but as far as I know he's just like he's just a Drupal user who was doing some penetration testing for an application that he was building for his employer or she I mean I should be gender neutral here yes sir I think that person didn't really know specifically that it was a sequel injection they were like this seems like a bug and it might be sequel injection but they weren't really sure but then it was later found by a company called Section Ainz and Stefan Horst is the name of the person who worked there penetration tests so they found it and reported it to the security team who then coordinated them yes sir you need to wipe your whole server and reinstall your operating system and I'll tell you why and this is exactly what I did which again is a hassle but there's really no way around it let me give you a nightmare scenario to sort of make this point let's imagine that your server is in such a way that the exploiter the hacker was able to gain access to change binary files in your root and let's imagine that the hacker replaces the Apache binary with a new version of the Apache binary that he's created which will do exactly one thing differently every 5,000 requests puts a little bit of JavaScript at the bottom of the response I don't know about the rest of you but I would never catch that and like Unix systems are complex and there are a lot of places for worms to hide like it's a little bit of a balancing act like is that that scenario I just described like a real world thing that we know happened no not as a result of this bug a real virus that hit Apache boxes about 3 years ago so you do have to measure it's going to cost me $100,000 to wipe this server and I really don't see anything wrong with it I don't know maybe you'll get away with it but if you're running an enterprise application if you find one day that your server is being used to send spam is that a risk that your business can tolerate and I think probably for most of us you don't know so you have to restore from scratch yes you sir I think it's an excellent idea and in fact a previous version of this talk included that strategy but I cut it for time and also it's kind of hard to explain without live demoing it yes sir so Ben Jevins from the Drupal Superior team and I saw your presentation in New York City so I just wanted to point out there's one thought around the idea of the hosts that you talked about so this is not a question but more just for the recording so the security team is working through some policy on what security team members can share and so you have the slide about different hosts and the idea about certain hosts being more professional than others so just the Drupal security team works for all Drupal users so we want to secure all Drupal sites because those are hosted so some security team members work for some hosting companies but certainly it's not you know in the attention to secure their customers only thank you for pointing that out I was actually a little worried about that implication so first of all thank you for your work on the security team you guys yeah you guys do you guys do amazing work and then that's actually your work is one of the core things that keeps me on Drupal as opposed to some like young hot technology because like that's the perfect example of a human institution that we've built over a long period of time no matter how good your code is you don't have that in MeteorJS I know that was a controversial that was a controversial thing that some hosts got early access to this information I do want to say and being a person who got late access to it and who had his site hacked I do want to say I think you made the right call in releasing this information early to the biggest hosts because the world in which we wake up and like Acquia got early access I understand the frustration there and I share it a little bit but what we wake up to find that Whale Acolypse was hacked is such a different world from the one in which we wake up to find that WhiteHouse.gov is hacked and even if you're not hosting on Acquia or Pantheon or BlackMesh or platform.sh even if you're not hosting on any of those you would still lose money if they all got hacked because no one is buying Drupal services for a little bit on the same day so I think it was the right call and I think you guys do awesome work and thank you for it I just want to add a little piece of nuance to that the security team didn't provide the hosts specifically with the advanced knowledge it's just that some of the hosts have people on the security team there wasn't a decision made I work at Acquia and I'm on the security team right yeah I yes yes sir just a quick question on kind of this was kind of a knee-jerk reaction that some clients we had worked with had after the attack what do you think the value is in hiding Drupal on that sort of thing obviously change log is something that always goes away but from the metadata other things is that something that is actually worthwhile well to judge whether it's worthwhile I would need to know your budget and how much it would cost to implement I don't think there's zero that's a thing that people kind of brush off as like that's security by obscurity I'll never do anything if I'm running a bot that scrapes 20,000 websites I might miss a thing or two based on some seemingly trivial obscurity measure I wouldn't rely on that that's obviously not that's obviously not the only thing you need to do but if you have the resources to get it done I don't see any reason not to yes sir in the situation where you might take over a site where you don't know the history of it and when it was patched and so forth back around the time this happened is there something you can look for in the database that would give you any clue that it had been yeah sure now just to be clear if you're taking over a Drupal 7.31 site or a low or that has not been patched it is hacked you don't really need to check well I'm saying it's up to date now right yeah but no I can answer that question for you there's two things in the database that you would really want to look for that would be the canaries in the coal mine the first would be bizarre entries in the menu router table specifically in the column name those should all be like human readable English words if you have an entry in the menu router table whose name column is set to a series of random letters that's a result of Drupal Gedenoma certainly the other the other thing to look for it is in the users table or the user roles table either a new role or a new user called mega admin or super admin or something like that that was a common exploit that a lot of people saw you might also look in the blocks table for if any blocks have PHP in them but those are kind of the three big ones and just to reiterate assume that you are hacked gentlemen did you have we found some PHP files in our sites files folder so you could actually go to that file from the front end and the server would run it so right so that's the that's why it's important to have cron running yes to follow up on the database question there is a module that it's called the Drupal Geden module I wouldn't rely on it but one of the things it can do things like breaks in the UIDs for users because the often attackers don't get the UIDs sorted properly so there are going to be gaps or users with high UID numbers with admin rights things like that so there is a module to do some of that scanning I wouldn't say if it's coming out clean that you're actually clean but it is one thing to give you some indications good suggestion any other questions gentlemen in the back wall is really clear if we already have been infected we see the sites folder it does have the PHP files we look in our database we see the weird users and we don't have backups are we screwed at that point it's determining whether to go fresh install there's no patching there's no upgrading and removing files correct no matter what so the official answer is yes the un-official answer is that's a business decision you have to decide how how much money is it going to cost you to attempt maybe 99% confidence that you've recovered and how much money would it cost you if you found three months from now that you have been attacked again like it'll just come back there might be a script that is running that you don't even know about that's outside of your web root maybe so from a technical perspective is there a way to know for sure that you've cleaned out all the dirt thank you awesome session thank you yeah I agree lots of great detail I just want to echo that point I would say there is a resource there was a frequently asked questions about Drupal get-in and there's a lot of great resources in there including a flow chart by Bevin Raj about how to recover your site that I think is a really valuable tool that people can use there's also linked from that is a guide that's called your Drupal site got hacked now what that provides step by step how to audit your site and try to recover from it and make a decision about what level of effort you're willing to put into it and whether or not to do that we have time for maybe one maybe two more questions if there are any okay well thank you guys very much for coming


A Mohsen was the first child of Zahra to give. They denied him a chance to see his beloved mother's face of beauty. Mohsen was the first child of Zahra. Mohsen, way up Allah. Mohsen was the first child of Zahra. In what state did they find baby Mohsen's body? Crushed against the wall alive they found nobody. Crushed against the wall alive they found the ribs of Zahra. In what state did they find baby Mohsen's body? Crushed against the wall alive they found not a chance to play with his grandfather. He knew him to sleep tragedy Mohsen. Just as they tried to hide the fact of his father's birth. Just as they tried to hide the fact of his father's birth.


Good morning, good morning. Today we're giving away some free advice to stay ahead of dishes and laundry and to feel like you're not always doing dishes and laundry. It's to just always be doing dishes and laundry. We're also giving away this six spice thing. Super cool gift we got when they launched Betamix launched ascent series four or five years ago. If you'd like to be into today's giveaway, make sure you subscribe to our channel and leave a comment. Let us know what your favorite spice or seasoning is. If there's just one that you could have and only one forever, what would it be? Mine I think is basil. You can make pesto and take sandwiches to the next level. And the winner yesterday's giveaway, the apron and the nut milk filtration bag, Jason York. Send us an email. Thanks guys, see you tomorrow. This is fun.


Hi everyone, Joe for jaspyscasebrakes.com. Happy Friday, coming at you with 2020 Gold Rush Baseball Vault Series 2. Six box, random team break, number one from jaspyscasebrakes.com. We've got multiples of these cases. The next one is in the store already if you wanna run this back. So we're looking for what, three hits, extraordinary baseball hits per box, they're saying. Nice, so maybe we'll find some nice graded stuff, some nice RPAs here. So could be a lot of fun. All 30 baseball teams are in. So we sold 30 spots, thanks to everyone. Here, thank you. There are the teams here. And let's roll it, let's randomize it. Three and a one, four times for each list. One, two, three, and a one, four times. After four, we've got Matt L, down to Nick K. Three and a one, four times for the teams. One, two, three, and a one, fourth and final time. We've got the White Sox down to the Tigers. Now, products like this don't have checklists and stuff. So trade at your own risk. You don't know what kind of hits could be packed in here. Could be up and coming stars, could be current rookies, could be old vets, Hall of Famers.  We'll just put all the teams on one screen here, let's alphabetize by team. I'm gonna pause the video and allow people to trade if they want to, trade at your own risk. I'm gonna product like this and when we come back, we'll see if there's any trades and then we'll break, we'll stick around. All right, welcome back folks. No deals were done, it's all good. Here in six box, random team one. We've got another random team break in the store.  There we go, so we're doing all six boxes right here, three, three and each of these should have three things inside. Good luck everybody. I don't know if these are packed up, they usually are, yes. Well notch right here to help me out, all right. Good luck. Oh, and if there's, I don't think this is, we might not run into this too often, but let's say there's a card of the player in like their team USA gear or their college gear or something like that. We'll go by the checklist for that particular product. If there's no checklist, then we'll go by or no checklist rules which is in the frequently asked questions. All right, we've got record breakers, 99 out of 100, Derek Jeter. Nice, that's a transcendent VIP party special right here. That's pretty cool. Could be worth grading. That'll be for the Yankees, that's gonna go to John McGee. Got another encased card here. It's an autograph, it's Aaron Judge, another Yankee. Nice, from 2019, Daenerys Baseball. Another one for John McGee and the Bronx Bombers. And does that feel like a graded card in there? It is, hard to dig out here, all right. It is graded, or no, it's maybe just authentic autograph. Yeah, authentic autograph, Eloy Jimenez. There you go, kind of hard to see the auto right there, but I assure you it's there. And his Cubs gear, remember he was a cub before it got traded to the south side. So that's Rick Serrano with the Chicago Cubs. All right, nice start, let's see what's in the rest. We've got a framed card here. Oh, Nolan Ryan, 66 out of 100. Franchise favorites, that's pretty cool. Yeah, this is the reproduction art card. That's pretty nice. That's Ranger's Edition going to Jack B. We've got a patch auto, it's Luis Areas. We've got new NT in the store too, jaspyscasebreaks.com, 15 out of 25. Nice patch, nice on-card auto. That's from 2019, last year's NT Baseball. We have this year's, just dropped yesterday. Twins, that'll be for Derek Disser. And the next one is another jersey and autograph from definitive Yaz, Carl Yastremsky. 22 out of 25 from definitive collection. Nice, red socks, Douglas with the socks, red socks. Next one is another Derek Jeter for the Yankees. John McGee, nice. Another VIP, transcendent VIP card. Not a lot of those out there. We've got a Robinson Cano One of One dual relic. That's pretty sweet, that's Seattle Edition. Pretty thick heart stock on here as well. Kind of hard to see his name against the dark blue, against the dark blue. Might have to look into that next time, design-wise. Seattle though, gets a train whistle, Nick Stover with the M's. All aboard the Big Head Express. Woo-hoo! And the last one here. What we got here, another authentic autograph. Doc Gooden, Beckett authenticated auto. Nice one for the Mets Josh with the Metropolitan's. Another nine autographs or nine things, nine hits to go, nine cards to go. We've got a framed card here from transcendent, Carlos Correa for the Astros, Matt Lieber. 83 out of 87 on that one. We've got relic and autograph, Xander Bogarts, from Tribute, 19 out of 25. Bow Sox, Douglas. I'll get these out of here. We've got an autograph here. It's gonna be, wow, Luis Robert. That is 86 out of 99, Luis Robert from a Diamond Kings baseball. White Sox, Matt Lieber with the White Sox. Nice. We've got another case in the store, folks. Jaspy's casebreaks.com. I feel like this is pretty solid, three hits a box. A lot of opportunities to hit, some solid hits here too. All right, Jersey in auto, hats off. Craig Biggio, Houston Astros. That's eight out of 10 on Craig Biggio. Piece of his hat. And that'll be for Matt and the Astros. We've got another patch and autograph. Wow, that's nice. Joey Vado from Diamond Icons Baseball. You got the MLB hologram sticker right there. So you can actually look up where that Jersey was from. You know, I think you can look up the box score too. See how Joey Vado did that day. Vado Matic, Eastwood with the Reds, tried to trade, couldn't trade, Mojo. And we've got a graded card. It's a 10, no auto, maybe an auto, or the auto is a 10. It's Wilson Contreras, with a World Series Champ inscription right there. There you go. An authentic, authenticated and graded, a 10. Cubbies, that'll be for Rick Serrano. And the final three, good luck. Oh, everyone watched Mandalorian last night? Or I guess today? On the West Coast it drops a little bit after midnight. Unless you're up late on the East Coast. All right, another thick card, frame card, 23 out of 50, Shohei Otani. Where is, what is this from? The 2018 Tops? Not entirely sure what set this would come from. Museum, doesn't look like museum collection, does it? Oh, tribute, transcendent? Transcendent, I think. Nice, that's a good looking card there for the Angels, Eastwood with the Halos. Got an autograph, it's World Champ Walker Bueller, Jersey and Autograph. And it's nice, nine out of 25, Jersey and Auto from 2019 NT Baseball. Folks, we have the current 2020 NT Baseball in the shop right now, jazbyscasewrakes.com. Just dropped it yesterday. Yesterday, two days ago. Last week, it's a new release. I think all my new releases are mixed up. Oh, a dual relic, dual auto, both Astros, George Springer, Jersey and Auto, and Jordan Alvarez, Jersey and Auto from Definitive Baseball. Nice one for the Astros, Matt Lieber. And there you have it, boys and girls. A nice six box break of a 2020 Gold Rush Baseball Vault. Series two, more in the store, jazbyscasewrakes.com. I'm Joe, and I'll break more of this with you next time. Bye-bye.