Good afternoon, everyone. My name is Kristen. I am a rising fifth year PhD student in the macromolecular science and engineering program as part of the College of Engineering. And one brief thing about myself is that I identify as someone who has both invisible and visible disabilities. I'm Isabelle. I am a second year PhD student in the engineering education research program. And my main focus of research is engineering students with disabilities. Hi everyone. My name is Ava Armour. My pronouns are she, her. I am currently a master's student on leave from the higher education master's program. And I also work in disability services at Michigan. I identify as having non-apparent disabilities, including neurodivergency. Thanks, y'all. Okay, so to start us off, would you please share with us what you wish you knew in your first year here? I wish that I knew in my first year that services for students with disabilities, or I think many of us will probably refer to as SSD throughout this, is able to purchase assistive devices and like furniture and stuff to support students. For my first year, I was, I knew that if something wasn't working out with an accommodation that you could reach out to SSD kind of whenever you need to, to set up a meeting and talk. Before that I just set up the initial first meeting at the beginning of the semester and then never reached out again, but you can do that and people are want to help you. This is Ava. What I wish I knew coming into graduate school is that I struggled with imposter syndrome quite a bit with the amount of effort I had to put in to get work done compared to my cohorts and cohort mates. And I remember, I wish I knew that everyone else is going through it too, even though they may not show it. And that there's a robust disability community here that you can talk to. I wish I knew that in my first year. Thank you. So now that you shared what you wish you knew in your first year, can you share with us what you wish you had done in your first year here? Yes, so I wish I had established my healthcare sooner when I coming from out of state. So, you know, establishing new doctors, especially primary care and specialists. I think it's very easy once the semester starts to become overwhelmed and let things kind of let's say get backlogged. And so I wish I had done that as soon as possible. I agree with that. And also, I wish I had met with SSD sooner in the semester than I did. I did. I don't think I met them so around mid semester and by then classes have already started. Which would have been nicer for me to meet at the beginning and discuss things and have things ready and prepared, like have the letters prepared and documentation prepared to let my instructors know. This is Eva. What I wish I had done in my first year was like schedule block my weeks out and get connected with the SSD academic coach sooner. And they, so then I could have better allocated energy in different places without tiring myself out. Thank you. Thank you. So now that you've shared what you wish you had done in your first year, would you please share with us what were the best things that helped you when you first got here. So specific for me, I utilized what's called the managed care center through you of them, which is kind of to my understanding connected with our grad care health insurance. And they kind of help navigate insurance concerns or finding specialists and things of that sort. And then specific to the College of Engineering, there is a facility there called the care center, which also has like, in addition to SSD or so I guess separate to SSD additional kind of resources for navigating tough situations and for me that was navigating grad school as someone with a disability. I agree care, the care center is really helpful and I also found connecting with advisors and administration within my program early on is really helpful and kind of managing or understanding and managing that the expectations I had and planning out what I needed to do to like accomplish the list of things or like proceed in the program. This is the best thing that helped me in graduate school, genuinely was connecting with the disability community. And we had, at least one group has regular meetings every other week and it was a place to where I didn't feel isolated in my experience. And then additionally, the student ombuds person was extremely helpful and in helping me navigate nebulous campus resources and what to do when things happened. Okay, thank you. Thank you. So after this, y'all now we're going to move into Q&A where y'all have the opportunity to ask all of the questions that you have for our panelists. I want to actually first as we transition into the Q&A, my colleague is going to place our evaluation survey in the chat, and I'd like to ask for you to do me a favor and just copy just open the link now, so that you'll have the tab ready and waiting for you when we're done here. So we'll move to this Q&A by keeping stack, if you'll remember. And for those of you who missed it, it's just going down the line of those who flag that they have a question and the order of appearance. And there are three ways to get on the stack you can use the raise your hand function and I'll call on you or write stack in the chat and I'll call on you, or you can write your question and I will ask the question for you. You can speak slowly so that the closed captioning can capture all that you have to say. And for those who haven't please change your name to the name you registered with so that we know that you're here. And we may not get to have your question, but we will be providing the panelists email addresses at the end of the Q&A. So you can reach out to them personally with any unanswered questions. Okay. And so, while our audience members get all of their questions together, I have a question for you panelists. What surprised you the most here at Michigan as a student with disabilities or what was unexpected about this experience? For me, it was a little unexpected how inaccessible some of the laboratories can be. Unfortunately, so working in a wet laboratory space, there's a lot of things to navigate. But when you find the right resources, they can make that space more accessible. And so some of the resources that I would include in that would, I would always start with SSD. But I would also say that like the building manager is very helpful as well. And I'm surprised by all the different programs and groups and people that seem to be interested in disability advocacy or research or things like that. My previous institution, there wasn't anything like that, but here in my second semester here, I, there was a disability visibility symposium, and they had people present. And got a cool book to read in it. So that was just really cool. And it was a good surprise to have that here. This is Eva. The something that surprised me about Michigan was, well, for context, I came from an institution that has had disability services since 1940s. And when I came here, something that surprised me beyond just some physical inaccessibility was that there are a lot of professors and university members that are interested in disability as a disability studies as a, as a topic of research. However, they don't have a program focused on disability studies. And then another thing that didn't surprise me is the amount of activism that occurs on Michigan's campus regarding disability. That was really pleasing to see and seeing that the disability community is not just like a present community on campus but a very active one. Thank you. So I'd like to know how do you manage the inevitable journey of figuring out like work-life balance and time management and stress management, especially as a person with disabilities. How, what has that journey been like for you? I would say my most important piece of advice is that the path should be flexible. So what you may expect or want to achieve may not always be realistic. And so something that I struggled with a lot in my first year was wanting to work as many hours as my colleagues wanting to be present in the lab and show that I was making as much progress. And I rather quickly found out that I couldn't do that, you know, my body was not going to allow me to do that. And so remembering to give myself grace and accept your limits. Don't, don't push them if you don't have to. I think having or finding an advisor or other people in your lab who can understand what's going on, understand that. Like for me, I needed to take some time off or some things and they were very flexible and supportive supporters of me and so that helps a lot. So just having people who were, I guess more open to changes and open to like my different way of working sometimes. This is Eva. One of my disabilities primarily impacts executive function and things like time management. And something that helps a lot for me was having accountability bodies, scheduling in times when I could work, like alongside other people on different things like they'd be working on different things but just near each other. And if my friends found I was getting distracted or getting discouraged, which is a really frequent thing for me when I was writing I got very discouraged. They, we would check in on each other if we saw that. Additionally, using, I use my Google calendar, religiously. And that helps me gain a lot of, or like realize what what I had the capacity for that day, and knowing that we'd have seven to three hour classes from seven to nine. I would be able to plan my schedule around those classes. So things were a bit more complicated with an internship. However, working with my supervisor, not necessarily disclosing disability, but working with my supervisor on how to be a student and work somewhere as well was really helpful so find finding good mentors who have also walked the walk is this was really helpful. So speaking about disclosing disabilities. What has that experience been like for y'all. When do you when don't you when do you find it necessary do you find it necessary.  Who do you, who do you disclose to or who do you feel the need to. Yeah, so I think that this extremely situation dependent but in my case. I rather quickly disclosed some of my disabilities I have actually undergone three different orthopedic surgery since becoming a PhD student at Michigan so there were various times of being on crutches being in a wheelchair navigating a medical leave of absence for one of the surgeries and things like that. And that made it pretty necessary to, you know, disclose that I am, you know, being faced with X, and X will not be going away, but, you know, X is going to require qr and s treatments, and that's going to take me away. So for me, disclosing my disabilities were kind of empowered me to advocate for myself more strongly. And I would say that like, you know, disclosing to my lab mates as well has been something that I found beneficial because you know, I find it easier to ask for help when I can justify why I'm asking for that help so like, I have a lot of joints to advocate so sometimes like reaching up high could be problematic and so I would, you know, working in a wet lab space again would often require me like, can you get this for me and it was something that was occurring so frequently that I, I felt more comfortable just kind of disclosing situational and I feel when I feel comfortable disclosing to someone that I'm working with like my advisor or someone on my research team, I will disclose to them but sometimes I make the decision not to if I don't know the person well. That's just something for me sometimes I don't disclose or if I'm not working closely with them and I don't think they, you know, need to know my instructors. I don't always disclose what my disability is, but if I send in my accommodation letter just to kind of let them know like these are my accommodations. Initially I usually do not disclose my disability to them. This is Eva I genuinely do not disclose my disability. But it's very much situational in a disability space I will disclose my disability if I feel comfortable. But unfortunately, when I got to graduate school. I thought that it would be a safe place to disclose in the workplace and unfortunately it wasn't. And so I usually err on the side of caution with disclosure. And for me with my specific disabilities and how I present. And a lot of people frequently respond with oh I wouldn't have expected that or you talk so well, kind of thing. So, which can feel really ableist sometimes. So, at least for me I disclose if I feel like I have to. And then sometimes to friends and some cohort mates but unfortunately in my program. There was an absence of disability. Like literature when studying DEI and I felt like I did a lot of the educating and in that educating it became pretty clear to most people that I had disabilities. So there's sometimes where you may like not intend to disclose but the topics you choose to talk about will reveal things. So, disclosure. For me genuinely I will, I will caution disclosure usually, but if you're in a welcoming space that's that's a whole different story it's very situational. Thank you for that. I would like to ask about the, what's what I have heard from others as the unfortunate burden of having to educate others around you in order to try to exist as your full self. And what has that been like for y'all. Yeah. So educating is the number one word I would use. For me, a lot of my educating has come through asking for things basically so you know more ergonomic furniture and things of that sort and you know even my PI is like, well why would we need a wheelchair accessible sink if you would only be using it for three months. And like, things like that and it's like, well I may, I probably won't be the only person ever to come through this space that would benefit from this. So, a lot of them. I would just say in general in the physical sciences there's a less flexibility to change. I think they're they're more rigid in their mindsets and so if it's functional for most, it can sometimes come across that they think it is functional for all. And so that is something that I have worked on with my advisor I've worked on with others in the department and things like that. But it's, I wouldn't use the word demeaning but it, it is exhausting. That is the word. I guess I have a little less experience feeling like I have to educate others. Most of the people I interact with are familiar in some way with disability studies or have read like some research papers about it or something like that so that very few people interact with are like at a level where they are not. They like don't know anything about disability or the disability community. I do feel like I'm the main go to person in my lab for people when they have questions about disabilities because that's like the main area focus of my research and I have to read a lot of books read a lot of papers about that and so people will come to me and ask for resources and I don't mind sharing that with people. This is Eva, I, um, yeah the burden of educating others. When you're here to be educated is really exhausting, like, like Kristen said, and that genuinely is one of the things that had started to burn me out pretty quickly. However, when you are educating and people are receptive and put things in action from what you've said and how you've educated. That's a extremely rewarding feeling. And I center that in all of my work now. Since I've been on leave, I still do disability education around campus through an organization and when you when you see that that light bulb turn on and make things a little bit more relatable to folks that might not have disabilities through like comparisons and analogies that that has been a very rewarding experience. However, during like while in graduate school it's unfortunately like for I like to say that it's not your responsibility to educate people. But hopefully finding a group of folks to rally behind you in your educational efforts this will be helpful like for me I had two cohort mates who are absolutely amazing. And also other people with disabilities, who, when I got really tired and couldn't. They, they really helped out a lot and we made a lot of changes towards accessibility in our, in our school. So, there's the disability community is very wide and there's education here at Michigan. And there's a lot of opportunities to connect on regarding disability education. However, it's, you're here for a degree. And sometimes you can get caught up on the, the educating side sometimes and I think I burnt myself out a little bit, focusing a lot on what what was not right versus what was going right. So, yeah. Thank you. Okay, so speaking of burnout and how easily it can come if we're not careful. How do y'all rest, how do y'all find space as a human being outside of being a grad student, what has helped you just, you know, make sure that you have a full of like a full life rather than just like the life of an academic that most of the time. I feel like grad school wants to tell you is the only the only life to have. Okay, I will preface this with this is probably not the right decision for everyone but my first month of grad school, I decided to adopt a senior dog that was in not the best health. He didn't need a lot of walks he couldn't go on long walks. I always had a reason to leave in the afternoons, I couldn't stay on campus for an unreasonable number of hours because I had something depending on me. And that was a great boundary. But again, I don't necessarily recommend getting a pet within your first month of graduate school unless maybe that's something you feel prepared for. Other, you know, beyond that, I have a pretty friendly lab space so we will often spend time together actually outside of work I know that it's not something that happens in all lab spaces are all, you know cohorts but having friendships that exist outside of the nine to five or whatever hours you're working is really valuable. I often try to try something new out in the city. So, going to a new place in an arbor or trying new food. At least every few weeks. Sometimes I go to the same place that I know I like. But like, there's ice cream places with interesting flavors there's a lot of restaurants. And in terms of like stopping like balancing work and other things I have it like, I made it pretty clear with the people I work with like at 4pm. For me that's the time where I stopped working. I thought for the time where I'm. If I am like working, I'm not productive so like, I decided I'll just stop at 4pm so I could go do something else. So that's usually when I'll like go for a walk and explore. Go to the library. Yeah, things like that. Eva. The something that I did that I wish I had done when I when I wasn't on leave was I joined an ensemble like a band I play French horn and so I joined like a community band in the area. And so I knew like every Thursday at seven to nine I was going to be playing music. And right now I work full time in a while on leave. And I have found that is trying, trying to find like going to trivia is something that I do relatively often as well. There's a lot of campus eateries and like places to get drinks that have events that are like trivia or like occasionally there's like nerd nights where things will be talking about Star Wars or something. And then I also adopted two cats in my in my first semester of graduate school. Coming home to them and then waking up knowing I have to feed them and cleaning around them. It's helped me like exist in my apartment and not just like existence in a mess which is what I had done in the past. So it's another like accountability buddy kind of in a way with the with the pets to. I had a service dog in the past and when that was mostly an undergrad by no if I had had him and then graduate school. He would have just the active caring for him like Kristen said was it would have. It was a way to set set those boundaries to a reserving one night a week to do something fun, or to just hang out, listen to an audio book, watch a movie, do something like your, you should be allowed a weekend, or allowed a day off. Contrary to some expectations I would say. Definitely definitely don't have to expectations trick y'all because they'll try to. What do you guys. Is there anything that you wish that you knew sooner about campus about the facilities about the culture of being here. Yeah, so one exciting thing I guess that SSD offers is if you have a like handicapped placard for your car. And you bring that to the parking office on campus SSD covers the cost of a student blue parking permit. And the entirety that your placard is valid so even if you have like a temporary one and that has made campus a lot more accessible for me. And in addition to that, oh, I guess I should clarify blue parking is considered like the best parking on campus so it, it gets you access to like the handicapped spots that are like near your buildings. Oh yes, good point about this is for students only. In addition to that SSD offers through the university as well, a pair of transit services. That's not something that I have personally utilized but I'm not sure if any of our other panelists have, but they're able within a certain mileage range of campus to do scheduled live pickups and drop offs, which can be really helpful. For me, I wish I would have known about a lot of the student groups on campus that were involved. You just believe I didn't know about any. When I first came here. But I also, I didn't go to any of the student days where they have all the clubs outside so they might have been there, and I didn't, didn't go so I didn't see them but I think. I knew about those groups earlier on and was able to like meet people and get more involved sooner. I think that would have helped me just feel better being on campus and just having people that I could talk to, and maybe could understand some of the things I was going through. This is Eva. I also wish I knew more about like disability related student organizations on campus, but something that I wish I knew I could do that I recently started doing is SSD has a branch. It's under their unit called adaptive sports and fitness with various sports like wheelchair basketball and wheelchair tennis, and they have drop in practices where community members can drop in and play of all abilities, I was always exempt from PE growing up so I never thought I could do sports and just going to those events have have has been like, I'm really encouraging and lightning experience for me. Like, and it all relates back to like connecting with more people with disabilities and finding community there. Michigan, Michigan, and disability at Michigan is it's rapidly changing and it's get it's really exciting. So, then also, I wish I knew about Argo Park and the here on river, and the kayaking that in tubing that you can do there, like I love that. And you only get a few months of warmth during the semester unless you stay here over the summer. So, definitely try, try going to Argo Park or Gallup Park. And Arvor is blessed with so many amazing parks. So, I would definitely explore the town. Thanks, y'all. Thank you. Would you be able to share with us what if you have experience with it, what the accommodation process looked like for y'all. I think I'm going to let the other panelists speak because my accommodations were put in place before they even changed to their new system. So I'm going to, if there's a specific question I'll chime in but I'll pass. Eva, I enrolled in SSD. I'm sorry, Isabella, if you were going to go. I enrolled in SS with SSD. The summer before I entered graduate school so July 2021. They had just implemented a new system called accommodate. And the process for me, having had accommodations in undergrad was relatively easy. You go to the website, you fill out a information form. They ask a lot of questions about like sort of what are the barriers that you experience. What accommodations, if you've had any in the past have worked for you on what other ones are you interested in exploring. I of course ask for medical documentation. But you don't need that to meet with someone to start at least when I started I'm not sure if that has changed now. And then, like I met with my coordinator a few weeks before school started and then start filled out a full accommodate profile and that's where you get your letters. They used to be called visas. And in accommodate you can apply specific accommodations to certain classes. And I just applied all of them to every class even though I knew I wouldn't have exams I still had an exam accommodation. It was really easy and but something that I a barrier that I found was the application was very long for me, and I thought that I, I, I think I ended up completing my profile my accommodate profile in like, September, or later, it by asking my coordinator to schedule a meeting with me and sit with me while I fill out the profile. And that that got me to get it done and like I'm so thankful that she sat with me for that and then. Additionally, I continuously met with my coordinator throughout the semester most folks just meet with them once a semester once a year. I consistently met with her to determine what was the, what were the best accommodations for me at the time. And like which ones were working and which ones weren't. So, yeah. Okay. Thank you. I appreciate that. Thank you for being so thorough, Eva. You spoke about earlier about the inevitable right of passage that is imposter syndrome. I feel like that grads graduate students go through how all my to all my panelists how has your journey been with that. How have you overcome it have you yet. What's the process been like what does it feel like and what have you done about it. Imposter syndrome is something that I still battle every day, you know, going into my fifth year I often feel like I'm never going to graduate I feel like the work that I do isn't as strong as some of what my lab mates may be able to accomplish. I find it easy to think about like, well so and so was able to publish in this journal which is this much a higher of an impact factor than what I was able to publish in. But what I've been trying to do lately is remember that I'm going to get a job someday I'm going to get out of here someday and it'll happen when it's time for it to happen. Just sometimes, you know, I get as much as writing one sentence in a day and other times I can set up 25 different experiments, but both of them were important days. Something that helped me when I was feeling this way. Kind of when I first even just started before I came to grad school when I started thinking about even trying to go or applying and like not feeling like I was the right like the right student to go to grad school. Just kind of talking to myself and telling realizing that there is no right student there's no right thing everybody's different and it's hard not to compare yourself to others but and I'm still working on like not always doing that but you know try not to always compare yourself to other people are doing because you're going to be doing different things. You have different timelines different goals. And also recognizing that like just feeling for the specific feelings I had of like not being good enough or smart enough like real recognizing that really nobody's good enough or smart enough like everybody needs help with things. Nobody is like a best at everything can do everything and and that's okay. This is Eva imposter syndrome is really hard. I would say, like, I, I in when I during when I was in graduate school I think I submitted maybe two papers in total. And a lot of that was because I struggled with imposter syndrome, starting a sentence and not feeling like it was good and restarting and sitting at a blank page just staring at it. And while I saw my cohort mates just like finish the assignments and move on with their lives. And something that at least has helped me. I mean, like, has been, you know, knowing that at least with like a social science program, when you're submitting papers they want. They're not expecting perfect perfection from the start. And that sometimes, sometimes for me I just felt like sometimes I just I felt like maybe I wasn't good enough or maybe that I was admitted for other reasons beyond my merits or like other things like that but And being with and being real with like other people that have some similar identities that had helped me out a lot like I quickly joined like the Asian and Pacific Islander organization in my school and joined like disability And that helped me realize that like, you know, everyone's going through imposter syndrome I'm not alone. And then additionally, like some sometimes when I was sitting in class it was it would get I would feel like I'm really not able to pay attention right now like what's going on, having just sometimes talking with the professor if you felt like the professor was someone that was relatively safe to talk to about imposter syndrome can be helpful or like your academic advisor. Definitely gauge how safe you feel to talk to them about these things but I had one professor who was who I felt like I could talk to about a lot of that when we had some shared identities and just seeing someone someone someone like me has their PhD or has their master's degree it helped motivate me to like keep going and I know I'm going to get mine eventually. My timeline is very all over the place I don't know yet, but I know I'm going to get one eventually and hopefully and just knowing that people have walked walked these paths before and that we're not alone. That's a big one. Yeah, definitely I think understanding that everybody experiences whether they seem like they don't know not is an important realization to accept. A student asks, you know, Have you attended any of the workshops that SSD hosts, and if you've done academic coaching, what is the process like. I have not. I have not either so. Okay, this is Eva. So I am not sure if the workshops were going on when I was in school, but I did do academic coaching and I did do past partners so peer assisted study sessions. So I'll start with academic coaching. Academic coaching was very helpful and having a you meet with a coach once a week or every other week depending on what you know what capacity you have. And for me something that I really needed was to like look at assignments and start gauging how long things would take based on the history of how long things have taken me in the past. She would check in with me on things from last week. Basically, it was. We would set smart goals, like, which I don't remember what that acronym stands for but it's like basically like manageable goals that I can do, do each week. And then we would check in again. And then for pure, and that was helpful so it's a it's you fill out a Google form. I'm not sure if they've changed to Qualtrics but you fill out a form, and they will reach out to you. Your coach would reach out to you and you can get on their schedule. And then for past partners. That was basically body doubling sessions if you know what that is. Like before it's where people sit down. Like with each other, this in this case on a zoom call and for like a four hour work session and there's check ins every. I think it was like every 30 minutes. They would check in and you can update how your progress is going or what might be stopping you right now and the past partner, the other who is another graduate student. They will, they can help guide you, or you can go in a breakout room and talk to them for like a little bit about what's going on to help get you back on track. And then they also used I'm not sure if they still use this but they used a program called fivable which I'll type in the chat.  And for me that was very motivating I was like wow people are getting stuff done I want to get stuff done to. Do the timers do the pomodoro method, which is studying for 25 minutes taking a five minute break. Yeah, so that that's how it is it's like a structured study session in a way, or work session. They're really helpful. Thank you. Okay, so before we wrap up for today. I'd like to ask you panelists. If you would like, if you would like to share your biggest piece of advice that you have for audience members as they start this new journey. Yes. The biggest piece of advice is do what you can but remember to listen to your body and your mind. You may not be able to spend as many hours performing research or studying as your colleagues, but you can move forward at your own pace and that is more than enough. Second that and also add on and say that you can do what you need to do for yourself and like, you don't need to explain it to anybody. If you don't want to and like you don't need to feel bad for it. Like you just do what you need to do. And that's, and that's okay. That's good. This is Eva. I'm third in all of this. This is something that that for that I think I would like to leave the advice for is to give yourself some grace. In like most things you do, like, especially doing a capacity check, or there's a thing in the disability community that we say called spoon theory, where people are allocated a specific amount of spoons, each day, meaning your energy or your. Yeah, your capacity. And for every task you do, you give a certain amount of spoons so like waking up in the morning for me is at least one spoon. And then by the end of the day you might have two or three spoons left so I'd say every day doing a spoon check and give or take a few spoons. Like I used to push myself and and say I have more than what I actually have and then that leads to burnout pretty fast. So, I think that's another way to say be aware of your body. But yeah, no one you're spooned out is what I like to say. Wonderful. Thank you. Thank you. Thank you. Thank you panelists for giving your time and your expertise to us today. And thank you audience members for your presence and your participation. I want to remind you that the recording of this event, the link for that will be sent to you once it has been processed that takes a couple of weeks. Please remember when you get a short break, take the opportunity to pop over to the evaluation survey so that we can keep improving our programming for you. And the panelists email addresses will be placed in the chat if you want to reach out to them for further communications. But other than that, thank you very much and take care of yourselves.


Welcome back to another acting analysis and tips for animators. And today I'm going to take a look at season two of succession.  So let's go. I'm going to cover episode one to four. I'm currently watching season three, which is great. But before I start, hi, my name is JD. And I do acting analysis tips like these. I do animation analysis tips. I do animation lectures. I do review reviews, product reviews. You know what this is. This is the pitch at the beginning. This is the channel. This is what I'm doing. If you like it, subscribe so you don't miss any of my uploads. And if not, maybe you'll do it later. That's OK, too. So no more pitching. Let's get straight to the clips. Now I'm actually starting with a moment from episode four and not episode one. But I wanted to talk about just his body language in terms of there's something that happened. I'm not sure, you know, we're watching this, I don't know what, you know, but something happened and he can't really do much anymore. He is a very compromised situation. And you can see this in terms of hiding behind the desk and always looking down. He can't really look up and tell his sister what's going on. Now, at this point, she asked him straight out what's going on. And he kind of puts his hand in the pocket again. He doesn't want to be exposed. He kind of hides always something, right? And he has a moment of actually looking and then that's it. He tries to be straight, like this is this is what's going on. And he tries to convince it with nodding. So a little bit of a moment of not being able to look at her, but goes back. But she doesn't buy it. And she has that great moment of really, I don't I don't buy this. And as she's confronting him, you can see that, oh, OK, she's not really buying this. And you can see that moment of curious. And you get that puppy tilt of, oh, I wonder what's going on. But he takes that little step backwards away from her. So as always, if you have multiple characters, this is these are my characters. Think about how close they are. And if you watch my channel, you know, I'm always harping about this. But if you have multiple characters, what is their distance? And is there a significance of them getting closer or potentially stepping away? Now, as this continues, you can see that he just really can't look at her for too long. There's always a bit of a problem in terms of eye contact. He's just very embarrassed. He's sort of in a very tricky situation. And again, she doesn't buy it and she pushes him. So what does he do? He goes back and starts to hide again behind the desk. And not only that, he starts to grab even this. It's almost like he needs something to occupy himself like a fidget spinner type of thing or just hiding behind whatever he can hide. As it continues, though, he realizes, well, I got to say something. And again, this whole walk looking down. So always consider the eye line is the character looking down. Yes or no. And why and how is this going to affect the other character? And how is this going to affect us watching those, you know, one or two or three characters? And this continues with him not being able to look at her, her pushing him and confronting him. And it's just there's a moment of a breakdown where he just he just can't tell her what's going on. And he just asks for a hug. This one is great, too, where he just it's about, again, successions in the title. Like he won't be the next CEO. And she has that moment of, oh, interesting. And just that readjustment as well. She's kind of leaning against that puppy tilt, that lean of interest. And now she heard something goes, oh, interesting. And she got a bit of a change, like, OK, OK, what's going on? And then it's this absolutely great moment of him asking her, give me a hug. And, you know, the siblings in the show, they're not exactly warm. And you can see that in this reaction of, really, really. And he gets really close to what's going on. And she's not, you know, it's not a warm embrace, kind of like what's going on with expression. It's a tap on the back. And then she realizes that he's kind of nestling in here. You can see this, he's rubbing his face. He really needs a hug. He's really broken down at this point. And it's this great moment. If you just watch her how she doesn't tap again, you got that change in her face. I love how just everything comes down. This you'll watch the hand here when she realizes, oh, something is really not good. And now starts the embrace, the hugging, the caressing. And if you're watching this, this great moment of just that moment here where he actually sobs, it's like one little sob. And then she really realizes this is not good. This is what's going on. Think about this in terms of if characters embrace in your scene, how do they again interact? Like anything where not just an expression, but is it a tap? Is it a hesitation? Is it a long hold? All of that is going to tell us how they feel. And it's going to add layers to your performance. So it's not just I'm moving and got to move my IKR or FKR and think about constraints and this is the move and that's it. But they always think about what does a gesture mean? What does timing mean? Like in this case, tap, hold, that hesitation and that look, that combination is all of that. It's always so super important to think about every single move, every gesture, every look and how long things are taking. And it's a pain to think about as an animator, but you got to go and think about that frame by frame and actually sticking with him. So this is episode one. He has an interview and this is a great thing of this massive imposing prop. And he is attended by tons of people. And this is something for you to think about in terms of sets. This is not what I want to talk about. But now that I'm seeing this is really great, that massive overtaking camera that leaves him really tiny and alone, but you can see it is later too. But the main thing I want to talk about is this. As we can see a certain area cut off, and that's all we can see of the character. But then as it continues, and it's a great moment through here, you can see this here. He sits down, gets ready, and we're starting to cover the character with her and him and then look at how we reveal him. And you got this.  He's just it's always like he's on rollercoaster and he's just he's afraid. And I love that contrast of or kind of that reveal of while there's one way this is how we perceive him. But in reality, he's actually more like this. And I love this too. When he goes away and as this guy crossing the camera here, look at his eyes. He just looks at it's almost like a look for help. I'm alone. Don't leave me. Oh, such a great moment. And again, the differences of we are like this. That's what we see and you can pretend to be all OK. And then here does the blinding lights. This is almost Star Trek. There are four lights. Anyway, but I love this here, all of that, just seeing the different changes of how nervous he is, all of that, the preparation. This is something else for you to think about. Maybe your character is in an interview or somewhere with an audience and then your lip sync, right? You can have your lip sync here and then that beginning, as long as you have some ambient noise that matches the rest room tone wise and everything, you can start a shot like this. I love this all that getting ready. OK, and then he could cut to the interview where at the end he could be like this and now suddenly he's confident. But we know that's not really what's going on. You can see this later, too, is they make an extra point here of showing this, the nervousness. Oh, it's so good. But also, again, in terms of sets, I love how he is just so tiny in here in this massive, it's all fake, this empty room and just this watching him, that whole setup is great. But again, I love this as an idea for a shot. If you're doing a lip sync where we're showing something and that's, again, the face can lie, but the body is going to tell you the truth. So the subtext here and him being nervous, you can show it through something like this. And it doesn't have to be a tilt on revealing the hands. It could be just something like this as opposed where we go back and forth between, you know, people in the audience or someone in the set. And then we cut to this where we see the confident thing and go back seeing actually the full body language of what's really going on with him. This one is mainly about Roman, the character Roman here. He's just so great. That actor, Hulkin, is so good. It's this thing, it's a simple thing, but she goes, all right, let me show you around and look at him. Why? Why would you turn like this? He just has so many moments like this. There's nothing huge I want to talk about. It's just as an original idea of if your character is kind of quirky. Also, he does great listing all the time with his facial expressions. I love that little slight little tilt. And again, he does this for these eyebrows. So does in terms of like general, interesting acting choices or how you can go from A to B, again, this has to be in character. It has to work within the scene and the situation and the story. It's just a great moment. And there are actually a lot more than I want to show. This one with him being awesome and he's always so awesome in the show.  So you can see here he's flustered. He just wants to get out of here. And you can see this awkward bumping into the chair. And then that does that push off. And this is because I always show to my students, the big hero six character tests where they sit down and especially how they interact with the sets, the environment. It's just you can really show the personality in terms of how they interact and what they do.  Is the standing up kind of awkward as he bump into this is maybe something spilling. And is this is frustrated, but he doesn't want to take it out on a person. So he takes it out on a piece of furniture. So just kind of thinking about that in terms of setup. That if you do a quote unquote, simple assignment where someone is sitting and then standing up, think about how far you can kind of push this in terms of personality and then how you can use sets and prompts to kind of push the emotion and kind of push the character traits. Again, this is purely about an awesome moment. She is not agreeing with him, but he doesn't really want to realize like, yeah, it's fine. And does that little, OK, it's kind of like an agree to disagree. But it's almost like he just overrules what he just heard. She said no. And he goes, no, no, we're going to do this. And I love her reaction to I just love this in general. But her reaction, OK, OK, what was that? And then he goes into because he wants to be politician. And it's this kind of this, OK, team, let's go, let's do this. And then this great anticipation of he does this with the sound. So before he actually gives her a kiss. So there's a lot of a lot of awesome stuff in terms of what could you do when characters are facing each other and there could be disagreement or something that is almost cute, condescending or just kind of off. And I love that where it's not. I mean, it's obviously weird and forced, but her hand is there. Like, yeah, I'm just going to use this to kind of make a point of it's a handshake and I'm only one shaking because you're disagreeing. But it's OK. It's OK with me. Just kind of think about that. And of course, character reactions when the lip sync is about one character, but you can always cut to another character reacting to whatever they're hearing or whatever they have just done to that person in terms of again, like an embrace, a handshake, whatever it is. And of course, my favorite in terms of anticipation, you can do something here before the actual action. Here's another one about a gesture. He just says orchestra quiet down or stop. Actually, I can't remember what he says. But it's something super simple in terms of just music stop. It could just be this. And I love that he continues with and just tone it down.  And you're always tied to the rhythm and kind of, you know, you kind of have to do what the lip sync tells you to do. You can like we've shown before with Kendall holding the chair. You can show subjects, you can do a bunch of stuff. But the moment the audio ends, it's your opportunity to add a little button at the end. That one more thing where that's just a great, a great expression, a great little thing that goes, OK, guys, because it's not really, it's not really, I won't say polite, but it's not really friendly. It's more like, OK, guys, it's not great. Come on, come on, pipe down. So again, are the gestures telling us something more about a character and how can you use this once the audio is done? And speaking of gestures, here's another one. She asks him, how are you doing? Everything OK. And he is in a horrible state of mind. You can see this here hung over a hair of the shovel. You got to put this clothes back in. He's not good. And he says, I'm not good. But while he doesn't, he gives it to a OK. Even here at the beginning, he goes, he knows, yeah, I'm not well. I'm not good. Yeah. Everything is not great. And it's a simple thing of doing the opposite. It's like what I talked about before in a previous clip where if your character says yes, you can do yes, or you can do no. So you have a gesture either through the head or whatever it is, and then you say and perform something else. The opposite. It's not a crazy idea, but I just like the contrast and it's exaggerated. And it's something you wouldn't expect. And depending on how you act and what the secondary action is with him putting in back to close, you just add extra nice little contrast that you wouldn't potentially expect. And actually, speaking of contrast, I love this here. If you look at them, you can see there's a specific height difference against a simple thing I want to talk about. But she comes in for a kiss and look at her. She gets on her toes and it goes back down. Just a little moment of up and down. And it's cute as you can feel it, even though we can't see the the feet or the legs. But it's something for you to think about. If you do have characters, is there a high difference? And then what can you do with this? Does the character have to lean down all the time? Maybe it's something annoying where the character is this tall and this character constantly has to talk down. Is something dismissive? Is it condescending because of the height? Or is it something where the character is small and the other character who's tall doesn't want to be threatening? So then you use that height difference for the character to actually squat down and talk to the character from a lower point of view. And in this case, just for a little kiss, they can just get on the tippy-toe if a cute little moment and do kissy-kissy. But if you have characters of different heights, think about that. But can I use this to my advantage? Once taller, once smaller, what can I do with this? And here's another one with a great expression where something happens. Spoiler's not going to say anything. And he tells him, good job. And I love that little subtle, huh? Really? He's telling him. And they all work together and she's probably expecting, well, he's going to tell me the same thing and he doesn't. And he just does this. So good. It's this moment like, yep, not you. Thank you. And then he still kind of looks at her to see what the reaction is. It's a great little turnaround and that I messed up. But I love this again, something that wouldn't expect from this character. This character is mostly angry, not mostly, but there's a lot of anger in this character. So for that moment of, hey, it's so great. And again, this is something where lip sync and a no lip sync and it's purely pantomime to give us something else. Also great for lip sync, which I've mentioned before. You don't always have to animate and see.  We can see this, but we don't have to have a focus on the character talking. So imagine your whole scene is them talking. You see some blurry jaw movement up and down, but it's all about the third character. They're listening, I don't think they have eye darts, you never reactions. So that as a set up is cool, too, because maybe you're new to lip sync. You don't want to really deal with all the shapes here. Put that in there in a different layer, blur it out. And then it's all about a character listening and the thought process and how they're processing the information. Because again, for your characters, you always have to pay attention that they're listening and reacting and processing and reacting.  I have to be like this, I have to look over there, I have to react. And it's especially difficult for animators because we're listening to this all the time, looping, going frame by frame. There's a spontaneity that's kind of gone because we just constantly have to analyze this frame by frame. Is the eyelid here and then here and so on. But as you do your performance, really try to make sure that your character is witnessing things for the first time. Obviously, the Koopi story point that it's not, that it's a repetitive thing. But generally, right, in most of the character pieces, the characters are talking or doing something or seeing something. And that character will be exposed to something for the first time and it will be listening to something and hearing something for the first time. So really make sure that that is visible in the character's face, in the body language, if they're multiple characters. So try to keep your characters from being animated by an animator, if that makes sense, because we know everything and we just we're too familiar with the whole scene frame by frame. So it's kind of that freshness and that reaction of the character that's a hard thing to sell. But that makes the performance that much more interesting because we get to see, oh, they're thinking, they're processing and that's a cool reaction and so on. Now, speaking of reaction, if your reaction to this is that, oh, this is interesting and maybe he, as in me, can help you with your shots. You know what it is, it's the end, it's the picture on the workshop. So if you like this and you want me to help, you can sign up for my workshop, link in the description. The signups are open and you can sign up at any time. And speaking of time, this is, I don't know how long, longer ish. So if you're still watching, thank you for watching. I appreciate your patience. And if it's something that you ended up liking and you don't want to miss any of my future uploads, it's the other page. Subscribe to my channel and you know how it goes. Hit that bell button so you don't miss any of those uploads and that's it. So thank you for watching and I'll see you in my next upload.


With over a thousand active Omicron COVID-19 cases and a positivity rate just shy of 25 percent, Pike County Health Department will be implementing a new system to deal with overwhelming case numbers. Tuesday, Mountaintop spoke with Public Health Director Tammy Riley to learn more. Now at this point, we simply are not able to call every patient that's newly reported to us. That has been a challenge for several weeks now, but at this point even data entry on our end, we must get these cases reported, put into the system rather that are reported to us. So just data entry is taking up much of our time. So we're going to look at a new approach for patient contacting and relaying information. As of present, PCHD relies on calling patients one by one to contact trace, but as cases continue to rise, Riley says calling those infected is overwhelming, as some do not wish to be called. If you take the amount of time that it would take to speak even for five to ten minutes in some conversations last much longer than that, but just to speak for five to ten minutes to 180 patients in a day would take a numerous amount of man hours that just is not possible for the staffing that we have. The CDC's definition for contact tracing is that any case load over 25 per day per 100,000 would be overwhelming for Public Health. That's the CDC's definition. We're currently at close to 180 cases per day per 100,000. We just simply can't call the patients any longer. So we're going to look at a new approach. At Pikeville Medical Center, we believe that together we can make a difference in the fight against cancer. We are proud to have patients who have experienced successful outcomes over many years. As always, we believe in the power of faith. Pikeville Medical Center, where cancer can be defeated. As Riley states, PCHD will continue with weekly updates and continue with their current system. However, they hope to streamline the process with a website and phone number. However, you know, moving forward in the very near future, we will have a different process. We will have a phone number and an online form. So there should be a 1-800 number in an online form where patients can either go online, they can go to our website, they can go to our social media site, or they can call 1-800 number, give us updated contact information, answer a couple of very basic questions. What we want to do at that point is focus on patients who are requesting phone calls. That will be time efficient, you know, for us. And we'll appease, I think, and make the public as satisfied as possible during this time. Dates for PCHD's new system have yet to be announced. If you have questions, you can call the Pike County Health Department at<PHONE_NUMBER>. For Mountaintop News, I'm Joel Chorjol.


Hi, everyone. Thank you very much for tuning in today. Today's talk is about attacking terraform environments.  This talk would cover a lot of things that probably not known before. One thing to say before we start, terraform by default is not as secure as you would think. You have to put a lot of work to secure it. What I'm aiming for is by the end of this talk is to learn about all the things that you can know so that you can secure your terraform environments. Let's start. A little bit about me. My name is Mazin Ahmed. I'm an application security and offensive security engineer. I founded Full Hunt. It's a security startup that solves the attack surface visibility problem for companies and organizations. Also, I'm an occasional but 1,200. I have been acknowledged by Facebook, Twitter, LinkedIn, Zoom, Oracle, and many other companies. Of course, I'm in love with cloud security. Anything related to cloud security and of course, different things related to security are my passion. That's why I put the effort into having this research made. The agenda for today is first, we're going to go over things, a background on terraform. What's terraform? How does it work? Why do we need to learn about all of this? Why is it important? Attack, victors, scenarios. Attack, victors, and scenarios. Of course, the most important part is the demo, which would be really cool. The recommendations at the end and then we'd have room for questions. First of all, what's infrastructure as good? Back in the years when cloud was starting, water was becoming a thing, if someone would like to deploy something, they would go to the console, take their time in deploying their resources from the console and if they would like to do this again and again and maintain that, they would have to log in every single time to do that, which is a bit of a painful thing and does not scale. That's why infrastructure as code became a popular thing in the DevOps and DevSecOps communities. Why? Because you would be able to write all of your resources and the cloud as code and then you would be able to deploy many times and at the same time, you would allow room for peer review so that the people in your team and different teams would be able to review it. It's amazing. It allows that part. Of course, one thing that you can say that once you have this being set up, you would be able to run it through CI, security scanning for compliance and you can automate many things without really having to have someone to review everything being deployed. Of course, when you deploy this in using Git, you would be able to have an archive of everything being deployed. It's just an amazing technology that everyone loves, hopefully. Who is Turfome? Turfome is an open source infrastructure as code software made by HashiCorp around 10 years ago. Users define their code in a language called HCL or HashiCorp language and then deployments and the entire infrastructure management happens through Turfome. Whenever you write code, you would pass it to a Turfome build binary and then it will read the state of the current infrastructure and then it would decide what changes should be done. Why I'm talking about Turfome today, instead of all of Apollomi or different cloud formation or different cloud orchestrator, because Turfome is the most popular IAC orchestrator in the planet. This year, a couple of months back, they have released Turfome 1.0. It has been a big thing for everyone that is working with Turfome and of course it passes 100 million downloads, crazy numbers. Another thing that is cool about Turfome, once you have it, is you can write the same infrastructure code and have it integrated with different providers. You can write code that allows you to deploy to AWS or Azure or GCP or anything else. It's not only these six technologies and six providers that are there. They support more than a thousand providers as of today. How you would be able to do this is, as a practitioner or a user, you would write your code. Then once it's ready, it would go through Turfome plan and Turfome plan is the way that Turfome would be planning your deployment and show you what would be changing. Then it would go through the apply. Once you click on a run apply, it would be deploying right to your cloud provider. The thing is, when you are running apply and plan on apply, this means that you are checking the drifts between the current code and what is there on the provider. If you are applying changes, this means that you have right access on different things on your cloud provider. Who would have this? It would be Turfome. Setting up Turfome would grant it high permissions that allows it to do everything that you need to have it to do. While it sounds curry, it's the default thing. We have to just set it up in a way that could be secure and not rely on the default things and try to think better about it. As I said, with great power comes great responsibility. A single mistake here can lead to the entire compromise of the cloud provider or the cloud account. Imagine your entire AWS account being held for ransom. If someone compromised it, they would go into your cloud provider. They would be backing up all of your S3 buckets. They would delete everything. They would have it somewhere else. Then they would ask you for ransom. Imagine this. Ransom is not a thing that you would see only on your internet network or in your laptops. It's something that can be done also in the cloud. It's still not a thing today, but I can imagine that this would be happening in the upcoming years. As I said about the Turfome states, the way that Turfome works is it would be storing all of the changes and all of the additions that it made in your cloud provider in a file that acts as a database called Turfome state. Every time you do a change, it would check it against that file and then would update it whenever there's anything. There are many ways to have your Turfome state being deployed. One thing is you can have it locally. Second way that is I think the most common way by everyone that I know is using a remote backend of S3 so that you would specify a bucket, you would specify a key, and then which region would you like to have this bucket at on. Turfome would be automatically creating this bucket for, would be automatically pushing the changes and the state file there, and whenever it updates, it would synchronize with that key. So attack number one or thing number one, if you have get object permission on the S3 bucket for sorting the state file, then you would have access to secrets, access keys, and database credentials. So everything that is being deployed for the organization through Turfome would have a copy of it in the state file. So there's something like an RDS database would have their credentials stored somewhere and that place would have a copy in the state file. Same thing if you create an IM key, access key, then you would have it there or any other secrets that you would define or the provider would be defining for Turfome. So whenever you get access to an organization and a cloud account, try to search for if they have a S3 bucket that looks like it's storing secrets for Turfome. It would have the entire instructions for you to go further in the environment. Another thing is states on Turfome Enterprise. Turfome Enterprise has, Turfome has an enterprise offering called Turfome Enterprise and the normal Turfome that people use is a CLI binary that people would be using for deploying infrastructure, but with Turfome Enterprise you would have SSO, team management states management in different ways and configurations and different ways for your integrations. And Turfome Enterprise is amazing, but still the same problem of storing the states files exists on Turfome Enterprise. And how it works is you would deploy Turfome Enterprise as an instance. It follows a sort of hosted model. Also they provide a cloud hosted model that they would be hosting it within an offering called Turfome Cloud. But let's focus on the self-hosted one that you can host in your infrastructure. The states can be stored in many ways. Postgres UL, AWS RDS, if we wanted this same instance desk and many more. If you get access to any of these places, these places would have access to the state file and then you can copy this state file inspected for secrets, use these secrets for gaining a step ahead. Another thing to say, of course we talked about Turfome Enterprise is deployed as an instance on the AWS account or in the cloud account. And if you compromise an instance, this is the best place for attack resistance. And there are many reasons for that. One, once it gets deployed successfully, no one really touches it. Another thing is upgrades and maintenance really happen. It's not a common thing that in a DevOps engineer we go in and log in and access it to the server to see different things. And this, something is broken. Then there is an actual upgrade that would happen. This is the only time that someone would go in and try to SSH to this instance. So this is one thing to add. And of course, because Turfome Enterprise would have permissions to deploy to your cloud environment, the company would have to provide it with proper permissions to deploy online. So it would have probably admin access to your AWS accounts or any account that is being used for. If you get access to this VM or this instance, then you would have high permissions in doing whatever on the infrastructure. You can create new users. You can backdoor users. You can read buckets, which is something that is not really common, but of course you can do that. And you can do everything. And one thing that is funny here is let's say that you are in engagement and the security team detected that the database was compromised because of the state files and all, they would ideally go and rotate the database keys. And how would they rotate the keys? They would rotate it through Turfome. That's a typical way, or one way actually. But if they updated to Turfome, then you would still have the latest keys being synchronized on the Turfome instance, which is really cool. Let me pause for water. And as I said, Turfome Enterprise has high permissions. And it's not something that you should really put on the internet. But there are hundreds of organizations around the world that have Turfome Enterprise exposed to the public. If there is a single zero day here, I'm pretty sure this would be a nightmare for all of these companies. These are filters that you can use for just checking it out by yourself. Okay, we talked about how you can use this in your advantage with when compromising an AWS account that has or an AWS user that has access to the S3 bucket that stores the state files. But let's say that you are not really able to compromise the AWS account and you get access to a developer machine and this developer have access to Turfome Enterprise or Turfome Cloud. What things can you do here? Turfome have exposed a full dedicated API that can be used for automating functionalities and tasks. This can go from everywhere from updating users to provision plans to add comments and everything. And one thing that they have is an API called state version output. And this state version output API allows you to download the state file that you would have needed to compromise an actual IM user or all of this. So now if it wasn't really possible to do this, you can just go to the API and ask it for your state file nicely and it would respond with the actual state file in plain text, which is nice. Of course, this would also contain sensitive data with clear text credentials and everything that could be fun. Going further, a couple months back, Alex K. released a blog post talking about Turfome plan RCE. It's a problem that Turfome has it for over the years, but it wasn't really talked about within the Turfome primates. This blog post has become a viral post about how this attack could be done in a practical way. And they were talking about how you can use an emulation provider or an external data source that could allow you to get code execution on the Turfome interface or the instance that is running Turfome. And this can result in the compromise of the entire infrastructure when someone submits a PR that is not approved. What you're going to do is if you find, let's say you landed on a developer machine and this developer machine has GitHub token that allows it to push PR on the account that is being in the repository that hosts the Turfome code and this one is integrated with the Turfome interface like the normal setup. What would happen here is if you as a developer check out a future branch and then push code with the malicious payload or the attack that talks about the malicious provider that you're going to talk about, then you will get code execution on that server. You would get shell access. And this is really simple and of course it's not really intended and this should never happen in real life but it has been applied between usability and security here. It's hard to find a way to secure it and at the same time it's hard to not allow something like external data sources to be used. Chris for Alex K for having this book was written and shared to us. And this is an example of an actual proof of concept. If you'd like to test it out and you are authorized to test it, go and copy the code that I have here on my screen. Of course the slides would be public on my website and my blog and just use this code and then push it in as a future branch and get the repository that is responsible for hosting the Turfome code and then see the magic happens. You would get shell access on that machine. Of course this is a big problem here but the thing is other platforms are also vulnerable. It's not only a problem for Turfome interface. Anything that relies on Turfome built would be vulnerable to this. Eric Osterman in 2018 tried to introduce a fix and it was rejected. The fix was to use to restrict users from querying Turfome plan within Atlantis to only a subset that is being specified. And this would grant security here and could be a temporary fix but it does not really resolve the actual problem from Turfome. Ideally you should not really be able to run code on Turfome interface instance and get full access there or get access into the machine or the instance that is running Atlantis. Or even the developer machine that runs Turfome plan. This is not the right thing. Moving ahead, we talked about the attack that you can upload and you can upload an external data source like this one to gain access there. But would it be fun if we can do this in a way that is not really detected from the PR? Let's talk about the evil provider attack. Publishing providers within HashiCorp's Turfome is automated. This is made to encourage publishers to push code to Turfome. But the thing is trust but verify. We cannot really just push code and have it being trusted to be used by the community and by Turfome without really verifying its content or even having a way to detect attacks here. So let's say for example that one of these providers or one of these 1000 providers that are being used by people it's not only these 608 providers have been compromised and they have been bagged or and you're going to talk about how. And if this happens and someone just say Turfome in it and Turfome plan, what would happen is the attacker would be compromising the company. It would be chaos. But you know I don't want to have this being as a theoretical attack that does not really happen in real world and someone is discussing it in public. I would like to show an actual proof of concept about this attack from zero to the end. So let's start. First, let's try to set up a provider. I set up a new GitHub account. I called it even Turfome. Of course I didn't want to use my personal GitHub account because I know it may get suspended. We're going to talk about this one in a bit. And then I developed a simple provider and this provider was pushed into even Turfome such as Turfome provider E. Of course this is my picture. Anyone can know that this is the code that I have. And then I backdoor this provider with this code. This is a simple provider that would grant me reverse CCP shell upon the execution to my server. And then I pushed it to the Turfome registry and it was accepted. It was approved. I had my category as cloud automations because it automates my hacking here. And I was showing a bit what happened. Once I had the provider being approved by Turfome, I made a PR to push it to somewhere. And it looked like this. It's just the same way that we would be pushing providers in our companies. And now the fun part is the demo. Popping shell in Turfome cloud hosted by Turfome. This is app to Turfome.io. And you would wonder from here is how is the detection here? Probably in a well-organized environment that is running a good EDR solution or antivirus solution, this attack would be prevented or detected, but it wasn't the case. I pushed the provider that I built into VirusTotal and no provider really detected it. And back to the attack that we showed here, pushing the provider that grants me a reverse CCP shell got executed correctly within HashiCorp infrastructure, which is really bad. Imagine what could happen afterward. I haven't really exploited this further. I only slept at this part. And I tried my best to make it as obvious to the security team to see how the team response would be like. And before I continue here, I want to say that this attack is against the terms of use by HashiCorp, running this in an account, my reslocked in account description. So how is the security team response? Within hours of my exploitation, they detected the evil provider attack and contacted me directly to chat about my findings. And then we discussed various ideas and thoughts to introduce a fix for the thing that was presented here. And HashiCorp informed me that they are really thinking about ways into having this being mitigated for their customers. For the time being, there is no patch. There is no fix to introduce. And there is no way to prevent this. I appreciate HashiCorp's efforts in handling and analyzing the research. One thing to add is I was planning to make the responsible disclosure the next day of my tests. And before even going to the next day, they were the ones who were contacting me. And I really appreciate them being this proactive. One thing to add here is they are also thinking about starting their bug bounty program. At the current time, they don't have a bug bounty program, but this is one thing that they also are planning to have. Now, going to the recommendations. First, be careful. There is, like you would have hard times in maintaining a secure from environment. So being careful is my mere recommendation here. Another thing is, why is it like this? Okay. Another thing is, when using SV as a remote backend, try to have a bucket access policy to prevent other users other than their from instance to have access to your instance. This way, you can prevent like unauthorized access in certain ways. Of course, there are bypasses for this solution, where if you have another user that has access to modify the the bucket access policy for this bucket, then they can delete the access bucket policy and then they can access the bucket here. But at least if you can use this as a protection, this would be a good way. Another thing is to continually update and review your terraform instance. It can be easily forgotten in the noise. And if there is an attacker or an actor that lands on your terraform instance, as like mentioned earlier, this is a great place for attack persistence. So it can be easily abused badly here. And then it can be easily for defenders to forget about it. So, yeah. Another thing is, be careful in permitting people to have right access, even feature like feature branch access for your terraform repository. Because it can lead to direct code execution and there is no way to pass it. I'm waiting for a patch to happen. We had a group and I were talking about different ways to detect the attack. Meanwhile, the actual patch is there. But it's just ways to detect it. There is no way to prevent that moment. Another thing is to maintain a terraform instance in an isolated VPC that no one really actually said on the Internet. Do not be exposed to the Internet. This is bad. The next zero day that would happen, someone would scan the Internet. I'm probably compromising organization because of this mistake. And it would be that. And I think this would be lastly, state files are sensitive. Like they contain a lot of data from database passwords to SSL keys, SSL certificates, access keys. Read them as sensitive data. And of course, a good idea is to set up CI check to detect rogue terraform providers. This would aid in the exploitation discovery whenever someone is trying to exploit your terraform setup. This is one thing to add as a defensive measure. One thing that HashiCorp security team asked me to add is the terraform class security model. This is a document that talks about different ways that you can use for modeling your terraform class security while at the same time it can apply for your terraform interface setup. And now we are reaching the end of the talk. Final thoughts. Terraform is amazing. I love terraform. It brings several security features when implementing IEC with terraform, but still with great power comes great responsibility. Protect your terraform environment. Stay safe and set up persistent monitor like full hunt to discover shadow IT, misconfigurations and mistakenly explore services. Of course, it would not really work out for all of the terraform attacks we talked here. But yeah, just one thing to add here. And lastly, the questions.


All right, welcome back everybody. It's Eric Bidleman from the Chrome Dev Summit 2016. We're just wrapping up the day I'm here with Rick Byers from the Chrome team and Robert from Develop Relations. The party's about to start But before we do that, let's talk a little bit about predictability and the things you guys presented today You want to kind of highlight the show for us? Sure We want to make sure that it works for web developers across the board It doesn't have to they don't have to worry about different browsers and inconsistencies and all that And Rick you showed us some really amazing kind of numbers on where Chrome is going kind of stats and bugs were crushing Can you kind of highlight those? Yeah, I was just trying to show that really we're putting a lot of effort into Engineering discipline right we care a lot about developer feedback We want the web to just work for developers and so I just just trying to show we're not perfect yet But I'm just trying to show that there's a really good like if developers file bugs against us We've now got the process in place so that both get ready to teams teams have a process for triage And their bugs prioritizing and fixing the most important things and so it's really worth developers time to file issues And I think we're doing a good job at at least tackling the most important ones So what you're saying is we're gonna fix all the bugs and all the future requests, right? No software project ever fixes all their bugs, right? But the important thing to do is that we're seeing everything we're engaging with web developers, right? When you file a bug against us like engineers are looking at that and we'll talk to you about it And you know, we rely a lot on stars you people should star the bugs they care about and and the ones with the Most stars get get the most traction cool And Robert you talked a little bit about a new kind of offering for web developers a place they can go for feedback right so we have our developer site with lots of documentation and guides and walkthroughs and all that and The idea there is to have a new feedback section Where you can learn how to file good bugs to make sure that they get resolved you can search across bugs Bugs across different browser engines and find the different ones and get some consistency in feeling for how it actually all holds together And much much more and and also we're gonna keep on doing things over time there So it's not like a stale content page and we're gonna have more offerings and more opportunities for developers to get involved So that sounds amazing. Thanks for joining us today guys again. Welcome everybody signing up today from Chrome Dev Summit 2016