Thank you for waiting with us. Uh, I'm Mudge. Uh, this is Sarah and we're going to give you a little uh, uh, information about the Cyber Independent Testing Lab. Uh, you may have been reading about it. Kind of pull back, uh, the curtains and um, so that's the introduction. I'm gonna let Sarah start this off. It kind of, as a heads up, uh, we go a lot from like a 30,000 foot all the way down into the weeds and then back up. So, um, it's gonna be a little bumpy ride, but hopefully it's enjoyable. We know different people are interested in different technical levels, so we wanted to make sure we hit something for everyone. Uh, but anyways, uh, this is just a preliminary data peek behind the scenes. So, um, if you visit our website, it's mostly just coming soon right now, but uh, this is what we're, but uh, uh, this is uh, what we're up to. Uh, just the quick peek. Okay, so first off, uh, what problem are we trying to address? It's the fact that, uh, we've been trying to get people to care about security for years, but then whenever somebody says, okay, I give, I get that it's important, what should I do? We don't have very much concrete data to give them. They don't have anything to act on. There's no consumer reports that, uh, for software security that tells them what's the safest browser. And if I put it out to the floor, what's the safest browser? We'd get a lot of very strong opinions, but a lot of those opinions would be based on what feels true rather than actual data. And that's the problem, that nobody actually really has data. Um, so, uh, what are the things people are trying to do right now and why don't they work? First off, there's certifications and evaluations which are frequently focused on processes and procedures and don't actually look at code or at the final product. So, they can't really speak to security. Um, there's industry and marketing labels, but these are frequently vague or misleading. Um, and they're, they're not, you can't compare between them. If two people have the same sticker on their product, you don't know which of them did it better or which one did just the bare minimum and then stopped. So, it's not useful to a consumer. Um, source code review definitely has its place, but it's not there to serve the consumer. It's the, either an internal thing by the vendor or the vendor is paying somebody to do this on their product and they're, the consumer doesn't see the results of this or whether the bugs that were found in review actually got fixed. Um, and so it's just the incentive structure there isn't right for consumer advocacy. And finally, legislation is frequently well-meaning, but a lot of the time ends up trying to fix a problem by making it illegal to look at it. And that's a terrible way to fix anything. So, is this mic on? Can folks hear me in the back? Great. Thank you. So, I wanted to dive pretty quickly into some of the data. Um, and just so you keep it in your mind, we're measuring how difficult it is for an adversary, how much work you can impose on an adversary to newly exploit a piece of software. The more work you can impose on your opponent and you know, without any work on your own, you know, the better off you are. So, to date, we've looked at about 100,000 binary applications, um, with about 100 plus features, uh, static features. We've got a whole bunch of dynamic ones. We'll go into some difference there, uh, and, uh, measure, you know, as bug hunters and attackers and exploiters, which I've been doing that for 20, almost 30 years now. Um, I'm old. Uh, you know, what do we see? So, when you get such a large amount of data and applications and binaries and libraries to look at an operating system, you can build up these continuum. So, here's the first continuum. This is Linux Ubuntu and this is the first, uh, 10,000 some odd binaries. And the way you read this is the easier to exploit is further to the left, going down to negative numbers here. And, you know, we normalized up at 100% on the far right. And then the number of binaries, which are executables and libraries, are, you know, uh, bucketed into the columns of, uh, five point bins. And with this, you can kind of, so the, let me back up. The installation is, this is all the base software that comes with it, plus most of the, most common third party applications installed. And because of this, you can kind of pull in any of the data sheets from the really detailed data, uh, extract, uh, the, the relevant metrics and kind of plot them. So, if we throw the first couple on here, uh, we're gonna do it on a relative hardening line underneath that's mapped to the top part. And we'll take two common browsers, Chrome and Firefox. And Chrome, you know, did a little bit better. It's a little bit more difficult to exploit. If you look at the underground market, the cost of a zero-day on Chrome bears that out. It's, uh, slightly more expensive than the cost of a zero-day for Firefox. Uh, and then the yellow triangles up on top, you know, show where that is. Next slide. We see a little further down, um, because we're, we're approaching the only fifth percentile mark, uh, you start to see some of the office sweeps, the client side applications. Um, for crowds like this, this isn't that much of a surprise, because we know that the people writing those, you know, it's, it's, they don't view themselves as the most common attack surface, but it's also why client side attacks and attachments that get opened up by these are, you know, the easiest path to compromise and exploit. Um, and next slide. This is OSX. So we've done this on Linux OSX and Windows, and we'll have some of the RTOS's and the other architectures coming online. And instead of just the first 10,000, this is the 38,000. So this is all of OSX, uh, El Captain, uh, and about 20,000 third party applications that we went out and measured, uh, and then plotted on here. So let's see what this looks like now that we've kind of seen Linux. We have a much wider spread for Chrome on the far right, uh, pretty decent, almost approaching the 95th percentile safari. And then Firefox is way down here. And this was surprising to us. Uh, it was also surprising to the Firefox development team. And they've now confirmed this as well. Um, so that's nice. And I'm gonna get into what makes up these numbers to show you the depth of the data that we're extracting out of the binaries to give you some confidence, uh, in how this is working and how it would be useful to you. So let's look at some other applications out of these 30-some odd thousand. Well, here are the different office suites that are available on OSX. You've got Microsoft Office coming in pretty, again pretty close to the bottom 5th percentile. Uh, Open Office and, you know, uh, uh, Apple's Office. Again, all on one particular platform. I should point out with this sort of view from the data, it is important to only do comparisons within the same platform. So it's not fair to say, oh, how did Firefox on Apple do compared to Explorer on Windows? Because they have different attributes and different traits. I mean, and the compilation settings are different, but we'll go into that and more. So let's pull out a few more examples. Because it's nice to have something on the far right and the far left. And why not let it be the very software that installs the security patches for your product anyway. Um, yeah, that's a little disappointing to see the Microsoft Office updater being a negative 7.5. Uh, I was talking to a team, uh, that I believe might be involved with, uh, some of the zero days going around that are popping a lot of the OSX boxes on El Capitan.  And they said, oh, you'll figure it out. And I went back to them. I said, all the boxes that you're going in on have, uh, Microsoft Office installed, don't they? And they're like, well, maybe. Um, and this is a real quick way of looking at not only as a defender being able to choose and say, hey, if all things are even and I can kind of choose which office suite, because it doesn't matter to me, I'm going to choose the one that imposes more work to my opponent. And that's kind of the goal. The flip side on the offensive side as the adversary is I want to choose the lowest hanging targets because I've got finite amount of resource and time as well. So why am I going to go after OSX's software updater if I see Microsoft's updater listening on the network and taking input? Okay. This is the base, just the base, no other apps. We haven't finished this one yet, of Windows 10. And I wanted to pull this out because this is really impressive. Because this is a level of consistency that we didn't see in the base of, um, Linux, uh, when we were looking at the base, uh, before we added in all the other ones, we did not see this in OSX. And the development life cycle and the compilation process that Microsoft has imposed, this is way different than what it looked like on Windows XP. Um, because you can see they're very consistent with what they put in. There are a few on the bottom. That's because there's this one set of applications that I did install. It's a big data analytics package. It was installed on all three. It was the bottom in all three. And we're going to point out the lessons learned on that one in a moment as well. Rest assured, as we put in more third-party applications and as we start to flesh out more of the binary and more of the dynamic feature sets, this is going to start becoming a bit more, uh, dispersed.  Um, previous slide, we might question if they know what they're doing as well on OSX. Into the Michael Bunch. Alright, so the, we've shown you some numbers, but you probably want to know what kind of data we're looking at to produce those numbers. Uh, and we're, there's a lot of other industries that have trained consumers in how to make complex technical decisions. So in figuring out how to help consumers make security, software decisions, we are drawing from those. So first off, we've got our static analysis features, things where we're measuring aspects of the application without running it. And this is like the nutritional facts for the software, which functions were used and what are the complexity values, etc. Um, and then, uh, the runtime testing, the, uh, dynamic stuff where we're fuzzing and, you know, crash testing is like crash testing cars, you know, so the Manroni sticker that you see in any new car that you're buying, uh, you know, tells you how it didn't crash testing, what's its, uh, EPA expected miles per gallon, things like that. And then, um, the safety continuum where you see where that software falls compared to its peers or to the rest of that software environment, uh, that's like energy guide where you find out, you know, how much does this fridge to run, cost to run monthly versus another one or what have you. In the, uh, static part, which is a large amount of what went into creating those scores on the back end on the continuums that you saw, um, and is really going to be the focus of most of this talk here, although we will talk about what we're doing on the dynamic aspect, um, includes essentially the 100 plus featured, uh, extractions in the following three categories. Measurement of complexity, uh, turn out to be very, very important. Not only because, um, you know, the more complex something is, the more difficult it is for the developers or the creators to have gotten it right, and then for other people to ensure its correctness in operation and function and intent, um, but because it works across the board. I mean, we can do things like just the code size as a simple metric example, up through measures of branch prediction complexity, through, uh, stack adjusts and rack and stack those up through more complex, uh, things such as cyclomatic complexity for functions. And this works across any sort of operating system. In fact, it works on any binaries all the way down to extracting them off of firmware from televisions or cars. And this is a nice way of comparing, you know, how complex, you know, product A is versus how complex products B, product B is. The other areas are a bit more specific to the types of operating systems and development environments themselves. So application armory is a catch all that we say for all of the features that can be imposed and buttressed into and, uh, reinforced in the binary from the compilation stage. So if you do slash GS in Microsoft, it will try to go in and do stack, uh, protection by putting stack guards in. Uh, if you do dash D fortify source on OS X or Linux, uh, it'll go in and look at 72 common risky functions and see if it can't do heuristics to replace them with the safer version. Um, and, you know, they're more recent, uh, modern advances have control flow integrity, code pointer integrity to prevent, rock, et cetera, return on your programming. Then there's the linker. So this is, you know, where address space layout randomization comes in, uh, is important. And of course there's lots of measurements, not just is it turned on or not, but, you know, is it high entropy, uh, how ubiquitous is it across all of the components, et cetera, et cetera. And then the loader, which is, you know, what's ultimately run at the very end right when the application is put in and is being told how to mark memory as executable or not. These are all very important safety features. In fact, some of these are akin to automobiles with like the seat belts, the airbags, the anti-lock brakes. If I'm buying a piece of software or using a piece of software that doesn't have address space layout randomization, fortified source and stack guards, I'm buying a car that doesn't have, you know, seat belts and airbags and ABS and I need to know that because they've been around for decades and they definitively and demonstrably and quantifiably have made applications more difficult to exploit. In fact, some of the capture the flag people when they want to make an easier challenge binary, they just go get an older compiler that doesn't have those attributes and they build it because it's much easier to exploit. And then the final part is developer hygiene. So here's about 500 common function calls across POSIX and ANSI that historically have been the root urbane of memory corruption, code and data confusion, et cetera. And we break those out into the following buckets. There's IC functions. There's only a few of these. If you remember the poison sticker underneath your kitchen sink for the detergents and stuff, you know, that's IC. If you see an IC function like GitS in commercial code, run screaming. Those people should not be doing commercial code. And then there's classic bad functions which are difficult to use correctly. The unbounded stir copies, some of the mem copies, et cetera. Risky ones which, you know, the bounded versions and more recently we have some good functions that are hard to use incorrectly like the sterl cat sterl copies done very nicely. The problem is the only people who know about those good functions are folks who cared about security in the first place and we don't teach those in school or anything else. When you see those in the code in the binary, that's a really good sign. But it's not as good of a sign when you don't see a consistent use of them and you see the risky and the bad ones next to it. So anyway, these are all the sorts of things that we're pulling out of all of those, you know, tens, hundreds of thousands of binaries from the static component. Next slide please. Right before I go into the dynamic one which I'll just talk briefly about, we're going to do a bunch of deep dives just showing you deep dives looking at one or two of those static sort of features and then kind of pop the stack back up because it gets way too much in the weeds otherwise. Dynamic fuzzing because it's really nice to say like, well, this looks like it's a super soft target. But it's even better to say we know we can get a crash with a SIG bus or illegal instruction or whatever, SIG-SEG-V. Right now we're using AFL. AFL is fantastic. It gives us good enough coverage and we use it for three specific results. One of them is the exploitability because our environment, we really care about exploitability because, you know, we're bug hunters. We like to write exploit code. But that's not always the most important thing for different consumers, which is why we call out the level of disruptability as well. Think about a big business. Think about one that's doing offshore oil drilling. They care much more about the disruptability than the exploitability. And if you ask them, they'll say, if our system crashes, the drill bit stops. The molten core solidifies and that offshore oil rig goes offline for more than 12 months as we have to build a new one, and push it out there. I don't care. I don't want the system to be compromised and exploited. But if it is, I'd rather they're on IRC or doing it as a wearer's distribution site and they didn't crash the system. You go talk to a bank and it's a different story because they're saying, we want our systems to crash rather than be exploited in a way that we can't trust the integrity of the underlying data and we're propagating bad information and before too long we can't unroll and reclaim the books. And then the final one, which is a new one and I'm calling this out here because this is about two, three, four, hopefully longer off but it's coming and this is algorithmic complexity and this matters to any large distributed companies like your LinkedIn's, your Facebook's, your Google's because they're pretty impervious to distributed denial of service because they've got more bandwidth than, you know, well they are the world's bandwidth for all intents and purposes and they're distributed and decentralized but when you can find a small amount of input that causes the worst case in particular types of algorithms so a link list devolves or a hash table devolves to a link list you can start taking these guys out and they can't defend against it the traditional DDoS defenses de-aggregate decentralized increased bandwidth don't work and so based upon how we modify AFL we can get all three of these but fuzzing's expensive. Fuzzing's expensive so we'd like to do as little of it as we need to and so what but on the other hand math is cheap so what we're doing is fuzzing a statistically significant portion of the software and then using Bayesian math and linear regression so that we can model how the rest of the software would do because we don't care about finding a specific exploit we want to know what categories of function of vulnerabilities are present what sorts of problems do we expect to see and for that we can model that based off of the static features the like somebody who's actually looking for an exploit still has to do the all that heavy lifting but for our risk assessments we don't need that so some software will have a little a in the corner saying actual we really fuzz this and then some things will have little e saying it's estimated and that's the that's the icing on the cake the part that would make this scale really well for and mathematically we can show you to what level we're able to actually predict this you know 99.99 whatever we have and this isn't too unusual you're actually used to this in a different area explain you know the car so like for the EPA miles per gallon they don't run every single car until it's on fumes they do it for enough so that they can understand and model how the rest of the cars will do you know assuming no one's trying to trick them with the Volkswagen figured out a way around that right so we would continue to do spot checking and if we find an anomaly that goes back into our model but it should work really nicely long term for us and even out one of the traditional asymmetries of defender and attacker because this is something that works really well for defense not so well for offense yeah one of the things I learned when I was a deputy director of ATAP out in Google and got to see how Google did things is don't underestimate the power of Bayesian analysis and linear regression testing so go ahead okay so we're going to I'm just going to set this up for Sarah I mentioned we want to take you on a deep dive on just some small subsets to show you kind of the power of what you can do when you start to really tease out information on specific attributes from the binary extraction and then we'll pop back up to a higher level view of the world again okay so this is one of our automatically generated reports for Google Chrome on OSX and I got to spend lots of quality time with I can never remember whether people prefer LaTec LaTec yeah I read it more than I say so the first page is always first a table that gives the rubric for how scores were achieved because as we tweak things we want to be able to look at old reports and remember how we got those numbers and then after that we get a summary of any anomalies for the file so did it have any weird flags that you don't normally see or strange initial permissions or what have you uh... how did it do for function consistency which uh... we'll we'll talk about in a little bit and then uh... the file code and data size for the main application average library total libraries and then all of that together uh... because you know the I mean Google Chrome the main application is just six hundred and one bytes of code it's a stuff all the action is happening in the libraries and when you look at the libraries it links to directly and then the libraries they link to and so on down the rabbit hole eventually chrome is using a hundred and seventy six libraries so we put out that number and then the average and minimum library scores that occurred to and then the next page is that the main report obviously there's more than one page of this if there's a hundred seventy six libraries so that this is just the first page but uh... uh... the first line will be the main application and then all the libraries listed after that and uh... for it then uh... columns are whether it's thirty two sixty four bit what's going to get and then two categories features that were highlighting here are application armoring and function hygiene and so the application armoring are the you know safety features that make software better and then the uh... function hygiene is a measure of how well do the programmers know what they're doing so that's more detailed view this is a very core screen view comparing three browsers on OSX and uh... what we have here is that we're just looking at four application armoring features ASLR, non executable heap stack guards and fortified source and uh... if all the files for your browser had ASLR enabled that would be twenty five points uh... if you had all all if all files had all four features you get a hundred points which no one did uh... but google chrome comes out ahead because they had pretty consistent application of ASLR and non executable heap uh... safari did not quite so well they had all four of those things present in some cases but just not consistently and then firefox was missing ASLR entirely which was a shock to us and then if you looked at the uh... bugzilla comments it was a shock to the development team it was quite interesting because kim zedder did a very nice article uh... on us in uh... i can't remember the name of the uh... the journal uh... and some folks on firefox dev team popped up and said that doesn't make sense we've had ASLR since two thousand mumble mumble and it was enjoyable in a kind of you know uh... awkward way to watch some of the other developers point out all the situations where they intentionally disabled it and guess kind of what we might have measured and somebody said well wait a second they've got safaris and that doesn't live on other things this must be os x we have ASLR and os x don't we and then somebody goes and looks and goes no uh... not at all and they dig it out and it's like sure enough for backwards compatibility you know uh... from ten six os x you know they had to drop it out now the good news is in september they're going to rectify that they won't be able to fix i don't i don't it doesn't look like they're going to try and fix the non-excutible heap the way chrome google chrome did which is a bummer uh... so but the good news is a fixes coming based upon this data uh... we'll see how well it goes across the board the bad news is until then i don't know what the recommendation is maybe use chrome so that was a view of uh... just a few of the application armoring uh... callouts so let's dive down into just one specific one uh... since the data on the back end that we're using for all this is actually pretty rich and this is the fortify source and i give you a little for those who aren't familiar with this there are seventy two functions i think it's seventy two presently uh... that the compiler uh... has replacement safer versions for and if you say fortify source on Linux or os x it'll go through and see if you have any of the functions in your code there do a bunch of heuristics on each one to see if it can guess what you had really intended and then replace that risky function with one that's more strongly bounded so it'll kind of like do some extra safety for you and put that into the resulting binary so we looked at uh... the linux applications and across so uh... across all of those that were about two million opportunities for a risky function to be uh... enforced or improved with fortify source and the way you read this graph is that each one of these dots is a file and along along the x-axis is what percentage of the opportunities of those risky functions it found it was able to replace in the file and on the y-axis is the number of those risky functions per file so you know a little bit off uh... is there's a file with over ten thousand risky functions that was only able to replace about seven percent of those uh... for those who are linux hackers uh... system d kind of extremely important uh... uh... binary uh... for linux off the scale how many forty three thousand opportunities mostly p-reads and it was able to successfully reinforce those less than seven tenths of one percent of the time and the interesting part here is that the developer is trying to do the right thing i mean the right thing would not to be used as risky functions in the first place but sometimes you're kind of you're kind of host and have to so they told it fortify source but then they don't know the efficacy of the coverage that it got and the consumer needs to know that as well because the fact that two people have anti-lock breaks is a lot different than the fact that one of them will stop within three hundred yards and one of them will stop within ten yards and depending on your environment you need to be able to know each this gave us a nice view of source code fortification across linux how does it look across osx first a couple other things for this chart the uh... a third of the files end up being in the ninety five to a hundred percent range and then the rest were really evenly distributed from zero to ninety five percent and interesting thing to note is that some of these very well fortified close to a hundred percent files are up at like twenty five thousand functions so it it's not that they've only had five functions and that's why i got a hundred percent okay now moving on but it also means that two-thirds of the time it's not able to protect you uh... when it's putting on there so this is osx and you can see it's weighted a little bit towards the other side in fact there weren't any functions uh... any binaries that had a significant number of functions that were uh... completely fortified the ninety five to a hundred percent one of the largest one had like a hundred and twenty one uh... functions that that were replaced uh... and this led us to believe that source code fortification is lagging behind in osx as to what it is on linux so we dove into the data and decided to slice and dice this one more way and look at it per function so remember there are seventy two functions in the way you read this chart is the far left one says there are about thirty seven functions out of those seventy two that were never zero to five percent of the time where they ever able to be fortified and replaced far right you see that there were fifteen functions that almost all the time uh... were able to be replaced successfully with the safer versions far right makes up essentially your stir copies your unbounded was there that says i know what you're trying to do the far left all of your pointer arithmetic on mem copies largely there were twenty eight functions out of their that never got touched they're essentially academic uh... with our hypothesis that it's a little uh... more mature on linux than it is on osx what it is that's look like that's not that good so there were you know fifty plus uh... out of the seventy two that are you know only ever occasionally and then a whole slew of them well fifty two or zero percent out of the seventy two this is a way of using the data rather than looking at a per binary of looking at an entire environment and figuring out its maturity level as a consumer as to the different safety mechanisms that are in place where there were fifteen functions that were ninety five to a hundred percent fortified in linux here there's only one in the ninety to ninety five and then nothing it was a hundred percent fortified so you can see that it's a much less mature feature on osx okay and uh... a lot of the things we're looking at are not new things to be looking for their things that attackers always look at when they're trying to find a weak target and figure out how to target their efforts usually they look until they find something that looks juicy and then they start working on that uh... it's as far as we know nobody's ever applied these metrics across the entire ecosystem to see on a broad scale what it all looks like so and i wanted to add we've shown you at the beginning an example of looking at individual files the last couple showed you looking at an entire operating system in kind of the maturity level and now it's there is going to walk you through as if you step back and look at the institutions that made the code and what you can infer about them that maybe they don't even know about themselves so what we're going to look at is google chrome and microsoft excel on osx and what you can learn about the osx development uh... for those two organizations and what you can see uh... as i'm gonna explain is that each organization has something they do very well and each organization has a blind spot so first off uh... the application armoring features what they really tell us about is the development and build environments for the the software developers and that's an area where google chrome does very well they actually had the only sixty four bit files on osx that had the non-executable heap flag enabled uh... out of the almost forty thousand binaries that we looked at so kudos to them they did a great job there they figured out how to manually go in and hack the binaries because they knew the operating system in the a b i would allow you to explicitly call that out even though the compiler chains don't give you the option to do that and they said osx tries to make the heap non-executable by default but it's a system-wide control and we can explicitly say no it should never be executable for our app please and a lot of you might be surprised that for at least a period of time it was executable on all of your distributions some of them that might still be so uh... they went above and beyond to make sure that they had the best development and build environment on the other hand microsoft excel was still a thirty two bit binary and they didn't have some of the application armoring features that are default for thirty two bit binaries on osx uh... if you're doing a modern build chain and so what we can infer from this is that either they were using a really old build system for osx because it's not their wheelhouse their main focus is of course windows development or that they were using a modern build environment and specifically disabled it so we're giving them the benefit of the doubt and assuming that it's just a really old compiler um... but then uh... on the other hand uh... let's look at function hygiene so google chrome has more use of good functions than excel does but all those binaries that had good functions also had the risky and bad versions of the same functions which sort of defeats the purpose uh... you know that if you're gonna use the stirrel copy always use stirrel copy don't also have stir copies right next to it uh... on the other hand microsoft excel when they use the good function they just use the good function they uh... they don't have the stir copies in there anymore because they got beat up for them too many times and they don't let their developers use them now and uh... so this is an area where microsoft has learned the hard lessons and is really doing the right thing but uh... at google it's a little bit of the wild west it's some developers know about the good functions and so they'll catch it and code review or use the right function from the beginning but other ones don't and so it's sort of luck of the draw and they have i mean they have really good programmers at google this isn't a knock on them you know not all of them are security uh... as their main focus uh... and it's a little bit of luck of the draws to who you get as the reviewer as well but microsoft in their pre-compiler has a dirty words list essentially and you've seen this on their deprecated so you know these functions are too risky for security we will not let you ship you know if you're using that out of microsoft so it flags them refuses to go to a gold build and they have to go back and actually replace it so it's an institutionally enforced area which is impressive and uh... this is also just to plug a different pet peeve of mine variance in what you see from security knowledge of developers is also just the fault of computer science curriculum that it's not something that's included for general computer science uh... but anyways moving on back on talk back on topic uh... this is the the sort of curated report that we're doing automatically off of the data sets and it's only highlighting those sub-functions out of app armoring and uh... and the function hygiene but what we're doing is as the non-profit we're opening up and licensing the data sources so other folks can cut it and slice it and dice it any way they want for their own analysis but we're modeling off of consumer reports to figure out something that's in the middle that will give consumers the ability to kind of look at a high level of what's going on and if we pop back to the big picture and you think back to the histograms of linux os x in the in the the early one on windows there was something because we always we always want to know uh... you know with the attacker hat on what's in the far left what's making up all that low hanging fruit and we had installed the same package on all three of them and there was a package that had about six hundred binaries uh... if you are any startup in silicon valley working with big data you probably rely heavily on this uh... as do a lot of larger organizations and it really surprised us because uh... this would not have been picked up with source code analysis which is also another reason other than we won't don't want to be under n d a is because we want to be able to give you the output why we don't look at source the sources the developers intent but the binaries is the actual ground truth so what is that nest the story of something called anaconda we were looking at address based layout randomization uh... and measuring the efficacy uh... in some of the linux areas and this is a view of the number of dynamically of dynamic uh... dynamic symbols that are fixed on the x-axis and the number of function pointers that are fixed on the y-axis you want everything to be zero zero that means you've got all the a s l r that the colonel can do as much as it can to try and protect you against particular types of attacks anything moving up to the top right is getting worse and worse and worse and worse so we were like what the heck are all of these and we looked at it and we saw that who a bunch of moral from the same package what's going on and that's where we decided to look into this particular package uh... it's a DARPA funded package uh... which is a little embarrassing i mean i had a lot of fun at DARPA and i'm a huge fan i'm a booster you saw cyber grand challenge that was that that was history actually uh... that's going on and uh... they'll be the first ones to say look this is sometimes it's about rapid prototyping but as a consumer i need to know where i'm accepting more risk than i ever expected it's a roll-up it's a whole bunch of open source software for r and python with all of your numpy and pandas and your side plot and then it's got you know open ssl libraries and xml and libcurl all pre-compiled and packaged together it is super convenient i mean it's like backtrack or cally for linux because it's a royal pain in the butt to try and put that stuff together and get it working on your own somebody else does it yay and i rolled it out the problem is on all of our systems i mean and i'm not the only one that's rolled it out here's the customer list from their uh... it's major fortune ten companies you know everything from bank of america seamans every to do d and what have you uh... how large is the footprint when you install it and why is it the bottom score on all of these operating systems for six hundred plus binaries because we had these binaries from other kids other things used open ssl and had the binaries there and they weren't scoring as low so what was up with that and as we looked across them they had the old version of the uh... segment and section layout for linux which you know implied that was weird because you can overwrite in strange ways they were missing things like basic stack guards uh... even on osx almost everybody that's been default for the comp for the compiler settings for eons and on windows uh... no high entropy uh... uh... address based layout randomization no safe structured exception handlers yet now it refixed again microsoft thinks it's she rather than s e h that's fine so we finally were able to get the ground truth as to why this was happening because on linux uh... they put in the uh... dot info section it spits in the compiler version in the build environment and their most recent uh... batch of binaries is being recompiled from all the source code on what two thousand eight gcc running on a two thousand and five installation of linux those were different defaults back then and it missed all of those safety features all of those anti-lock brakes airbag seat belts side you know side impact et cetera i hadn't realized that they had essentially done the same trick unintentionally that the capture the flag folks do to make very easy targets for exploitation uh... they missed almost a decade worth of improvements and you saw how well that worked for google on the compiler tool chains by staying up to date on the latest and greatest uh... so that's a kind of interesting little side story we figured we'd share about why binary looking at binaries rather than source actually sometimes isn't the uh... deficiency that many people think it is just to wrap things up there's been various misconceptions about what we're doing or not so this is me making sure that we've uh... got everyone on the same page as us these are preliminary results the uh... detailed data releases are planned for end of this year early next year uh... the goal of this is just to familiarize everyone with what we're doing uh... and as we've stated we do binary on the analysis partially because we don't want to be beholden to vendors or have to have NDA signed or anything like that but also because in a lot of ways source code is the theory whereas binaries are the ground truth and we want to see what the consumer gets uh... this is not a pass fail you get a gold star sort of thing it's meant to be quantified and comparable between different products and uh... we look at overall classes of vulnerabilities and trends rather than specific instances so we're not going to be like you know giving you oh there's an exploit on this line of whatever you know but we will tell you that this will be exploitable at a ninety nine point nine percent percentage and that the adversary still has to do all the heavy work in order to do it so finally an asymmetric win for the consumer and the defender this talk focused just on the static analysis because we had to pick a silo to focus on but uh... we the dynamic analysis results are planned to be released next year uh... and we are also going to be looking at uh... internet of things devices again next year uh... we're a 501c3 which means we're a non-profit charitable organization uh... the uh... with non-exclusive rights to use the IP we are going to be offering uh... the ability to license our data or to uh... uh... other partnerships with corporations just not with the corporations that make the software this was actually a really important uh... choice that we made because we needed the incentive structures to be aligned that would enable us may force us to be able to give out the data uh... to everybody and there are a couple of other efforts here i know folks are familiar with the more traditional underwriters laboratory you might not be aware and i hope that they do well i'm not sure i'm i'm i'm uh... a booster of their approach they're now a for-profit organization and it's a for-profit based on public safety and to me those are fundamentally misaligned incentive structures uh... and then of course what they're doing is a bit more of the did you do all of the forty a l common criteria which we've already demonstrated really are just measurements of your processes and not not what the safety is in the end product we're partnering with uh... consumer reports for some things right now yeah some reports is involved with the consumer reports sort of business model is what we're think of that for what we're going to be doing yeah if you're wondering how are they going to make money or how are they gonna do anything else look at consumer reports and we're trying to do it the exact same way that they do we won't accept things from vendors we will go out and buy the software and analyze it ourselves or get it the same way you do off of the download sites and finally one thing a lot of people ask us about is we're not looking at software configuration vendor history how quickly they put out patches interpreted code corporate policies privacy any of those things it's not that we think they're unimportant it's just that that data is already out there other people are looking at it and we're trying to focus on the blind spot the thing that no one has data on yet and uh... you know we've uh... compared to what we're doing to nutritional facts so you know having the nutritional facts on the thing is great but you still sometimes need a doctor a dietitian so the security specialist that you know consultants they can tell you what diet you should be on for software and they can also bring in all these other factors and you know help uh... put it into a whole picture for you yeah we aren't telling you what to buy or what not to buy we don't want to do that we want to tell you what's inside of it so that you can make your own informed decision the same way that i enjoy my candy bar i want to eat my candy bar uh... but i do want to know you know what it's made of and i actually enjoy it more when i know how many calories and sugar and i'm cheating yeah so i'm flying through this this is what we're gonna see at the end of the year some of those curated data releases coming online we're gonna release in detail on the site our static measurement methodology so other folks can recreate and do it we are not releasing the actual source code because that's uh... a gaming issue uh... but we're releasing enough data so that you can recreate it on your own twenty seventeen the large-scale data analytics dumps and everything else uh... internet of things and then the large-scale fuzzing results of the mathematic models are going to be released more publicly and describe publicly in twenty seventeen two slides i gotta get to the these are our thanks darpey afl community capstone uh... ford foundation is funding us through consumer reports we've got some money from darpa i'm huge fans they took the risk on us and this is the mandatory slide at the end uh... because we have d o d funding inside of it but it's basic research meaning that we can publish without having to go ask permission uh... because this information just needs to be out there this does not necessarily represent their opinions or anything else from the air force darpa said me too make sure me too and then the white house says why do you keep name dropping us all the time would you please knock it off uh... but so be it thank you very much


All right, so we're going back to Vienna All right, and this is the Schoenbrunn Zoo. This is the oldest zoo they claim in the world. So We don't know everybody always claims are the oldest in the world But in any event the oldest world oldest zoo at least in Europe And so this is right on the grounds of the Schoenbrunn Palace and you've got here You can see this is one of the residents after a night on call totally exhausted Relaxing, you know eating all those Cheetos that are in the machine because that's all you have time to eat and some Black bears they're kind of cool because I'm not sure What kind of black bear this is because they've got this little facial coloring on here and your obligatory polar bears It's always fun to watch And again, these are a couple residents lamenting the weekend call. Oh God primary called me a hundred times All right, enough. So we want to talk about the optic nerve today And when we're talking about the optic nerve, I mean you guys are all aware of the picture of the optic nerve And so when you're looking in at the optic nerve, you know, first of all, it's the border should be sharp It should be flat. It shouldn't be elevated. It shouldn't be depressed or concave You know the color is kind of this You know pink sometimes yellow color, but it shouldn't be white and you see that there's no hemorrhages around there There's no vessel engorgement. And so that's a normal looking optic nerve And here's the optic nerve in a sagittal view. And so when we think of the optic nerve anatomy, all right I like to use the analogy of a fiber optic cable So first of all optic nerve is made up of the ganglion cell axons which then come out through the nerve fiber layer through the lamina crebrosa Tina what happens to the axons once they get beyond the lamina crebrosa? They become myloneated. So there are Alligadendrocytes that live in the optic nerve here that myloneate them. So think of an axon as a single fiber And it's got mylone around it. So it's got it's an op. It's a it's a fiber optic cable It's got a little bit of insulation around it Now they're also organized into these columns right here in Weisch. What what goes in between these columns of these axons here? The P.L.Septe P.L.Septe. So this is like a bundle of those you know fiber optic bundles that are right there. And then finally The entire cable is buried in the ground with steel around it And then what surrounds the whole cable there? The optic nerve sheath. All right. So each individual axon has mylone Which the oligodendrocytes put on it once you go post here to the lamina crebrosa and then they're bundled together and they get into these columns with these little P.L.Septe That are going along then and the whole thing is wrapped in the optic nerve sheath All right And here we can see that in cross-section All right, so optic nerve sheath Let's see. So Brad what what is this tissue underneath here? Um, so we have the arachnoid in the subarachnoid space. All right, so remember this is the second cranial nerve And so just like the brain it's got Dura around it i.e. the optic nerve sheath and then it's got the arachnoid granulations Subarachnoid space what runs in here? Um, so you have the little like arachnoid processes. What else is in here though? Um, so you have vessels as well. What is in this empty space here? Fluid CSF exactly CSF and so that's important CSF flows through there. So anything that Increases CSF pressure could be transmitted out to the optic nerve and that's important to remember that What are these two structures right here? Central right in the artery, central right in the vein All right, so remember we talked last time how the artery in the vein share a common Advantitial sheath so you can see right here where arterial sclerosis Can push on the vein next to it that can cause stasis or arterial sclerosis Not only causes central artery occlusion, but central vein occlusion All right, so what are we showing right here? Rachel just keep going around And so there's the optic nerve sheath what are these guys here? Exactly these are the little arachnoid granulations when you look at these I oh another question here. What stain is this for bonus points? This is a trichrome stain So, you know trichrome stains connective tissue blue It stains kind of mesenchymal tissue nervous tissue red So this shows you the optic nerve sheath the arachnoid arachnoid granulations and then these are the little pl SEP day kind of separating off the bundles of the optic nerve As it comes down and here you can see it in kind of a longitudinal cut Here you can see the pl SEP day The axons here now we'd said oligodendrocytes live in the optic nerve What's another cell body that lives in the optic nerve trees? All right, what more specific actually astrocytes So astrocytes live in the optic nerve too So when you think about what kind of tumors you can get of the optic nerve Astrocytes lived in there So you can get astrocytomas and there are some little microglial cells in there that do a little bit of cleanup action But remember there's astrocytes that kind of live here and their cell bodies are kind of in between here in the The columns of the axons Here again, just showing you that common abititial sheath between the central retinal artery in the vein All right, we're just going to show a few simple things. I guess we'll just go back around the room. Yeah What are we showing here the optic nerve? tempo side There's that paler Tissue which probably is a sclera So it couldn't potentially be like a small coloboma Not quite a coloboma yet, but that's a good that's a good thought But if if you look at this boy, that nerve is just really small You've got kind of almost a double ring around here. So this is optic nerve hypoplasia Pretty common entity that you can see and the interesting thing about this is it really doesn't affect the vision a whole lot I mean you look inside and these people tend to have normal vision. It's bilateral.  You're going to see almost a double crescent around So this is a hypoplastic optic nerve All right, Chris. What is this? This looks more like a optic nerve coloboma. Optic nerve coloboma. Exactly. What is a coloboma? Coloboma is where you have a failure of um, the embryonic vision to close Okay So if you remember when the eye is forming you get indentation Of the neuroectoderm and then it forms kind of that bilayer Cup, but then as the vessels are coming in you start to get it sealing off and it seals off at the equator And then moves forward and backward. So when you get colobomas It's usually at the front part of that which is inferiorly in the iris Or it's at the back where it seals off which is inferiorly at the optic nerve So this is failure of that original embryonic fissure to close And this is just bare sclera.  Catherine. What is this? Exactly. So what's the name we put on this? Morning glory and so you can see it's almost like it's it's out of focus because it's almost like it's pushing away from you It's it's pouching out the reason it's called the morning glory malformation is this is the morning glory plant And so it looks like a trumpet horn. So if you think about it, this is like a big trumpet horn moving away from you So this is kind of the ultimate Optic nerve coloboma. This is a morning glory syndrome. And um, this is the morning glory plant. That's why it's named that way All right, what are we looking at here? Tina So there's a kind of a small outpouching Around four o'clock in the nerves that looks like a Small optic pit All right, so that's another thing that can form there and people have argued if optic nerve pits are Kind of put together with colobomas or not or if they can occur separately and I still think we don't know exactly what Causes an optic nerve pit, but you can see right here.  So the biggest thing is you can get a little bit of fluid underneath the macula there Exactly so fluid can leak out where this optic nerve pit is and it could actually leak out because usually these are temporal And it'll leak out underneath the macula so you can get this This fluid underneath the macula and you actually get a little focal detachment of the macula And some people will argue that this fluid is csa Others will argue that it's got some components of vitreous in it And so what you worry about is not so much that you get that focal nerve fiber layer defect But that you get leakage of fluid and these are tough to treat because it's not like you can put A wall of laser here to get rid of the fluid because if you do then you'll have a huge You know scatoma in your macula and so these are very very difficult to treat What are we looking at right here? So we have these Looks like the nerve fiber layers has this whitening. So it's probably because it's myelinated Okay, so remember we talked about myelination starting posteriorly to the lamina crevosa And what's interesting is is when the optic nerve grows The nerve grows, you know from the from the brain from the original, you know embryologic Outpouching that comes out the nerve will grow out But the myelination starts at the lamina crevosa and then grows back Toward the you know toward the optic chiasm and backward, but sometimes some of those um Illegal dendrocytes can end up forward to the lamina crevosa and then you'll get Myelinated nerve fiber layer now. These are usually congenital So when you look at these they're they're there from the first time the kid is examined And it's important that you note these because you don't want You know a guy to get in a car accident and then they go to the ER and someone looks at an undilated people says Oh my god, papillodema You know, they start drilling holes in the patient's skull to relieve pressure You know, so I always let patients know I say you've got a curiosity in there Some of the insulation on the on the nerve fibers that shouldn't be in the eye is in the eye So if anybody ever looks in your eye and says, oh my god, just let them know that this has been there since you were born And so now interestingly enough, this really doesn't cause a whole lot of Of vision symptoms I mean you might if you really check carefully could get like a big blind spot or some focal scatoma here But you know the nerve fibers still function through that area It's just that the myelin will you know dampen down the light getting through some of the fibers underneath it So this is one of those things that kind of looks pretty exciting and alarming and the patient doesn't notice a thing What are we looking at right? All right, so what exactly are optic nerve drusen? Uh, so they're calcifications And so they're they wouldn't show up Unless you you know, you may not know what they are do you do like an ultrasound for sure Exactly now these are sometimes if they're buried they're really hard To discern and so sometimes people will come in and the ox would be referred in for a peppalodema And they'll be concerned that there is an elevation of the optic nerve head and you look in here And this one is a little bit more prominent. You can actually see the little bumps in there But you know if you just looked at this this nerve head is elevated. It's it's pushing up toward you But it's because of these bumps here. And so when drusen are on the surface You know, you can see them pretty readily, but when they're buried then it becomes tricky because you you often can't see them when they're buried So this is just showing you some of the different Presentations here. You can see again Classic drusen you can see them here here Not pretty good, but sometimes it's just a little hard to make those out when they're when they're buried deep And of course, this is an end stage. This is rare that you know, they'll you'll get it to this area This is an end stage drusen.  And so you mentioned one of the things that we can do to tell the difference Which is an ultrasound and so because these drusen they're they're highland eyes But they have a lot of calcium in them calcium reflects ultrasound And so if you take a b scan And you know, dr. Harry's wonderful doing this, but you guys can even do this You know you take a b scan in the retina clinic and you just get the shadow to where the optic nerve is coming out And you slowly turn the gain down and what'll happen is a lot of the eye will disappear But the little bright spots are on the optic nerve will stay there because as the sound waves hit that calcium It bounces back really strong. So calcium gives you a strong signal back And you can even see it on a ct scan And I'm sorry I copied this and that's bad. I'll have to get a newer one But you can see that that the drusen just kind of light up here on a ct scan This shows it matter It is bilateral but can be asymmetric So sometimes you'll see it and you'll scout you in a lateral But then you can do a scan and you'll find that it it'll be buried sometimes So this is a better one.   Here's the Center of the eye over here is the optic nerve going back laminocrobrosa and here we have this calcified highland eyes Jews and sitting in front of the optic nerve and then underneath the nerve fiber so you can get focal Nerve fiber layer defects from these drusen the problem is again, we don't have treatment for these And so i'll send them to brad cats because he's really interested in following up these people but I you really can't do much with them. And so fortunately people don't get serious law, you know, loss of vision I'll often get some focal You know bundle type visual field defects Here's another one Drusen buried here Sir have you ever found in your In your experience that coming up anti glaucoma medications has slowed down the progression of any Field loss or have you not seen that good question people have of sad that if the Optic nerve fibers are compromised already with this drusen underneath them that even a slight increase in pressure can maybe cause Further loss and so you certainly want to keep the eye pressure as low as you possibly can But there's been no good evidence that the so-called neuro protective Either pills or drops do anything with these but you definitely want to Make sure that you don't put even a moderate pressure on top of this Right brad what do we see in here? So this is a color from this photo of the nerve we can see that There there's some blurred disc margins consistent with optic nerve edema I don't see any Hemorrhages really So this is an end stage, but it's definitely I don't know stage two Okay, well and you really got to be careful and I'm glad you said it the way you did you said optic nerve edema Papal edema you can get I got nailed on oral boards on this Papal edema by definition is optic nerve swelling secondary to increased intracranial pressure And so you can have swollen discs from other things And so be careful if someone shows you a picture of this on boards and you say, okay, this is a swollen disc If this were bilateral and associated with increased intracranial pressure, we would call it papal edema So be very careful to do that because the the guy kept saying oh, so You could tell papal inside of then I said oh Then I had stopped myself saying no, no, no, okay It's a swollen disc if the other discs were you know elevated and the pressure were high it would be papal edema And then he goes they never tell you yes, correct when you do no boys. They go Okay, then they flip the page You don't give you any feedback so But there are other reasons for an optic nerve to be swollen aside from papal edema So be careful when you do your definitions All right, so this is just one that's Probably more severe and and what do we see in here in addition to what he saw in the previous one seeing hemorrhages more tortuosity of the The vessels make some tortuous vessels Hemorrhages on the surface of the nerve Obscuration of the vessels exactly obscuration. So this is uh severe Um, whatever grade there's one scale that goes from one to four There's another scale that goes from one to five This would be a four or five depending on what scale you look at so severe. Um, this turns out to be papal edema Okay, so when we look at it pathologically, here's the laminar crebrosa back here Here's the edge of the square there.  It's markedly swollen But look at how the vessels are engorged and look at the hemorrhages on the surface. So you get Hemorrhages On the surface you're getting gorgement of the vessels you get it literally gets swollen and pushes forward So pushes toward you when you're looking at it. So that's a classic path of papal edema And you can even get forward bowing of the laminar crebrosa from the pressure coming from behind So those are the laminar crebrosa fibers Pushing forward and so kind of the opposite of glaucoma remember we talked about glaucoma How the fibers excavate and you know, the laminar crebrosa gets pushed backwards this they're all Pushed forward. So the opposite direction with papal edema All right, what do we see in here? There is some obscuration of vessels on the disc. This doesn't look like classic papal or classic optic disc edema though What else could cause kind of a picture like this? Exactly. So you want to start thinking about ischemia Okay, and so You know, you want to worry about aio and you know anti-ischemic optic neuropathy and what is the two ways we kind of Break that down. What are the two different things that can cause that? Arteritic like GCA or non-arteric. Exactly. So you always want to keep that in the back of your mind, you know You don't want to miss an arteritic You know aio and versus a non-arteric aio. So a lot of it's going to be the history So what's the history of a classic aio and these who? has 70s Yeah, 70s Kind of sudden onset vision loss it like me like blurry in a particular area Completely painless the other eyes to find And in fact sudden onset oftentimes they'll even wake up with this And so it's it's like an old vascular path, you know old guy with diabetes and hypertension and You know, he wakes up in the morning and says yeah, I just can't See out of part of my eye something's funny and the reason people think that's that's it is remember your Blood pressure kind of bottoms out right before dawn And so oftentimes that's when these aio ends will occur Now what else at least in an acute phase can give you a funny swollen disc also aside from ischemia How about just just optic neuritis or pepillitis exactly so you can also get You know inflammatory autoimmune other things and causes so swollen disc You know, you get one of these on boards You're in big trouble because it It can be anything and so be sure when you do an oral board that you list as many things as you possibly can In order to do this sir What's the mechanism for looking swollen when you have an aio and isn't just the nerve fiber layers kind of dying out It's actually swollen. So in ischemia you actually get swelling from the ischemia In optic neuritis you actually get inflammation of the fibers behind there and then you get secondary swelling coming up if it's acute Now sometimes you can get Optic neuritis the nerve looks fine. You don't see anything initially and then you start to see You know losing of the normal color and pallor later on All right. So the reason I wanted to show this is We we said as as rachel said, you know, you can get aio and and again, it's non-artoretic It's the person we talked about but don't forget you can get temporal arthritis Which is the arterioidic form and you don't want to miss the arterioidic form because patient may present with Loss of vision in one eye But not only can they lose the vision in that eye, but if left untreated they can lose vision in the second eye also So you don't want to miss an aio and so trees. So what am I showing here? All right, so actually I'd like to start from the inside just because I'm oscd. So Here's the luma and here's the intima. What is this layer right here? To elicyclamina and then here Muscular media and then here Advantish, okay, so I want that artery right now. That's a normal artery So if you do a temporal artery biopsy, that's what it looks like. Now you you may ask Why do ophthalmologists do temporal artery biopsies? That's a good question Just because historically patients present with sudden vision loss And so, you know, usually we're the ones who do the biopsies You know, you'd think that you know, you'd refer to somebody else or the plastics guys would do them all But you know, even general ophthalmologists do temporal artery biopsies. It's just something in our Purview because we see the patients How does this look different than the previous picture? Yeah, look the intima is massively thickened Don't have internal lastic lamin is gone Boy muscular media, you know, I can't see anything at low power And not only that, even at low power, there's these little tiny blue Dots around the edge. Let's look at higher power And what do we see here? Thus the name some people call this giant cell arthritis and so You get epithelioid and giant cells and for some reason they cluster either Internal to the muscular media or external to the muscular media So they can be around the internal lastic lamina. They can be external people have argued Is this an attack on the internal lastic lamina is an attack on the muscular media Is there a bug in there, you know, for a while the rheumatologists and brad were Had me looking at a whole bunch of these to see if there was a specific bacteria that could cause these Fortunately didn't turn out to be but we still don't know exactly what causes this. We just know it's an older people It's a disease not just of the You know the the temporal artery or the short posterior ciliary arteries behind the nerve It's a disease of kind of medium small arteries through the entire head That even the entire upper body And so these people may have Loss of vision, but then you talk to them carefully and you say do you have intermittent claudication and then they go What? So but so you want to ask them specific questions and you want to say, you know, when you chew Something does your jaw hurt? they say Yeah, do you have trouble getting up out of chairs? Do you feel stiff and tired all the time? You've have like some low-grade fevers and so Ask them for the, you know, polymyalgia rheumatica type questions and you'll find they often have these So you don't want to miss temporal arthritis. All right, so tina you suspect temporal arthritis You haven't had a biopsy yet. What blood test do you do? esr crp Okay, esr crp Let's say the they are high enough that you're suspicious Then what do you do? start them on steroids before you do a biopsy and then you usually have You talk to one to two weeks after starting steroids to get the biopsy And that's critical Don't wait for the biopsy to start the treatment because again, they could lose vision in the other eye if it's positive But you want to get the biopsy within seven to ten days because Sometimes if you're on steroids for a long period of time, it'll calm the inflammation And then the biopsy becomes difficult to read You know, there is an entity that we call healed arthritis But that's when you know, I'll look at a biopsy and they'll say someone's been on steroids for a long time Nobody's done a biopsy you look at you say well Turn on the lactic laminates chewed up. My skeletal medias may be gone But it's a really iffy call so you really want a positive diagnosis because steroids are nasty Medicines especially in old people they can run into all kinds of side effects You want to know what you're treating the worst thing we get here is someone's seen by a guy in the community They have what sounds like temporal arthritis. They give them 40 of prednisone First of all 40 in a in a good-sized man is not enough to treat it anyway And then you know, they come back again two months later with side effects from the steroid and say well Did they have it or didn't they That's always stuff to do so know your diagnosis at first because we get a lot of negative biopsies here because we're a Tertiary referral center so we often get you know, kind of the final dumping ground here So we end up doing a lot of biopsies that are negative now in a pathology practice They say you should have about 20 to 30 percent of your biopsies should be negative meaning that you don't miss any You're doing a little bit too too much in our Lab it's more like 90 to 95 negative and so we just get a ton of You know final referrals could this be so we actually don't see as many positives And this is that so-called healed arthritis So here's the lumen Intima Kind of thick and hard to see an internal elastic lamina. Here's muscular media here. Look muscular media kind of absent there No inflammation though. So this would be the so-called healed arthritis. So really know your diagnosis first Vice, what are we seeing here? so, um this field the optic nerve the This also could be From an ischemic cause ischemic optic neuropathy non-eridic Okay, so you could think of ischemic optic neuropathy, but you look carefully. It's kind of fuzzy here But wait, maybe that's a little bit of powder there. So I don't know Okay, now we'll we'll help you out a little bit with the diagnosis. This person's 20 Exactly. So one of the things could help you is age I mean, obviously if someone comes in with a funny disc in their 70 You're going to think more ai on if someone comes in with a funny disc and they're 20 You're going to be thinking more like an optic neuritis And so this turns out to be More an optic neuritis. And so you can see right here Unfortunately, this nerve has been wiped out here And so you can get but segmental focal areas here. It's okay here. It's been wiped out Now again, this starts getting really confusing here. This is just What do you think about this one, Kevin? So it looks like kind of the whole peripheral part of the disc is just kind of Spull and I can see that the vessels kind of come over like this type of raised portion and so And then it's kind of just all the way around. So I would think more of like an optic So you could think again and depending on their age kind of the same idea that we talked about Ischemic optic neuropathy, maybe even you know Area of inflammation, optic neuritis And so this actually turned out to be this patient had had MS and this was optic Neuritis and you can see here There's a focal area in the optic nerve of demyelination And so you often don't get diffuse demyelination of the entire nerve. You'll get focal areas So you can see this has got this one Kind of quadrant Has been affected by the demyelinating process This just shows you in a longitudinal view Here is an optic nerve sagittal here right here Again, it's a focal area With demyelination affecting the nerves and now Optic neuropathy, especially if it's associated with MS is a waxing and waning entity So you can get episodes where you'll get an acute episode and then it'll be calm for years and then you'll get another episode And so when you guys do neuro ophthalmology You'll learn a lot about optic neuropathy and the various studies that have been done and how you treat it And so you really need to know those cold But bottom line is is they did a very interesting study. They compared IV corticosteroids to oral steroids to just follow up And it turned out that the IV, you know, you blast them for three days with IV corticosteroids high dose followed by oral Actually the vision comes back quicker And the patients do better, but when you look at them at six months It makes no difference in terms of their acuity at six months But you know, again, if you have visual loss, you'd want to have it come back quicker But one of the things that came out of this study is they find out when you blast them with those IV steroids Their chance of getting MS Is certainly delayed for at least a couple of years. It may not be Cured and so one of the advantages too is it delays the onset of MS And so there's actually benefit to blasting them with those high dose steroids, whatever that does IV steroids But it turned out if you just treat them with oral steroids, they not only don't do better. They actually do worse So when these people come in three days of IV steroids followed by oral steroids followed by a taper And this is what you worry about in any disease affecting the optic nerve either ischemic or inflammatory What do we see in here? I mean, we see like total loss of Also, it looks like just total loss of infarction of the optic nerve and we see like edema as well In the subarachnoid space that believe it or not that is not edema. That's just Wide meaning of the subarachnoid space and so this is optic atrophy And so this is the nerve sheath and that subarachnoid space is really wide So whenever you get loss of the optic nerve fibers of those axons, you get wide meaning of that And so this is just end stage. So this is an atrophic optic nerve All right, and he gets Keep going just tell me what you see so looks like the Left pupil is larger than the right pupil. It's probably because the pupil's bigger Now it's a little bit displaced What direction is that I displaced? superior nasal If you look at the light reflex, it's actually a little bit inferior. So it's displaced a little bit inferior What do you make of the upper lip? Some ptosis maybe even a little bit of Fulness in there.  She's I think she's like 11 or 12 So what could be going on, you know unilateral in an 11 or 12 year old in a Again, you got to start thinking what are we lecturing about today? What's our topic? Okay, so what could be going on that could give you this set of symptoms? Intervation to the Extracular muscles and innovation to the to lid and then so when you see an eye that's kind of sticking Out and maybe you've got a little fullness here as if there's a mass behind it That's what this all shows. And so this is consistent with a mass behind the eye And then we look inside and we see this Jesus, what is this? So we see in here That's not a Yeah, those are those are posterior Striations those are little we call them wrinkles or folds almost And so now of course people are used to always get excited They used to teach, you know us in the olden days that this meant there's a lesion You know behind the eye specifically in the muscle cone when you see these striations But it doesn't necessarily mean that and someone who's hyperopic With a flat posterior surface of the eye you can get the same thing But this is actually that kit And so when you see these striations in the setting of proptosis and other things this is a sign that you want to look for A lesion in the muscle cone behind the eye and now this is what happens in the end stage of this lesion Look at that nerve That's a pale Atrophic optic nerve And that's because This is what the scan shows So what are we seeing right here? Yes, a large mass in the muscle cone. It's kind of fusiform So given the history and the findings of that previous patient, what would you be concerned about here? Okay, given the history that we said before Glioma, all right, so, you know, if you look in in kids and in adolescents teenagers You know lesions of the optic nerve in this area. Those are optic nerve gliomas In older people, they are usually meningiomas Now if you get one that's outside that group that it's it's really behaves totally differently And so people usually say well, these are kind of benign. They may not be aggressive Well, if you see a glioma in a 70 year old, that's a different animal But you know in a younger person you see this fusiform Lesion, it's almost like it's not around the nerve. It's almost like it's in the nerve And so this is an optic nerve glioma And here's is that biopsy Here's the nerve sheath. Here's the tumor within that optic nerve And here you can see this is one where they actually move the eye This tumor is growing out from the nerve and it's kind of a sausage-like growth or a fusiform growth Okay, so Oh, you can take a stab if you want. How do we grade these? And if you know if you say I have no clue, that's okay Okay, no, no, that's fine. I'll just take a stab because We typically grade these grade one to four Um, so what grade are most of the ones of the optic nerve? Yeah, exactly.  And in fact people call these juvenile Pylosidic Astrocytonis juvenile obviously because they're in younger people. What does pylosidic mean? Hair like so they've got these little almost like little hair fibers in them, but they're low grade You don't see mitotic figures in them. You don't see a lot of pleomorphism. They're very very low grade Some people would even say they're almost like a hematoma kind of a benign growth But if you look at these oftentimes especially if they go back Through the optic canal, you'll even see remodeling of the bone in the canal, which means that these have been there for a long time And so this is kind of hair like pylosidic And here you can see them again. These are believe it or not astrocytes Some of them will be kind of spindly shaped. Some of them will be round And they have a specific Entity that goes along with them that you can recognize that you have to know Catherine What is this showing you? It's a rosenthal fiber. What the heck's a rosenthal fiber? It's kind of a bunch of degenerative material that's in the cytoplasm of these cells And so it's this pink Intracytoplasmic inclusion material here. It's called rosenthal fiber And that's classic with these grade one astrocytomas these optic nerve, you know pylosidically almost Now here's one That you can see it's growing up from the optic nerve. It's even squeezing the optic nerve So, you know, you can see how this is not really conducive to sight the problem with the treatment of these is okay You can go in and remove them Okay, then the eye's blind or you can just watch the tumor grow and then the eye's blind Or you can radiate them. These are really slow-growing tumors. They don't respond real well to radiation. And so You're kind of darned if you do and aren't if you don't The one thing we do worry about is sometimes you can get reactive meninges On the outside surface of a glioma and so there might be someone something's atypical their age range is different The orbital guys go in there and do a little superficial biopsy And they'll take a biopsy of one of these and then if you get this on a biopsy say, oh my god, that's a meningioma No, it's the actual surface of the glioma Down here where you get reactive changes of the meninges And so a bottom line is if you're going to do a biopsy And you know boopy and these guys are really good at doing that.  I'm out to be sure here again Almost looks like a meningioma right here reactive proliferation of the meninges All right, Tina, what do we see in here other picture, but a different age group. So looks like that eye There's some inferior scleral show you get the idea that that eye is proptotic There's fullness in the orbits purely and inferiorly. So just kind of looks like everything's being pushed forward Okay So you're worried about a nerve, you know, you're worried about something behind that nerve again pushing forward now Look inside and what do we see in here? Optosilary shut vessel Optosilary shut so I mean these can show up in central vein occlusions and other things but in this setting Why would you get an optosilary shut? anything that is Compromising Nervous culture. So like a meningioma would give you Exactly. So I mean if again, what are we talking about? We're talking about optic nerves. We're talking about an older person So likely this is a meningioma meningiomas again, they go from the meninges not from the Inside of the nerve but from around the nerve. So they slowly Squeeze off and strangle the nerve And so as that slow process is going on oftentimes you'll get these little optosilary shunt vessels forming to try to get You know blood out of the eye and then through that nerve from where it's being squeezed down and strangled And so this is the classic appearance. What do we call this? The tram track sign so you can actually see the nerve Still there and then you see the widening of the meninges next to it So kind of like the you know tram going up, you know with the tracks around it, you know the tram wire So they call this the tram track sign This shows you a severe example. This actually is an exenteration, you know or remove the whole Eye and orbital contents. Here's a little bit of nerve here and here's this huge tumor Bilob growing up from the meninges behind the globe All right, so vice what do the cells look like? Um, so these are from the meningosilial cells. They look they have a pink or cytoplasm look kind of like squamous cells Exactly. So they almost look like squamous cells, you know, they've got this nucleus notice the nuclei the clump chromatin But the pink cytoplasm and they tend to form these little worlds almost almost like squamous cells do And you can see if you look at this people say kind of that kind of looks like squamous cells almost What are these things Caleb? Is your somoma bodies? Somoma bodies First of all spell it Good so somoma with ps Somoma bodies So again, these are almost like if you think of drusen these are almost like Um concentric lamellar structures. They've got hyalin in them. Sometimes they have calcium in them They almost look like remember when squamous cells form those little squamous pearls It's kind of the same idea here. And so these are called somoma bodies and there's the meningothelial cells And there's the somoma bodies. So these are a real classic tip off that this is a meningioma All right, what else can show up in the muscle cone back there? So you could have a um What are the kind of cells live was the optic nerve goes back astrocytoma? No, that's the lioma. Yeah, um Schwannoma Schwannoma exactly remember Schwann cells live back there So it's very rare, but you can get a schwannoma right next to the nerve It doesn't come off the nerve itself, but it's right next to the nerve. It's in the muscle cone You can get a schwannoma or what's the other proper word for schwannoma? I I didn't know what you're talking about. I have no idea Neurolemoma and again spell if you can spell that and somoma you guys are doing well because there's double m's in there So neurolemoma Uh, let's you know, this is an unfair question. That's a fair question for a For a second year here What are the two growth patterns you have to memorize for schwannoma neurolemoma? Exactly and which one is this one Okay, so see again. I'm ocd. I'm going to show it in order Yes So antony a Is a swirling or fascicular pattern. So if you look at these Schwann cells, they're almost spindly shaped and they form this little swirling fascicular pattern. So that's antony a And then antony b is a more mixoid It's almost like there's a little bit of fluid in it and some other background materials in there. So this is an antony b And antony is is like, you know, the only pathologist who wasn't like german or austrian or british, you know, I think he was Italian I think so in any event antony a is swirling fascicular antony b is more mixoid Okay, and then we say hi to the penguins at the zoo Next week. I hope it doesn't snow so I can get here on time Next week is orbit Okay questions on optic nerve