Yeah we on boss talk one on one, one on one. Yeah we gonna talk. Like we always like to go back when you were younger, when you were a kid, you know, growing up in Arlington, did you have siblings? Were you raised with your mom and dad, stuff like that? I got two grown brothers, they fully white, we got the same mama, but like. They fully white, that's dope. Yeah, but then my niggas. So your mama white? Yeah, my mama white, my daddy black. Okay. I ain't broke, now I'm a white.   So on your daddy's side, you don't have any? I'm his only child. Wow. I grew up with both my parents, we never like lived together, like for real, for real, but it's always been love, like we all cool.   He stay with me. Oh, he move with you, you look out for him. I hope my, you hear that boy? Hell, I hope somebody look out for me and vibe with me.  Oh, really? So you have a close relationship with your dad then? That's my best friend, like. That's good.  That's dope, man. That's dope because you trust him.  You telling me that your dad is gonna help you deal with your estate? Yeah. So basically, I mean, I don't, Beyonce tried to be careful. Nah. Nah, that's a bad word.  You trust him. What's the most important thing that he's taught you?    I like that, man. I love to see that. When did you realize you had the talent to rap? Okay, well, with that being said, like in elementary school, I've always had a sense for like music and shit, but I didn't want to do choir. I couldn't sing. They don't want to do band cause I didn't want to play one of them instruments.  Like rapping ain't real, I ain't Jay-Z.  I ain't, you know, I ain't Fergie. Like, you know, like, I ain't. I'm thinking, I'm watching these people on TV when they songs come on in the morning. And I'm like, that can't be me. They already famous, you know, like, so my brother was a rapper. Like when I was a kid, his name was A1. His name was A1, yes. And he could actually rap. He was in Allenton? Yeah. A1. I'm trying to think back. Like this nigga probably went hard. He said they're older than you. How much older are they? He said 37. I think she said one was 37. That was like 10 years. Like 15 and 13, 15 years apart and 13 years apart. I'm 23, I just turned 23. You're the baby, baby.  You know, I'm blessed, though. Highly blessed, highly favored. What was I saying? Oh, yeah, he raps. So like, you know, I was like, well, he can go to a studio and find a microphone. So like as I get older, I'm like, I guess it's possible.  So my 18th birthday, we were just playing. I turned on some Detroit. I said to treat. Detroit style type beats. And I'm just rapping, freestyling, just doing whatever, doing whatever.  I grabbed a notebook. I got a whole, I still got it to this day. The same notebook. I don't write no more. But like at that time, that's all I could do. I didn't have a studio. So I was just like, well, if I write songs, like something, you know, like I'm gonna find a studio. I'm gonna find a microphone.  Started recording, recording my first song. And it was like, you got to keep going. You can be a star. I'm like, I know, but like, I don't know, you know? No, you dope, man. Oh, I know. But now it took time to be like confident. First time, because normally a lot of people always say the first time they hear themselves after it's mixed and mastered. I was in the studio, it was like this scared to rap and my voice was just cracking. I was like, they were like, just relax. I'm like, all right. And then I did it a little bit more. You can still hear like in my voice that I was scared. You know, and then when people were in the studio, I was scared to rap. I don't know why I was just scared to do me.  They're here because of me. Like, why am I caring what y'all, what I sound like? I'd have been around in the studio, bro. One person I was in the studio with was Lil Key. Rest in peace to him.  But when he's recording and you're listening, like, you wonder what this finna sound like. You know, like, it's like, but me at the time, I was like, it gotta sound perfect when I'm recording the mic because they're listening to me. You know? But you didn't know that it doesn't have to at that time. Yeah, at that time I didn't until I got around people and I was like, okay, this just rap. Like, I got a song with Pablo Juan. He went in the studio, he did a verse.  You know, like the end bars might be harder. Like the first bar might be hard.  It sounds crazy.   You know? Somebody else I know that they came on and that's what they do.  You gotta find your own rhythm and you gotta find what works for you. Hell yeah. So after, so when, how old were you when you would say that you found your confidence? How long did it take you? Like, ooh, my voice cracked. Like complete confidence, 22, last year. What made you find your confidence so late?  But in rap?   Regardless if people see it or not, I see it in a lot, people see it.


We now move to agenda item 2 of the second meeting of the Standards, Procedures and Public Appointments Committee in 2022. The committee has been considering a complaint about a former member of the Scottish Parliament and I will now read out a statement that sets out the committee's findings. On behalf of the committee, I would like to make the following statement in relation to a complaint against a former MSP. The committee has considered a complaint from Mr Joe Lowe about Alison Harris. The complaint is that Alison Harris did not register the true market value of the shares she held in Georgian Finance Company Ltd appropriately in her register of interests. The committee is unanimous in the decision reached on the complaint. The committee cannot concur with all of the findings, in fact, of the commissioner and does not agree with the commissioner's conclusion. In relation to the commissioner's findings, in fact, the committee does not consider that the valuation of the market value of the shares in Georgian Finance Company Ltd, secured by the commissioner, can be deemed to be the definitive market value of the shares in the context of the code of conduct. Indeed, the committee would highlight that material included in the commissioner's report illustrates that experts can have conflicting views as to the market value of the shares in private limited companies, because different methodologies can be used to determine that. The committee was cognisant that the code of conduct for MSPs does not provide a definition of market value, nor does it prescribe any methodology for ascertaining the value of shares. However, the code does state that, on detailed financial and commercial matters, a member may wish to seek advice from other relevant professionals. Alison Harris indicated in her representations to the committee that she had sought the professional opinion of the company's accountant as to the market value of the shareholding, which she interpreted as being nil, due to her being unable to freely sell her shares. In relation to the commissioner's conclusion, the committee does not agree that there are sufficient grounds to conclude that there has been a breach of the interests of the members of the Scottish Parliament Act 2006 and, indeed, the code of conduct. Alison Harris registered an interest in shares on the basis that she held more than 1 per cent of the nominal value of the issued share capital of the company. She did not additionally register the shares on the basis of the market value exceeding 50 per cent of a member's salary at the start of the relevant parliamentary session, because she ascertained the value of the shares to have a market value of £1. While the committee recognises that a fair observer might reasonably consider the market value to be higher, there were conflicting expert views on the market value of the shares. In addition, the committee could not draw on either a definition of market value or a prescribed method for reaching a market valuation within the code to reach an incontrovertible conclusion that the market value of the shares exceeded the threshold. For those reasons, the committee does not consider that it is in a position to reach the conclusion that a breach of either the act or the code had taken place. The committee recognises that there are many different types of shareholdings, particularly in relation to private limited companies, and that, in some circumstances, ascertaining a market value for shares can be complex. For this reason, it intends to consider this matter further with a view to revising the guidance on the code of conduct for MSPs, provide more clarity to members, on the registration requirements and greater transparency to the public on members' interests. In conclusion, although the committee does not consider that there are sufficient grounds to consider that the code of conduct has been breached in relation to that complaint, it would remind all members that they should approach the registration of their financial interests in the spirit of the utmost transparency to ensure that their integrity and propriety cannot be called into question. Full details of the complaint and the commissioner's investigation of it will be included in the committee's report, which will be published later this afternoon.


Fresh milk wafted into D60245's nose as he luxuriated in the richness of the bath. A weight lifted off his shoulders, as it always did. With every stroke across his chin, dread receded. He could forgive himself for being the foundation's monster. Christ would. He almost enjoyed this. Those who sinned as much as he did rarely got to bathe weekly in milk. He leaned back, just to relax for a second, and wounded shadows grabbed his chest. He was pulled beneath the milk. He thrashed. He opened his mouth to scream, and the milk rushed in. Visions followed. His childhood imaginings of heaven, a bucolic English countryside, a distant shining city on a far-off hill. The city glowed alabaster white, but no, it was mozzarella. Dawn broke as he watched, and the mozzarella white aged to parmesan yellow beneath the sun, and the bucolic green, those endless English meadows of untainted grass. It was mold, blue, stinky, spotty, spreading as far as the eye could see, burrowing its way into the walls of the shining city as he watched. And then, the shining city fell, chunk after chunk cascading downwards, crumbling like feta. He burst through the surface of the bath, clawing at his face, taking in gasp after frantic gasp of air, before he was pulled beneath again. An outstretched hand turning water to milk, feet washed in milk by a woman bowing her head, his virgin mother's immaculate breast again through the surface. This was wrong.  Far below, a man ambled between groves of bushy trees, a milky white light emanated from the sky. D-60245 recognized this, the agony in the garden of Gethsemane. This was when Christ learned all of humanity's sins, learned what it truly meant to be the Lamb of God, agonized about his fate, and chose to bear the burden anyways. Rays of light rained down from the heavens, D-60245 saw them and knew them to be sins, those he'd washed away in the bath, and many, many more. Every ray hit the man far below. Every time, his gate slowed as he bore the sin, he gazed down at his hands. There was hesitance, yet resignation. D-60245 knew his gospel, and there appeared to him an angel from heaven, strengthening him, and being in an agony, he prayed more earnestly, and his sweat became like great drops of blood falling down upon the ground, Luke 22-43 and 44. Was he playing a part in the agony of Christ? Was he the angel sent to give Christ strength? He landed and carefully approached his savior. Wasn't he drowning? Wasn't he choking on his sins in a bathtub of milk? Kind words, perhaps, but what did you say to the savior of man? What did you say to someone who bore your burdens, yet loved you anyways? A few steps, then a few more, closer and closer. The man gazed at him. His eyes were solid white. He perspired, but the beaded liquid upon his brow wasn't sweat or blood. It was white. The air smelled of sour milk and a Limburger. The man approached D-60245. D-60245 wanted to run, but he couldn't. He remembered Jacob, who wrestled an angel and didn't lose, and so was blessed. But he was the angel now. The man was upon him. Christ was supposed to lie down and take it and bear the sins. He wasn't supposed to fight back. A final gasp of air bubbled towards the milky white sky above and the shadow freed from its burden erupted from the tub. Thank you for listening.  Please become a patron or visit our merch store at the link in our bio to support our work. Secure. Contain. Protect.


This is my assessment of what that nola dual-carriage way means. Number one, we need to understand that in every contract there are two sides. Particularly this one, there is a public being government of the Republic of Zambia and there is a private partner being the macro-ocean investment consortium. Which, and I want you to quote this, which includes NAPSA and Weka's Compensation Fund as part of the macro-ocean investment consortium. Why is because NAPSA and Weka's Compositions are the financiers of this deal. So they are part and parcel of the macro-ocean investment by that of being the financiers of this deal. NAPSA and Weka's Compositions are government entities. They are government entities. Meaning that in case there is a conflict, there is failure for instance on the part of macro-oceans to deliver the road to the expectations as prescribed in the contract specifications. Government will not be able to hold macro-oceans to task because if they for instance take macro-oceans to court, government will essentially be taking itself to court because NAPSA and Weka's Compositions which are the financiers of this deal are government. So meaning that government cannot sue itself. That's a serious anomaly and it raises very serious questions about how government will ensure that macro-oceans deliver the contract to its specifications. Number two, if you read the statement of the Minister of Infrastructure Honourable Menopi in close 10 of his statement, the Minister states that the contract was awarded at an exorbitant price of 1.2 billion US dollars and this is in comparison with the contract sum of 649,967 dollars. The Minister says it was awarded at 1.2 billion by the previous regime and that they have reduced it to 649 million. Can the Minister confirm what has necessitated this reduction? Is it because the scope of the Weka has also been reduced because the Minister cannot argue today that they have reduced the price by half and they want to save money if the scope is still the same? Because actually the cost of doing that road now has doubled if you look at the exchange rate and if you look at the cost of all materials, if you look at the cost of transport, the cost of machinery, the cost of cement, the cost of asphalt, the cost of all materials that are needed to build that road, the prices of all these materials have gone up. So when he says that the contract sum has been reduced from 1.2 billion to 649 billion. Can the Minister also be honest enough to tell the Zambian people that they have also reduced the scope of the Weka? They have reduced the scope of the Weka and can they tell us what they have removed? Can they give the Zambian people the BOQs of the so called 1.2 billion dollars and the BOQs of the so called 649 so we can do compare and contrast? If the Minister claims that there was corruption when the price was pegged at 1.2 billion because the scope according to him remains the same, then why has the contract been given to the same contractor who had pegged it at 1.2 billion? Why give it to the same contractor if at all the price of 1.2 billion was exorbitant looking at the scope of the Weka? Why have you awarded the contract to the same contractor who in the first place according to your own submission wanted to steal over 600 million dollars from the Zambian people? Number three, the Minister in a statement if you read clause 42, this is what the Minister said and I want to quote, besides that NAPSA are not the only ones likely to be approached for possible investment in the project, they are just part of the possible funders. Now listen to this again and I quote this is the Minister's statement go to clause 42, he says NAPSA are not the only ones likely to be approached for possible investment meaning that NAPSA has not agreed there's no contract yet, there's no agreement yet because the Minister himself in his own way says NAPSA are not the ones who are likely to be approached for a possible investment in the project so can the Minister tell the Zambian people the truth have they signed the contract with NAPSA or they have not yet signed the contract with NAPSA because clause 42 of his one statement says that NAPSA might not be the only one they will approach and that NAPSA might possibly be one of the funders now this shows that NAPSA has not yet committed to funding this project in the absence of a conclusive arrangement what criteria was used to pick the questionnaire and how then did government proceed to sign a contract with the questionnaire before concluding the funding arrangement and funding agreements with NAPSA these questions must be explained to the Zambian people I went further, no I'm talking about what the Minister said in parliament and the Zambian people must know and this is where you can see that we are dealing with the government of dealers and here is where the deal comes in if you go to clause 49 of the deal this is what the Minister says we are guided by the total revenue over the concession period by the government total gross revenue of $432 million and using an average of 10% as stated in clause 48 of the Minister's own statement that is about it ranges from 1.5% to 15% the concessionaire will collect a total of $4.3 billion the concessionaire will collect $4.3 billion now do the simple maths after the deduction of this envisaged accrual to government this is how the breakdown will be $1.1 billion will be repayment of the loan and financiers of approximately financiers will get $1 billion including interest rates we are being very fair we are including interest rates and everything and I will go back slowly so that we are on the same page so the money after the project is done is expected to be done in 3 years and expected to collect the tofis for the next 22 years the concessionaire will get $4.3 billion if you do the refining the refinancing or paying back of the debt to Napsa with interest rates it will come to $1.1 billion save $1.1 billion ok let's add the maintenance the maintenance work you can put it at $1 billion and the future maintenance costs approximately maybe $300 million will have will leave the gross revenue accrued to the concessionaire a total of $1.8 billion so concessionaire akachosamon drama zonse abapaswa government $1.1 billion repayment of the loans to the financiers abapaswa $1 billion approximated interest rates abapasa $300 million approximated maintenance rate the concessionaire will walk away with $1.8 billion you know what this represent? 289% profit that is the money that the Chinese who have been given this contract to make $1.8 billion representing 289% of the total investment now let's ask ourselves questions that's first of all this makes sense that we can use our own money our own money give it to macro oceans macro oceans build the road after 3 years they walk away with a profit of $1.8 billion from the toffees it doesn't make sense so what is motivating the government to go on this deal the no more decent thing to do for government was simple napsa is not a bank all the projects napsas done they will finance and own if you go to kwa chazanga they have a complex they financed it and they own it if you go to levy park they finance and they own if you go to zamiashio building society they finance and they own that's how they get their money why didn't we say napsa finance the project pay for the cost of building the road and then recover your money using toffees so that the $1.8 billion that is going to go out of this country could have gone back to napsa what is the motivation then the motivation is simple they are using this deal the idea is 1.8 billion so while we are fighting each other over 1.8 billion 1.8 billion and lastly if you go to close 35 in the minister's statement the minister emphasised that there was no requirement for a sovereign guarantee money sourced locally is guarantee enough ma minister wants us to believe that these are geniuses we are dealing with smart guys we have nothing to negotiate in terms of a sovereign guarantee because napsa money is public money is government money it is a sovereign guarantee on its own so this whole project first of all from the financial point of view doesn't make sense


As Johnny dollar Jim base Johnny. Oh hi a Jim Johnny when a chief of police gets shot and killed What would you say is the most likely reason for well most likely because he's a chief of police right only? I've got a hunch on this one like what Jim the insurance the chief was middle-aged Shot to death with his own gun in his own house The beneficiary his wife is 27. They've been married eight months The policy has been in four seven months The face value is $50,000 And the wife filed a claim on that only 24 hours after he was killed well fast girl She didn't waste any time. What do you think Johnny same thing you do? Maybe I'd better look into it All about taking a minute or so to talk about seals and fish that have some connection with the government of the United States Now that isn't as strange as it sounds You take the matter of seals for example There are two types of seals that are the responsibility of the Secretary of State First there's the great seal of the United States which is stamped on all official documents The Secretary of State makes sure it's always on hand when it's needed The other kind of seals he takes care of are the ones that swim in the ocean Since it's up to the Secretary to work out agreements with representatives of other countries and let them know How many seals can be caught in what is called international waters and when? The Secretary of State works out similar deals for the catching of fish and blobsters Because these agreements are actually treaties Before they can be put into effect. They have to be approved by two-thirds of the Senate As a matter of fact anytime our government wants to work out a deal with a foreign country on trade Mutual assistance fish seals or lobsters. It's done by treaty and all treaties are signed by the president Though some of them aren't drawn up until after the Secretary of State has worked over the rough spot In order to pave the way for prompt ratification. So Just remember the Secretary of State is a mighty important wheel in the machinery of your United States government Expense account submitted by special investigator Johnny dollar to a home office Commonwealth Mutual Assurance Company Hartford, Connecticut. The following is an accounting of expenditures during my investigation of the Dan Frank matter Expense account of one seventy six dollars and forty cents transportation to the Great Lakes town of Middleboro and Taxi to the home of Dan Frank former chief of police now deceased It was a rambling two-story house well-trimmed hedges smooth lawn quiet neighborhood Good place to live and the last place you think of as a setting for murder.   Oh, you're getting warmer insurance investigator Insurance that's what I just asked her about and she threw me out said I was drunk She was right.  I? Like you Johnny. You don't talk too much. I do Let me give you a little advice Watch yourself meaning what this town? It looks sleepy dead Don't let it fool you. It's wide open Rackets everything a guy could get hurt. What about Dan Frank was he in on these rackets? Johnny the police chief here gets six thousand a year Take a look at that house Go in and take a look at Laura even more expensive Dan was in He's out now though Be seeing you Pete right do that. I'm always around Pete Parker that drunk that works for the Herald ask anybody Well Johnny dollars my name I'm representing the insurance company.  I'm not here to pay you Mrs. Frank. I'm an investigator The company wants a little more information about your husband's death. Why I told them everything in the crime I sent I know but there are always a few to try to get out of it. I know how those companies operate Oh, you've had experience with them before. No, of course. I haven't but What information what is it you want to know mr. Dollar. Well how it happened for one thing Right here. This is where he fell Done was laying beside him someone had taken it from the table there by the door and waited for him to come down the stairs middle of the night wasn't it Why did he come downstairs? I'd heard a noise I woke him up and he came down to see about it for the lights on not down here I turned on the whole light upstairs and done the shot for five of them Someone ran out the front door and got away without being seen. Yeah Who do you think that someone was Mrs. Frank? I don't know Dan had a lot of enemies of course because of his job. What about his friends? You suppose they could have done it. I don't know what you mean Well, who were his friends? Who heads up the rackets here in Middleborough? What racket? Okay, without your cooperation. Oh, it's gonna take a lot longer to get this settled Tell me something does the insurance company think I'm the one who killed him Well, I think 24 hours is pretty fast for a grief-stricken widow to shoot a claim into the office I'm not grief-stricken. Mr. Dollar. So I've noticed you go see max Billy talk to him max Billy the city attorney Get his story before you jump to conclusions. See if he thinks I'm guilty.  Billy late at night the two of Malone in the house the chief shot with his own gun That mysterious prowler story has been used before yeah, I know But you're wrong about one thing. They weren't alone in the house. I Was there oh You see Dan and I were leaving early in the morning on a fishing trip. So I was staying all night. I Woke up and heard somebody in the hall outside my room About the time I opened the door Laura snapped on the hall lights just then the shots blasted downstairs She was standing in the door of her room not ten feet away. She couldn't have done it No, apparently not She sure couldn't have had a better alibi the city attorney himself Were you and Dan Frank good friends mr. Billy? No, we didn't have much use for each other Well, then why would I know I know I was spending the night in his house and we were going fishing together You're thinking maybe I needed that alibi as much as Laura does well. It does work both ways mr. Billy No motive Laura could be a motive. She's a beautiful girl A lot younger than her husband. I understand About your age in fact, uh-uh again. I Know it too. Well sure. She's a knockout wild honey suckle and a handful of stars Inside there's a little cash register bell when you put money in it rings real pretty when you don't nothing Dan found out is that why he got mixed up with the rackets here. Sure.  I wonder if you'd go over that. Oh, I'm sorry I didn't know you come on in commissioner. This is Johnny dollar insurance investigator He's checking into Dan's killing a terrible loss mission of Corbett. Mr. Dollar. How do you do? Oh, yeah If there's any way at all we can help this dollar just speak out the entire facilities of City Hall are completely at your disposal So well, thanks commissioner Just what is the theory on the shooting? Find Eddie sales, and you've got the killer Eddie sales and chief Frank sent him up a couple of years ago Eddie swore he'd get him if it was the last thing he did Eddie was parole last week seen here in town the morning before the killing hasn't been seen since we've combed the town for a week No luck Well, it seems to add up Would missus Frank now anything about the rackets her husband was tied up with like it's why that no commissioner He's been talking to people found out our fair city is not as lily white as it looks Well, then there's no point in trying to cover it up It's true. Mr. Dollar unpleasant as it is to admit it any idea. Who's back of them not enough to talk about if I did I'd be talking about it in court find Eddie sales. Mr. Dollar That's the key to both the killing and the rackets find Eddie and you can wind this up in 10 minutes Expensive on Adam to a dollar and fifty cents taxi from City Hall back to my hotel. I Kept trying to make sense out of what I'd learned but got nowhere Everybody blamed Eddie sales the ex con with a grudge on the Eddie wasn't around There wasn't any closer to an answer when I got out at the hotel I Watched the taxi pull away and then started across the walk throughout the entrance It was Laura Frank parked at the curb a few yards away I've been waiting for you Johnny. Oh have you I wanted to talk to you. Why don't you get in? Okay Did you talk to Max? Yeah He gives you a pretty strong alibi. I could have told you myself, but you'd have checked with him anyway Yeah, I imagine I would have They're not being any nicer Johnny. Is that what you wanted to talk about? Maybe I'm ready to be nicer. Oh And how about cooperative that to tell me and tell me why you didn't mention Eddie sales when I talked to you earlier Why should I I don't know that it was Eddie? I suppose it was everybody's sure of it But I don't know it with him. I see forget him Johnny It's the police can't find him when they know the town inside out. It's the fincher. Get out quick Yes, I guess I am why Johnny, why would they want to kill you? How do you know it was me they were shooting at? No No, something to think about isn't it? You feel any more cooperative. I gotta get out of here Johnny. I'll talk to you later. I've got to get out of here Another scotch and soda. How about you Johnny? Well, thanks people right now. Oh, I forgot to ask How did you find me? I called the paper. They gave me the names of three bars. I was lucky on the first try Reputation is a wonderful wonderful thing Well, Johnny, what else you want to know more about Laura Frank? Why? She's got an alibi. I know and somebody tried to knock her off a couple of hours ago not necessarily She could have been setting me up for that one Possible. Hey, Arthur. Oh, thanks Laura Frank hate champagne, but always Auditors it costs more a pink and gold dollar and spangled tights a four-star tramp X dance at the Cosmo Club X girlfriend of Eddie sales until Dan girl friend of Eddie sales. Oh, sure Sure, hadn't you heard about it? That's why Eddie swaried gets Dan claimed he was being framed Maybe he was Maybe Laura suggested it to Dan. Eddie had done all he could for a by then Why do you hate her Pete? It's quite the contrary Johnny I'm in love with her Always will be she was my girl before she met Eddie sales. Oh Oh Waiter It's a screwy case anyway, you look at it Johnny That gun for instance, I guess you heard Now what about it? Well, they found it lying beside Dan's body His own gun. So of course they assumed he shot it out with a killer It was two days before the lab woke up and realized he'd been shot with his own gun Hadn't used it at all. Hey, Mr. Parker. There's a call for you. I'll plug the phone in here. Oh, thanks. Yeah, sir Pete Parker What oh Yeah, yeah, sure. I'll cover it. Oh, yeah, yeah right away It's a three alarm fire Johnny Laura Frank's place flames 50 feet high. They can't get inside No many great men have attained the highest office in our land the presidency of the United States Can you guess the name of this man? The son of a president he served his country as diplomat lawmaker and secretary of state before becoming president himself his excellence as a speaker one for him the nicknames of old man eloquent and the walking vocabulary in His first message to Congress as president in 1824 He recommended a program of national improvements including the building of highways Canals a national university and federal weather observatories He was also responsible for the Smithsonian Institute If you don't have his name by now here are two more clues During his presidency the Erie canal was completed and the first passenger railroad was built Who was he? John Quincy Adams six presidents of the United States His life is part of your American heritage And Now with our star John Lund we bring you the second act of yours truly Johnny dollars Franciscan item three six dollars and twenty cents refreshments for Pete Parker of the Daily Herald and taxi to Laura Frank's house in the suburbs Marked now by a pillar of flames visible for block The whole outside shell of the house was blazing and the fireman couldn't do much of anything but try to keep it from spreading And hold back the crowd that it collected on the street and lawn. It's terrible Mr. Dollar simply terrible a total of yeah I look that way so what about Laura commissioner? Where's Laura Frank? Oh, she's all right Pete got out before it really caught She's over there in the car with Max Bailey. Oh, oh, yeah Well, we'll see you later commissioner. You're coming Pete. They're right with you. That's a terrible thing Pardon me, please. Come on. Let us go please It was me they were after and now they've tried again. Yeah, it could be. Oh, hi. Yeah, Mr. Billy, I'm another one for you, Mr. Dollar. The house is in short, too Oh, it's awful. I came home and laid on this sofa. I guess I dropped off to sleep. I woke up with planes all around me I was just lucky to get out. You've always been lucky Laura. I can get along without any remarks from you Sure, you can baby.   Why you can afford me now Get out. Get out of here. Take it easy both of you. I'm sorry. I lost my head. How do you figure Mr. Dollar? I mean the fire Eddie sales. Well, it kind of looks that way He got Dan Frank a week ago and came back and tried for Laura tonight. Where the devil's he's been hiding out though I've gone over this town foot by foot hard to tell That came from the house ammunition maybe the chief probably got some somebody coming out by the cellar door He's carrying a gun look fallen on the ground. Come on How can anybody come out of that alive? I'm trying to Good Lord, you know, it's the boy we've been looking for Mr. Dollar Eddie's sales I can't promise anything gentlemen That shot may bring him to for a few minutes or it may not badly burned What are his chances of coming through it alive like a resin not one of the thousand commissioner you may hang on for a day or two and Might become conscious for a short while and be able to talk as far as pulling through Not a chance really. Hmm. Well, there's no point in me staying here any longer If he does talk you can get his statement Max. Good night gentlemen. Thank you. I The whole answer Mr. Dollar right there on that bed and we may never find out what I can't figure those shots He fired him before he came out of the blaze He wasn't trying to shoot anyone apparently he couldn't even see anyone burn the way he was I'm going up to the dispensary and get some more plasma back in a few minutes But how do you figure it Johnny that Eddie started the fire? There's no other way to figure it Pete. Oh, if you needed funny He got caught in his own trap. Yeah, he started it. All right, and he shot down Now he's paying for It looked like we're not going to find out who's behind the racket Wait a second. He's trying to say something Who double crossed you Eddie Still can't make it that may be as close as you'll ever come I'll get it. Oh, yeah Thank you You miss the dollar. Oh, thanks Johnny dollars Oh Right away All right, talk All night long over here. I guess so right away. Yeah, right away so long Pete That was Laura. She wants me to meet her across the street stay here and keep an eye on things with these sure go ahead What's in your mind? Down Johnny Come on. Thanks. You had a talk to me right away. Well Look at me Johnny I'm not so bad.  I don't care what a couple of guys said What do you say Johnny? You look great, Mrs. Frank terrific now if you'll excuse me. No, wait Johnny I'm in the clear on this. You know that The night my husband was killed. I've got an alibi. Nobody could shake right Well, I'm convinced that you didn't pull the trigger. That's what you mean You could convince the insurance company to see what We could have this over in saddles. Yeah, they'd go pretty much on my report Why don't you be nice and turn in a real good report? Well, we get some answers first, Mrs. Frank Straighten out some of the coincidences Like the fact that you heard the noise and woke up that you sent chief Frank downstairs And you turned on the upstairs light behind them and made a perfect target out of Let's hear what Eddie sales has to say before I file a report suppose that he dies without talking Well in that case you probably will be in the clear and now if you look sorry I'll give you $10,000 Make that report now You are anxious, aren't you? I just want to get it settled and out of the way Johnny one of the firemen I know just came by the hospital They found out why Eddie sales fired those shots the cellar doll was padlocked on the outside He shot the lock off to get out and Eddie didn't set the fire. He was locked in the basement So he was the one who was supposed to die in it Right, Mrs. Frank. I don't know what you're talking about. What did you want to see me about Jenny? See you about oh, yeah, you just phone the hospital and said to come right over here that you wanted to see me Come on Pete.  Bailey? Yeah, somebody phoned the commissioner wants me to meet him across the street Is there anybody up there with Eddie? Well, no not right now the doctor be back in a few minutes though Come on look. Look. I've got to meet the shut the doors Pete. Oh, what's going on here? Look, I haven't got time to go back upstairs. I think you'd better take time mr. Billy was all right. Eddie wasn't showing any signs of coming to help Eddie wasn't All right, let's go Now look you mind letting me in on this mr. Dollar. Let's go down to that room and take a look at Eddie first What happens that policeman they had undue I was here in the hall when I left it might have walked down to the Did you leave that door open mr. Billy? Come on. What's the devil? Are we interrupting anything commissioner? What are you doing with that pillow? Nothing nothing at all. I'm holding it down over Eddie's face. You would try Dead you smothered him he was dead when I came in I was just moving the pillow Did you have to get us all out of the hospital and send the police guard away just to move a pillow mr. Dollar? Surely you're not suggesting what I'm suggesting it Corridor I've known for a year that you were back of the racketeer But I didn't have any way of proving it until now. Is that what you mean max hold it right where you are That gun isn't your answer commissioner There are three of us and you can't get us all stay back dollar. Why did you have Dan Frank killed? He was one of your boys. I can tell you mr. Dollar Dan was going to pull out fill the whole business Give me names and facts that was the reason for the fishing trip Laura must have tipped off Corbin Eddie sales was in town and already had a grudge against the chief. It was real convenient That's right max real convenient and Eddie hit out in the basement of Laura's house until she decided she feels safer If he were dead until she locked the basement door and burned the house down tonight Laura was a weak link That's why we tried to knock her off this afternoon money better. Give me the gun call you back better do as he says Commissioner I've worn your daughter. Don't come any closer stay where you are To watch it he's making for the window You got out of being prosecuted Laura sales is dead mr. Corbett and Dan too No witnesses and nobody to prosecute He still has you Mrs. Frank accomplished a murder Johnny no witnesses. She's right Mr. Dollar I couldn't build a case against her with this you can Well she intended it to be an insurance claim but it's actually a confession all signed and witnessed What are you talking about? It's all filled out with a complete story of what happened It says We found my husband's body at the foot of the stairs He'd been shot and killed with his own gun Oh, I don't quite see what this claim was in the main office of the insurance company less than 24 hours after Dan Frank was killed But the police didn't find out he'd been shot with his own gun until two days later How did you know it Mrs. Frank Expense account item four one hundred and ten dollars and eighty cents hotel incidentals and transportation back to Hartford Expense account total one hundred and ninety four dollars and ninety cents yours truly Johnny dollars


from Las Vegas, extracting the signal from the noise. It's theCUBE covering Interconnect 2016, brought to you by IBM. Now your host, John Furrier and Dave Vellante. Hello everyone, welcome back to Las Vegas. We're live here at IBM Interconnect 2016, day two of exclusive coverage from SiliconANGLE Media is theCUBE, our flagship program where we go out to the events and extract the signal from the noise. I'm John Furrier with my co-host, Dave Vellante. Dave, day two of three days of coverage. Day one in the books, day two, more cloud, more infrastructure, more Watson. A lot of stuff happening. What's your thoughts from day one and what's your view on day two? A lot of great people coming on theCUBE. The biggest names in tech here at IBM. What's your thoughts? Well, watching the keynotes this morning on IBM Go and it's all about the developer.  When IBM announced Bluemix and it was good concept. It was kind of a shell. And now, as I said yesterday, IBM's on that flywheel. Essentially what they're doing is they're building out a digital strategy or a strategy that allows their customers to build a digital strategy, build digital assets and take them to market and allow their customers to consume them, interact on mobile, et cetera. And what IBM is doing with Bluemix is building services in that are essentially facilitating that transformation for customers. So that's what it's all about. It's interesting. We heard a little bit yesterday from Robert LeBlanc about cheap storage and cheap compute. That's not what the cloud is to IBM. It's all about this digital transformation. So you totally different messaging, which is typical of IBM. Well, first order of business, Dave Kinney who's now running Watson from the Weather Company. He said on stage, very, as a matter of fact, very direct, he said, first order of business is developers. That is the theme, Dave, I agree. But the IBM has to follow through on this. I mean, their narrative is right on. It hangs together. I think they're taking a good approach. And I think that IBM is not behind in this. They see companies like Twitter who blew the developer opportunity. Obviously, they have a deal with Twitter, so that's probably obvious to them. They understand that- Yeah, that's not the playbook as your point though. It's not the playbook. You've got to embrace the developer community. One, two, they actually have so much experience in open source. They're on their, some will argue, multiple generations of open source DNA within the company, yet they're transforming. So you've got this open source ethos, embedded in the roots of IBM. Okay, now there's organizational challenges, but you're seeing blue mix really move faster than I thought it was. I thought it would be slower, longer than it is. They're working hard. They have to follow through on open source and do it right for this new generation. They have to make the developer top priority because, look at the bottom line, we talk to customers all the time. There's not enough people in the enterprises that actually can do the development. So anything to make the developer's life easier, the mobile developers is key. And this Lego Blocks open source build on other people's stuff is great. If you're going to build a building, you don't need to be in the concrete because it's the lay of foundation down. Watson can help there. This is their opportunity in my opinion and I hope they don't blow it. So I want to get your take on something. So we have put forth this premise. You know, we talk about this digital fabric all the time, these horizontal transports like the cloud, there's a data transport, et cetera. One of those transports that we talk about is the identity transport. So you saw today there was news, MasterCard is now accepting fingerprints and selfies, right? One of the things that we predicted and you're seeing now happen is that increasingly organizations are going to use external services to provide things like identity, the data platform, obviously that's happening with the cloud. I want to get your take on that news generally and specifically what you see happening in the business. Well, there's a complete infrastructure transformation going on with the cloud. You're seeing little things from content management systems, API, the identification is changing old stuff. Email marketing doesn't work anymore. I mean, it does work technically, but it's not the preferred user experience. So a lot of this infrastructure software and infrastructure is radically shifting to the preferred new user experience. Okay, and one of them is federated identity but not federated by anyone vendor. Open source will be a leader there. So what I see happening in the Apple back door with the terrorists MasterCard will accept selfies and fingerprints as access is an absolute new paradigm in identity and companies used to have federated identity across their systems and now are changing it. For instance, people want their own identity. We do it on CrowdChat, you can do it with OAuth, but IBM also has interesting opportunities with their own identity systems. So you can't, it's not a winner take all on identity. I think a new paradigm is coming out. You're seeing things like fingerprints, you're seeing biometrics, you're seeing selfies. There is a new way of identity and I think no one's cracked the code on that and cloud exposes the opportunity but also exposes the weakness. So in an era of social, in an era of push notifications a lot of stuff's certainly changing. Identity is a huge issue. This is absolutely directly related to security. This is the subtext of this event Dave. So at the Uber level, John, I think this is profound and here's why I say that is our industry has really only been through previous to this current one two major shifts that move from vertical integration to sort of horizontal competition. Essentially that's been in place now since the mid 90s, early 90s even. When IBM decided way back when to go forward in services that was a winning strategy. Frankly it's trivial compared to the transformation that's happening now. It's radical Dave, I mean it's so obvious but I'll give you some examples today, just today. None have to look any farther than this morning. Top news in technology industry globally today are a few stories I'll highlight if you to make my point. One, the government is putting pressure on Apple to backdoor 12 iPhones. That is a huge thing. Apple's putting that heat shield down. No, no, we're not gonna create a backdoor. Huge implications on policy security. Two, master cards accepting selfies and fingerprints from people for access to content and identity. And three, Uber driver killed five to 15 people in Michigan. All three are related to around one core issue.  That should have been using big data analytics to predict that. You have the master card identity issue. That's going to be a new form of identity. And obviously the Apple backdoor is a security issue. All revolves around cloud security identity. It's all software. And all this stuff about Watson analytics, emotions, how people feel is trivial compared to what is actually happening in the industry. So the opportunity is going to be for the big guys to do well. And startups to fill the gaps. The point I wanted to make was in terms of the industry structure. And so what's happening is, as we talked about, these horizontal platforms, these horizontal layers, if you will, whether it's cloud security, identity, the data transport are supporting what used to be vertical industry structures where the value chain of that industry was hardened in cement. That's blowing away. Why is it being blown away is because people are digitizing everything.  Yeah, I mean this is the guy from the predictive analyst. Alchemy is now part of the formula, but we've been saying on theCUBE and we continue to bang on this term, you've got to be horizontally scalable with data and now technology, whether that's open source, industry standard hardware. Okay, horizontally scalable works. But also you can develop a pre-packaged, vertically integrated apps on top of it. It's not the stovepipe of the past where here's my silo, here's my app, that's my retail app. You know, by the way, I had a different app for back end. No, the data modeling is causing a horizontal integration plus vertical integration. This creates a huge challenge, huge opportunity at the same time. And so, I mean, again, this is a trivial example, but if you look at the mini-computer business in the 80s, it died because those guys failed to respond to the trend toward disintegration. And what's going to happen now is I think you're going to see similarly some of these industries are not going to respond to the digital transformation imperative and they're going to get blown away. You know, IDC put out a number out here this morning and the keynote said one-third of the leaders are going to get disrupted. I think it's much higher than that. And so, that industry structure, the way you structure and organize an organization is table stakes, but it's vitally important. And I think that's what Ginny has been spending a lot of time on. Now, to me, John, the big challenge is the inertia of IBM's huge fragmented software business. It is a great point. The fragmented software business is something that I think is a challenge for IBM that they've got to address. Well, there's two things. You hit a nail on the head. IBM's got structural challenges in how they've organized. They've got zillion CTOs. They're working on that, right? And they're working on that. But this is not the issue. The issue is the person has to implement the solutions. The doer, the practitioner who's sitting there going, wow, I have an opportunity. I got risk in my business. I got to actually build out these horizontally scalable applications. There's no playbook. And so what has to happen right now is to mitigate the risk and take advantage of the financial opportunity. A person in the company says, hey, I got a meeting next week at off-site. I got to present the not the five-year plan, the one-year plan, how I'm going to move from point A to point B for our business, not the vendors or not the company. So all that kind of ties together because how do I implement the solution? How do I learn? Where are my peer groups? Where's the best practices? I got to buy research from Gartner. I mean, this doesn't work. I mean, this is the whole thing. The content is going to be free. The community has to come together. And the issue is on the customer side. IBM's customers are the ones that I feel in the pain. So IBM's got to move their organization in a position to be more agile, okay? And to make the demands of those folks building the next generation architecture. Well, and I think you're going to see huge demand for how do I do that? Like you said, there is no playbook, so. All right, we are day two kickoff. This is theCUBE. I'm John Furrier with Dave Vellante. We go out to the events and extract the signal from the noise. Check out cube gems. Go to Twitter and search hashtag cube gems. We are taking all the little highlights from these interviews, putting them up out on the web very fast, in real time, sharing the social content. Go to Siliconangle.tv and remember, March Madness is coming up. And of course we have the companion cube madness. Where all the guests bracket up and fight for who's going to be the most influential guest. And of course it becomes a hackathon because they all stuff the balance. So join cube madness at Siliconangle.tv. We'll be right back for day two after this short break.


All right, next is Matt from WebSense and he's going to be talking about exploit spotting. So let's just give him a hand here. Big hand. Yeah, thank you. So I'm going to talk about exploit spotting and locating vulnerabilities out of vendor patches automatically. So let me introduce you myself first because this is very relevant what I'm going to talk today. So my current employer is WebSense Incorporation and I'm performing some malware and exploit detection. And my former employer was EI Digital Security and I developed IPS security products there like five years and I dipped vendor patches regularly over there. So you will know why I had to like the vendor patches. Before I was just like software engineer there but I still had to like dip the vendor patches there. So, and also I found some vulnerabilities like MS-06, 070, RPC vulnerability or CAO server and I used just stating methods to find that kind of stuff there. And I also developed Darren Grimm, it's a binary dipping tool and it was a kind of weekend project. And at this point I want to give you a simple question here. Do you really believe that if a patch is out, every security problems will be gone. So whenever there are some GRO days out, most people talk about the patches. When the patches is out or like just like the LNK like GRO day this time, people always talk about what is that patches. So next week they will release patch or yeah that kind of stuff. But do you really believe that if they release the patch, everyone will like patch their system immediately or within a day or two days? My answer is no actually. So let's look at comfical one. It was like spread like 2008 or 2009 and actually it used a vulnerability like patched at least a few months ago. So even though the patch was out, most, a lot of people didn't patch for some reason. The comfical one like infected more than 8 million computers over the world. And how about the driver exploits? They only include, they usually include one day exploits, the exploits that has patches. But there are some GRO days but they are very rare. And how about the meta-sploit and core impact and canvas? The exploit frameworks usually not about the GRO days. They are about the exploits for the like vulnerabilities that has patches usually. Or they gather the information from POC code actually. So let's talk about exploits and security products. By exploits I'm talking about the POC and exploit packs and drive by exploits and exploit frameworks like meta-sploit, canvas and core impact. Exploit frameworks are also security products for testing.  You remember, anyone remember retina? Yeah? Yeah, a few of them, a lot, yeah actually, from EI actually. So retina or yeah, that kind of stuff. And basically what security industry is doing is creating signatures for vulnerabilities. So they have matching signatures for each matching vulnerabilities. So even vulnerability scanner has their own signatures for every matching like a CV number or something. So what exploits are doing these days are like using obfuscation to evade all the signature systems like IDS or IPS. And like if you look at some JavaScript exploits you will see some like a random bite there. You will never see the direct, the explicit exploit there. So this is all about the evading the security product. So I mean if you find some vulnerability that has been patched but is not known to the security vendors then it might be very serious concern because many systems doesn't patch for some reason and the exploits try to evade the like IDS and IPS system but if they find the attackers find the one they exploit they can still like exploit the system like by evading the IPS and IDS. For example if there are some product system like selling some stuff like if they are running some IIS and they have like a lot of traffic there if they like need to if they recycle the machine I heard that it takes more than 20 minutes. I'm not so sure why it takes more than 20 minutes but it's a lot of loss for them so they will not turn off the machine every month. So they will do that like every three months or six months and there are some time frame the attackers can like use one they exploit to like own the machine. So you might wonder there are like a real example that has been a problem passed in the past so I gathered some like examples here like for someone is MS07004 it was a VML issue and the patches were out but nobody wrote any exploits about that because they didn't have any information about that like of all our reality. The vendor just released the patch and they just released advisory saying we like patch is something wrong inside the VML module or something like that and that was it. But a guy from like Korea actually he's my friend and he used my tool to like reverse the patch and wrote the exploit in a few hours. And the second example is MS08067. Actually this one was used for config around actually. So his name is Steve Ridley. Actually he used my tool he also used my tool to like diff the patches and create the exploit like in a few hours. You can look up the blog here and you can read the whole story. And the next one is very interesting one like MS10024 and this is a kind of undisclosed vulnerability from Microsoft and they were releasing patches for other vulnerability and they included some undisclosed like vulnerability patches inside it. And actually it was caught by core security lab here. So yeah it's a little bit like embarrassing. So you can know that why binary dipping matter here. So the first you can use binary dipping to create exploit like if you have POC you can just use that like to put your own shell code or like make it more reliable. So you can use that as a template for your exploit. But if you don't have any POC code then in that case you need to figure it out yourself. Maybe you can get some information from the vendors but I don't believe any vendors will like release any like a technical information to like any exploit writers. So the only way I think is using binary dipping. And maybe people start to look into like a binary dipping. Maybe the meta-sploit arsenal will increase by far now maybe I'm not so sure. But the other use for like a binary dipping is actually generating signatures. So with the same technology you can create exploits or you can create defense mechanism or something like that. So IPS and vulnerability scanner or even AV uses like signatures for like detect the binaries, the attacking binaries or attacking websites or like exploit. So if there is any POC they can use that POC for their like signature template or something. But if there are no POC then where will they get the information? Only vendors. So there are some vendors actually provide that like actual technical information. Like Microsoft they have a program called MAPP. You can just call it like a map. So how many people heard about map here? Yeah looks like not many. Yeah it's always like not many. Under 10 people. So looks like it's not that popular now. But it was launched I remember like two years ago at Blackhead. So it's been two years and they provide real like a real technical information to the like a security vendors like maybe yeah our company also get that information and all the like any security vendors that are like willing to get some information they can just contact MAP like a coordinator and they can like get sign some document maybe and they can get the information every like a patch Tuesday or whenever there are some zero days are out they can get the information. They send it through the mail and you can get the information like very quickly. But if you don't have that kind of luck to have map then patch on once is the only way and there are other problems like even though you have the map they still doesn't disclose the information fully. They still hide some information and like they only write just one vulnerability in their report but actually if you deep the binary you can catch that they like included like more than four or five other maybe sometimes like one or two vulnerabilities in their patches. The one example was that one that I showed like MS 10 024 that one that one was caught by Colette. So let's talk about the binary dipping tool itself. There are some limitations with the current binary dipping tools like a bean diff or other like patch diff too and there are also turbo diff and dark green and that is my tool and there are like a four major dipping tools out there and but there are some limitations and there are two of them I just wrote here and one is like a managing fires is very like a boring job. So if the Microsoft release a patch like they include like so for example 12 patches then there are like because they like release patches for every OS is or something like that then it will include like maybe 40 or 50 different binaries and you need to manage all the binaries and you need to find the old binaries for that matching binary. So it's kind of very time-consuming and boring. So sometimes it takes more time to find that old binary or something like that so it's very time-consuming. So the other problem is that how do we know which function has security updates not like a feature updates. So sometimes they include just feature updates or yeah something like that. I will talk about this later. So I wrote upgrade the dark green and each dark green three now it has web interface and it's a very user friendly and it has a bin collector it manages all the files for you and it has a security implication score that shows what function has more security implication inside this. So you can know what function has more probability of having some security related patches inside it. So the security implication score itself is based on signatures. So there are some patterns like appearing like in the security patches. And there are some noises like it's for like eliminating some like noises caused by like a feature updates like they didn't patch it. They didn't like didn't patch any security related problems but they did like just upgrade some functionality or something and that kind of thing or they can do some kind of code refactoring and or they just change it the optimization level and they will that will create a lot of false positives also the disassembler is not like a disassembling itself is not like a deterministic problem so there can be a lot of problems in like recognizing some code parts or data parts and it makes a lot of false positives and as I said security implication score is a signature based scoring system so something like a string length you can use string length to like patch some kind of what is that the stagger flow so you should use string length to fix that kind of problem so it will it should appear in the patched part so how about the safe string API so something like Microsoft SDL like they recommend using like a new API new like a new safe string related API so in that case they should use a safe string API to fix the old problem so you will find that like a safe string API from the patched part so you can use that for like signatures for locating security related patches or about some like a constant numbers some big numbers maybe to fix some integer of loss so this code is written in Python and it's in Python so you can just rewrite a part if you have your own logic so you can just rewrite the part and you can test it yourself so the actual question will be is it working or not so I have a example I have an example here like acroald32.dll from adobe and they patched they released 933 recently a few months ago and I did 933 with 932 and it created like a 3, 3,630 entries like a modified functions so it's almost impossible to go through every functions to find these security patches so if you use SIS the security implications score here then if the entries with number 0 the score 0 is only 992 and the score more than 1 was only 70 so you can like save a lot of time and effort here so I will show you how the how the 3 looks like so this is the main page actually I'm running some background like a web server just like a web server to like run some their own process or something like that so I just use a web like what is that there is cherry pie I just use the cherry pie Python module to run the web server and you just connect to like a local host and you can like a designate like any port you like using like a configuration file so in this case it's 80 so you just connect to like a local host like this and each adjusts main menu and it only has four menus here and if you click here yeah files import and there are some input box here so here you don't have any files yet right so you need to like import all the files from like a remote machine or your local machine so if you want to collect some because I'm running Windows XP right now if you want to like collect all the windows XP system files you just put like a C windows here or maybe you can use to see program files anything like that then it will collect like a copy all the files to your like a library so you probably need a lot of hard disk like 20 or 30 gigs like storage space for that and or maybe you can set up some virtual machine and you just install something there and you can just like share some directory there and something like this or you can just import all the files from the remote machine and in that way you can collect all the files and binaries from other machines or for like other operating systems so it takes some time like 20 or 30 minutes and after that if you click files list the system will parse all the information from the like binaries and version from the files of version information and you deal like a sort all the files like according to their company names and like a file names and everything like that so here's the all the company names that are installing the like binaries on my system so probably you might be interested in Microsoft cooperation so click here and it will show every file from Microsoft cooperation so I used to example from like an API 32 this is kind of RPCDL that is exposed through the pipe so it has some history of a lot of vulnerabilities found like from like a five years ago or six years ago so we are interested in that file so we just find the file here and you go there and actually it will show every file that has that name that has that name so here you have all the file that API 32.dll with that name with different versions so you can see so maybe you can just want to put the latest one with the previous one like a 5.2 2600 and 5694 with the previous version like 3462 you just click it like a left one here is the previous file and this one is the like a patched file so you just click start dipping here it takes some time like five minutes or something because it will launch IDA you need actually IDA like IDA I used IDA 5.6 so probably if you are like a reverse engineer and guy you probably have IDA so you can use IDA and either locate the IDA and either launch the IDA and generate all the information and gather all the information for you so after that the result it will take five minutes so I just created some examples here so in this case it is one of the examples so after that it will like generate some table like this so you can see there were only two patched functions and you see that there are security implications score here three and two and probably three is bigger so probably this function has some patches inside it so if you click it then it will show some tables like this so from the table the left side actually left side empty right so actually the start is here so left side is unpatched file and right side is patched file so it means that the first the red block it means that the red block has been inserted to new the patch so it means that they can you see this like actually it's calling WCS LAN here I'm not so sure you guys can see this it's WCS LAN here so actually the patch is patching the vulnerability using like a calling WCS LAN so you can actually see what the actual programmer did to fix that vulnerability so it had like a stag of flow and they fixed it by just calling WCS LAN from the start of the function so this is some table view here so this is left side if something happens in left side it means that they removed that code block and something happens on right side it means that they inserted new blocks there so you just need to like look into red block or like there are also yellow blocks but there are no yellow blocks here so yellow block means the block has been modified so maybe I can find some example here yeah there are some yellow blocks here so in this case it changes some logic here so it's recognized as a kind of red block so anyway so you can click open IDA menu here so you can actually use IDA to see the diff result so in that case this is the old binary for same function so it's a net P managed IPC connect here right and if you see the graph overview it doesn't have many things here and there are some red blocks here so it looks like they removed this block from the unpatched binary so it shows two IDA the next one is patched binary so you can see that they inserted new blocks here and because it's showing the red block here right so it means that they inserted new blocks like this one and this one and just three and the first one contains that code like WCS LAN so actually you can use IDA to perform the actual analysis because it's more comfortable to the reverse engineers so this is the demo so let me show you some signature examples here so I just talked about the signatures right so it's all about the signatures so what kind of signature are you talking about I just talked about string lengths or some constant number like a 0x, FFF something like that but beyond that what kind of signature can you use so this one is MS06070 and you can see that the vulnerability is in here SW printf here right side SW printf is accepting some data from ARG0 and actually this function is exposed to through RPC interface so the user can control ARG0 and it can just direct straight forward stego flow in that case this is the example that I just showed an IP manage RPC connect and just as you see it's using WCS LAN to fix the problem and you can know that you can use a string length or WCS LAN or that kind of string length check as a like what is that signature for both overflow so what about the other like a stego flow like MS08 067 this was used for config column right so it has three entries here and the first one has a security implication score 20 and you see that I'm not so sure you can see that but this is a string cch copy W API this is a new API introduced by Microsoft so it's a safe string like API or something like that so whenever they like a Microsoft patches any string related problems they are going to use these new secure APIs and we can use that as a kind of pattern to locate the security patches and this is integer overflow from MS10 030 and it is the problem inside the Microsoft Outlook client and if you use like a what like a what like a darn green you can see that I sorted by security implication score here and you can see that the first entry is like a response start method from CPAP transport looks like it's processing some response from PAP3 server so if you look into that you can see very interesting like a call inside it actually I'm not so sure you can see this each API you long long to you long so each API that converts 64 bit integer to 32 bit integer so you might wonder the original problem was integer overflow and they are using 64 bit to 32 bit conversion API to fix what is that integer overflow so you might wonder why it is working so before that if you track the input for the conversion it's coming from actually string to INT API and the buffer for like STL to INT API is coming from like PAP3 response like a header like response line so it's like attack control over if the attacker is running some fake like a PAP3 server and like what is that hijacking some like wireless traffic or something like that then maybe the attacker can control the user's machine own the user's machine so you might wonder why the Microsoft engineer used you long long to you long function to fix integer overflow not just comparing some like integers that's it was because it is recommended by STL like you long long to you long API is actually converting 64 bit integer to 32 bit but it fails if the original 64 bit value is greater than maximum 32 bit value so any value that is greater than 32 bit maximum value will not be converted it will just return error so they are fixing the problem just calling this API they don't need to like use like comparing the integers or something like that they just need to use this API so whenever they fix integer flow then they will use probably use this API because it's recommended in their guideline so maybe you can just use this as a kind of signature to like find any kind of integer flow from like a Microsoft so you might wonder from the list of the functions that has been modified that patch they only talked about like one or two like CPAP 3N iMap but it actually shows a lot of like meaningful entries here so you might wonder they might be hiding something here so I just dig into more and looks like the other method the next one like a C iMap 4 agent here resize message sequence number table is fixing same problem it's calling the old one was just calling the memory allocation routine but the patched one was calling you long long to you long just as they fixed the other integer flow so it looks like whenever they find some integer flow from their module they are fixing same kind of problem from other code parts so that is now related to each other but looks like the programmer actual programmer that is responsible for that code just learned that kind of technique or that he might not know about integer flow before and somebody reported and somebody like from the security team maybe they talked about it and he's educated maybe and he fixed the other problems with other parts of the code that has same problems so he fixed the code in other parts with the same method he's calling you long long to you long to fix some integer flow here so this is very interesting problem bug because it's very hard to exploit so looks like the server the fake IMAP server should return like more than like a few like one gigabytes of data to maybe a few gigabytes of data to the client so it's not likely to be exploitable but it's still like a security problem so looks like they fixed it for their reason but looks like they don't talk about it so they just fix it but they just don't talk about it so and let's see next example so next example is about the use after free bug usually this is very popular in the internal explorer these days and I found that I did patch for CV 2010 0249 and I found that they are using a lot of code to replace PTR so it's a small here but actually the red box there is containing some replaced PTR code there so this is also that pattern happens a lot in the code so left side the left side is the original code and right side is the patched code so they are calling replace PTR so this is the reference cross reference from like unpatched code and replace PTR is called only from six places but from the patched code they are calling a lot of replace PTR so looks like they are all related to some kind of event processing so I looked into replace PTR function so looks like it's just about replacing pointer so the name tells everything so it's just about like a replacing pointer and looks like the old code was like now replacing the pointer for some reason and it made like some problem like use after free because the invalid pointer was still there and it was not replaced for some reason and it was causing the kind of use after free so maybe you can use replace PTR string as a kind of signature for like a future same if someone just finds the same bug maybe they will use same like replace PTR to fix that kind of problem so maybe you can use that API as a kind of signature for like that problem and there are other things I found like the original one it's a method inside the C markup and it destroys plate tree or something like that and actually the original one and looks like the name implies that it's destroying some like a memory structure or something right so the original one was just calling man free so it just destroyed the memory whenever it's called but the patched one is calling C tree node release method and if you look into that method if you can read this disassembly then you can know that it's doing some kind of reference count check so it's decreasing the reference count and if the reference count is not zero they just return and looks like somebody is still using me or something like that so it will not free the memory so when the reference count reaches zero then it will free the memory so looks like as I told maybe you can use replace PTR or man free or other patterns for like use after free bug so let's talk about another use after free bug actually this is the number is a CV 2010 0806 and actually this vulnerability was used for like attacking Google so it was like a few months like almost six or seven months ago and the if you look into maybe some of you already look into this exploit code so it's from the wildlife like exploit code I just guess take house some very important part and if you look into that it's adding some behavior here the default user data this is very important keyword here it's adding some behavior called default user data if you look up MSDN it will show every like behavior that is available for Internet Explorer so this is one of them so the attack only meant for this behavior so you must use this string here so and it's setting attribute and this is the key the ass is the key here and window is the value and in place of window here it's meant to use some string here so you are like setting some attribute using some string but in this case the attacker was setting attribute using some object and it's a very serious problem here because let's see this first if I deep the patch you can see that they patched two methods here and both of them has same patterns inside and they are the pattern is like this one they are some change inside a variant to change type EX call and the original one the variant to change type EX takes a first and second argument and first one is destination and second one is source so they are just changing the type of variant object variant type variable from source to destination and they are using same one and it will destroy the original like data and it will cause what is that the user and they are fixing it by just using different argument for destination so they are just allocating some local variable and they are using it for like destination for variant to change type EX so this is a very good example because I never know I never knew about this variant to change type EX issue before I deep this patch so you can actually learn something from the patch because now I know the variant to change type EX can cause some kind of memory corruption error so maybe if I do some kind of other like code auditing or something like that then you can use this knowledge for like that kind of stuff so in this case there are very interesting stuff here like because there is not only one exploit out there but they patched two methods so what does it mean? It means that they patched something silently without letting people know so I tracked down the one method they patched was C process to user data which probably linked to related to that what is that default to user data behavior but the other one was C process to use the data peer and I traced back where that like classes used and actually it was used by default to save the history and default to save a snapshot behavior so I could create some other exploit using that knowledge just in like a few hours because I need to figure out how to use that behavior I grabbed some examples from the internet and I just changed it to use some set attribute for like a document or window object something not string so it was like a very easy create new exploit so I think no IPS or ideas have that patterns inside them so somebody is very like malicious intent then they can just create some kind of exploit and they can evade the IPS because they don't have the patterns inside them so this is some kind but this was patched like almost half a year ago so I think it's okay or something like that so in this point there are something to think about so probably MS could just release that information like we also have like a default to save history and we also have some problems inside the default to save snapshot and also as I showed like we also have some problems inside the IMAP client and it will overflow if the attacker returns a lot of entries they could just write about that in the first place but looks like they didn't do that so even though they are trying to provide some programs called like a map MAPP looks like they are missing some information for some reason maybe intentionally or by mistake or something like that so it looks like it's not a good like good behavior like from like because like what is that the security vendors should default the binaries themselves even though they have MAPP they can't trust MAPP because MAPP doesn't include some valuable information for some times so I showed the first one was caught by Core Impact a few months ago and I showed two examples here from Microsoft I only showed two but I might find more if you look into more like patches so it's a kind of just problems for security vendors not having the full information so let's talk about other things so this is about exploit spotting so there are some other problems like even though you have deep entries so exploit writing might be very hard because something like Adobe Acrobat I did test with some Adobe Acrobat patches and just I said it will create generate a lot of patches to list or something like that I used like a cool type example here and it created like a more than 20 or 30 entries so actually they said they patched just one like one vulnerability like CV 2010-2024 and I used some public exploits out there and I pinpointed the exact function that was patching that problem so it is this entry here the red box here this one is actually that one CV 2010-2024 then how about the others like looks like they fixed a lot of problems the other problems here so looks like they might have found similar problems in other codes and looks like they patched it so with the original exploit code from the exploit DB you never hit the other functions so how can you hit other functions and how can you make an exploit for them even though you don't know anything about cool type so I used this method called the mini code coverage test so I just let me show you so here's the method I just Google random PDF document from the like all the places from the internet and like I make some library of the PDFs like more than 10,000 or something like that and you execute Adobe Acroba reader with some break points inside it like from this deep to least you just need to like from I used the unpatched one so you just need to look into one, two, three, five, six, eight points so you need to break point eight points of the cool type.dll to see if the sample is hitting the point to see if it's using any kind of cool type related code there so you just put like eight points of break point to Adobe Acroba and you just run the like something like a forging test you just execute acroba for every files and you if you hit any break point there it means that the PDF document contains some template that you can use for your like a testing so actually I didn't use debugger but I just used assigned some debugger as a kind of GT debugger and I just replaced some bytes inside the cool type.dll to like bring up debugger so I just put 0xCC some the exact point like eight points I find that and just do that and it's very fast or something like that and after that like if you run something and you can collect all the like a PDF samples that is related to that one day exploit so and after that usually the PDF documents are like a compressed you can use a PDF TK tool to decompress the PDF documents and you can actually see the actual the memory they showing up in the what is that the debugger is appearing inside the actual PDF document so you can just find that actual byte from the PDF template and you just modify that template and you can trigger the crash condition or that kind of thing so this is very easy to achieve or something like that so within a few hours by diffing the binary and collecting some PDF documents and using the mini coverage method that I suggest you can create some real like a one day exploit template or something like that within a few hours so I found that what I tested is all about the out of bounds memory access so I'm not so sure it's exploitable or not but maybe you can just use this method to like achieve other one day exploit writing so this the mini coverage test was attempt to use dynamic method for binary diffing so how about state analysis how about you can you use state data analysis or something like that for like binary diffing so I was trying to write some tools to do that like tracing all the variables back to and see if it is like a tangible or not looks like it is very hard job looks like there are some issues like C++ issues if the code is using C++ it is very hard to trace back all the variables and there are also if the binary is very big usually it generates incomplete disassembly list so I was just trying to make some attempt to write some state analysis tool and it was called I.Tracker but looks like it's now releaseable right now but I'm still working on that kind of code and maybe sometime it will be combined to like binary diffing tool and yeah it looks like in few months maybe I'm not so sure so I did some attempt but looks like it's not working very well so conclusions here binary diffing can benefit IPS rule writers or AV rule writers anyone like that or also it can benefit some exploiting writers like if you are interested in like writing some exploiting modules or something like that maybe you must start with binary diffing so in that way you can find something nobody ever like a found so and there are some typical patterns inside patches so you can use that for like to benefit binary diffing itself and it is called the security implication score in Darren Green 3 and it helps a lot and you can use dynamic analysis or stating method for binary diffing and looks like dynamic analysis is very helpful in like writing some one day exploits and any questions looks like I'm not sure so looks like we have clinic room over there so anyone have any questions come to the room and ask you questions to me thank you


St. David's School is a inner-city school. It's located in the Donovan area of Sudbury. In general, and this is a big generalization, our children come from families that potentially have had struggles in their life. No question. So that being said, our children are as bright and beautiful as any other children in any other school. We really believe in instilling a sense of identity and pride in who you are. So our hope is that, number one, you will love school. When you leave the building, you will go on to great things, and that doesn't necessarily mean educationally. It doesn't mean that you're going to go to university, but it means that you're going to be a good person. It means that you're going to treat people respectfully. It means that you're going to be a good parent to the next generation. Potentially, you could go to university. Doctors, lawyers, that's what we want to see, but it doesn't mean that everyone's going to fit into that mold. Our building is filled with amazing children of all different backgrounds, but we do have a high population of First Nation, Métis, and Inuit students. Primarily, we have First Nations students in our building, so we do have a true responsibility to be responsive to their needs and to complement the math and literacy curriculum with the cultural supports and a better understanding of our students and their families. What happens here doesn't happen anywhere else. The care and the focus into recognizing the value of Indigenous teachings here. This is what gives our young people hope, their identity. It's very important that our young people have their identity and that they can appreciate their identity. All that previous curriculums have embedded into young people that there's no hope. It's important for them to see their path through the future, but the only way they'll see that is to see the footsteps that have come behind them. It's very, very important. Everyone, Indigenous, non-Indigenous students, teachers within this building are committed to that holistic view of that lifelong learning, that we have them here for a short bit of time, but while they are here, they will be taken care of in mind, body and spirit. And everything that happens in the school, whether it be academic, whether it be the extracurricular activities, it is 100% dedicated to that mindset. So that's a really important piece, I think, is the importance of that holistic approach, the importance of identity and culture that everyone sees themselves within this learning environment. So those are some really precious things. For myself, as an Indigenous person, I came through the same school board as a child from JK all the way up. And when I went to my elementary school, I didn't see these posters up on the wall. I didn't see Anishinaabe people in the system. So I was lost for a long time, and I didn't see it until I went to Laurentian University. And that's when I started learning about my people and understanding myself. So for them to see it as a young age, you walk with your head a bit higher.  And when you have it in your home, when you walk around, it changes you, you know? You can be yourself. You can... Ah, yes I am. I'm here. Back when they were developing the school, it was recognizing the importance of letting architects who have been conditioned to build boxes know that this is not a building. This is a space for human beings to be human. And it needs to be understood that it's not your typical building. And because of where it's located, that's what was exciting so many people, but myself personally was knowing that my children would be in a building this close to nature. Because most of the summer, we would be spending that time outside. And then to have them come to a school that had no access to the outside would be stifling of them being humans. And that's that message that indigenous knowledge is actually human knowledge. And if we look to all cultures and all spiritualalities and traditions that we will see those human teachings. And education is one of those places where more of those human teachings need to be infused and more of the spaces need to be more conducive to that human way of learning and engaging. Our school is a brand new school to the neighborhood. We used to be farther down the street and it was all surrounded in concrete. When we first moved here, when people would come and ask the kids what's the difference about the school, all they would talk about is the grass and the trees. They didn't care about the inside of the school, they didn't care about the new gym. It was evident that they hadn't been surrounded by nature before. They were really proud of that. They're proud of our brook. They're proud of how much time we spend on the trails. They're proud of the outdoor classroom. And just to spend time in those spaces is important to them, so it makes it important to us. We're privileged in that the leadership in our building really enables us to do that work. But it's like I wouldn't even have started thinking about this if it wasn't for our principal and vice principal and other people in our building. I'm terrified of snakes. I don't like bugs. I'm not particularly an outside lover. But it was like kindergarten is doing these great things and they're going outside and the kids love to be there and our vice principal and one of our ECEs is going to this really cool workshop. Do you want to come? And the next thing I know, I'm like, sure, I'll take my kids outside every Wednesday all year long. This is great. Lots of animal tracking this year, which is funny because I didn't come out with a plan that we were going to really focus on one thing or the next about my kids. Just they love tracking. They love identifying plants and medicines. They love building shelters, so it's a completely different way of thinking. So instead of me going out there necessarily and thinking, okay, we're going to cover curriculum expectations 3.2, that's not necessarily what happens. So it's like they do what they kind of want to do and I guide them in that. Like sometimes I have a bigger idea of what sort of where we're going but it's sort of doing it backwards. Then I go and look and see what it connects to and then try to fill in the gaps. When we look at curriculum, we are pushing for that inquiry-based approach where there's that shared leadership for learning. And so yet there are some challenges around that because as a teacher, often we do have that type A personality of wanting to make sure that we're controlling that environment in a very prescribed way because that's the way our curriculum is set up. As a teacher, you have a role and your role is to ensure that you're providing opportunity for students to lead the learning. Then the learning becomes that, it becomes a collective knowledge and taking that approach, that's what we're talking about when we're talking about Indigenous education. When you walk through these doors, you're going to hear laughter and you're going to hear laughter from 8 a.m. to 4 p.m. because it's the culture that everyone has helped cultivate in the school. There's a lot of things that are sad working here but those kids are the best. They're the best kids in the world. They're so funny and resilient and they just want to learn and to have kids that are so grateful and love school. Like that's our goal here. I care about curriculum but my number one goal is for you to feel safe for you to feel loved and for you to love school. Like that's my biggest goal over everything and I think that's why the people that work here do such a good job because we put kids first and I think the joy of working in this building is that for sure. When we talk about protocols and bringing in elders and the Indigenous knowledge it's a co-guided learning. So there's an openness that is present within this building. When we consider what that looks like when an elder comes into the classroom the teacher is sort of that guide on the side. Indigenous education really is about a collective. It is not one person that is necessarily an expert. Any elder or knowledge keeper will tell you that. I always get asked about the Catholic Board and I've gotten a lot of flack from our community about working in the Catholic Board. What am I doing here? And the main reason is First Nations spirituality. When you talk about the medicine wheel you can't talk about the medicine wheel without a focus on spirituality because again everything, our language, everything that we did connected to spirit and the earth. And everything was about the children. So it's really hard to teach about our culture when you're not talking about that spiritual part. And then of course we've got kids in this building. When you do work for that Catholic School Board look man, we've got a lot of kids in this building that are First Nations. And those kids need support. And they don't get the teachings and I bring it in. And again I can freely and openly talk about anything I want. That spiritual part is such a big deal man. For me, for students, for our people. So there's more freedom for me to do that, which I like. I've had the opportunity to have a number of teachers who were too scared to identify. But because of the teachings in the classroom doing the teachings with the children, they came out and they identified after me. And that was very powerful when that started to happen because all their lies they were probably told they would never say those things. Never to admit that. And to come out after having the teachings and realize it. Hey I should be proud of William. This is a home, not just for our students but it's a home for the parents. And all those community partners that want to come in here and help us educate these children. It takes a village to educate our children in a good way. And that saying is lost these days because that's what this place is. The village raising our kids, not just a teacher in a classroom. It's the EAs, it's the ISWs, it's the elders, it's the better beginnings, the after school program. We're all this community that teaches and educates and raises our children here. And that's what makes this such a great place to work. It's not just a closed door place like a lot of schools are. Now is the time. For hundreds of years we had to keep it secret, we had to keep it safe. But when that white buffalo returned to Turtle Island in 97 that was the time that that door kind of closed and the next fire was lit. Now is the time that we're supposed to be sharing these teachings with the rest of humanity. It doesn't matter what color you are. This Anishinaabic teachings that we learn and that I teach those are human being teachings. They're not for just one part of the medicine mill. They're for all races of mankind. And we've gotten so far away from that beautiful holistic circular thinking that that medicine mill teaches us. That's what we need right now. Like society needs to get out of their hierarchical short-term narrow-minded thinking and get back to that seven-generational circular way of thinking. For many years in Canada quality education was judged in a Western philosophy. So it was your math, your literacy, but it was not in nature. It was not in the world we live in. It was in textbooks. It was theories. It was formulas. And I think today we're at a different place where we are as a country recognizing that Indigenous knowledge is of equal value. I left school learning that I contributed nothing at all to Canada. You know, I left school learning through those books that my goodness, it was a good thing somebody came and discovered us, you know?  And St. David's School has one school that shares the culture, it shares the gifts, it shares the contributions that our Indigenous community has put forward that we do have a presence in Canada on this land.