All right, welcome everybody. This is debugging Android devices in the field. I wanted to start off and say that there's going to be lots of helpful links and things throughout the slideshow. So I've included a quick URL and QR code that can take you to the actual presentation. And you can access all the links there. So give a few seconds to anyone that wants to get a quick picture of that or scan the QR code. Cool. So a little bit about myself. My name is Chris Hayes. I've been working at MemFault most recently. And for the past nine years, I worked at Square on basically everything Android. I started out in just generic app development, working on their point of sale apps, doing UI tests, feature development, things of that nature, and then quickly went into working more so on their build systems, where I optimized their Gradle builds and also worked on transitioning from Buc to Bazel.  And now I am working for MemFault as one of their Android solutions engineers, working on their SDK and helping customers integrate and add new features to their device observability. MemFault is a global company. We have offices in San Francisco, Boston, and Berlin. Myself, I actually live in Colorado and work full-time remote there. So today, we're going to do a diagnostic overview of the latest tools in AOSP. And we're going to go through basically three different areas. We're going to look at logging infrastructure within Android, then the diagnostic tools available to augment and make it easier to understand what's going on with those devices. And then finally, we're going to talk about how you can remotely observe your devices in the field. So to get started, we're just going to start with the basics and talk about Logcat and the NK message. So Logcat is a very straightforward logging infrastructure. It's mainly aimed at the Android runtime and has five different buffers that you can access for the main system, crash, radio, and event logs. If you've done Android app development, you're probably very familiar with Logcat already. It's one of the first things you basically learn. If you're just getting into AOSP development, then you have access also to the kernel logs, which are found at slash proc slash K message device. And you can also use D message to actually read those logs at the command line of the Android device that you have. D message provides a lot of colored output and filtering options to really make it easier to understand what's happening with the device. So a lot of people are familiar with Jake Warden's Pidcat tool for colorizing Android Logcat logs. But I found with working on AOSP, LNAV to be a much better tool to use. So LNAV is a generic log navigator binary that you can use on the CLI. It supports log interpolation. So you can actually combine both the Logcat logs and the kernel logs into a single view and see what's happening with the system as a whole and have the timestamps interleaved with each other. So you don't have to keep jumping back and forth between kernel and Logcat logs. When I was working at Square, we actually had a product that was two discrete Android devices. So that meant that there were actually four sets of logs. And so what I ended up doing there was I wrote a script to prepend the different device IDs to each log line and then was able to not only see the Logcat kernel logs from a specific device, but from both devices interleaved with each other to see how they were communicating back and forth. This made it super easy to understand when there were network communication errors between the two devices or understanding state that was being relayed from one device to the other. It also supports syntax highlighting and custom projects highlighting. So if you have some sort of specific message that you're looking for, if you're debugging some issue, maybe in the runtime, you can easily create a regex to look for that. And then when you're scrolling through the logs, it'll be nice and highlighted. And then finally, it does also do pretty print of structured data for you. Now, one thing I want to mention is that out of the box, it actually does not support Android Logcat logs. But at the base of the slide, you'll see that there's a link to my GitHub repo where I've provided a custom Android Logcat schema that you can install to Elnav to make it work correctly. So next, we're going to talk about the different types of crash data that you can get from a device. So tombstones are basically very detailed crash reports that you have access to. They're generally logged to slash data slash tombstone. And they will give you all of the stack traces, a memory map, open files, et cetera, of the application that crashed. Next, we have kernel panics. So a fatal exception happening in the Linux kernel. If you're already familiar with Linux, then this is pretty straightforward to you. You can, it often leaves a tombstone file. So you can use that information to understand what caused that actual kernel panic. Now, there's also kernel and RAM oopsies. They're generally serious exceptions, but they're not always fatal. If they do end up being fatal, they're usually followed by a kernel panic. So you get both sets of information in that case. Now, further up into the Android runtime, you have ANRs or application not responding. This is any time that your application blocks the main thread. And the reason that this is important is because if you're blocking the main thread, the Android runtime is unable to actually accept user input. And therefore, your user believes that your device is frozen and not responding. So generally, this is because you're doing either network or file IO on that main thread. And all that work should be moved to a background thread. Next, we have WTFs, or what terrible failures, according to the AOSP documentation. But I think we all really know what they stand for. These are used for situations where something really shouldn't be possible and will show in the logcat the WTF verbosity level. They can be fatal. They don't necessarily, they're not always, though. There are several instances where AOSP has put WTFs into their code bases, and they can be ignored at times, or they can be actually indicative of a real problem. Java exceptions, again, pretty straightforward. You'll get a stack trace of the exception, and you can basically step through each of the, the different frames of that stack to understand what was happening. Finally, there are SCLinux policy violations. SCLinux defines the permissions to processes, applications, files, and other resources. And it's one of the mechanisms that Android uses to create a secure runtime environment. So in user debug and engineering builds of AOSP, SCLinux is generally set to permissive, so it will only log the denial, but it'll still allow usage of that resource. Then when you're in a user build, it's defaulted to being enforced, in which case that can trigger a crash if your application is not expecting that denial. So it's generally a good idea to actually keep track of those denials when you're doing your development phase and address them when you see them. So from there, we have different ways of getting that information from the device. So first is the Android debug bridge. This allows you to connect to your device over USB or the network and run commands, pull logs, install apps, reboot the device, and push and pull files. There's a lot more than it can do, but those are generally the most common things that you can use it for. And it's just a very powerful tool with interacting with the device. Next, we have bug reports. These are generally huge dumps of information. Bug reports trigger dumpsys, which iterates through every single running service on the device and calls its dumpsys handler, or the dump handler, excuse me, and will give you a wealth of information for every service running. It can be from network usage to the state of the Wi-Fi, cellular chips, any custom state within your services. It really has everything in it. The caveat here is since it is grabbing so much information, it's very taxing on the system and can cause the device to appear frozen or just very unresponsive in general.  There are usually other ways to also have a user trigger it from the settings application of your device if you're using more stock Android, or there's callbacks that if you're writing your own settings applications and things like that that you can use to trigger that bug report. And then next is Dropbox Manager. This is basically the API that you can use to grab a lot of the different types of crash reports we just talked about. And it allows you to retrieve those files and either store them to maybe external disk or maybe send them to a remote backend. So as we transition more into the diagnostics, one of the next things that we have is battery stats and battery historian. Battery stats collects very detailed information about anything that is drawing power on the device and will log things like wake locks, file IO, network usage, Bluetooth state, wifi state, cellular, all of those different things that can be very taxing to the battery and pulling a lot of power. And then battery historian is a web app that Google provides that you can run locally on your laptop. And it consumes a bug report and gives you extremely detailed graphs and timelines of that bug report to help you understand what things are actually happening at that time of maybe a high power spike. So next we have performance monitoring or tracing and monitoring. Perfetto is a tool that Google provides that does recorded traces of the device under test. It captures high frequency F trace data, scheduling, task switching, CPU frequency and honestly so much more. There is just a wealth of information that Perfetto can capture and it can actually be pretty overwhelming the first time you start using it. So generally what I tell people is make sure that you have a well-defined issue that you're trying to understand, find it in the timeline first and then start exploring the data from there because you can very easily get lost in the amount of information that it provides. And then in terms of doing some monitoring, a colleague of mine at Square, Pierre Eves wrote a library called Leakinary that you can include in your Android apps which will detect memory leaks in the Java application or service. It has a built-in heap analyzer as well as it allows for uploading those heap analysis to third-party services. So what is a common problem with the existing tools and information? They're basically all great if you have the device right in front of you. It's if the device is in the field you still need a way to get that information back to yourself for analysis. And so this is an area where Memphal can step in and help. Kind of a quick overview is this is your general release cycle, if you say, where you start at basically the design phase. You start writing your code, test and then you do your release, your actual deploy to a device. You then observe it, analyze the data and then provide feedback to your design and engineering teams. So our goal is that after you integrate one time the board SDK, then the next release cycle, you'll get a lot of this information back to your engineers for basically improving the stability of your devices. We focus on the right-hand side of this cycle. So doing the release process, doing actual OTI updates and then device and fleet monitoring as well as analysis of that data. Just want to give a quick overview of the Memphal SDK for Android. The heart of it is the Memphal's board app. It connects and communicates with the Memphal update agent for facilitating and scheduling OTA updates which can be either full updates or differential updates. And then it also connects to the Memphal usage reporter app which collects all the different types of log files and crashes that we talked about earlier. It also has the capability of triggering bug reports if needed, but again, as I said before, it's not something that you want to be doing on a regular basis. And then in a moment, we're going to go through a live demo where we take a look at the fleet dashboard, individual devices, and then some of the issue tracking. Make that a little bit bigger for you all. So from here, you can see the number of active devices over time. This is useful to understand if devices are actually communicating with the internet. I find this really useful that it's coming to our backend versus your own so that if you do have an issue with your own services that you're running, you have a second reference point to understand how many devices are actually online. So you can see, okay, well, Memphal says there's 28 devices currently active, but I only see 15 check-in on a daily basis. You can start asking your server team to understand why that's happening. You also get a chart of the rate at which software is being picked up over time between different versions. So you can make sure that your actual release is being adopted by your users. If you have automatic updates set up on your device, this is helpful in understanding that that process is working correctly. If it's something that needs to be manually triggered by a user, then this can help your team find ways to incentivize your users to update more quickly. And then we have an overall breakdown of different versions in the field. Super helpful if you have maybe a endpoint on the server side that you want to deprecate and you want to know how many users it would actually affect if you were to take down that endpoint or something along those lines. We also track the number of traces each day that are coming in and what those top issues are. Traces can be really any sort of, I call them negative events. They're generally some sort of crash, whether it's a job exception, a native exception, kernel panic, WTF, anything along those lines. And then you can see the actual top five issues that are affecting your devices in the field right now. Next, we track all the different types of reboots. So you can differentiate between a reboot caused by an OTA versus a user-initiated reboot or something from, let's say, a kernel panic where the device was forced to reboot. I really like having the number of user-initiated reboots here because sometimes your devices can get in a state where they're not necessarily crashing, but they may still be misbehaving and they may not be actually creating any type of trace events that would be easy to track. But if you see a high spike in the number of user-initiated reboots, that can be a signal that something is going wrong with your device. And then finally, we have the newest issues on a specific device. So if you're doing a rollout, you can see if you just recently introduced something new to your devices in the field. Next year, I wanted to kind of show some of the metrics collection. Metrics can be any sort of data that is important to your organization. We have a lot of things that are already instrumented out of the box. And one of the powerful abilities of this system is the ability to compare different versions over time. So if we set up something like this where we can see the battery discharge rate was a pretty nominal state and low, but then we released version 1.1 and we see that there was a huge spike here. So our engineers went hard at work to figure out what regressed and what the cause of that was and we're able to validate that their fix actually resolved the issue in the next release. And then finally, if we go into an actual device view, we'll go into this one right here. We can get very high detailed information about the devices. You can see when it was first seen by Mempholt, as well as the last scene. So you can see how quickly it's checking in, what cohort it's in. So you can group devices into alpha, beta production cohorts or whatever is meaningful to your organization. You can also just add custom notes about it as well. If this is like a device that's maybe in your development lab, you can annotate that. Then when we come down here, we start getting into the timeline view. This is an example of a lot of the battery metrics that we've instrumented at this point. So you can see trends in the data where a device was plugged in and the battery started to charge again. You can see what was running on the device, whether it was dozing, if GPS was on, how strong that signal was, how many actual jobs were running on it, screen brightness, everything that you want to know. And so if you find an area of interest, you can zoom into the data more clearly to understand what was going on. When we, nope, we don't have traces here. I'll go to another device in a second and show that. Within the attributes, this is data that doesn't change all that often, generally. There are usually things about your device that you want to know on a high level. It's not something like, you don't wanna log what the current battery level is, for instance. That's not important to understand as an attribute of the device, but you may want to log what color the device is or what locale it's locked to. We also support linking multiple devices. So as I was saying with Square, when we had a product that was actually two different devices, you can jump between them via this links attribute here. And when you do that, you can actually look at the timelines in parallel and see what's happening on both devices at the same time. We collect all of the different log files for you and you can do either continuous logging, depending on if you have something that has a strong reliable network connection, or you can have it only grab logs periodically. For instance, all the logs leading up to a crash of the system. And then again, we log each of the reboots here so you can see when they actually happened and you can jump to them in the actual timeline view. And that's gonna jump into, this is actually for MCU devices, this project. So we do actually support Linux, MCU and Android, but I wanted to do a quick overview of the traces. So if we look at a specific trace events, you get all of the threads associated with it and log messages that were logged to the device. So if you want to learn anything more about AOSP tools and mem faults, we have a couple of different webinars available. And I also wanted to mention the AOSP and AOS meetup group. It's led by Chris Simons. He's actually right there in the middle of the crowd. It's very remote friendly and it's talking about all things AOSP and AOS. And thank you. And I'll leave this slide up again if anyone still needed to grab that. Do we have any questions? So how would you handle the, if you can only use mem fault if you have the ability to update it on the device itself, right? But what about just tracking the app crashes themselves? So if you don't have the ability on the device itself. So you're talking about more so tracking just application level crashes? Yeah. So honestly, if you're looking at only application level crashes, I would look at one of the other services such as like Bug Snag or Crashlytics. They're geared more towards one app's specific crashes and understanding what's happening there. Whereas our goal is really to instrument the entire system and see it as a whole. So honestly, like their services are very good at tracking a specific app. Thanks. Yeah. Yeah, thanks. One technical question. So Memphold is living as a system privileged app or how is it implemented in the AOSP tree then or in the device? Yeah, so if I go back here. Yeah. So it is a privileged app on the device. The Memphold SDK, you would add to your repo manifest and pulled into probably the vendor Memphold part of the tree. From there, it's basically a simple wiring of Android make files to pull in the compiled apps. From there, we set up all of the SE Linux policies in our SDK. So really there's very little that you need to do. Honestly, the first time I implemented the SDK it took me about five minutes to wire up the actual repo and config some API keys and things like that. And then the build took 15, 20 minutes. So the build took significantly longer than the amount of time it took me to actually wire everything up. Correct. Yes. And then you can see here the Memphold usage reporter for instance is a system app on the device. But both the update agent and the board application are both only privileged services. And we're actually in the middle of working on something that is potentially even just installable on a generic Android device that does not require wiring up into the actual Android build system. But we're still kind of working out some of the kinks with that. Hi, thanks for the talk. Just to clarify then, this is not open source but is there a free version that we can try out? Yeah. So the SDKs themselves are all open source but the backend and the web services that you saw me demoing are you're correct are not open source. There is a free trial version that you can use for up to 10 devices. And I should have included a picture of that in my slide deck. But I can find that information for you and I'll add it to the slide deck online after the fact. Thanks for the talk. Can you tell us a little bit about the update service and how does that work? It seems to be like a parallel thing to what you demonstrated, right? Yeah, it's parallel but we consider it part of our core offering because we really want to enable the whole right-hand side of this graphic here. And we want to be able to understand the differences between two versions. So here the Memfault board application does communicate with the update agent to basically identify what cohort a device is in, send that information up to the server and then the server determines which specific payload to provide it. So this can be useful if you have alpha, beta and production groups. Device may be part of the alpha group and therefore it gets bleeding edge software. Another option is if you have cohorts that are set up maybe by specific feature sets that a device has. You can distribute different software depending on that device. So we use the native Android update engine in AOSP and provide it basically the tar ball of images that would be flashed to each of the AB partitions. So the update agent is really focused on the grouping of devices, understanding what actual software should be installed to it and giving feedback on the state of the update. Any last questions? Oh, thank you.


Okay. I've been told that it's time to start, so we'll go ahead and get going. My name is Thomas Holt. I'm a professor at the University of North Carolina at Charlotte. I am in the Department of Criminal Justice, so most people immediately ask, so do you do CSI kind of stuff? And I always invariably say no.  So it's nice to have a large audience of people who will get most of this presentation. Basically, it's kind of odd to have somebody from Criminal Justice talking about security, or at least from my colleague's point of view it is. But let me tell you a little bit about what we do at the university at the moment. Right now, we run a honey net, and I run an intelligence team within the honey net. And our role is to go out and identify new threats, new targets, who's selling stolen data, how they're getting it, what are the latest tools, what are the latest trends, and what can we get for free, because a lot of these groups out there tend to provide resources for those who are interested. So what I'd like to do today is just kind of walk you through some of what we found, some of the latest stuff, and some of the things you're probably familiar with, and some of the data that we've seen being sold for profit. And basically, we know that the problem of malware as a whole, and identity theft, computer-based theft, is continually increasing. It's becoming more complex. The reports of phishing, spamming, they just keep going up and up. Dollar losses continue to climb, too. My personal favorite are the Nigerian email scam victims. You know, the African Prince contacting you. Victims, unfortunately, in those schemes lose around $5,000, or at least that was the estimate from last year. And that's just a staggering amount of money. So when you think about it, it's important that we understand where our threats are coming from and how they're actually being performed. You've probably seen the CSI FBI report where they talk about damages to different companies. $15 million in virus contamination damages, bought damages estimated around $1 million.  Operation Firewall in 2004 that dealt with the Shadow Crew and a couple of other groups. Operation Bot Roast where the FBI and other agencies are trying to take down bot herders and bot nets. You may have seen some of these headlines recently. Of particular note, the TJX suit. You've heard about the 45 million credit card numbers that are just floating around out there. The spam king who was busted, the bot net or bot roast problem. And what's great for us is that we can actually go out and track these things to some extent. These groups are operating, the criminals themselves run websites, they run forums, they have IRC channels all devoted to malware production, distribution, sales, carding, which is the sort of use of stolen data for different purposes and even some intellectual property kinds of things. And the sites themselves can tell us or at least give us an idea of who is responsible for these problems. It gives us sort of a snapshot of what's going on at the moment. And what I'm going to present to you today is information from our research. So basically what you're going to see today is information from around six to seven forums related sites that are actively involved in carding the distribution of malware and hacking. And I use security kind of loosely here because we see security as a justification among a lot of these folks. They say that they're bots or for network penetration and intrusion testing, so use it at your own risk. And so in the process of our work, most of these forums are run out of Eastern Europe, Russia, and so there's some language issues that we have to deal with. We use machine translations via Google and other programs to get a sense of what's going on, and we also have some human translators who speak various languages or at least have the capacity to read and understand what it is that we're looking at. So we have some inter-rater reliability by saying, here's what this translation tells us, look at us, pardon me, look at it, tell us what you think. And so we have some good ideas of what are going on. In fact, we have a sample of about 30 sites, they come, they go. So we try to have a pretty good understanding of where some of our threats are coming from and we track a lot of different issues all at once. I don't know if you're familiar with how these markets work, and what I'm going to talk about today is not so much IRC-based, but these are publicly accessible web forums. You don't have to register in order to look at what's going on. You can just ghost very easily. And so I'm going to walk you through a little bit about how the markets work, what we see currently being sold, and then some general information about the dynamics within the markets themselves. So how sellers work, how buyers work, and hopefully you'll find it pretty interesting. Basically, forums are structured in a specific way to act as advertising space.  And in that thread, you'll provide information about what you're providing. If it's a bot, you talk about its functionality. You talk about what AV systems it can get around. If it's, say, a packer, you talk about what programs you can do, how much you charge for it. You'll provide your ICQ number and ways for various people to get in touch with you. In turn, when you make your post and you create your new thread, you have to give your malware to the website for review. Moderators take your code, take whatever specific product you've got, and run it to see if what you're claiming your malware can do is actually possible, if it's effective, and where its weaknesses are. If you say it's got ten different functionalities and they test it and it appears to have nine functionalities that actually work, one doesn't work as well, then they say, great, we'll sell it for you. They verify whether or not what you're selling is good, and the same is true with stolen data. They'll take a range of dumps or credit card numbers that you may have, and they'll test a few of them to see are these accounts valid. If so, go ahead and sell. So the moderators will come back and post within your thread, here's what he said it can do, here's what our testers found. Buyers at that point will begin to provide feedback or ask questions. With stolen data, we'll see people asking, do you have any information for Turkey? Do you have German information? Or can you do credit card lookups for a specific individual? With malware, they'll ask what kinds of platforms can it go across? Can you provide me with denial of service attacks for, say, a 24-hour period against a specific target? And the sellers will go back at that point and try to address some of the questions. They may put something simple like, knock me an ICQ or contact me an ICQ and I'll answer some of your questions. They provide basic information. But what's critical for sellers is to have your customers say how good your service is. We know that they're going to be reviewed by a moderator, by checkers, but we want the customers, or at least the malware writers, want their customers to come back and say how good or how bad your product is. It's kind of like eBay in that the better your review, the more likely people are to buy from you. Let me give you an example of what I mean. This is a series of comments from one of the forums, particularly for a tool called FreeJoiner. And I'll talk a little bit more about FreeJoiner later on. You can see all four of these people say thank you for FreeJoiner. It's the best program in its class. I like this joiner. It's very useful. This is one of the most powerful products on the market. It's just super. It works well. Huge respect for the sponsors of the program. Great respect for the author. It's a remarkable tool. These kinds of very positive comments will make people say, great, this guy's trustworthy. He's got a good product. I'll buy from him.  First, I'll talk about some bots. This one in particular is called SuicideDDoSBot by a guy named Rkl or Crash. And he posted it in a couple of different forums. It's been reviewed. People generally say it's very good. In fact, in a review of the best bots of the year of 2006, Suicide was one of the top. And it can be controlled through the web, through IRC. The Botmaster controls can be separated out. It does ICMP, SIN floods, HTTP floods. It can disguise itself. It can be packed. It can be used for a number of different things. We didn't find a lot on price and it's varied. We don't know exactly how many people are using this bot, but at least we know that it's a popular code to be purchased. The same is true with this one called Illusion. Illusion is a bot written by the Cyber Underground Project, or CUP. Initially, this was being sold for about $400. Recently, though, we've seen it being posted in different forums for free, but you have to be a substantial member within the forum. Basically, you have to have over 100 posts before they'll give you a copy of it. And we see that happen a lot. Older bots, older malware. Once it's gotten used, people don't want to pay as much for it. Someone will say, here you go, it's free. So it kind of becomes like wares. And with Illusion, they say that it's good for SIN floods, ICMP floods, UDP, HTTP gets. It can do spoofing. You can send multiple commands at once. In fact, we've gotten the command book for this specific bot so we could understand what actually happens. They just posted it for free and said, here's our commands. Here's how you would use it in an IRC channel. And so you could say, flood this specific target at this rate for however many microseconds. This one also has something that was kind of interesting. It says the bot password. So your control password is MD5 encrypted and is used to prevent the evil enemy from getting your password and controlling the bot net. So sort of it's hacker-proof, if you will. And they say that it's got an easy-to-use command interface. A lot of these individuals will provide either video of how their tool works in action or they'll provide you with screen caps so you can see kind of what you're dealing with. This is a shot from Illusion from the provider and you can kind of see some of the different things that it can do. There's the password, there's the MD5 Crip portion, some of the options as to what works and what it can do. So that's a little bit about the bots. Let's talk about Trojans. Everybody wants to know about Trojans. Basically, one of the most well-known is one called Nuclear Grabber, created by a guy named Corpse. He's even got his own website where he's advertising this tool. You can purchase it directly from Corpse. Unfortunately, it's about $3,000. They say that it's very, very good. Corpse has a lot of great reviews. If you follow the security community at all, you've probably heard of this before. Unfortunately, for Corpse, we've seen cracked versions appearing. So people are getting this tool for free. You don't have to pay $3,000. You just have to know how to actually use the tool. So what does it do? It's a universal TAN, or Transaction Authorization Number Grabber. Any bank that you want to target, you can do so. It makes it possible, he says, to effectively gather TANs and more. And he calls it a consummate phishing tool. So you can get and make transfers with the data that you capture. Let me show you a screen cap from Corpse's nuclear grabber. So they say that nuclear grabber can be used for phishing. Here's kind of an image that will be created using this tool. On the left, you'll see a Wells Fargo sign. So your username, password, sign under your account. What's the difference in this one? ATM PIN number. That's correct. So this is the phishing one. Username, password, ATM PIN number. And you hit Enter, and all your information goes. What happens is that the data is split into three different streams and sent out to a selected server and then redirected to the actual, in this case, Wells Fargo domain. So you'll go right to your account. You think everything's fine.  And he goes so far as to say that this will actually defeat virtual keypads. It captures the side text, so it'll get actual data on username, password, so you can see what it is that you're dealing with. And with NuclearGrabber, we've seen a few instances of people actually selling stolen data from this tool. Back in January of this year, a guy named Death, which interestingly enough is another pseudonym for Corpse, was selling data that he picked up from the U.S. In fact, he went so far as to tell us later that, or not tell us, but tell some of the forum users, that this was from Dallas, Texas. So he was selling data by pieces, so you buy it in megabytes. So for 8 megs, you pay 6.5 WMZ, or WebMoney U.S. dollars. So for 6 bucks, you can get 8 megs worth of stolen data. And he's selling it in lots. Most of the folks who are in these carting and malware markets provide bulk discounts or they prorate their prices as they go up in volume. So the more you buy, the better price you get. And Death was giving people a pretty good deal here. So this was back in January. Another one that you may have heard of is a tool called Pinch. And Pinch is a pretty well-known trojan. It's been around for a pretty long time, actually. It's gone through a number of different iterations. I believe it's on version 3.1 at this point. And it was originally sold by its creator, a guy named Kobin2K. In fact, there's a very interesting interview with Kobin2K on a Russian hacker site where he talks about why he made Pinch in the first place. There's some controversy, though, as to how it became this very freely available public trojan. Initially, Kobin said he just released it to the public after it had been bought a few times. He said everybody should have this. However, there are some people who say that a group cracked it and then released the version for free. Either way, you can find Pinch on a number of different sites and download it yourself, but it takes some effort. There are also custom builds that are out there, so people will provide Pinch in a number of different services. They sell the latest version. They sell these unique builds for whatever it is that you specifically needed to do. Let me talk a little bit about an older version of Pinch, or at least the latest version that we saw. And it's Pinch 2.99. It's written in assembler. It's pretty small in size. He says that there's no special knowledge needed to use Pinch. It's apparently something that can be run pretty simply. It obtains passwords from 33 different programs, including Outlook, the BAT, RDP. It sends passwords from HTTP, SMTP, or FTP. You can get statistics about the machine. It binds itself to different executables. It can kill processes. It can create different favorites in IE. It'll add information or listings on a host file. You can even turn it into an IRC bot if you're so inclined. It says that it can hide itself from MS config, uses a couple of different packers, and it adds itself to the Windows XP-SP2 firewall allow list. So it tries to hide itself and allow itself to do a lot of different things. That version of Pinch was being sold for $30, and it could be customized to whatever your specific needs are. And the seller guaranteed that it wouldn't be detected by antivirus when it was sent to you for use. This is the person's ICQ number. Because Pinch is released and is so freely available, the specific seller was very clear that if you didn't buy it for me, don't contact me for customer support. In other words, if you get this tool without coming to me first, I'm not going to help you. And so for $30, you get a pretty good deal. They'll revise it for $5 a pop, and you can get statistics server software for $100. So it's a pretty good deal, all things considered. It's certainly a lot cheaper than nuclear grabber. This is kind of small, so I'm sorry that I read it pretty clearly for you. In terms of Pinch as a trojan for stealing data, we see people constantly providing stolen data from Pinch. In fact, in a one-week period this March, five different people were selling data that they obtained through Pinch, and they clearly stated sales of data from Pinch, 100 pieces of data, $3. Another guy was selling traffic for 100 pieces for $2, so undercutting the previous seller. And they were saying that the data came from the U.S., England, Russia, Germany, and Italy. And they'll offer discounts the more that you buy. So here's my ICQ number, contact me. The last guy there, same thing. Another seller named Exim. You can see he's got a very nice little logo here. He's a very proud seller. You've seen our famous trojan Pinch sales, in fact. He's really good at what he does, apparently. They say that they sell two different types of data. They sell information that's been parsed, or they just sell lots of data at once, so nothing that's been parsed. And whatever kind that you want to buy will make the price different. So if you want the parsed version, it's $3. If you want just the basic, it's $0.30. And you can buy it in a minimum order of 20 megs. So they like to deal. So for $6, you get 20 megs worth of data. They say that most of this data for this specific seller was coming from Russia, but there was some from Europe, some from the U.S. So clearly this is an international problem. Another tool that we just found recently in March. This is called PG Universal Grabber. I haven't heard much about it. We haven't seen anyone selling data from this tool yet, but if it can do everything that it claims to do, then this is going to be as effective a tool as nuclear grabber. It was posted on a forum, and the individual posting it was acting as a middleman, or the advertiser for the actual writer. So he was saying that it works through IE, and with different browsers based on an IE engine. You can get it and install it for $700, and they'll provide you with antivirus protection for another 30. And they'll give you updates and optimization for free, but if you need essential updates or if you need something custom, then they'll charge you for it. So they're giving some customer service. What can it actually do, though? It acts as a grabber, and it can get information from, you'll see PayPal, eBay, banks, trade, et cetera. And it will capture flash keyboards, so virtual keyboards. It does the keys for Bank of America, and the keys for different banks in particular. It gets protected storage data. It works with eGold, and basically what you can do with this one when it comes to eGold, is once it's installed, and your victim tries to use their account, it'll send the info to you, hit you on your ICQ number, and then you can immediately get in, your victim is locked out from their account, and it'll transfer 98% of the account to you. So you can drain somebody's account pretty easily without them being able to do anything. It also works with TANs, not unlike Nuclear Grabber, specifically TANs from Germany, but they do different countries as well, Poland, Lithuania, any country that works with TANs, and it can be used for phishing in terms of redirects. They say that it's got a very easy to use administration panel, it works for page substitution, and the Trojan is compiled by default to fake Wells Fargo, Bank of America, Lloyds, and Barclays. So it's got all these images pre-built. What else? There is a variety of different smaller services that are offered out there. For example, there's a tool called FreeJoiner. This is the one that you saw some reviews for earlier. This is basically a polymorphic joiner, so it'll put your specific piece of malware or whatever it is and bind it with other things. And you can obfuscate what it actually looks like. You can change it to appear as any kind of file. You can edit this file in particular. You can change the language interface. It's got integrated packers. And for $30, you can get this very nice build, but he provides a free version as well if you're interested. If you want some limited functionality, Gloth is saying just download it from my site. If you want the great service, pay me $30, and you can use it. In fact, here are some screenshots from FreeJoiner. You can see, well, maybe you can, maybe you can't. Here we've got Pinch, the Trojan we were just talking about, and it's going to be bound with something called girls.jpeg. So your victim would want to open it. Nice deal there, right? And on the right, you can see a little bit about the actual interface. What do you want it to do? What do you want it to bind? How do you want the product to look like? So you can see what file, how do you want to edit it? What language do you want it to look like? What kind of a packer do you want to use? So that's FreeJoiner. The same author, or at least a friend of this author, guy named Xploit, was releasing something called SymbiosCryptor. And this is an encryption tool that will be used to bind and basically hide your executable as it's going through. He offers this for $10, pretty inexpensive, with $2 updates. And if you buy from him, he'll even hook you up with the private version, that $30 version of FreeJoiner. And this can hide different tools. It says it will get around firewalls, and it's got a lot of good functionality. And here's another screenshot from the SymbiosCryptor. As you can see, this is all primarily in Russian. So it's a little bit obfuscated. But the individual Xploit is providing his ICQ number, his email address if you need support, if you need help, just contact. He's very good at providing customer service. So we have encryption tools. What else? We see some people in limited circumstances offering denial of service attack services. This group in particular, hackshop.org.ru, says, have your competitors started a pressure? Is somebody trying to prevent you from doing business? Is it necessary to take out your opponent? Well, we offer a solution. Our botnet's constantly increasing. We can attack countries wherever for long periods of time. We have zombies in all kinds of time zones. So for one hour, it'll be $20. If you want 24 hours of service, it's $100. And they'll do larger projects, just depending on what you have in mind. $400 or $200 are more. And we've seen people selling denial of service attack services for anywhere from $50 to $100, although many people complain based on the price, because there are so many zombies and bot herders out there. So we have denial of service offerings. We also see a lot of spam services for sale. This group in particular, the infected team, is saying, hey, we've got this great database of email accounts. We offer this professional, note they say that, professional service. It's operational. And depending on what you want to do, here's what we sell. If you want to hit targets in the US, we have a base of 1,200,000 email addresses. And if you want actual physical individuals, we have a 3 million account base to draw from. They have all kinds of different organizations and different individuals included here. We also see individuals selling ICQ numbers and different tools. This is something that we don't fully understand because ICQ is free, but we have a few ideas as to why this may be happening. It may or may not be clear, but we have different numbers for sale here, like 444X, so the last number is something different. So you can buy that for $1,500 from this particular provider over here. Another guy is selling basically the same service just for different prices. What we think, or at least what we assume based on some of these different sellers is that you can pay a lot of money for an easy to remember ICQ number. If it's only a two or three-digit combination, something basic, it might be good to help establish a name or it might be related to the age of the ICQ number. So there's a couple of different potential explanations that may be present, but there's a range of prices here. Most of these sites also offer a lot of free services. They'll provide older bots, cracked versions of different pieces of malware. They give password scanners, FTP checkers, ICQ tools, including encryption and different products there, proxy checkers. They also provide a lot of articles in terms of computer security, new exploits, old exploits, and a lot of wares. In particular, antivirus software for testers and different individuals who are working for these groups to run it against known bots, a lot of the Microsoft products, one group that had a lot of Linux stuff posted also. So a lot of things are free and you can basically build a nice arsenal of attack tools by going to some of these different sites. In terms of how you actually go about buying these things, individuals contact the seller privately. If you remember in that first slide, I talked about how these forms are actually structured. So in a string, you may have some questions for the specific seller or the writer. And you may ask, well, here's what I want. And they'll say, knock me on ICQ or send me an email. A limited number of people also use private messaging systems in the forum. It just depends on the person. But the person who's interested in buying contacts, then they say, here's what I'd like to get. And the buyers will have to go through the specific seller's provider for service. Some people use e-gold, some people use WebMoney, limited circumstances. We see them using Western Union, but they charge more if you want to go that route. So escrow payments offered in some of the boards. And these escrow services are designed so that the forum acts as a middleman. They will take a payment from a buyer. They'll contact the seller and say, hey, we have your money, please send the product. So the seller sends whatever it is to the buyer and says, I just sent the materials. Please contact the buyer. The buyer gets contacted. Did you get it? Yes. And then the forum will release the money to the seller. So it's just a way to guarantee service and money. And in terms of the organization of market actors, there's a continuum of sellers that we see based on their reputation, based on their trustworthiness. And it runs from rippers to unverified sellers to verified sellers. It's a process. So if you've created a new bot or a new virus or a new Trojan and you go to one of these forums and say, I'm interested in selling my specific services, please contact me. They'll send their code to the forum for testing and the forum will say, yes, it does what the person claims so you can buy from it. The first time someone posts in one of these forums, they don't have a lot of status. People don't know whether or not they can trust them. So they'll be labeled as an unverified seller. Over time, if people buy from them, if their products are sound, if they're selling stolen data and it works well and provides people with a lot of money, the customer feedback comes in. And if people are saying, gosh, this guy is great, his services are wonderful, then the forum will begin to put a little bit more trust and faith into this individual. And over time, they'll go from being an unverified seller to a verified seller, meaning whatever you want to buy from this person is going to work. So becoming a verified seller means that you have a lot of status. People can deal with you and we know that you're going to offer something worthwhile. However, there are a number of people who post in these forums who provide information that may not work, who provide bad services. And in those contexts, individuals will say this stuff doesn't work, this exploit isn't very unique, it's not anything new, why would we even want to worry about it? The bot doesn't do what you say it can do. And so that individual may become labeled as a ripper because you're providing bad services.  And that's what the term ripper is referring to. This person's a rip-off artist. And if you become a verified seller and for some reason if things don't work out, if you become unreliable, you'll get knocked back down to that unverified status. And if you continue to get bad reviews, eventually people will begin to call you a ripper. And if you're labeled as a ripper, it's essentially like being blackballed from the community. You can go somewhere else, but people will try to follow you. In fact, there's something called the Ripper's database, which is sort of like an internal site for all these malware writers and carters where you can say, hey, this specific individual is a ripper. He's unreliable. Here's the Eagle transaction where I paid him. I never got what I asked for or his services were bad. And so they maintain this list for everyone who wants to know, who can I trust? Many of these forms will operate their own white and black lists where you can determine, hey, is GloF a good seller? Is Crash actually reliable?  Do I not want to deal with him? So this organizational continuum reflects a lot about how the markets actually operate. We've seen, after looking at a year's worth of this data and from various sites, we've seen some interesting things with regard to what actually shapes the relationships between individuals. It appears as though the cornerstones of these markets are structured based on general business practices. People want to know that if they want to buy something from you, they can get ahold of you quickly. If you contact them in ICQ, how long does it take for them to get back to you? If they can provide the data that you're asking for very quickly or if they send you code in a fast, reputable fashion, then people are going to say, hey, this guy's great. One of the best comments that appears in these forums is someone saying, I can always get ahold of him. Whenever there's a problem, I can get him. Whenever I want new data, I can get ahold of him. It's especially important thinking about stolen data when there's time-sensitive materials involved. These guys don't want to sit on it. They want to get it as soon as possible. If a victim's been compromised and they're aware of it, they may get that account closed. So for a carter or for someone who's in this business, they need to know I can get it quickly and I can use it as fast as possible. Pricing is also important. Guys like Corpse who are offering these very complex, sophisticated tools can charge a lot of money because there's not products like it out there. But over time, people will begin to figure out how their program works and build competing models. And so prices begin to drop. With the DDoS services, for example, it's relatively inexpensive because there are so many bot herders and bot operators out there. So you have to offer prices that are competitive and reflective of what it is that you're actually giving to other individuals. You also have to provide reliable products. So if your bot is functional, is great, does whatever you claim it can do, then people will want to buy from you. If you're selling stolen data, then people want to know that your accounts are going to be valid, that there's going to be money in them. And customer service is also very important. There are individuals who operate kind of like tech support. If you have a problem and you buy this Trojan for me, contact me. I'll help you get it set up. They'll tell people in advance, this is a highly technical tool. You have to know what you're doing when you get it.  But they do provide updates. They like to give their customers whatever it is to help them get along. And with stolen data in particular, we see individuals providing these bulk discounts for purchases. If their data doesn't work or if it's not functional for them, they'll just trade it for new ones. If you buy from one of these sellers, for example, and you say the data that you gave me was junk, they may send another three megs for free and say, hey, I'm sorry for the inconvenience. At least that's what the good verified sellers will do. And this seems to be what drives the markets. These four factors really seem to shape the practices and the behaviors of different individuals. We also see something kind of interesting. They try to negate their responsibility to some extent, and this is probably no surprise. They say that whatever we're offering is for security. It's for pen testing, especially with some of the bots, like this first quote here. The bot is a means of testing its network to the object of vulnerabilities. In other words, it's just for testing your network, but not for attacks or incorrect actions. For its use, for any illegal purposes, the author does not bear responsibility. We see these disclaimers at the bottom of pages all the time, where this program was created for informational purposes to check your own protection or security. The author's not liable. Whether or not that's a valid claim is something else, but at least they try to negate their responsibility, as with many different forms of crime. So taking this as a whole, what can we glean from all this information? There's a great deal of malware and stolen data that's being sold and that's being freely made freely available to individuals in these forums. The prices are reasonable. They may be particularly inexpensive depending on the product, and some of these types of tools allow anyone to become involved in computer crime and identity theft. You don't have to have any technical skill if you buy a denial-of-service attack service from someone for 24 hours.  And based on how individuals actually operate within these markets, they run like a legitimate business to some extent, especially since it's based on trust and based on general business practices of turnaround pricing, et cetera. And some of the writers and some of the carters try to justify their actions much like other types of crime. So it's an interesting thing to observe. Unfortunately, there are some complex issues that come into play, too. The instances of law enforcement interdiction like Operation Firewall have had some impact on these markets, but they're still around. They still come up regularly. In fact, we've seen groups trying to take donations to get the Shadow Crew website back up and running. So while they may go down for a while, it appears as though it's not a permanent solution. It's very hard to attack and really take out some of these individuals. It's sometimes hard to attribute the creation of a tool to any specific individual with something like Pinch when it's gone through so many different versions. And we may not know that the individual author who created this did it for a specific purpose. It got cracked and then got released. Well, he's claiming something else. It can be sometimes hard to figure out who's actually behind some of these things. The language issue also complicates the process of research and examination. If you don't have Russian speakers, if your software doesn't provide an accurate or reliable translation, what is it that you're actually looking at? And it takes a lot of time to go through these threads, to look at the markets themselves, to analyze what's going on. It may take us a couple of days to figure out what a specific post means or where this tool came from. So it's not just a quick rapid-fire kind of exam. It's got to take some real time to review. And considering the range of markets that we're actually dealing with, it's not necessarily something easy. If you consider we have 30 different sites that we could go to around the world, then it may be very difficult for us to go through all 30 of them in the course of a week. We may only get to five or six. It just depends. And the transitory nature of these forums complicates things. They go up, they go down. Groups hack each other. ISPs get complaints, and so they take the site down. They come back again a few weeks later. The Rippers database provides kind of a unique examination of, this forum is up today. This one's down because they're changing the content. This one got hacked. So they can tell you a little bit about a select number of forums. But as a whole, they're present one day. They may be gone the next. Eventually they'll come back, but it's not necessarily easy to follow. And just for any of you interested, here's a couple of the key terms translated into Russian. And I've got some related readings if you're interested at the end of the slide. That's it. I'm open to questions at this point. Yes, sir. Thank you very much. No, no, we do not. We make no purchases. We go... Yes, the question was, in the course of our research, do we actually make any purchases? Where do we draw the line in terms of what is acceptable, what is ethical? We don't buy anything. We go to forums where we can examine, where they make things freely available, but we never ever buy anything that is for sale. We don't buy any data. We don't buy bots. If they're saying, here's a free release, here's the distro, we will try to get it, but we don't purchase anything. Any other questions? Yes, sir. You mentioned Western Union out there. Western Union. The question was, Western Union was on the buy list. Yes, they are. Yes, Western Union is involved. We see people, in particular, when they say you can buy through Western Union, they set a specific amount above what the minimum order may be. That's $3,000, or just as an example. They may say, if you want to pay me through Western Union, you're going to have to pay $5,000, because they take some of that extra money to cover the cost, to maybe have the money switch from actual currency into e-gold or something else. So, yes, Western Union is involved, it just depends on the person itself, or on the person themselves. Yes, sir. Yes, the question is, do we want to see any kind of international law enforcement cooperation to deal with these problems? Yes, we try to communicate everything that we find to different law enforcement agencies. If we know that it's something that seems very significant, if it's a threat to a specific target, we try to share that information as much as possible. We're somewhat limited in terms of who we can communicate it to since we don't have direct ties with international law enforcement agencies, but that is something that we would definitely like to see. Yes, sir. What's the ethical nature of getting ... What's the legality of it? Well, the legality of selling a bot and then if somebody cracks it, what do you do? Well, these sellers generally police themselves. The bot writer isn't going to go to someone and say, hey, that's my intellectual property that you just stole. We see people become labeled as rippers for cracking a specific kind of code or for releasing information to the public, but nothing tends to happen, really. Oh, is it legal for us to distribute what it is that we're finding? That's something that we negotiate with our law enforcement partners to determine what can we do with that. It just depends on the situation. You, sir, in the front. Do moderators do verification testing, collecting the information? It's not clear to us at this point if they actually get paid for their services, and moderators may or may not do the testing. There may be a middleman involved in that, so I can't honestly answer that at this point. Yes, sir, you and the way back. We try to go through, the question was, how do we obfuscate who we are? We try to go through proxies and conceal our identity to some extent to minimize or mitigate some of the threats that may come our way as a consequence, and we try to use relatively secure computers and networks. Yes, sir, you in the front. Basically, you're asking what happens if somebody drains an account, can it be tracked? Yes, it could be when we see individuals who sell, for example, hey, I've got data from Wachovia Bank of America and MB&A. Then we try to account for how many, say, accounts that they have, what their prices are, and we do try to ship out information to specific groups in our law enforcement community so that they can share that information back. Yes, it seems like there are ways to track it. The problem comes in to the amount of data that's out there. Like if you think about the TJX thing, accounts floating around, we don't know when those are actually going to be funneled through or how long it will take for data to actually turn around. So it is possible to check. It's just hard to know when a compromise happened. Yes, sir? Is there a buyer rating service that kind of comes into play with the different white lists on a board? One other thing that we do see with sellers or writers who are very well known or who are trying to develop a reputation, they will say, I've listed my data on four different forums, and I've been reviewed there, so they'll provide links to that specific thread within another forum as a way of verifying their identity and saying, hey, if these folks over here like it, if these folks like it, then I must be reputable. So not a site so much like Ripper's database where they're saying here's the best sellers, but groups do tend to manage themselves and say here are some good groups. Yes, sir? Can you repeat the question again? I'm sorry. Yes, sir? Not specifically, but we do see a pretty consistent range of banks that are targeted, and it does appear to be relatively straight from point to point to point. So yes, there is some way to verify, or at least we can say that there are some banks that are targeted more often than others. Yes, sir? Yes, sir? Yes, sir? Oh, like write your own code in an easy to point and click kind of environment? No, we don't see individuals selling those kits at least not in the places we go to. That's not to say that they're not out there. I think VX Heaven is one of the places you can get a lot of those point-and-click kinds of malware generators, but we do see a lot of different types of malware that are not out there. I think VX Heaven is one of the places you can get a lot of those point-and-click malware generators, but we haven't seen them for sale. Any other questions? Yes, sir? The question is what OSs are being targeted most often. Consistently, yes, it appears to be IE-based, or at least Windows-based systems. We have seen one or two instances of Apple-related products, but generally not. There's some variability in terms of whether something is Firefox or IE or Opera or what have you, but yeah, Windows tend to be the biggest targets. Yes, sir, you and the way back. Yes, that is something that we want to develop since we do these reports weekly, and we do try to aggregate at the end of the month. We can say that there are some banks that are targeted more consistently. I don't have specific stats right at the moment, but that is something we do want to develop, yes. Do we need assets at another university or research institution to help? It's possible. I'll talk to you about it later if you're interested. It just kind of depends. Yes, sir, you and the back again. Sure, the question is how do people manage their identities and how do we say that someone in particular is responsible for something? Don't they have multiple accounts in different forums to say, oh, yeah, I'm Johnny89 and I'm Turk182 or whatever. That's something that we are trying to work on to validate who is who and what identity is what. The interesting trick is that some of these guys use the same label or at least use the same handle for consistency's sake so that they'll know so that the general public will say, oh, yeah, that's crashes suicide bot. That thing is good. We also see sometimes people providing their blogs and saying, oh, hey, here's the recent language pack that I added to this specific service. And at the same time on their blog they'll say, oh, yeah, I'm a university student and I'm studying accounting. I like computer security. I like boating. And here's my picture. Here's my picture with my friends. We see that with some Russian groups and some Chinese groups and we don't know if it's just a consequence of young people using social networking as a means to share information. But there are some ways to attribute people to specific products. Yes. You sir in the back. Yes sir. That is a very good question that we have had some difficulty ferreting out. We've seen people that, oh, I'm sorry, the question was what about proxy services? Which ones operate best? Have we done any examinations of proxy services? We've seen people that provide proxy checking tools to say this is a good speed, this is a reliable connection. But we haven't looked at that one very heavily. But that is something we are interested in examining further. So I don't have a very good answer for you at the moment. Yes sir. That's a good question. Basically, how do people verify if they buy say some dumps or some stolen account data? How do they verify it and use it for whatever they may have in mind? Making cards or making online transactions. We have seen a site where it's just a bin lookup and it'll provide all the information for you. It's very blank, it's very bland, we don't know who wrote it or why it's there. We are very interested in trying to consider how this works. We do see people selling services to check and tell you what, I'm unfortunately going to have to go, but there's a Q&A room and I can answer more questions more fully. So thank you for coming, I really appreciate it.


This study assessed the e-health literacy, pre-existing knowledge and the nursing students' perceptions and attitudes towards e-health among undergraduate nursing students. The results showed that students in Level 4 had higher scores of knowledge in the use of e-learning technology, than those in the first entry university nursing program. Additionally, the students used the internet frequently, especially to access social media and search for health and medical information for their studies. Their attitudes towards e-health and technology were also found to be positive. The study recommended that digital literacy should be enhanced in the nursing education curriculum to further strengthen the knowledge, and skills towards the use of e-health and health technology among nursing students. This article was authored by Eusebius Lekolakolomokil, Migral P. Lohan and Vlajling Mabina Mogali.


On Thursday, two blasts outside Kabul Airport led to the death of nearly 85 people. Many more have been injured. The attacks have believed to have been conducted by Islamic State Khorasan, which is an outfit of the Islamic State Organization. This has caused a huge amount of chaos, not only in Afghanistan, but in the entire region. A lot of questions about what is likely to happen in the coming days as the US plans to complete its withdrawal as do its NATO allies. You're watching Mapping Fault Lines and we'll be discussing these issues. We are joined by Prabir Purkayasar. Prabir, there are two basic questions. What happens to Taliban's plans of reconciliation and what about the US and NATO withdrawal that is supposed to be completed in a few days? You know, it's very clear that Taliban's plans for reconciliation never included ISIS and its various offshoots. So I think that's really, has always been off the table. It's always been the argument that is Taliban going to give them Afghanistan as a place for which to conduct their activities outside Afghanistan. Taliban has said from the beginning that they do not like ISIS, then have no sympathies with them and they will not allow their territory to be used against other countries. So I think that issue had been settled long back. It's only the media campaign that Taliban is a protector of ISIS and a protector of al-Qaeda that's been going around. And I think Taliban from the beginning has made this issue clear. Whether they will also behave better, will they also be a new Taliban is an open question. We are not getting into this today. But this was never on the cards. And they have been warning the United States, the NATO allies of the United States that the situation is becoming dangerous in this evacuation. Because ISIS as a force is there, ISIS-Korastan, all this is basically various names for very similar outfits and therefore they did expect the terrorist attacks of this kind to take place particularly because other parts of Kabul are at the moment under their control and it seems peaceful. There are no crowds over there but there are large crowds over there and plus the United States forces are there. Therefore there are also targets which they could then be considered for attack spices. So given all of this, they had been warning of this for some time and it is also now clear that the United States was coordinating with Taliban on this issue. They also had received warnings as we know the CIA head, Mr. Burns was there in an undisclosed meeting with Taliban. So they seem to have known about it and preparing for it but at the same time if there are a huge number of people which there were outside Kabul airport wanting to be airlifted the last days of the NATO presence on Afghan soil which is the Kabul airport then it is difficult for anybody to control that situation in terms of security. There is no security perimeter then you can set up like this in such large crowds. So Taliban wasn't happy about this call for evacuation of all Afghan nationals who have been a part of the NATO maybe various outfits, social outfits, whatever it is, NGOs working with their embassies. So they were not happy about the very large number who are rushing in terms of wanting to get out of Afghanistan and therefore one of their consideration was really that NATO should not stay beyond 31st August and that this becomes a ready-made target of attack and therefore they need to depopulate is a wrong word but see that not many people are there. So only those who have hold passports, foreign passports etc should be going and Afghans should not go at this stage for various reasons. So I think that expectation that there is going to be an attack on both sides and it does seem to indicate from what we can see of the reports that both Taliban and the United States were coordinating whatever efforts they had to see that there can this be prevented. But as I said it's clear if the suicide bomber attack it's always been difficult to protect against that and with such large number of people over there it's almost impossible to prevent them for something like this happening. So I think what we see is very unfortunate. 85 people died, number of people injured. There seems to be two explosions definitely. We don't know if there are more. There seems to be also been firing. We don't know against whom. So all these question marks are there which will become clear over a period of time. But what it puts at risk is those wanting to leave Afghanistan now before 31st. I think that is going to be much more difficult and only those who hold foreign passports will probably in this phase be able to leave and others probably not. And they will have to wait for civilian flights to come and then take them for those who the Taliban allows to leave. So I think that question has now gone a bit into the back burner and I don't think people will now be going in very large numbers in that airport perimeter either. So we have to wait and watch what happens. But one thing is very clear that ISIS or its offshoot, ISIS-Khorasan as it's been called is something that worries Taliban and of course worries all the neighbors because they have been from the beginning worried that can these things spill over to their territories and ISIS-Khorasan, ISIS being something which is destabilizing for the region as a whole. All of them are concerned that they should not find any place in Afghanistan. But of course, as we know, the control of Taliban over Afghanistan has to be firmly established. They're still negotiating in Pansheer Valley. So it's clear they don't want to go into offensive in any of these places. They would like all forces to come together so that they can try and isolate ISIS. What their internal policies are going to be towards their own people, towards women, education of girls, all of this is an open question. And I don't think we can conclude on that. But it is the common interest of both countries outside Afghanistan and for Taliban within Afghanistan to see that ISIS does not take roots in Afghanistan. Because if that is allowed to grow, then it's a threat to all over across regions and of course across countries, it would be a threat. Absolutely. Praveer, it's interesting you mentioned the region because quite a lot of developments taking place to the west of Afghanistan as well. So we see that there are reports that Iran and the Gulf monarchy is at Saudi Arabia and the UAE are likely to meet in Iraq. That's tomorrow, that's Saturday. Now it's not clear at what level these meetings will be, what the agenda will be, but it seems to be a continuation of a process that began some months ago. And it has to do with Yemen, of course. It has to do with the nuclear deal. But also Afghanistan coming into the picture because many of these countries have various kinds of stake in Afghanistan, especially Iran. So how do we see the process of this rapprochement or dialogue taking place considering that these have been very traditional rivals, Iran on one hand and the Gulf monarchy's on the other? You know, earlier it was almost felt that the overall global hegemon, the United States, will play the role to bring people together. Now when the United States itself becomes a problem, like with Iran for instance, or now with Afghanistan, then you get the problem that how do you bring everybody together if you are against a particular party, which is actually quite important in the region, in this case Iran. So I think what it does is it makes the relationships between the countries of the region much more difficult because they have to now deal with the overarching presence of the United States. And the United States has always looked at the West Asia as their property because of oil, as you know, Carter doctrine itself said. And there's the same Carter who also did allow the intervention of Afghanistan to start inviting in the Soviet Union. And that is as Brzezinski said at that point of time. This is their Vietnam. So all of this if you see and you go back and look at it, it's clear that a lot of the dynamics of the region got completely distorted, if you will, or completely sidelined. Because what happens is the United States with its overarching presence and it's what it wants then becomes the driving force in the region. So what we have seen in West Asia for instance, they have had essentially supporting extreme right-wing forces, Islamist ISIS kind of forces aligning with them in Syria against the secular Assad regime. In Iran, of course, they were using an anti-sheer platform to attack Iran, trying to get the Gulf monarchies together. At the same time in Iran, they also did the same by trying to make shears versus Sunni battles take place. All of this means that they were acting as a force for breaking up the region rather than bringing people together. Now that the United States is withdrawing from Afghanistan, as we have discussed earlier, their entry to Afghanistan had to do with West Asia, Iran, as well as Central Asia. Now they're withdrawing from Afghanistan. I think the region as a whole is also seeing that instead of getting United States to side with A or B, can we actually try and sort our differences together? And I think Yemen is a first big test case. If Yemen can be resolved in Saudi Arabia, Iran acting on two sides, Saudi Arabia is basically the aggressor against Yemen. So if that gets resolved, Yemen civil war and the Yemen war, the Saudis have launched stops. I think that's a huge boon for the region. And it is also important for all these countries then to sort out their differences among themselves. And that is the long-term trajectory. I think the U.S. withdrawal from Afghanistan is sending a signal to the region that this is the way to go. Let's look at solve our own problems. Let's not look at what the outside powers want us to do. How far? Again, wait and watch. How much can U.S. players a spoiler? It will depend also on Israel. And I think that is the joker in the pack in West Asia. Not so much United States alone, but also Israel, who seems to hold U.S. policies hostage. Absolutely. It's interesting you mentioned Israel because just a few weeks ago there was an incident of an Israeli-owned tanker being attacked. And there was a huge hue and cry, the United States, the United Kingdom, G7, all of them blaming Iran. The interesting thing, of course, is that a lot of Iranian tankers have been attacked and everyone has been very silent. You can see some of these on the map here. And there have been many more instances which are not really marked so far because I think they've been about 20. But what we see, as you said, is that Israel remains a huge possibility, the possibility of Israel being a spoil sport, very huge. It's a right-wing agenda continuing under the new government. It has been leading the effort to not bring back the nuclear deal. So how do you think Israel might play, what kind of a role might Israel play in this situation? You see, there has been a big partnership going with the issue of oil tankers, other tankers, shipping. Iran has been blamed earlier for some of the attacks. Now Israel has been identified by Iran as the party which is also attacking its tankers and ships. So this has been going on for some time. Does it have the potential for spilling over into an open war? This is the test case now is going to be what Hezbollah has said, that Lebanon needs oil and if Israelis do anything to the Iranian tanker which is coming to Lebanon, that is going to be extremely damaging for Lebanon. Therefore they will react, what they will do, we don't know, again. So they have given a clear warning that this they will not allow. What does Israel do? We don't know. But Israel has been, and Neftali Bennett is right now the United States, Israel has been talking about that they will take military action to see that Iran's nuclear refining, refining uranium refining does not go above a certain limit. And they are willing to take military action on that count. If they do, then of course we are in for a really open war in West Asia. And this is going to be extremely destructive for the region. Whether it is an empty threat, it's a real threat. Again, future will show. But it is poised at this point, where we don't know what actions, one or two sets of people can take, which can spill over into an open war. United States has its eyes at the moment, seems to be in Afghanistan. How to extricate itself from there? How can Biden protect his image after it is taken a beating? People are talking about, is it his Carter moment? Remember the Iranian hostage crisis? Is it the same damage that he's going to take? His ratings have tanked. So does he have enough focus at the moment to prevent Israel from doing what can be only called an extremely adventurous act we have to see? But yes, it is possible Israel's actions, and it is Israel's actions, which can provoke a war in the region. And if that happens again, things are going to get extremely dangerous for everybody because this is where India's oil comes from, China's oil comes from, Europe's oil comes from. So this is not a region that is just going to be something that happens in Afghanistan. But that is something which is going to affect almost the entire globe, particularly Asia, Europe, and of course Africa as well. Thank you so much for being. That's all we have time for today. We'll be following these issues in the coming weeks as well. Until then, keep watching NewsClick.


I'm Adam Cranfield with Cal OES. This week, in collaboration with federal, state, and local partners, Cal OES continues to coordinate disaster recovery centers in San Diego following a major disaster declaration secured by Governor Gavin Newsom. So far, over $11 million in federal aid has been dispersed to survivors to help them along the road to recovery. If you were impacted by the late January storms in San Diego County, be sure to apply for disaster assistance by going online to disasterassistance.gov or by using the FEMA smartphone app or by calling<PHONE_NUMBER>. And following the recent storm season, Cal OES recommends the following tips as most of California recovers from inclement weather, exercise caution when cleaning up storm debris, inspect for any potential water damage around your home, and check your go bag to replace any items you may have used. Also this week, Cal OES launched Least Us. It's a first-of-its-kind woman-focused initiative recognizing the crucial role women play in today's society as changemakers, leaders, and decision makers. Least Us works to empower women with emergency resiliency knowledge that they can confidently put into practice. For more information, go to leastuscalifornia.org. To see more from us, visit news.caloes.ca.gov and follow us on all our social media platforms.


Hollywood legend John Travolta has had plenty of years in an A-list career to build up a property portfolio to match his success and then some. Currently, he spends most of his time at his longtime airport estate near Ocala, Florida which he purchased with his late wife Kelly Preston in 2001 for $3.5 million. The 9.5-acre spread is located in a residential air park and includes a 7,500-foot runway that goes right to John's back door and is any pilot's dream. Travolta also added a Calabasas villa mansion to his real estate holdings in 2019 which he spends his time in when he's out in L.A. while selling two properties, one in Maine and one in Clearwater, Florida in recent years. Also, Michael and I have dropped our own house tour of our new home that we moved into this year so go ahead and subscribe to our personal channel if you want to see where we're living and more of what we're up to. In these videos we don't reveal any addresses and even though I've done a house tour of my own place, please do not show up at any private residences because it's not safe for anyone. John Travolta is an actor who rose to fame during the 1970s first appearing on a sitcom Welcome Back Coder and then landing roles in a handful of box office hit films including Saturday Night Fever in Greece. While John's showbiz career hit a slight decline in the 80s, he made a comeback in the 90s with his role in Pulp Fiction, my personal favorite and then went on to star in many more movies over the years. Aside from his long-spanning career in Hollywood, John is also a private pilot, reportedly owning four to five aircrafts. While the actor has maintained an impressive array of mansions across America, his long-time home is his place on the residential airport Jumbolier Aviation Estates in Florida and he and his late wife actress Kelly Preston were among the first residents of the community, which gives home owners their own fly-in and fly-out access. Sadly, his wife Kelly passed away recently in 2020 after battling breast cancer. John still lives there to this day. Hey guys, it's Kara The Vampire Slayer back with another exclusive house tour here on Famous Entertainment, today looking at the homes of John Travolta. Don't forget to like, subscribe and hit me up on Instagram to chat and now let's get into this video. In summer 2021, John Travolta offloaded one of his mega properties, this one being a waterfront retreat in Clearwater Florida for $4 million. While it might sound like an uncommon location, this home sat right down the street from the Church of Scientology's flag building, which was perfect for one of the religion's most famed members like John. And of course he isn't the only celebrity to own property in Clearwater with fellow Scientologists like Tom Cruise and Kirstiali, among others, having homes here. After the loss of his wife Kelly, John decided to also let go of his residence here, making a million more on the sale, considering he bought it over four years prior for $3 million. This spread sat on just under three acres of land, all of which was protected by a high wall, secure entry gates and tropical greenery. While past the gates and driveway, you'll arrive at the multi-level main house, which boasted a flat roof and pops of orange. Built in 1988, John's former contemporary home had a floor plan with over 6,100 square feet of space, along with five bedrooms and 5.5 baths sprinkled throughout. Of course, the home had been immensely updated and renovated to give it the modern look it has today, and its design has expensive finishes like French oak flooring, hand-crafted plaster walls, slate floor tiles, and much more. Past the sunny entryway and down a few steps, the home offered a combo living and dining area with a soaring double-height ceiling and walls of glass. Here, there was also an impressive concrete fireplace on one wall and stairs leading to the upper level. The contemporary kitchen, situated next to the main living area, offered a large L-shaped snack bar, laminated cabinets from Germany and a spacious breakfast nuk. This space opens to the outside through glass doors, while there's also a second and more cozy family room nearby. John and Kelly's former master suite here had the best spot in the house, on the top level, with a private balcony that offered amazing views, as well as a walk-in closet and spa-inspired modern en suite bath. Each of the guest rooms in the house were also en suite, and had their very own unobstructed views of the water. Outside, the large deck off of the home had canvas shades to make for comfortable outdoor dining and relaxing. The grounds also had multiple terraces, a stunning swimming pool and a private dock. Aside from the main house, the property further boasted a poolside cabana that could act as an art studio. In 2021, John also listed another one of his getaway homes. This one located in Osboro, Maine, but according to records, it hasn't yet sold. Listed at $5 million, this massive spread has served as the Travolta's family's beloved vacation home on the island of Islesboro, which can only be exclusively accessed by ferry. John first visited this island over three decades ago with his Scientologist and actress, Pal Kirstie Alley, who has her own vacation home here. John and Kelly, who are newlyweds at the time, fell in love with this 48-acre waterfront property and bought it in 1991. This hotel-sized mansion is perfectly secluded and situated at the end of a gravel driveway surrounded by trees. It was built back in 1904 for a prominent banking family by architects Peabody and Stern, and inside it boasts 42 rooms with a colorful and cozy design scheme that suits the country mansion on the coast. Inside, the mansion covers a whopping 10,830 square feet of space with an unheard of 20 bedrooms and 7.5 baths throughout. It's full of classic features like rustic stone fireplaces, gilded fixtures, tutor revival windows, and more. Each room of the home has linen, draping, and velvet upholstery, while many of the furnishings came with the vintage mansion. In the 90s, John revealed to architectural digest, the house was already full of English antiques, 30% of which we refurbished and still use. The mansion's entry feels like a hotel lobby with some lounge areas and a bar nearby. There's a formal living room with fireplace and large dining room with equally large table. Other highlights of the estate include a second level sunroom, which is one of two in the home that offers amazing views, a ton of floral patterns, and various pastel colors throughout. This sunny country kitchen has chef-grade appliances and butcher block counters, while it also boasts a huge pantry. Within the many, many bedrooms, there's still a stunning master suite with John and Kelly shared for many memorable years. This space had a fireplace, private porch, and vintage style ensuite of its own. 14 of the guest bedrooms are located on the second level, but the third level was transformed into a fantasy children's wing. This impressive part of the mansion would be any kid's dream, boasting a schoolroom, library, a diner, a theater with its own stage, and four themed bedrooms, two of which are said to be a princess room, and another a Peter Pan room. John and Kelly no doubt adored this property and put all the work into changing the mansion from its formerly dark interiors to a bright and cheery ambiance. Outside, the many acres offer everything from a swimming pool to private beach access. It also boasts a deep water dock on Sabbath Day Harbor, plenty of forest trails, and rolling lawns. While John may be offloading that home, maybe because it holds too many family memories and he doesn't need that massive space anymore, he still splits his time between two impressive mansions. In 2019, the couple decided to buy a Mediterranean style villa mansion in the exclusive Calabasas area of LA for just under 2.7 million dollars. Located in a guard-gated community on a half-acre plot of land, this home was built in the 90s and offers over 7,500 square feet of space with six beds and six baths over two levels. The property also comes with amazing views across the canyon and mountains, and interior features like open-plan living areas, high ceilings, and four fireplaces. John and his family spent much of lockdown at the home too, even sharing a pic on Instagram last year with his new puppy Jinx in videos with his kids. The front of the villa offers a courtyard entry with a stunning three-tiered water fountain, and inside there's a double-height rotunda as well as a skylight overtop the sweeping staircase. Some of the airy spaces inside of the home included a double-height living room with wall of windows and a fireplace, a formal dining room, and a top-of-the-line gourmet kitchen. Elsewhere there was a family room with fireplace, wine closet and bar, as well as a library with handmade wood bookshelves lining the walls and second floor gallery. Many of the beautiful rooms in the home come with vaulted ceilings and natural wood beams, which are super high for an open-air feel. The main floor even has an office space as well as a mirror wall gym. Outside, John has access to a handful of living and entertaining spaces too, like the shaded patio with outdoor fireplace, barbecue station and dining terrace, and an infinity-edged pool and spa. Sadly, there's no airplane parking at this mansion, but that's where John's final home comes in handy. Last but most definitely not least, John keeps his sprawling airport-style main residence at the exclusive Jumbolair Fly-in Community near Ocala, Florida in the small town of Anthony, and it's here he also keeps his collection of planes right in his yard. In 2001, John and Kelly worked out 3.5 million for this 9.5-acre spread and set out to build their mid-century-style concrete and glass dream home here, which spans about 7,000 square feet of space along with six bedrooms. There's even a 6,500 square foot garage that boasts eight efficiency apartments inside. John and Kelly showed off the luxurious estate way back in 2004 to architectural digest, which is any pilot or airplane lover's dream. The custom design mansion is mainly white throughout, with thick concrete walls, towering columns and walls of glass. The highlight of the interior spaces has got to be the great room, which boasts a curved wall of double-height windows overlooking the tarmac out back. Here there are contemporary chairs and low sofas with modern pops of blues and greens, and it almost looks like a vintage travel lounge. There's also a formal dining room with an art deco style and a massive mural on one wall. Travolta was always into airplanes, and he got his pilot's license by age 22. We can see his love of aviation present in the mansion's design, almost like you're stepping into the 1960s Pan Am era. There's also a stunning entrance hall with a custom floor design and multiple model airplanes, as well as two kitchens, one for serious cooking and one for more casual affairs, creating three separate dining areas. That, according to Travolta, they're like those in hotels. Among the many features in the modern mansion, there's also a bed and breakfast style quarters and multiple suites for guests to relax. Of course, the best part for Travolta about this estate has got to be the outdoor features, like the 7,500 foot runway that extends right up to his back door, as well as two airplane parking pavilions and a separate-laden grass runway. His personal airport has more than enough room to store his collection of aircrafts too, which include a USA Air Boeing 707, Boeing 707-138, Bombardier Challenger, and more. It's said that he currently owns four to five planes. When he's not up in the air, Travolta can enjoy the other features of his home, like the resort-style pool with hot-tub out back, it even boasts a slide, patio space, and a dance floor with custom stonework. Another one of his favorite spots on the property is the cabana with bar that looks like an airport lounge and overlooks all of the action. Looking at a handful of John Travolta's massive properties, we can see that he and his late wife Kelly went above and beyond to craft the ultimate real estate portfolio, which included a massive fairytale-like property in Maine, a Calabasas villa estate, as well as the iconic Florida mansion, where Travolta has his very own airport. Well, that's going to bring this house tour to an end. Let me know what you thought of his homes down in the comments, as well as who we should feature next. Thanks for watching, hit that subscribe button if you haven't, follow me on Instagram to chat, and I'll see you all in another video. Bye!


Hi, I'm Matthew Coase from commitmentconnection.com and today I have another question from a woman in our community and she asks are my standards too high to meet a guy who will meet my standards and I You know, I don't know what your standards are but if you're anything like the overwhelming majority of women that I talked to then The answer is probably yes your standards are way too high and it's not that your standards are too high It's probably that your standards are just you're focusing on the wrong things Right a lot of women focus on the wrong things like What one of the big ones that I see really really often is in online dating because online dating can be a very shallow and superficial place to Meet people and one of the things that happens all the time is is every woman out there is looking for that six foot tall guy even if they're you know five foot three or whatever and it's you know, it's a Guy's height, you know, maybe you'll be attracted to a guy or maybe you won't My suggestion is that you loosen your standards, whatever they are, you know focus on things that are important like your values and making sure that your values are in alignment, but You know all the other things all the superficial stuff all the things that you know You think that you'd want in a guy like, you know You know dark hair and blue eyes or whatever it is that you know, you're looking for my suggestion is that you loosen most of that stuff up and just allow yourself to a date and and You know get to know guys who might not fit in that perfect mold of whatever your standard is that you normally look for You know most women are too focused on you know This checklist that's a mile long of all the things that they're trying to weed out in a man And it ends up weeding out a lot of really good guys who might be perfect for them And so my suggestion is that you you broaden your the amount of and your your standards so you Don't lower your standards, but just open them up to something that that's more important focus on the things that are the most Important and the other things, you know just allow them to be whatever they are and you know I know people all the time who end up with In relationships great relationships with people that they didn't think that they would end up liking because it is Because they relax their standards a little bit and looked at guys that they wouldn't normally go for So that's it for this video if you want more information on how to attract a quality man into a committed lasting Relationship make sure that you subscribe to my youtube channel I'm Matthew coast and I'll speak with you again soon