Hello everyone Good to see you have the room full. Thank you for coming Today or yesterday and is a special day because we have this vanity metric, you know 500,000 downloads for all symphony components. So that's a huge number. We're very happy to show that with you in a Drupal con Let's proceed it's the symphony track. So we're talking about symphony things in Drupal Okay, um, let's go Today we're gonna okay talk about Symphony inside Drupal because as you know Drupal 8 has symphony many symphony components Inside and uses them to do so many things and core things Quickly so my name is Nicolae Grecois. I'm from Paris Half Greek you may have wondered with my name I'm the Currently second contributor on symphony. So I have a lot of time Working at sensual apps to also hack and do things on symphony. So I'm very happy to work there I also work for blackfire and blackfire is a profiler. So If you want to know how you code behaves in terms of performance consuming resources memory things like that it's a nice tool for that and I worked on these slides and this presentation with Ryan Ryan weaver is the symphony documentation project leader. So really important guy for all new commerce to symphony and Advanced people because he owns the I mean owning he leads the documentation project and this is a huge task That's it for me Okay, so We're going to talk a bit about the fundamentals of every framework Not anymore except Drupal. So now Drupal has the same kind of you know life cycle web request handling than almost all current frameworks So that's the kind of code you used to write with Drupal 7 So some convention a naming function Like you had to do to make it work in Drupal and what that was magic and working fine So that's not the kind the kind of things you do anymore In symphony in Sylex now you have roots controllers request Responses and a service container. So we are going to talk about all of them in this presentation And of course now it's also a Drupal 8 thing. So all of this concept applied to Drupal 8 Sylex who knows Sylex Okay, great So Sylex is a micro framework a micro framework is something that works in a single file So as you can see, this is a single script with the requiring requiring the auto loader first line And then we have the Sylex application at our disposal and we can program a route and the controller. So This is amazing Then to run this you may use Enginix or a pitchy. So who is doing this daily for development using a pitchy or Enginix Okay So and who uses that PHP dash s Okay, so It's a developer's best friend. So you just need to know about let me talk a little bit about that so PHP comes with this PHP server embedded and You start it in the folder where you are the current moment on the command line And this just opens web server that listens on the local host on some port you have to provide it So a thousand in this case and it's really the quick and not that dirty quick and dirty quick and development way to You know start an application It looks for the index of PHP file in the current folder and that's it That's enough to boot a full application and it works with Drupal Which means that if you're in the Drupal folder You just start PHP dash s local host and you don't have to configure any virtual host any Web server or you know or there's something that can be complicated to configure and to get right Just start that in the folder where you are and open the web browser to this year and it should work So that's the kind of experience you have with that. So and that's running the script on the silence application So in this case, so we PHP dash s local host 2001 and then It's listening weapon this URL on the browser and we get the feedback from the application So it's a really a trainers also best friend because when we have I do a few trainings and sometimes when okay It's complicated to have everyone on board with the same setup and PHP dash s is really the common way And I use it almost every day to just hack on something and try it quickly Let's see the general workflow of the request response of that framework deal with so The request comes from the browser usually or some client web client Then the routing maps and reads the URL really to map it to some controller So the controller is the actual function and the code that should be run for this route that the router matched and then the controllers is responsible for Returning a response. So creating a response and give that back to the browser so that's typical workflow and we're going to see this slide a few times again because It's really the core the hot bath of every framework nowadays So back to this this is the roots. So Silux comes with a router embedded and this is the route so slash hello slash name So name is a wild card. We give it just a name When the URL matches it the function should be called so With a parameter so the router looks for this bracket name and gives it to The control release so this function as an argument and then the code is run and that's it We have our response our hello world silux application and basically This is the kind of things or also that Drupal does internally catching the request getting it creating a request object dealing with life cycles so Routing with the router. So it's symphony router. It's not the silux router, but anyway Calling the action so the controller class and providing a response HTML usually json if you do APIs things like that Okay, so let's try with symphony Who knows drush everyone? Okay, of course Who knows Drupal console? Okay, so it's Drupal 8 way of doing drush like comments In symphony we have the kind of same kind of console and the Drupal console is Using the symphony console components to build the experience and the subcommons things and all of that and Symphony is doing exactly the same to build the symphony Installer so the symphony installer is just some glue some helper To download the code so the code is on github and the helper is Because this installer is a common line that downloads the code for you checks that everything is okay in terms of php version extension Things like that and it really makes the installation process Easier even though you don't really need it technically to have a symphony application working so You could use it to create a new project so symphony new my dear name so my project really and this downloads the symphony application and Show you some you know nice A greeting a welcoming message to onboard people easily If you look at the downloaded code you'll see this kind of directory structure, so the app folder is where All the configuration and templates and not code related Files are so config.yaml twig files all of that Then this other very important folder is the SRC so the source folder and this is where you put your classes Just following, you know the psr4 psr0 naming convention So the class app bundle is in the app bundle namespace and this maps to the directory structures And so we have directory for namespaces and file for the class the last part of the class name So this comes empty, of course, except maybe with the app bundle which is the you know the module file in in symphony Then you have okay the test folder. It's up to you to fill it and the var folder where we put cache information generated files Logs and things like that so technical things that are managed by symphony itself usually and We have the vendor Directory which is for libraries third-party code. You have the same in Drupal 8 so you will find the vendor directory in Drupal 8 and this is Created by Composer which is used to manage dependencies In symphony and in Drupal 8 and in I guess most PHP application not as who uses Composer Okay Drupal console symphony console When you install the application there is also the bin folder and in the bin folder you have a local script local PHP script So this is a PHP script and it runs From the command line so you can run the PHP dash s server and just using bin console server run This is just a helper wrapper around you know PHP dash s. I was talking about Previously so you could start PHP dash s with a few common options on the command line and do exactly the same This is just a helper But yet this is really helpful to you know you get into this folder your projects You start the server and you work on it. It's ready. Nothing else to configure on APG and Linux things like that and in the same with Drupal console with Drupal console You can say Drupal server. That's the name of the command on Drupal console And it boots just the PHP dash s server and you can hack on your Drupal installation and on broken models and Things like that everything you need to do really So that's the welcome page of the symphony Default installation application So dress was talking about you know welcoming people with and not that empty Application at the beginning so same for Drupal and next version of Drupal and not providing only empty pages so that so that people can Feel a bit more how it works and what they can do and that at least that it works So here we are. This is a welcoming page If you go to something some other URL so slash nothing flash to see slash here You'll get this kind of exception page This is just the page that is displayed when something went wrong Not in terms of symphony not working because this is symphony working on behind So this is an exception page and it means that symphony tool is working But there's no page here so that the you know error page for nothing there So, okay, that's basically what this means. Hello. I'm the Pac-Man ghost look Things are working. This page does not exist yet in symphony and in Drupal so Everything is hackable. So you you may you may have to you may find some fancy bundles and this is one I wanted to share with you So if you want to replace the ghost you can do that Surely code give exception bundle it takes a random bundle from a website random Okay, so now we installed symphony let's build a page And so the first thing one of the first thing you can do is Creating a route to the new page you want to add to your application. So to do that you print the routing YAML file and In Drupal model, it's called my model dot routing dot YAML and the content is the same So the content is this kind of YAML who? Uses YAML Okay So, you know how it works. So the hello world is the name of the route path is the URL Pattern, you know, because we have the bracket name thing that is not exactly URL, but the placeholder for it And we have defaults and in defaults we define this underscore controller and a class name So the class name is the full Fully qualified class name and the method that should be called whenever this route Is hit buzz by an HTTP client? The route has a name hello world Because we use is we use routes both to match from the browser from browser to the controller and we use this also this we use also this Configuration to generate URLs. So you can set to the URL generator give me the full a URL for the hello world Routes with the name Nicholas and you will get HTTP slash localhost slash my application slash hello slash Nicholas, so That's why roads have names On the controller side We have this function This kind of code. So this is really plain PHP code as you can see there's no No much dependencies. So we have just plain class no extend no Implementation of an interface and a public function say hello action for the name and That's the job of a controller returning a response Saying in this case hello name This class the response class is the same that Drupal hate Drupal 8 uses inside so you can do exactly the same in your own controllers returning a new response And you will take control of the full page if you do that. So if you return, you know the sharp markup array and Sharp markup with the value with HTML content this one in Drupal will be included Inside the default layout so you will have the Drupal layout and in your block You will have the output of your controller, but if you return a response You will take control of the full page from the beginning HTML tag to the end HTML tag And you can do whatever you do there even return non-h not HTML content. So Here we are It works So back to this That's the same exactly the same workflow life cycle that we did with Sylex But now we just did it with symphony and also Drupal 8 because it's exactly the same. So the request came in Broting did a job to map it to the controller the controller created the response and the response was sent back to the browser What about the debugging experience, you know, it's something really important in terms of you know Doing with dealing with code and having things working and all the time is not the case and we are used to you know Have things not working yet and to we need to be able to reflect the state of the application and to Get insights on what happens on how this application is configured So with the symphony we have the debug rotor Command on the console application and this displays all the routes that are Available for this application for the current state of the application So as you can see the last line there is our hello world wrote with a slash hello slash name path It matches all The method so HTTP method get post put delete so we could have restriction there all scams HTTPS or not and All host because you could have different controllers based on the on the host the local host also so on and you have also all the underscore profiler routes Which are just the routes that are required to make this Work so at the bottom of the screen. It's the web profiler toolbar You have exactly the same. It's white and not black. Okay with the devil devil model in Drupal 8 and So you have to and you should in fact if you not doing it already so install the devil model and Install also the in enable it the web profiler model and this will provide you exactly the same experience having Everything at hand in the bottom of the screen. So as you can see the total Generation time so 87 milliseconds for and something megabytes and a few other information. So for example It's a bit cut there, but we have a 200 Which is the response code HTTP response code then the controller. So we know that's okay That's not unexpected, but it's our say hello action and the polite controller The controller class root name. Do we have a session? Yes or no? We also have you know Security tokens security authentication authorization so we can check there Who we are for the application and we can see if did we log in to get this page is the application Knowing us. So in this case, we have a session and we are some anonymous user browsing the application If you click on anything on the toolbar, you'll get this profiler Pages so underscore profiler if you remember the roads and the previous screen So this will show you for the current request the one that was just displayed before The render time the number of template calls of block calls The details on the renderer templates. So in this case we have these four Twig files that were, you know loaded past the renderer and you can click on the other tab and to get a request response details performance log so all the logs can be consulted from this The event routing security twig. So this is for example the view for the profiler panel it's a really an Interesting view when you want to understand and to figure out what happened during this page rendering because you know sometimes it's a bit magic to Have a response and you know that Drupal did things, but you don't know what and in this case You can just look at this and have a quick overview what happened. So what happened there at the beginning there was some Section it's a black section. So it's kernel.request and in fact, that's an event. I will talk about that later So it's Drupal and Symphony work with events So this is the first event that is triggered when a request comes in There is an event that is dispatched and it's called kernel.request and this does call some listeners So as you can see in blue, we have several listeners That did something on the request So we have the debug hunglers, the dump listener, the session listener, the fragment listener, the router listener As you can see this one did most of the job looking at the time it took So that's really the listener executing the router Reading the URL and figuring out Which methods and which class should be executed for this particular route slash hello slash name Then the firewall and the local listener, the listener, the translator So security also is hooked on the kernel.request event And so on so we have the kernel controller and you can okay understand and get an overview That's really helpful not looking at the number because performance This is maybe not the best tool to deal with performance, but just to understand things better Okay, can we do even less work just back to our route and our control definition In symphony because you can use annotation to define routes. So instead of Creating this routing.tml file in symphony You can put configuration and code at the same place using this at route Annotation and using okay the slash the path in fact as first argument on this annotation And this is configuration and this is really useful because you know you have everything in one place and You know just by looking at the single file that the say hello action is mapped on the slash hello slash path name URL next topic services and the container So services services Drupal 8 symphony Have a container and the container holds services services are you know useful objects That do things so not all objects in your application are or should be services Only some of them are services So we are talking about a plain PHP object. So you create a new instance of my thing So anything it could be the URL generator the routing it could be twig it could be so Anything you have in Drupal is a service and services are Object that do things which means that they process Content, but they do not change state which means that you can call them twice Three times four times any time you want and you will get the same results at each time Which is very different from an object that can mutate state for some if you have some painter So an object that paints Some drawing then you can have a set background method on it And if you use that as a service it would be mistake because you could have some first part in your application saying set background red and Then the other part of the application using that but red background whether when they may expect it to be white at the beginning when they start drawing the The painting so services object that only do things and on the other side you have Data objects and data object is the opposite of services data objects are You know Date time so things that have almost no method on them But that they just hold some value and collection of values of properties and they can mutate and they can just hold the state and by splitting your application in you know services on one hand on Data object on the one. It's a really good design pattern and best practice to have clear and clean a code them splitting them So now the container so the container is logically some associative array that hold That holds the services Which means that services are object actually PHP instances and We give them just a nickname so they have an identity and the identity is this nickname so logger in this case It's a string Logger is the string the nickname of the logger object So at some point at some bootstrapping step in Drupal 8 or symphony We created a new logger. We don't know how but that's not our business so there is a logger and Drupal knows how to Instantiate it and this object that it created this new logger Has been stored in the container under the logger You know nicknames or key in the array. Okay, so really this is not an array, of course This is just a logical and technically the container is an object so the object has a method which is Almost the only one yet that you should use which is get so container get logger Which means give me the logger, please Okay, and then you get the logger So in silence there is a container which is not the symphony dependency injection container But which is called pimple which is another project Then in symphony and in Drupal 8 there is the dependency injection component from symphony that is used And he if you have it at hand You can get any service from it. So It's yes really preloaded with many useful features really And on symphony we have being console debug container This shows a map an array table really of all the services that are defined in the application In Drupal console, it's just Drupal container debug and we'll get the same output or almost the same In symphony we have two hundred and twenty built-in services, maybe more it changes a lot In Drupal, I think you have way more So if you want to dig and inspect one specific service You can I give it name the name of the service you want to Get more more therefore and get the details. So in this case we have We are displaying the service configuration for the twig service. So the service ID its nickname is twig the Class of the object is twig environment. So that's the actual PHP class of the twig service The tags is something we're going to talk about in the next talk in the afternoon Is it public or not? So can you fetch it by using get or not? Private services can't be fetched from the container Synthetic, lazy, shared, abstract, auto-wired and things like that. We'll see that in the dependency injection talk in the afternoon Okay, now we know that there is a container somewhere. How Do I get it in my own code because I want the features In symphony there is Property on controllers and if our polite controller extends from some base controller that is provided by symphony framework Then you get a property protected one. So from the parent class that is called Container and that contains the container. So you can use it to you know get twig and This is also a working example. So in this case, we are making our control better and using twig for rendering HTML around our hello message So we say container give me the twig service and we know by looking at the twig template class That there is all the documentation really that there is a render method there and the first argument is a twig File so that's the template and the second argument is the associative array of variables and values that should be you know used to replace the placeholders in the twig file and then we return the New response with the html. We just generated this way. Okay, but the same kind of things Drupal does internally when using twig You know to render things and blocks and things like that That's the kind of twig file You can use and So my name placeholder replaced with the Name from the URL There is no, you know security issue there because twig auto escapes the content So whenever there is some, you know Tricky name with html content there. This won't be displayed as html. It would be just escaped with the proper Cross-size scripting for So back to this We have the request routing the controller and now the controller is really you place to bootstrap and to wire So which mean using all the services you need to just build this page So you have a controller in the controller You have the container and the container has all the features that Drupal 8 provides that symphony provides So we just saw that we were using twig you can use the URL generator You can use the container factory in Drupal 8 to fetch, you know Default or user configured Values from the admin and this administration page on Drupal 8 and Use that to just craft your html and render the response and get back to the browser Okay, so the question is what else does symphony do or what else does Drupal 8 do The answer is not the question should be what lives in the symphony container What lives in the Drupal 8 container because this is really where features are the containers Some it should be something quite abstract, but yet it has a registry of features So some examples the doctrine or M We use it a lot in symphony. So we can get the entity manager from the container it's ready most of the time so doctrine.orm.entity manager and This will provide you the entity manager and you can get a repository for it and you know use that repository to fetch your entities and Persist modify your blog post and flush to you know save and update the database there You can use it also to get the database connection. So container give me the database connection and then we're going raw SQL requests with the connection in Drupal The same service is just called database. So it's not database connection. It's just database and there are a few differences like that Another service a more complex one we won't get into the details there There is a powerful yet complex form system in symphony. So Everything starts with a form factory service and with this form factory We create you know fields email username gender with a choice male female If the form is able to handle the request has been submitted and the data is valid Then we get the data we save it we update our entities so on so on and then at the end we can render You know the tweak templates which can display the form and there are some form helpers So in this case form start for the you know html form start tag from and and some helpers to render the Input tax and the labels and all the different fancy things to generate forms You can also of course do everything yourself So you are the request at hand and you can get the email from the request get the username for the request gender and Do anything one of that so with community vendors and with community so basically a model in Drupal 8 a bundle in symphony is just a way to you know define new services so models provide services and also create a few controllers a few roads That's basically what a model is what a bundle is you know services features and Routes which mean pages a few pages to a You know UX UI to So how do you create now your own services because that's what models do and that's what you Also should may have to do at some point So let's do this exercise So let's say we want to create some random greeting Feature so this one should be able to say hello or hey you or hola or ketal or anything else you want So that's that's the specification So where should we put this logic, you know selecting a random greeting sentence? Put it in the controller or put it, you know in some business logic class So it can be reused or flat function, but maybe not And let's do it In the decoupled way, so let's create a class whose responsibility should be just to you know randomly greet Some name so here is the class So we have a list of greetings that it knows about and then we have a function there and which Returns a string which is hola John or hello John or Get blame. I knew it was John So any greeting really so and then the content is really is easy around to get a random value there and Concatenate the name with the sentence business logic really The way to use that in your controller could be this one So in the controller you instantiate a new greeter and you get a random greeting from it You use twig or the templating service, which is the same in to generate the HTML and so That's it and you get the greeting and you displayed the page Next step now, let's say we'd like to log Which greeting was chosen so we displayed it And we want to log file with all the greetings that were generated over time How do we do that? We have a logger at hand in Drupal It's called logger dot factory and on the factory you have a get method Where you specify and it's your job to tell I want to log to the database and there is logger get database Way to get a real logger something which on which you can call the info of the log method to you know Put messages in the database in this case So in symphony, we just have a logger and the logger is configured somewhere else and the logger provides You know a PSL log log interface, which is a standard way to log messages in PHP and not only Drupal not only symphony really and Let's use it so We ask to the container Give me the logger and log this info message. We created the greeting greeting, okay? so we just use the container in Drupal in symphony to You know get the service and get the feature and log things in Drupal 8 You don't have a property like that. So in Drupal 8 if you want the container You have several ways one and the most low level if you can if you can say that is to Implement it's a container injection interface. So it's a special core interface So you implement this interface and implement it it means creating a public static function That is called create and then this one will be called with the container so the actual you object and in So it's a factory and you can return a new instance of our controller there with everything injected in the constructor I don't have an example. I Can show you later Okay, so now our controller is doing Logging but what if we'd like to have the random gritter itself log Maybe it's not the be the control business to you know log things Maybe we'd like the random gritter to log what it did. So how do you do that? So just copy-pasting the line we used in the controller This is taking the disk container get line and creating, you know, this info message Of course, this won't work because there's no container. This is a plain PHP class. There's no context There's no parent. There's no container property. So of course it won't work. So the way to do that is To use dependency injection so We add a constructor on our random gritter and in the constructor we Require a logger Argument and we store that logger into the property Okay, and that's it now We know and it's not our job there in this class to know how to instantiate this But we know that by contract by definition of this class. We need a logger so then Okay, if you want to be a bit more strict you can add the interface on the construct method so that you are sure that Someone no one will provide you with an array or with some, you know, request response any object that is not a logger So in this case now we are sure That we have a logger a real one that we know how to use and in back in our Controller We can know not back in the random return. We can just use this logger and Info because we have the logger at and now we have the property And then in the controller now we can just instantiate our greater and providing the You know symphony logger as a constructor and everything is, you know wired now and it works Basically Okay, so this is dependency injection. We just injected the the the logger dependency into the random gritter Now you can also tell symphony and Drupal 8 To do this job, you know creating the services injecting a logger there by providing it with recipes so This is a recipe for instantiating. Let's say my random gritter service So this is in service YAML file in app config and in Drupal 8 you'll find it in the You know my module dot service dot YAML file, which you know is there's just the Drupal way to Drupal place to put this Configuration so this configuration creates a new service my random gritter and it says to the container builder that this is This object this service is an instance of the app bundle greater great random gritter class So that the fully qualified class name of our random gritter and it takes one argument which is With a hat symbol which is the logger service that the containers the container knows about already Because of previous definition that we loaded and Drupal and symphony added there So that's enough for the container to create and to generate the code To create do by itself the new random gritter and give it the logger as arguments So if we use the console there, we can see that it worked and it gives us reflection in debug information So our service ID class tax cop container. That's something that doesn't exist anymore. Anyway And this is the way to use it so in comments the old way and now The new way is to call this container get my random gritter Which basically does exactly what the commented lines do but now it's the containers job to instantiate and do the wiring and Then we have our gritter and we can use it as a feature, you know service to randomly great someone Okay in the talk in the afternoon. I'll Show you many ways to you know Configure in sensation. So the previous Slide this one is just a simple one and there are so many ways to add Definition recipes for instantiating things So you can learn more in the afternoon about that Okay, now another topic events So events is really As you saw it's the first thing that happens in the symphony in Drupal life cycle So kernel dot request there are more events It's the hook system really in Drupal 8. So we have evidence hooks in the same So events Provide you a way to say hey when this event happened so cannot request If they execute this function, whatever it is. So let's do one Some events when the request comes so we saw that there is a kernel that request events then On the kernel that's requests. We saw that there is a listener there the routing listener. So this one is doing routing then We have the kernel that controller event which is triggered to resolve the controller Then the controller triggered which uses containers the container services When the controller is done There is the kernel dot view event that is triggered. We just Next let's slice are about the content of view when the response is ready we trigger the kernel dot response event and That's it for the main it are more but that the main event So you have the possibility to hook on each of them To do things at the beginning of the request at the end of the request at any time you need to So for example, what if The controller didn't return a response Let's write so Let's return an array. So let's say this array returns a template and variables so What will happen there? You will get the okay This is the actual error message you can see so the controller must return a response Or it fails you blew it Actually, you can do things with a return value of the controller and you can hook on the kernel of view event and You can have a listener that can you know listen for the return value of the controller and say, okay? I know how to deal with that array And I know I know how to build a response from it. So At the bottom of the screen we have this public static function get subscribed events And this is what is required by the interface on the top. So the event subscriber interface So this is the first step to wire an event listener even subscriber in Drupal 8 and in symphony So returning an array which maps, you know kernel dot view and a method there Which means just basically when the kernel dot view event is fired Please call the on view method on this very class Okay, so now okay, we have the on view event that is not yet wired because we have some definition To tell Drupal 8 and symphony that this should be registered in the container, but let's continue So how do we register that? Let's create a listener give it a name around the array view listener it's a class of Just the class created and it takes a twig The twig service as argument why that's because we know that our array is going to be rendered by twig So we need twig there to turn the array into an actual response using twig and what's missing there is this configuration So by adding a tag in this case the event subscriber tag you're just basically telling the container This is an event subscriber and you should give it to the event dispatcher service Which is something that already exists in Drupal 8 and in symphony And the container at bootstrapping stage will say will tell okay please give me all the definition that have this tag and Wire them in the event dispatcher so that the event dispatcher knows About them and can fire the listeners and the subscribers there, okay So doing so you can create the on view method. So We won't get into the details, but basically this is checking that this is the Result from the controller is the array. We are needing there And if yes, we could we get the template the variables we re we create render on the twig Service and we return a response there. So basically we just you know turned the array into an html response Doing it our way Okay, let's build something Building something is okay nice when you have already a skeleton something that you can look at and that's what symphony provides So we have a symphony demo Application so you can create a demo application using just symphony demo if you have installed at hand so this will download the code and Create this kind of directory structure so Abundant you know with common controllers that are fixed true because there is some model there It's a blog application entities for blog post comments event listener We just thought about them forms repository for you know set of that as twig and some interesting so It shows a lot many features of basic symphony application, but not that basic at all really and this is a kind of view you will get so This is the login page for the back end and there is a show source code so you can keep reading the code in the Demo application I'm almost done. So a few tricks And this may be the most important one Use PHP storm. I'm not PHP storm a researcher Yet, it's really great It provides if you enable the symphony plugin It will provide you with you know auto completion auto discovery for so many things It knows how services are defined so it's able to you know if you do container Get and it will provide you an auto completion for the list of existing services And if you select twig it knows by looking at the you know all the configuration there that this twig service has a render method So it's so helpful You don't have to you know, browse the code to figure out how it's Coded there There is this URL which provides a few introduction You know tutorial to Have more details on how to use that Okay, so summary use Salex of two servers use Salex to do simple applications really surely easy Use the plate Use Salex and Drupal 8 and symphony all together you can What did we saw in this talk? So What was all that about So terms to repeat in your head route controller response That's the life cycle we have services and services are provided by the container and we have evidence and listeners Listening for them. That's really the core of you know, Drupal 8 and symphony What symphony and Drupal 8 share they share the request and the response objects Which mean also the definition the class that's exactly the same code For roots controller response same again So same router same response and the control system is the same the event listener system is the same So this is the event dispatcher from symphony the dependency injection Component is used for container and so the definition of services is the same really The list of services so you can have the console and call debug container or container debug in Drupal Same thing for roots. So root or debug and the web debug toolbar is also Drupal 18 If you enable the devil and the web profile of models, which you should if you're developing and doing things like we just try to do Okay, you can use silence to learn Drupal. You can use Salex to use a tool on symphony. You can use symphony to learn Drupal. You can use. Okay. No and Finally we have More tools to solve problems. That's the point. Thank you You know if we have time for question almost no if you have a question yeah, and No, they don't need to in fact the container is able to you know Instance yet the container when you need it. Yes, it's lazy loading. Yeah, just use This subset and the container will instantiate this subset only. That's it. That's lazy loading. Yeah Okay, thank you You


All right. Hi everyone and thanks for coming to our talk. Relay in credentials has never been easier. How to easily bypass the latest NTLM relay mitigations. I'm Marina Simacov. I'm Yaron Zinner. We're both security researchers from preempt and today we want to talk to you about some of the vulnerabilities that we were able to discover this year. So we have a lot of ground to cover. Let's see the agenda for this talk. We'll begin with a short introduction to Active Directory. We'll see some common attacks and we'll focus a lot on the NTLM protocol. We'll see its design weaknesses, the NTLM relay attack and some of the, bless you, and some of the offered mitigations that we have against NTLM relay attack. Then we'll move on to talk about some of the vulnerabilities. We'll see some known vulnerabilities against this attack and then we'll see the new vulnerabilities that we discovered this year, allowing us to bypass all the mitigations against NTLM relay. We'll also show you how NTLM can be used in order to attack ADFS servers and we'll present something new that we like to call reverse care roasting and finish with some takeaways. I guess most of you are familiar with Active Directory but I'll give just a brief overview just in case. Active Directory is the main secret storage of the domain. It stores the password hashes of all the accounts and it's in charge of authenticating accounts against domain resources. This can be done using three different protocols, LDAP, NTLM or Kerberos and today we'll focus on NTLM, the NTLM protocol and the NTLM relay attack. So you might be scratching your heads thinking is NTLM even still relevant? And even though we've had Kerberos for quite a while now we haven't been able to see a single environment which doesn't, which disables NTLM entirely so if attackers can use it they can attack you using it and we'll tell you, we'll show you the vulnerabilities that we were able to find. So it's quite relevant. Now let's see the flow of this protocol. Let's say we have some user that wants to authenticate against some domain server. Let's see how the authentication process would work. The client would send an NTLM negotiate message to the server. The server would respond with a challenge and now the client would need to encrypt the challenge using the password hash of the user's account and send it back to the server in the NTLM authenticate message. Now since the server does not store the password hashes of the users it cannot validate that the challenge was encrypted using the correct password hash. So that's where the domain controller comes in. The server would send a net logon request to the domain controller with the challenge and the response and the domain controller would validate whether it was encrypted using the expected password hash and respond with an approve or reject response accordingly. One of the problems with this protocol is that the NTLM protocol is not bound to the target server. So if the server in the middle gets compromised it can relay the NTLM authentication in order to establish a connection against another server. This is exactly what happens in the NTLM really attack. Let's see the flow of this attack. We'll have a client connect to a compromised server using an NTLM negotiate message. So this can be done by attackers compromising server which users constantly connect to or by sending a phishing email to the user when the user clicks on the link an NTLM authentication is initiated. Now attackers would choose a target in the domain which they want to relay the credentials to and relay the NTLM negotiate to the target. Receive a challenge, relay it back to the client machine. The client would now encrypt the challenge using the required password hash, send it back to the compromised server and now all the attackers need to do is simply relay that last message back to the attack target and since the challenge was encrypted using the correct password hash the domain controller would approve the request and now attackers have an authenticated session against that attack target. So notice that at any stage the attackers did not have knowledge of the password hash of the user. All they did was relay messages back and forth between the client and the server and if that authenticated user is a local admin on the target machine attackers can now remotely execute code on that machine, dump files or entirely compromise their computers. This is a pretty serious attack vector. So let's see some of the mitigations that we have against this attack. So the two most critical mitigations that we have are session signing, we have SMB and LDAP signing and also we have EPA and channel binding which we'll be focusing on today and we'll show you how we're able to bypass both those mitigations. Okay let's give a brief overview of what each mitigation means. The session signing means that after the NTLM authentication is completed all the communication between the client and the server would need to be signed. Now the signing key would be derived from the authenticating user's password hash. So since the client has this password hash it will simply calculate it by itself and the server does not have the password hash so it will be getting the signing key from the domain controller in the NetLogOn response. Now if we have a relayer in the middle it will simply have no way to retrieve the signing key. It would not be able to send any signed packets to the attack target and the attack would fail. This is a very important mitigation. However unfortunately not enough servers enforce session signing by default today. Okay so let's see the flow of this mitigation will have a client connecting to a compromised server. Attackers would relay the NTLM negotiation challenge and response and then the attack target would send the NetLogOn message to the domain controller. It would also receive that session signing key. And also the client would calculate the signing key by itself so both the client and the attack target have the signing key. However the compromised server in the middle has no way to retrieve that key. It cannot send any signed packets to the target and the attack fails. Alright second mitigation that we want to discuss with you today is EPA enhanced protection for authentication. And here the goal is to protect NTLM authentications from being relayed over a TLS session. So the goal is to buy the NTLM authentication to the TLS session over which the authentication occurs. And the implementation is done by adding an additional field to the last NTLM authenticate message called channel binding. This field is based on the hash of the target service certificate. So if you have a relayer in the middle it would be using a different certificate than the attack target and the value provided by the client in the channel binding field would be based on the certificate of the compromised server. So if an attacker tries to relay that message to another target the attack would simply fail because of an incorrect channel binding field. Okay let's clarify this with an example. Again we'll have a client connecting using a TLS to a compromised server and initiating an NTLM authentication. Now attackers would target a server which enforces EPA and establish a TLS session relay that NTLM negotiate message, get a challenge relayed back to the client and here's the difference. Now when the client responds with an NTLM authenticate message the message would also include this channel binding field which would be based on the target certificate of the compromised server. So if attackers now try to relay this message back to the attack target the attack target is using a different certificate and the channel binding field would not be valid. So the attack would fail and the attack target would not need to verify the credentials against the domain controller. Okay so we've seen some of the mitigations let's now discuss some of the vulnerabilities we'll show you some old vulnerabilities which were previously discovered and then we'll show you how we bypassed all the mitigations that I've just presented. Thanks Marina for that great introduction. Offer the ears many vulnerabilities were found that allowed attackers to launch successful NTLM relay attacks allow review of few of them. So the first vulnerability I want to talk about is LDAP S relay. That vulnerability was discovered by our team in 2017. So as Marina mentioned NTLM is not protected by default from NTLM relay. To protect a specific application you'll need to either enable server signing or EPA. For LDAP servers on the domain controllers there is a GPO for enabling LDAP server signing. When that GPO is enabled the LDAP server would accept LDAP requests that are signed but also it would accept any LDAP request over TLS. This is sometimes referred to as LDAP S. This means that LDAP servers were completely vulnerable to NTLM relay over LDAP S. We have disclosed this vulnerability to Microsoft two years ago and they fixed it by enabling EPA on LDAP S sessions. It is important to note that LDAP is still vulnerable by default since the GPO is not enabled by default and EPA is not enabled by default on LDAP S sessions. The next vulnerability I want to discuss was disclosed in 2017 by Core Security by Alberto Solino. This is a generic bypass of NTLM server signing. So the attack begins like a normal NTLM relay attack. The attack target generates an NT a net logon message and receives a session key in the response. Since it enforces SMB signing we cannot launch an attack without having the session key. But as it turned out any machine in the network that knew the challenge and the challenge response could simply spoof a net logon message and receive the same session key. Once the attacker has a session key he can simply send any SMB packet that he'd like. So Microsoft fixed that vulnerability and the fix is a bit more complex so I'm going to dive deep into NTLM to explain all the details. The first part I want to explain is the NTLM challenge message. In the NTLM challenge message there's a target info field. This field contains constructs named AVPERS that identify the target. One of these fields is the net bios computer name identifying the net bios of the target NTLM machine. In the example you see you see the name test-01. When this message is received by the NTLM client the NTLM client will echo all the AVPERS fields that it received. You can see that it echoed the name test-01. But the important part is that when he signs the message the anti-proof STR signs all the AVPERS. This means that an attacker cannot modify or temper with any of the AVPERS and needs to relay them directly. So what was the fix that Microsoft applied? Microsoft simply compared the net bios computer name to the net logon originator. Since it's a bit complex let's review the flow. So again we have a normal NTLM relay attack. The attack target which is the legitimate target of the NTLM session sends a net logon message and receives a session key. Now the session will also send a spoofed net logon message. The DC would compare the net logon originator which is the compromised server and the AVPERS that identifies the attack target as the original target. See the discrepancy and simply reject the request. Since no session key was presented the attacker cannot use the SMB session that he just established. Okay that's it for the old vulnerabilities. Now let's move on to the new vulnerabilities we have discovered. Overall I plan to present, we plan to present three new vulnerabilities. The first your session key is my session key is another generic bypass for SMB and all NTLM server signing requirements. The second drop the meek is another vulnerability bypassing another NTLM mechanism the message integrity code or meek which we will explain later. And the third bypassing EPA. That's correct during our research we have bypassed all NTLM mitigations. Let's deep dive into the first vulnerability. So if you recall the fix I just explained for the 2015 vulnerability was for the DC to verify that the net bios name or in the end net logon message is the same as the net logon originator. We've asked ourselves what if we'll simply remove the net bios name from the AVPERS. So in the NTLM challenge message there's an AVPERS for the net bios computer name and we're the relayer we have full control over that packet. So we'll simply remove that field. Okay what happens if we remove this field? Now there's a series of surprising things. First the NTLM client receives the NTLM challenge message respects it even though it's malformed and generates an NTLM authenticate message. This NTLM authenticate message would have no net bios computer name since we haven't given no net bios computer name. The second surprising thing is that the NTLM server would accept this malformed NTLM authenticate message and would generate a net logon message and now for the third surprising thing the DC would also respect this rogue net logon session and would give a session key. Now once it gives a session key anyone can send this net logon message since it can't be authenticated whatsoever. So there is one last obstacle we need to overcome and that's the MIC. The MIC is a message integrity code that sign all three NTLM messages. They negotiate, challenge and authenticate. The MIC is there to protect from any tampering that is done to any of the NTLM messages. But wait we did tamper with the NTLM messages specifically with the NTLM challenge. But if you'll see the session key for the MIC is the same session key for the SMB signing. So what are we going to do? We're simply going to recalculate the MIC and send the NTLM authenticate message to the server. Let's review the flow. So once the attacker receives an NTLM challenge message it would tamper with this message sending a new NTLM message with no net bios computer name. The client machine would respect this message sending an NTLM authenticate message also with no net bios computer name. Now we'll spoof a net logon message. The DC cannot verify that this is the correct origin and we'll send back a session key. Now that we have a session key we can recalculate the MIC forward the new tampered NTLM authenticate message. The attack target would send a similar net logon message and we'll receive a session key. Now both sides have the same session key and SMB session is established and the attack can work. So I just want to emphasize one last thing. SMB signing is the only mitigation for domain controllers. This means if we're in possession of a privileged account NTLM session we can relay that session to a domain controller and establish SMB or RPC sessions. This means we can dump any credential in the domain or execute code remotely on the DC. This is a pretty serious attack. Now let's see a demo of the attack. In the demo we have two machines. One of the machines is a browser running a privileged account session and the second is the compromised server. Okay. That's strange. Let's try. Okay so first three. First we run the attack. That's why we made the video. Yeah. Yeah. No one said that hacking is easy. Okay. So the first the first time we run the attack without our exploit and the attack fails. If we look at the packet we see that the NTLM authenticate message contains a net bios computer name. So we can't spoof the net logon message and the session is not signed. You can see that the signature field is zeroed. This is why the server rejects the domain controller rejects our SMB packets. Now let's try running the same attack with our exploit. Okay so you can see two new fields. One is the computer's account hash. We need this to spoof the net logon message and the second field is the removed target removing the net bios computer name from the NTLM challenge message. So you can see that now the attack worked. We were able to retrieve a session signing key and we were able to dump hashes from the remote machine. Let's look at the network traffic to see what just happened. So okay the first NTLM challenge message as a net bios computer name. When we relayed it to the HTTP session there's no net bios computer name. The NTLM also doesn't have a net bios computer name. The net logon message is not present because it's encrypted. But you can see that we've retrieved a session signing key and the session is signed. Okay now I need to open the slide deck again. Okay so just to summarize with our exploit any machine in the network can get an NTLM session key and sign SMB sessions to remote machine. Okay we have disclosed this issue to Microsoft and they've issued a patch back in June. The patch works by giving NTLM servers the option to validate if the NTLM authenticate message. If the NTLM authenticate message contains no net bios computer name the server will simply reject the NTLM authenticate message. This works in general but there are some few caveats we want to mention. The first is that NTLM v1 does not have AV pairs. This means that the attack we've just presented will always work in NTLM v1 and it is unmitigated. The second is that sense patch is not applied directly on the domain controllers but on target servers. Older Windows versions and non mean Windows OS are still vulnerable. And the third maybe a little tidbit is that since again it's not applied directly on the DC any machine that even if it's patched was not restarted is still vulnerable. And in a domain with thousands of computers surely some are not restarted and are still vulnerable. With that I'm going to pass the stage back to Marina to present the two additional vulnerabilities. Yeah it's actually we'll be presenting three more so bear with us. The second one is drop the mic the message integrity code. So as Yaron mentioned the message integrity code is calculated by applying an HMAC MD5 using the session signing key on the three NTLM messages. And the goal is to make sure that attackers didn't tamper with any of the NTLM messages. Now let's see an example of why we might need this mic field in the message. Let's say we have a client sending an NTLM negotiate message to the compromise to some compromise server in the environment. And let's assume that this client supports signing and it sets the negotiate sign flag in the last NTLM in the first sorry NTLM negotiate message as you can see in this packet. Now if attackers try to relay this message to a target server that supports signing all they would get is a signed session with no way to retrieve the session key. Let's assume that all the servers are patched and attackers cannot retrieve the session key. So it's not possible what attackers however might try to do is simply to remove the signing flag from the message. In order to establish a non-signed session against that target. However this would not be possible because if attackers remove even a single bit from one of the three NTLM messages the mic would be no longer valid and the attack would fail. We have SMB clients that turn on this negotiate flag this negotiate signing flag by default and also use a mic. And this is why it was considered very hard or even impossible to perform NTLM relay from SMB to other protocols simply because the session would need to be signed. However other protocols don't set the signing flag such as HTTP so much easier to relay NTLM from HTTP to another protocol. Let's say we're persistent and we want to remove this signing negotiation flag from an SMB authentication. How can we do this? We've seen a way that we can modify the message integrity code but in order to modify it we need to have possession of the session signing key. Let's assume we don't have a way to do this. Well it turns out we can simply remove the mic from the message. We've actually talked to the few people yesterday that tried doing that but it's not enough to just remove the mic from the message. We also needed to remove the version field and change some of the negotiation fields. But at the end it was as easy as removing the mic entirely in order to bypass its protection. And the way we discovered it was quite funny because we were working on a completely unrelated vulnerability and the mic was interfering from what we were trying to achieve. So then we removed the mic from the message and continued to working on that other vulnerability. And at the end we had to look back and think wait do we need to disclose this one as well? Did we just find another problem? And turned out that we have. So by removing the mic attackers can tamper with any of the NTLM messages. Here you can see an example we have an original NTLM authenticate message which has the mic field and the version and our tampered authenticate message without those fields. Okay so let's see the flow of this attack. We have a client sending an NTLM negotiate packet to a compromise server stating that it supports signing. Now relays cannot relay this message as is to an attack target because they would not have a way to retrieve the signing key. So what they can do is simply remove the signing flag from the message and relay it back to the attack target. They would then receive a challenge and if the attack target does not enforce signing it would return a challenge and state that no signing was negotiated for the session. Now attackers can relay this back to the client and usually clients don't enforce session signing so they would accept it and send an NTLM authenticate message signing the required challenge and also adding a message integrity code to the message. However the message integrity code signs the messages between the client and the server. And the NTLM negotiate message that was signed was the one that states that it supports signing but attackers tampered with this message so they cannot relay the SMIC to the attack target. So they simply remove it in order to bypass its protection. Now the domain controller verifies the credentials, sends an approved response and attackers have established a non-signed session against the attack target. Let's see why this is even possible. Turns out there is an AV pair called flags inside the last NTLM authenticate message and if the second bit of this attribute, this flag's attribute is set it means that the client is providing a MIC in the authenticate message. However it doesn't matter what this flag states because the attack target upon receiving such a message doesn't validate that a MIC is present even if this flag is set. And this is exactly what allowed us to bypass this mitigation. So no one actually does the verification that if a client states that it provides a MIC, that it indeed provided a MIC. So we just dropped it from the message. Okay, let's discuss the fix. Now that we know what the flags attribute does, we know how to easily fix the issue. All Microsoft needed to do is for servers to verify that if they receive a flag's value which indicates that a MIC is present, just verify that a MIC is present. Some issues with this because some clients don't add a MIC by default and also, sorry, don't add a MIC such as Firefox on Linux machine or Mac OS machines. So those clients would still be vulnerable to NTLM session tampering. So attackers can still remove the sign in negotiation for such a client. But the more serious issue is they were able to bypass this mitigation and we have vulnerability that we like to call drop the MIC too. However, Microsoft hasn't patched this issue yet. So we'll have a blog coming about this in a couple of days. Alright, the next bypass that we want to talk to you about is the EPA bypass. So the goal of EPA is to bind the authentication, the NTLM authentication to the TLS session over which it is established. And some of the service that can be protected by EPA include ADFS servers, OA servers, LDPAS on domain controllers, or other HTTP servers which support Windows integrated authentication. Unfortunately, by default, none of those servers enforce EPA. So all of those would be vulnerable to the simplest NTLM relay attack. So attackers wouldn't even need to bypass the protection of the EPA. However, let's assume we have a very safe environment and EPA was enforced on all those servers. How can we bypass this feature as well? So the implementation of EPA is by adding an additional field to the last NTLM authenticate message which is called channel bindings. And this field, as I've mentioned, is based on the target servers certificate. And since attackers would be using a different certificate, they would not be able to relay this message to another target which enforces EPA. What they might try to do is maybe modify this field. However, that would not be possible because this field is also signed using the user's password hash. So attackers have no knowledge of that hash and they would not be able to modify this field. So we cannot tamper with the NTLM authenticate message. Let's see what we can do. Let's look at the NTLM challenge message. We know that when a client receives an NTLM challenge, it echoes the fields in that message and puts them inside the NTLM authenticate. So what happens if we compute the channel binding required in order to bypass EPA in advance? It is based on public values of the certificate and inject it into the NTLM challenge. What would the client do? Okay, so what the client would do is put our rogue channel binding field into the NTLM authenticate message. So we have a rogue channel binding inside the message signed using the user's password hash. In addition, the client would add an additional channel binding which would be set to all zeros. The only question left is what will the server do when receiving a message that has two different channel binding fields? Well, it turns out that it will only take the first one. And the first one is the one that we calculated in advance in order to fit what the server expects. So we're able to bypass EPA because the server simply takes the value that we computed in advance. So the last obstacle that we might have here is the message integrity code. So what happens is that we just modify the challenge message and the message integrity code is no longer valid. However, we already know what to do with the MIC. We simply remove it from the message. Let's see the entire attack flow because it was quite complicated. So we have a client sending an NTLM negotiate message to a compromised server and attackers now establish a TLS session against an attack target which enforces EPA and relay that NTLM negotiate message to the attack target. The target would send us an NTLM challenge message. We will compute the required channel binding field that is needed in order to bypass EPA on that server and inject it inside the NTLM challenge message. The client would respond with an NTLM authenticate message with the injected channel binding and an additional one which the server would ignore and also adds a MIC. We cannot relay this MIC because we modified the challenge so we just remove it from the message and we have our injected channel binding. The attack target checks the field, sees that it is compatible to what it's expecting and we're able to bypass the EPA feature. Okay, so now attackers can compromise that server which can be an ADFS and OWA or even a domain controller using LDS. Okay, so let's see a demo of this attack. Sorry guys for some reason the video is not working from inside the presentation. Okay, so what we'll show you now is that we'll have our HTTP relay server and when a client would connect to this relay server we would relay the authentication to a domain controller which enforces LDS channel binding. We'll show you the first attack which would fail without our vulnerability and in the second one we'll be adding our rogue channel binding and removing the MIC and we'll show you how we're able to escalate the privileges of a user to an enterprise admin by reeling the credentials of a privileged account. Okay, so first of all we run the HTTP server without our vulnerability and the let's connect to our rogue HTTP server and we can see in the console that the attack failed. We're trying to reconnect back to the target all the time and we fail. You can see that in the challenge we don't have any channel binding field. However, in the authentication the client sends this field to zeros and this is the one that we relay back to the domain controller. So we can see the channel binding is set to zero and this is not what the domain controller is expecting for the LDS channel binding so the attack simply fails. Okay, so we'll try to run it again with two additional fields. First of all we'll be removing the message integrity code and second is we'll be adding our rogue channel binding to the message. Let's see what happens when we run out vulnerability now. Okay, so we're connecting using our HTTP client to our rogue server and you can see in the console that first of all the authentication was successful and then that we were also able to escalate the privileges of a test user to an enterprise admins group. Let's see what happened in the network traffic. We can see that the original challenge didn't have any channel binding field inside but the one that we sent to the HTTP client does have one and this is the one that we calculated in advance. Now when the client responds to our message we see our rogue channel binding and an additional one set to all zeros. Okay, so now we need to relay this back to the domain controller. You can see this is the field we injected and this is the all zeros one and also there is no mick in the message, however the original message did contain a mick. And now the domain controller simply accepts our authentication. We're able to escalate the privileges of that test user to an enterprise admins simply by relaying the credentials and bypassing EPA by injecting our rogue channel binding and then removing the message integrity code. Oh, now it's working. Great. Okay, so that was the channel binding bypass. Let's discuss the fix. So the fix is pretty simple and it is based on, it's based on detecting a signature of this attack. So if a server receives an anti-LM authenticate message with two channel binding fields it would simply deny their request. Still have some issues with this as well because some clients don't support EPA and also don't add a mick. So those are the same ones that I've discussed in the previous vulnerability. Those would still be, would still be vulnerable to the EPA bypass. So attackers would still be able to inject a malicious channel binding. The client doesn't support EPA so it would not add an additional field and attackers can relay that to any target which enforces EPA. Okay, so our last vulnerability today would be how we can use anti-LM in order to attack ADFS servers as well. Thanks Marina. So we have discussed a couple of anti-LM relay vulnerabilities but anti-LM has other issues except anti-LM. First, if an attacker has possession of an anti-LM session he can use that session to do offline cracking of the user's password. Apart from that, using anti-LM, attackers can brute force or do perform credential spraying and password brute force attacks. We'll now discuss how we can leverage these features to attack the ADFS server. First, let's understand what the ADFS server is. ADFS is a server that allows users to perform claim-based web authentication using their domain credentials. The server allows users to use Windows integrated authentication as well as simple form-based authentication. ADFS supports both SAML and WFS Federation protocol. So in many cases you want to allow users to authenticate from external networks like the internet. Two common examples are OWA which is a popular Microsoft mail server and Office 365. A lot of networks don't want to sync their passwords to the cloud so they're using ADFS to authenticate Office 365. So since ADFS is a very critical server usually it is not open to external networks and typically you deploy an ADFS proxy that ADFS proxy receives the authentication requests and forwards them to the ADFS. Now I want to talk about our NTLM password brute force work and then we'll return to ADFS. So this time the rogue machine is the client machine and not the server machine. And if we want to brute force some user account we'll generate an NTLM authenticate message. This message could be over any protocol that supports NTLM. If we're dealing with insider threats this would probably be SMB since SMB is open on all machines in the network. But if it's an external attacker working from the internet for example SMB usually doesn't pass the firewall so it would be another protocol. For ADFS it would be HTTP. So if the packet is received by the server it would send an NTLM challenge message. This message will use our guest password and encrypt an NTLM authenticate message. The server would send it a net log on to the DC and if the password is rejected we know it's a wrong password and if it's accepted we've locked out and we've able to crack an account. The really cool thing is that in NTLM you can spoof the origin name. So if we look at it from the DC perspective the DC logs don't contain any IP of the attacker or the correct machine name. So if we'll analyze this log we'll have a hard time figuring out the attack origin. If we'll go back to ADFS and we've said that ADFS is open to the internet an attacker that has no physical access to our network can connect to ADFS and perform brute force attempts either with NTLM or with a form based authentication. So this is a pretty serious attack and it can have two consequences. If our network has account lockout policy if our network doesn't have account lockout policy at some point the attack would succeed some password will be guessed, accounts will be compromised and eventually data will be leaked. If our network does have account lockout policy it doesn't get that much better since now the attacker can de-dose our network with no physical access and lock all the user accounts. Microsoft is aware of this issue and they have an extranet lockout policy. When the extranet lockout policy is enabled the ADFS after a few authentication failures stop respecting authentication attempts that originating from external networks. So now let's move on to the vulnerabilities we have discovered. So as it turned out you could do windows integrated authentications from external networks to ADFS. This is a bit surprising but that's not it. We've found that if you use a Windows integrated authentication and specifically NTLM the extranet lockout policy is simply ignored. This means that we were able to bypass the extranet lockout policy entirely. We have disclosed this issue to Microsoft and they've issued a fix back in July. Now I want to, before I explain the fix I want to add one last note and this is about Kerberos. Sorry not all the talk is about NTLM. So we've asked the reason that the vulnerability worked is because the ADFS accepts Windows integrated authentication from external networks and we've asked ourselves can we also exploit this issue with Kerberos. And the answer was yes. So since our time is short I'll be brief and I'll mention that with Kerberos we can brute force only the ADFS service account. This is done by forging service tickets using guest password issues. We call this technique reverse Kerberos thing. This is a small attack surface but it has a huge impact. If we'll be able to crack the ADFS service account we can create any silver ticket and authenticate as any user to the ADFS completely compromising the ADFS infrastructure. It took us a while but we've convinced Microsoft that the correct fix was to simply block Windows integrated authentication from external networks and that's what they did. So what are the takeaways we think you should take from this lecture? First obviously patch all your machines. Second we recommend that you not use NTLM at all since it's very risky but if you use NTLM make sure all your servers are enforcing server signing and EPA. Third if you're using NTLM V1 please stop. It was already published it was already published that any NTLM V1 session can be correct since it's using weak desk encryption. We have now shown that any NTLM V1 session on fully patched machines can be relayed. Seriously just stop using NTLM V1. Some credits are in due. Ayal, Karnian, Segi, Sheinfeld from our team have also contributed to this research and Alberto Solino helped us integrate our code into IM packet. IM packet is an awesome tool that we use all the time and all the demos you've seen today were using IM packet. Okay so we recommend you stop using NTLM but if you do use if you can't resist we hope after this talk you won't get relayed. Thanks.


Okay, we're back live here inside theCUBE. This is live in San Francisco. This is theCUBE. We're here in San Francisco for GE's industrial cloud. This is our wrap up. I'm John Furrier with Dave Vellante and Jeff Kelly. And it's a big announcement by GE talking about their relationship with Pivotal Amazon, really expanding on the industrial internet, the internet of things. Essentially everything's connected from sensors to mobile devices to essentially the industrial of business internet. And our own Jeff Kelly was on stage with Werner Vogels, the CTO of Amazon as well as the CEO of Pivotal, Paul Moritz. And Jeff Kelly, the number one big data analyst introducing new research. Guys, welcome to the wrap up. Jeff, congratulations on your awesome presentation of the data. So let's talk about the event. Let's first get into it. You were on stage with those luminaries. And wikibon.org, Wikibon project introduced some significant research. Again, another groundbreaking report by Wikibon. Cutting edge in the emerging sector of industrial. What did you share with folks on the panel led by Beth Comstock, big time GE executive, and she was moderate on the panel that you were a domain expert on. So share with us what you talked about. Sure, well we talked about kind of the development of this new platform to really leverage the industrial internet and some of the requirements that such a platform needs to have. When we look at the industrial internet and what it's really all about, I mean there is certainly a scale question. There's the data in the industrial internet sector is growing twice the speed of other big data sources. But for me the real story is the potential value of leveraging all that data generated in the industrial internet. So when you talk about the industries that we're talking about here, we're talking about healthcare, we're talking about energy, transportation. These are sectors that touch all manner of society. They cross political boundaries, social, geopolitical. So the idea here is that really the value of bringing together all this data associated with the industrial internet, leveraging that data, analyzing it, optimizing processes and ultimately allowing companies in these critical industrial sectors to develop new business models, new ways to serve customers and citizens. It really impacts, you know gonna have much bigger impact on a kind of a relative size percentage, size-wise than the commercial big data world, if you will. So that's kind of where we, some of the key findings we had in our research. You had David Floyer on I think earlier today and he talked a little bit more about some of the numbers in terms of the spend. We see this moving to about a $500 billion spend environment in 2020, I think it's gonna create somewhere in the order of $1.2 trillion in value. So it's obviously a big opportunity, both for the vendors involved but also for kind of society at large. So one of the things that was tweeted about obviously the 2x growth of the data versus other sectors was one notable. The other one was this business value. Just elaborate on that. That seemed to get a lot of great reactions on Twitter and within the audience and among the panelists. This notion of value because the value proposition kind of is in the eye of the beholder. I'm sure he's driving some predictive analytics for ads is one thing. But you know for the example you use was getting medicine to a patient. You expand on the other areas of value that you point to here. Right, well as I said because of the very nature of the industries involved the impact of outcomes in those industries just are just kind of dwarfed in terms of their impact. Kind of just dwarf the value and the importance of some of the activities you'll see in the more commercial side of big data. And that's not to say that some of the things that we're seeing in the commercial side like retailers looking to understand sentiment analysis in the tweet stream for instance or place the next best ad in front of a consumer on the internet. But when you think about the outcomes in healthcare for example. So think about the consequences of delivering the wrong advertisement to a online web surfer versus the wrong medicine to a critically ill patient. Or think about the implications of a jet engine failing mid-flight versus not having a system crash that's supporting a commercial application that sells widgets. So they're both important, they're both delivered value but I think clearly on a societal basis we can most of us can agree that some of the healthcare, transportation, energy use cases are really going to drive significantly more value and just have a wider impact across society at large. Dave Vellante the co-founder and chief analyst at Wikibon, obviously the co-founder of Wikibon. Great to see your research up there being highlighted. What's your take? What's your analysis? Well, this is big as we've talked about. In fact, you and I John collaborated on a piece when GE made the announcement that's going to invest $105 million into Pivotal. And what was significant about that in the collaboration that we had was this is the next wave of big data apps and it was a real differentiator from sort of the traditional Hadoop distributions and we've always seen that as sort of a commodity. But I will say this, so this huge opportunity Jeff just talked about half a trillion dollar TAM. There's a lot of work to be done here and that's why I think GE is pretty ambitious.  So there's some real headwinds here. There's a real lack of data standards. These have to be developed and it takes a company like GE and it takes an ecosystem to allow those standards to emerge and it needs leadership. And GE, we heard from Bill Rose providing a lot of investment, a billion dollar investment over a few years. It's going to be up to I think a thousand, he said a thousand engineers in its facility out here. So they're putting the investments in but still again, a lot of headwinds. The other piece is there's real no industrial internet platform. We talk about the industrial cloud but so you've got sensors that are capturing data. They're processing data locally. They're distributing that data. They're connecting to other networks that will create value. They're providing what I call industrial analytics on top of that, no standards have emerged as to what that platform is. And I think that's what GE and Pivotal are trying to build out with its ecosystem. So it's a very early days. And I think the third really challenge here in terms of adoption is engineers. Engineers that are used to, hey, this works. I don't want to hyper automate it. I'm afraid to hyper automate it. So you're going to have to, there's going to have to be a cultural shift as well. And that's why you need a company like GE that is a recognized leader. And I think you need others. There was a question today about, well, what if another big competitor comes out and announces it's industrial internet? Well, let's hope they do. And in a way, IBM's smarter planet initiative now has really high quality company. I think you'd like to see Hitachi in here doing some similar types of initiatives and then coagulating some standards around that because this is an enormous opportunity that can have huge impacts on GDP, improvements in productivity, improvements in people's lives. Yeah, Dave, you and I have always talked about the, going back to the Wi-Fi wireless days, we saw sensors and you saw them on wireless devices. And I'll say with video surveillance post 9-11, that created essentially Homeland Security. Now we've seen all the dilemma with the NSA and surveillance, but ultimately now with mobile and connected devices on the consumer side, that certainly has shown the business model on the industrial or business side. You're talking heavy machinery, manufacturing, turbines, airplanes, telematics, a lot of automobile conversations in healthcare, et cetera. So the question I want to ask you guys is, that's great, the consumerization has led the trend. Jeff, what are you finding in the data with the technologies? Because still, we've seen the cloud war still on the consumerization side, as well as the IT side. So if it's consumer, IT, and then kind of industrial in that order, in terms of adoption, we're still kind of in the middle innings of the just consumer business, never mind the early innings of the enterprise play. What's your take on the stacks, the tech, and the offerings? Yeah, we're very much at the beginning of this process. I think the low hanging fruit, really, I think it's a very easy to understand business proposition when GE or someone else comes in and says, look, we can help you run your machines more efficiently using this data kind of on a machine to machine basis. But then to extend that to a network of machines, whether it's not just one wind turbine, but all the turbines that make up one wind farm and making those work together. As Dave said, the standards aren't really there to kind of connect all these devices, multiple different types of devices, different types of data. And if you think about the level of orchestration and workflow that needs to go into this, in order to really leverage this, where a machine creates a certain data type, analytics take place, it needs to kick off another series of processes, which then, in turn, create their own data, which need to be analyzed, then kick off more processes. So these all need to be connected, they have to be intelligent. So we're looking at things like machine learning open and hopefully commonly accepted standards to improve communication and networking of these devices, applications that actually deliver on value in terms of business value, in terms of real use cases. So there's a long way to go. Certainly, I think GE understands this. GE's an interesting position because they're coming at this from the machine perspective. They are the industrial equipment manufacturer maker. So they're coming at it from the machine perspective. You look at somebody like IBM, they're coming at it from the software perspective. So I think it's, in GE's part, a really smart move to partner with someone like Pivotal. They recognize that they were going to need the help of smart people like Paul Moritz and Scott Yard to help build this new platform of the future, and they're really going to try to leverage this platform to serve across all their lines of business. So Dave, I want to get to you in this wrap up, because this is where we kind of have to play your, you said you talked about horses for courses. Their races aren't even being run yet, so they don't even know what kind of horses they need to run on whatever course of it. So the message of open seems to be GE's take. So is that a good play for them? Obviously, it gives them a little bit of an option to play whatever that comes down the track for them. Yeah, well, John, I was going to say, and ask, I wanted to have you weigh in here, because one of the things I'm personally excited about is the degree to which open source is really now finding its way into virtually every technology business. Now, the latest is industrial internet. So John, I mean, you are one of the most, biggest proponents of open source that I've met. I mean, what's your take on this? Well, I think my, well, first of all, I love the internet of things. I've always been fascinated. Since 2001, really, when the wireless hit the scene, I loved, it was pretty obvious that this vision was going to take place, when and where, and to what the platforms would be, would be the question. I think now, to me, this industrial internet, this industrial cloud, I think it's just kind of pre-packaging of what will happen. And I don't think there's a name for that yet. I'll give you an example. To me, you know, in 1993, the word was information superhighway. That basically described the internet. And then, you know, Tim Berners-Lee started the web, HTTP protocol, and HTML became the web, and the web became what we all used. So back then, that was the word. So to me, this feels a lot like the information superhigh. Sounding, a really killer sounding word. It's impressive, but ultimately, that's not what became the reality in the marketplace. And I think that's something that I'm seeing. Also, with open source, you're going to see things like OpenStack and the Cloud Wars continue to expand. I think at the end of the day, it's going to come down to SLAs, who can deliver? Because I don't want my airplane turbine data going across, ops are down, plane's not functioning. So you need real time, you need really high-end ops. And I think that's going to be a challenge. I think it's going to be very early. What did Ed Double call it on the Cube? The data superhighway. The data superhighway. And I think he's right, breaking down the silos. But at the end of the day, data is like what packets were. So to me, another metaphor we brought up earlier was the local area networking days, internet-working, you know, TCPIP, as you remember, Dave, we was in the industry then, enabled massive wealth creation. You know, 3Com, Cisco, those companies were born out of that new standard. So to me, I think your question about open source is the issue. There are no more standards bodies anymore, in my opinion. It's all about the communities. Open source communities are the new standards bodies. And that is where things will get ratified. And I think from there, you'll see the market really lift. And then as people get direction, the fog will lift around where it goes. But ultimately that is going to be the detail-tale science. What happens in open source? What happens in cloud? And what happens at the edge of the network? That's mobile, that's probes. So software at the edge, that's data. And data, data will be the packet. So event management, processing, event streams, these are the tech. These are metaphors we've seen with network management. And again, networking. So I think networking is going to be a kind of paradigm. We'll see, instead of packets, it's data. And the stack I said of TCPIP is going to be some sort of interoperable fashion. And there's a lot of propriety in the machines that are installed, you know, that GE sells. And EMC's never really been a big producer of open source technologies. But that's the beauty of open source. I mean, you saw IBM turn on a dime. You know, Luke Gerson called it a recovering alcoholic. And they became a huge proponent of open source. And that, I think, is the beauty of this model. And then I guess the other observation is you've got companies like GE, obviously a lot bigger than EMC. But both of them, you know, it's the old Jack Welch. You want to be number one and number two in your markets. And you want to focus on markets that are large and growing fast. And that's something that I know personally from watching EMC all these years that they've done very, very well. Clearly, GE is going after, you know, a next wave of value creation for its shareholders and its customers. And so those are two very exciting trends that, let's just say, a lot of challenges. But challenges mean you need big companies with a lot of resources to solve them. And the end result, potentially, is a lot of reward. Well, that's to wrap up any final thoughts. Jeff, I'm happy to sit next to some pretty big names up there, Paul Moritz. Did you get him on, you know, put a Q plug in there? We did our best, yeah. Paul, you have to come on the Q, we're waiting for you. We've got a spot for you, Paul, whenever you're ready. The other fascinating thing that I found out, this was Leo who does the M&A for Pivotal laid out on the Q here, Dave, was fascinating because we've been watching the Inside Baseball on VMware, EMC for years. And to have him kind of give us some insight into a lot of the Pivotal gaming that was went on around how to organize, you say misfit toys, but the different components of VMware, which weren't materializing very well under the current, the old regime of VMware. VMware was too big of an organization, had too much legacy going on at the data fabric layer, and obviously, you know, vSphere and among other things with virtualization. That was just too much for Pivotal really to get any kind of traction. And to me it was just, they didn't have enough, you know, runway. Yeah, and EMC was a storage stove pipe, essentially. And so now they've extracted those and boom, put them into this hot new entity. It's a great move. My prediction is that you're going to see, you know, the architecture of what Leo put together with Joe Tucci, Goulden and Gelsinger, and Maritz is essentially an organization that's decoupled, okay, and highly cohesive. So you're going to see some great interaction. You're going to see Pivotal probably expand heavily. I think Pivotal's going to have a nice run. I think I've got all the elements. I've got a lot more work to do in the white spaces, which, you know, he didn't really answer the white space question, but I think clearly they're going to be on an M&A spree. I think for Pivotal it'll be interesting to see how they develop, because they have taken some heat in the Hadoop and open source community for taking a bit of a proprietary approach with Pivotal HD. And so we're here at the G event talking about being open and open standards and things like that, so. Well, they use open standards, but for their solutions, for proprietary. So again, this is going to be the question that we've always asked on theCUBE, will there be a red hat for Hadoop? And I think the answer is slowly becoming the only red hat of Hadoop will be red hat, which will buy Horton horse, possibly, or somebody else. So the only red hat of Hadoop will be whoever they buy. The red hat. And then the red hat will be the red hat of Hadoop, and they'll have their own distribution. But the answer was staring us in the face the whole time. I think the Hadoop distribution is a standard, but you can sit on top of it so that we're seeing some emerging paradigms there. Whether it's security or whether it's API management, that's going to be something we're going to watch. Well, and I do think to your point that Pivotal will have to become more of a contributor to the open source community. I think it's going to become a fundamental requirement over the next five years. And frankly, I think they will. I think the market will drive them. EMC, VMware, they're very market driven. So maybe they don't have to be the purest of Hortonworks, but. All right, no one's not suggesting they need to be purest, but one of the key questions about this business is where do you add the IP? And how do you monetize it? Open to proprietary. I mean, that's the equation that all these vendors need to figure out and they're all kind of taking different approaches. Right, but services is one way, but it's not the only way. It's a good way. I love services. Well, I mean, Dave points it out. I mean, many times on the queue, he has the guests today. It's the service provider, the technology providers, our solution provider is going to provide, you know, for every dollar they sell, the practitioners will be getting a multiple of that meaning the delivery or value. So, you know, I think to me that's pretty clear that's going to be the edge of the network. It's going to be app developers. That's going to be, you know, the in-between essential. I see Accenture, you know, essentially prototyping Accenture and giving that out to the channel. So I think Accenture's strategy is pretty relevant.   So I think that's where the action's going to end up going and if Pivotal can pull it off, that's where the developers will really make money. Well, and so you mentioned Accenture. IBM's obviously got the smarter planet. Tons of services there. You know, look for Deloitte and PWC to get into this game. I think they're logical partners of GE because there's huge opportunities and they have deep industry expertise as well. And those four are really the top ones. IBM, PWC, Deloitte and Accenture, the top four in IT. And I think you'll see them all doing stuff in this space. Right, well, let's not forget, looking at from the machine perspective, you've got GE's competitors like in technology, Siemens, you know, that whole. Hitachi, right.  So you're going to see this is going to be the next wave of activity. It's going to be among these players, the ones you mentioned on the software and services side. It's going to be on the industrial equipment maker side. Going to see a lot of strange alliances potentially and it's going to be really interesting to see how this plays out. Okay, this is the cubes, looking angles here on the ground in San Francisco, documenting and covering the emerging space of the internet of things, the internet of everything, industrial internet, industrial cloud, whatever you want to call it, Beth Comstock was on stage with GE, with their executives, Paul Moritz, Bernard Vogels, Accenture and Wikibon all on stage leading this trend and those are the companies that are going to start taking some of this emerging space. So great event, go to the hashtag industrial cloud to follow all the coverage, we have tweets, we have content, of course go to wikibon.org for their recent report on this. It is cutting edge and obviously go to Silicon Angle for all the coverage. This is a wrap up here in San Francisco and we'll be at the Velocity Conference starting tomorrow so keep on, keep watching theCUBE. A lot more events happen into the air and thanks for watching.