Aloha and welcome to another edition of Kondo Insider, Hawaii's show about association living. I'm back from vacation and looking forward to an exciting show today regarding foreclosures in Hawaii. I want to remind everybody that about 37% of our population lives in an association and the purpose of this show is to help owners and board members alike understand the obligations of living in an association. If you're following this and have a question, you're welcome to dial our hotline at<PHONE_NUMBER> and we'll do our best to answer it. Some of you may have read in the paper recently that there have been several class action lawsuits filed locally by local attorneys against current Kondo attorneys here in Hawaii alleging that they violated the foreclosure law and seeking large penalties for violating the law. So I asked a good friend of mine, Kapano Kiyakona, to come down who's a lawyer here locally to talk about these class action lawsuits and what the effect may be and what the issues may be. So welcome to the show. Oh, thank you. It's good to be here. Yeah, why don't you tell us a little bit about yourself personally? I'm born and raised here in the state of Hawaii. Actually born and raised in Kailua. I still live on the windward side. I grew up, went to Kalahau High School, I went away for school, came back right after. I've been doing Kondo law for at least a decade now and I've been enjoying it.  It's a tough business to be Kondo with you, you know. And how about the firm you work for? What do they do and how big are they? Porta McGuire, Kiyakona and Chow. We have 13 attorneys and we primarily focus on Kondo association law. We do some commercial litigation, some family law. And what we do is we make it our point to assist boards and assist the association in doing their job a lot easier. Would it be fair to say that when you look at association law in Hawaii, because you have 13 lawyers, you're probably the largest firm in Hawaii? I think we're up there. I think we're one of the larger firms. You certainly are one of the largest firms in Hawaii and certainly I've worked with your firm quite a bit as well as the other firms and I would say you're very good at what you do and you're very helpful to clients and boards and homeowners alike understanding their obligations. Before I begin on this class section, maybe just a little bit of housekeeping. Tell us the difference between a judicial and non-judicial foreclosure. Certainly. Judicial foreclosure, as the name implies, it goes through the judicial process. It means it's overseen by the court. You file a complaint with the court. You file motions with the court. They appoint a commissioner to go through the sale itself and there's a motion to confirm the sale. It's a long process and it can get quite expensive. A non-judicial foreclosure is outside the court system. It's handled by the attorneys. There is a set place on each island in each district where the foreclosure auction is to take place. Here the non-judicial foreclosures happen right in front of the Queen Lily Okolani statute by the state capitol. Now, taking just judicial foreclosures for a second and just approximate, briefly how long does it take and how much? The cost can range and it depends on whether you're able to serve the person or not. There are various requirements on that. But you're talking about cost at least $8,000 to $10,000 to do a judicial foreclosure. From beginning to end, how long? From beginning to end, again, that's a range, but normally at its earliest I've seen them happen with the lenders. I've seen one done in eight months, but that was an anomaly. It has often taken years to complete, yes. How about non-judicial foreclosure? What's that cost versus the timing? Non-judicial foreclosure, the large cost will be in your publication cost. That's where a significant amount of money comes from. But it can be done around for $4,000, $4,000 to $5,000. And how fast? From the point where it's given to the attorney, you can have something done within six months. Now, the difference between the two, in some respects, when you do a non-judicial foreclosure, you're really getting possession. You're not really assuming the lenders' obligation or the property taxes for an association. You're really getting possession, I guess, theoretically, so they can rent it out to help mitigate their loss of maintenance fees. Correct. The objective for the association is mainly to get people to pay, but if they take possession of the property, then their goal is to rent it out, recoup their costs, and eventually the lender will step in. Yeah, and so they're not paying that mortgage or absorbing the liability of having that mortgage. They just have gotten possession, and they're going to rent it out to try to help cover the lost maintenance fee and come for lack of a better word. Correct. I've always explained that to people, that four people went to dinner, and you get the bill for the dinner at the end, and only three of you have the money to pay for it. The restaurant's not saying, well, I'm only going to charge you for three people, I'm going to charge you for all four, and the three have to come up with the money to pay the difference. And very much like a condo, if you have 100 units and one person doesn't pay, their budget's based on everybody paying, so the remainder of your owners who are in good standing have to pay the deficit of an owner, and that's why it's important they foreclose promptly if they can't make a deal with an owner to catch up or make some kind of program, because I think it's very important that they foreclose promptly, and if they don't have someone who's willing to step forward and make a plan for lack of a better word. And I would add to that, I mean, if you look at it from the overall association perspective as well, what we've seen in some of our associations is owners talk, so they know that there's no consequence to not paying your maintenance fees, and so there are some unscrupulous owners out there who will refuse to pay their maintenance fees because they see there's no consequence to their neighbor for doing the same. And we're going to get more detail on this later, but just start to show by saying, give us a summary of what these class action lawsuits are saying. What are they alleging is being done wrong? Where do they feel there's a problem within the current statute? So the problem they're arguing about is for an old statute. The statute changed in May of 2011, so what they're arguing about is the statute as it existed prior to May of 2011. And what they're claiming is that under that statute, there were two parts. The first part was 6, 6, 7, 5 through, I want to say, 10. And then 6, 6, 7, around 22 to 43 or something. So you have part one and part two. Their allegation is that associations were foreclosing under part one, and they weren't allowed to foreclose under part one. They're claiming that associations were only allowed to foreclose under part two. And what is the difference between part one and part two? Part one is what the lenders were using. Part two had this weird provision that required after you had done the foreclosure that the foreclosed upon owner would have to sign the conveyance deed. So basically you foreclosed on an owner and they have to agree to that foreclosure. And so they'd make it almost, why do it if that's the case, right? Certainly, I don't know of anyone that was able to foreclose under part two. And when they amended the law in 2011, did they fix that part of it? Is that what they did? When they amended the law in 2011, they really kind of revamped things. So it made an overall change to both part one and part two. So it was a full alteration. I don't know if you recall, they had a foreclosure commission that went through and it actually put the brakes on non-judicial foreclosures for, I want to say, approximately a year. Well, yeah. So let's just kind of back up a little bit and talk about, in simple terms, the foreclosure process under non-judicial foreclosures. It begins with the association using the management company, giving what I call a 30, 60, 90 day warning. I don't look at those as fair debt letters as much as like late fee notices, more kind of notices before the legal process begins. And so my experience is most management companies or boards after 60, more likely 90 days are saying we haven't heard from you in three months. They turn it over to their attorney. And so what do you do then? We get it. We review the ledger, make sure we check the addresses and we send the demand letter. The demand letter expires in 30 days. If we don't hear back from them, we file a lien against the property. Once that lien is completed, we'll send another demand letter and let them know, hey, we're going to move forward if we don't hear back from you and if you don't pay. When that, if they don't pay, do a notice of default and intent to foreclose. And then you actually have, at the front of the Queen Lily Okolani statue, I think you said it wherever it was, that you then hold an auction. There's actually one more step after the notice of default and intent to foreclose presently. What happens is, is once the notice of default intent to foreclose is submitted, there is a 60 day cure period. Within that time, they can ask for a payment plan, things like that. Once that 60 days runs up, then you have a notice of non-judicial foreclosure. Is it fair to say that any owner who's delinquent, who unfortunately has this process initiated against them, has been given adequate, several notices? This doesn't happen by surprise, you know, that they've been giving lots of notice, a lot of opportunity to address the matter with the board or its attorney. Certainly most of the owners receive the notice. If they're saying they didn't, it's because they've skipped town a lot of times. We use whatever information they've provided, both the managing agent and the department of taxation, their property taxes. So we do what we can to make sure they get notice. It's always better for them to pay and keep people in their places. I would assume if the owner had died, let's say for example, it's probably then goes to probate court or some other, there's not some automatic foreclosure process where you have a deceased person that you can, it must slow down a little bit, they give them a fair opportunity to address that matter. Well, I'm going to give you the lawyer answer here, right? It depends. Because depending on how the property is owned, it may pass automatically to someone else. But if the sole owner was deceased, then there would be... But the important message is that owners are notified. So a delinquent owner, it's not a surprise to them that all of a sudden, how did this happen? I've read people in the paper say, I don't know. I came home and they were evicting me. I didn't know this was happening. Unlikely. Very unlikely, very unlikely. Especially considering notice is posted on the door of the foreclosure. Is it fair to also say that if you're an owner and you have a problem, the best thing is to get with the board and address it and try to find a way to solve it before... Because under the statute, these legal fees are going to be assessed against them. And if they're already having trouble paying their maintenance fees, more legal fees is not going to help them. Is it best to say that if you have a problem and... Because most boards that I know don't want the property back. They'd rather have a paying owner and have a payment plan, reasonable payment plan, that before they would take this action and the more you ignore it, you kind of force yourself into this legal proceeding, which is making the debt worth it worse. And so it's better that they go ahead and they try to meet with the board or discuss this with them. Absolutely, absolutely. And most of the vast majority of the associations give a 12-month payment plan. So you've got 12 months to pay off the delinquency. I think that's in the statute, right? That an owner has an automatic right of a 12-month payment plan. But I think that requires them also to stay current with their existing maintenance fees. So you could take your delinquency and you could then add that, divide that by 12 plus your current maintenance fees. And by law, the board would have to grant that to you. Correct. And I would just say from experience, I know where there's been problems and I certainly have empathy for homeowners who have gotten to some surprise. Maybe it's illness or death or loss of job. They don't want to lose their home and boards don't really want that. I've seen even some boards give longer payment plans to try to give people a chance to keep it. But where they take action is when they get no reply.  So I would just say in general terms, it's better to do that. It's better to stay in contact and please keep current on your payment plan. Boards tend to have some empathy for people. But if you're on your third shot at a payment plan, the board's gonna have some trouble with that because they have their fiduciary duty to their other owners. Well, this is fascinating. I got a lot more questions, but we're gonna take a short break. We'll be back in one minute, talk more about foreclosures in Hawaii. Aloha. Hello, this is Martin de Spang. I wanna get you get excited about my new show, which is Humane Architecture for Hawaii and Beyond. We're gonna broadcast on Tuesdays, 5 p.m. here on Think Tech Hawaii. Hello, I'm Marianne Sasaki. Welcome to Think Tech Hawaii, where some of the most interesting conversations in Honolulu go on. I have a show on Wednesdays from one to two called Life in the Law, where we discuss legal issues, politics, governmental topics, and a whole host of issues. I hope you'll join me. Aloha. My name is Reg Baker, and I'm the host of Business in Hawaii with Reg Baker. We're a show that broadcasts live every Thursday from two to two-thirty. We highlight success stories in Hawaii of both businesses and individuals. We learn their secrets to success, which is always valuable. I hope to see you on our next show. Aloha. Welcome back to Kondo Insider. We're here talking with Kapono Kiyakona about the recent class action lawsuits found in Hawaii against attorneys, alleging that they violated the current statute in their collection process for non-judicial foreclosures, and we're talking about how that whole system works and about that lawsuit. We kind of ended up with a discussion about the importance of owners, if in fact they have a delinquency, to reach out to their board and try to find a way to solve this because these fees mount up a lot of time because owners just ignore the demand letters and because they don't have an immediate solution or they're afraid of the consequences, they don't reply to all these legal letters and all of a sudden they're in foreclosure with a greater debt because of the legal fees and what not to put words in Kapono's mouth, but we were saying that it's highly unlikely, if not impossible, for owners to be foreclosed upon without a lot of notice. This isn't a surprise to an owner where all of a sudden they get a notice on a Friday and the foreclosure's on Saturday. There's lots of statutory obligations with regard to this. That is fair enough, yes. So let me see if I understand this class action well soon a little bit. So you have an owner who's delinquent. They've been given lots of notice from the management company, lots of notice from the lawyer, you follow the lien, you're given notice of the foreclosure auction. Under the statute, they have a right to a payment plan up to 12 months. And so yeah, but delinquent person who hasn't paid his bills and now they're trying to say the attorney somehow violated something, so you have to pay the bill. Basically. It's even more simplified and directed, I think. Their main contention is that the associations weren't allowed to foreclose under that part of the statute that they were using, that they had to use this other part that required someone to sign the conveyance deed. And how much, what are they looking for is for it? What is the claim? Is there a dollar amount or an estimated amount? Because it's a class action suit, so they're representing in theory a whole unknown group of people of hundreds probably. I haven't seen any specific demand yet on the numbers. All I did was read the newspaper and I believe they threw out a multi-million dollar number for that. I think it was tens of millions of dollars, you know. So where would that money go if they got any? Well, with a lot of class actions, a lot goes to the attorneys, as you'll find. I don't know. I think it's an interesting consideration, especially when you look at a lot of the foreclosures that the association did happened right before the lender foreclosures were completed. So you have these situations where you look at it and you say, okay, well, what are your damages because you hadn't been paying your mortgage for the last three years? And how are you gonna say that you were harmed by the association action? Right. I mean, I can see this, but to me they're arguing out of technicality. And I have a hard time personally understanding, are they trying to get their property back? Is that one of the claims? I don't think so. I don't think so. The claim is purely for monetary damages. They're saying they were harmed by the association moving forward with their foreclosure, exercising the statutory right of the association to foreclose. What was the association of harm because they didn't pay their bills? Oh, absolutely, absolutely. We had, when we took over for some, they had huge delinquencies of people because people weren't paying. And what it was is, if you recall that timeframe, it was sort of the leftovers from the housing crisis. People had walked away from homes and that was the problem many associations had to deal with. We had a project on Maui, which was I think 67 units. And mostly second homes, they may have used it for a vacation rental, but all of it legally and legitimately as far as the zoning and what they were at. But we had a third of the owners after 2008 simply walk away from their property, which means they weren't paying the lender nor they were paying the association. And if you can imagine the impact on an association of a third of your owners stopping their payments and how that affects funding reserves, how that affects just meeting the basic obligations to run the basic bills of electricity and pay them. So that particular association had to do a special assessment on a monthly basis for the deficit and cash flow lost by delinquent owners. And their hope was as they got through this non-judicial foreclosure process, because as you said earlier, that's quicker than the foreclosure process of a lender that they could get possession and at least mitigate that loss through renting it out, which seems only reasonable and fair to me. It's hard for me to imagine how you can argue that if you didn't do your job and pay your share, how you can say I'm harmed because of some technicality that exists with respect to this alleged foreclosure law. And that's what a lot of people, they have that empathy for the owners and they forget that the people that are paying regularly, like your project on Maui, they have these huge unexpected bills because other people aren't carrying their load. And all of a sudden you're left with the association, the board, the other owners are left with the idea of, okay, well what do we do? What do we need to do? How do we get these funds back? And foreclosure is a necessity. I think non-judicial foreclosure has been recognized by the legislature as a very important agreement to give fast opportunity to get possession of the property. Again, they're not responsible for the mortgage and not responsible for property taxes, but they're able to rent it out and get some cash flow. Oftentimes the rental income exceeds the maintenance fees and they're allowed to then keep the difference which helps mitigate the loss of cash flow. And of course, when a commissioner is appointed under the regular foreclosure, then that all changes. But it's a method to try to help restore the financial viability of an association. Absolutely. And the legislature, when they change the law, they recognize that. Because we all have a few more minutes left on the show, have there been any court hearings on this so far and what's happened with that? There are numerous cases filed on this, some class actions, some just single owners. There has been a hearing on a motion to dismiss filed on behalf of one of the law firms. And that hearing was before the line court judge, Judge Chang, and Judge Chang granted that motion. They dismissed it. He said, look, the association has the right to foreclose under the part of the statute that they were using. And so there's no claim against the attorneys for that. We are hopeful that the other courts will follow along with that. There are motions pending in other courts and we'll see how those come up. The foreclosure, the class action lawsuit, I believe is set for January with the motion to dismiss. So basically the attorneys have filed either motions to dismiss or motions for summary judgment saying this is not correct your interpretation of the statute. So they just want the judge to rule on a basis of the law that they had the right to do it. And so far, Judge Chang, on their first case to come forward, ruled in favor of the attorneys by dismissing the lawsuit. And I think he did for the most part that with prejudice. Can you tell our audience the difference between with prejudice and without prejudice? Certainly. If something's dismissed with prejudice, it means it cannot be brought again by that person. If it's without prejudice, they have the opportunity to change whatever defects there were in their complaint and file again. So that's a pretty solid statement. Yes, yes. Now is that probable or likely or maybe under the rules they can't do this? Will other judges know of Judge Chang's ruling? I mean like the federal judges and the other judges in state court that may have similar claims? They're likely to know about it. They're not bound by it, but they're likely to know about it. And we hope that they will follow his ruling. And as I said, Judge Chang is the judge that handles the land court appeal. So he handles these types of things regularly. He's seen it before. He's familiar with the statute. And so it's something that we trust he made the right call and we trust that other judges will see that. And do federal judges typically know what state judges have ruled and their deliberations? I mean, I'm not saying they're bound by it, but do they usually typically know other actions that have been taken place? As part of disclosures in federal court, you will list other cases that are similar that deal with the, that are somewhat related. And so they should know about this ruling. So it sounds like from your first case anyway, this case is going to have a short life. These cases may have a short life. We don't know how judges are gonna rule and every case may have some difference in facts, but the reality of the part two and whether the condos have the right, at least the first adjudication side with the attorneys that they follow the right process under the statute. Correct, correct. Now is your firm still doing that? Did I show foreclosures? Absolutely, absolutely. The thing to remember is these lawsuits are only challenging foreclosures that were started before May of 2011. So anything that happened after May of 2011 was done under a different law. So the arguments that they raised are inapplicable. Yeah, I can see that. And frankly, there's a degree of equity in this is that here you have a nonpaying owner who's been giving all this notice and still didn't make any arrangements to refuse to pay. And then all of a sudden he lost his unit to no surprise he should have known. Meanwhile, I had similar problems maybe with his lender and now he's saying, no, you have to pay me. There seems to be an equity in that concept to me, but you know. It is unfair, it is unfair to current owners. That's the thing. It's unfair to those owners that paid. So if you were a board of directors, what advice would you have that would you tell them that continue to collect money and do nonjudicial foreclosures? I mean, it seems to me not having income is very harmful to the association. Absolutely, absolutely. They shouldn't let us stop them what they're doing. Then the nonjudicial foreclosures are appropriate under law and they should go forward. They have a fiduciary duty to collect the maintenance fees. And when they stop doing this, that's when they get in trouble. Well, this has been a very interesting show today. And I think the message is that there have been some class action lawsuits filed and we've helped explain to you what the issues are before the association. But remember this, boards are fiduciaries. They need to have the money come in and based on their discussions with their attorney and what's the facts of our case, they need to continue to represent their board well and make sure that owners pay their obligations, in my opinion, under the current statute. Next week we have another exciting show. Condo Insiders every Thursday from three to 330. We hope you enjoy our content and we look forward to seeing you then. Aloha.


It is me, and in me it is considered the mental awareness month. So we have a psychologist in the building, she goes by the name Wilkista Juma, and she'll be telling us, we'll be talking about mental awareness, mental health, and just getting into it a bit and making sure that we are fine and checking out for our friends. Are we together? Wilkista, how are you? I'm okay. Welcome to the show. Thank you. So kindly introduce yourself, maybe tell us what it is that you do and where you work maybe. Okay, I'm Wilkista Juma, a counselling psychologist. Yeah. I work at Zittuck University as the student affairs officer in charge of placement and counselling of course. Yes, I'm so happy to be here today. We're happy to have you as well. So before we even get to mental health, I know you've had our discussion over here, and we're just asking young people out there, because it is young people who are watching this station, how would they want to start their marriages? Maybe the legal way or come with me. What are your thoughts about that and being a counsellor dealing with students, what have you encountered? Of course the legal way. Thank you. You want to be sure about what you're doing. There's courtship, friendship, and which leads to marriage.  I mean you have to be sure of what you're doing in that relationship. Yeah. Yes, of course it's a process, but legal way. The legal way. All right. Okay, okay. Meskia kutoka kwa psychologist mania. So let's get into mental health.   Yeah. It's about you feeling okay like psychologically, emotionally, and your behavior. It's about your thoughts and your thinking, the way you are behaving. The thoughts makes you feel something, then you feel your feelings and then behavior. Yeah. So it's a three thing. Three things. So it's the thoughts, the behavior, and... Your thoughts first. Your thoughts. Then you feel. Then you feel. Then you act. Then you behave. So it's about how do you think, how do you feel, and how do you act? I don't know. All right. So how would you support someone who is mentally well? Or how would we know them if they may be amongst us? You know them? Sometimes when you're having mental problems, the people who are close to you are able to tell you that the friends talk about it, family talk maybe about it. You feel it. You think. Okay. Today maybe I'll be able to explain to you how your thoughts are supposed to process things and how to know when they are distorted and the way you are feeling. Is it right to feel this way? When is it wrong? Or when are you having mental problems? And is it right to behave this way? Especially behavior. Most people will look at the behavior. Yeah, yeah, yeah. Yeah. They will look at your behavior and say kuna kitumbaya is something wrong with this person. But before the behavior, what are you thinking? What are you feeling? Yeah. Okay. When it comes to men, you've said that people will notice and we will get to see that. Maybe what are some of the conditions that mentally unwell people have? For conditions like symptoms? Mentally, kognitive. You will start thinking in a way that is not maybe okay. There are extremes. Extremes are when you start hearing voices. Yeah. Okay.  We call them delusions. Yeah. Delusions. We have different types of delusions. I don't want to use the kong terminology. Maybe if I give like two examples. Yeah, please. We have delusions of glanda whereby you start imagining you have power.  Superpowers. Superpowers to your superman somehow. When you start thinking, you start believing maybe you are the president of the republic, people know that you are not. You start some kind of power. You imagine that you have that power that you don't have. Suddenly you become that. Very rich. You become Bill Gates. Yeah. So... And you have delusions of persecution. But you feel like people... Are you seeing this? People feel like people are following them. Yes. They are following you. You are working at a place and people are like... Someone just start believing weird. People are after me. You know what you want. It's okay. Mazuri. Okay. Yeah, maybe there is something wrong with you. So the thought process is changing. Yes. So you start talking about things that are not real. That is maybe on the extreme side. But you can also feel very, very stressed. Very stressed. We have stress. We have depression. That's on another level. Sometimes if you are so stressed to the extent you cannot do your normal things well, maybe you are moving from this stage to a more mental situation.  You want to lock yourself in your room. Maybe you are at home. You don't want to talk to your parents. You want maybe with your gadgets. Socially you isolate yourself. Maybe there is something that is coming up. Then you see you withdrawn socially. You don't want to... You are not excited over the things that usually excite you. Like you used to love football and then suddenly you don't want to go. You don't want to watch that game.  You want to keep to yourself. Maybe there is a problem. There is a problem. Emotionally you feel like people don't love you. Then you start feeling very sad. You get so irritable. You start getting angry at things that are not... Even people are like, Hey, you need to take it over. How come you are so angry at that?  You are in a relationship. You are shouting.  It's your girlfriend. You are shouting at her. You can even become physical. You are physical. Sometimes you start feeling like you want to harm yourself. Or you want to harm the other person. Maybe someone else. You can even feel suicidal when it gets to a different level. So there are those feelings. And behavior wise we have conditions that people will just notice you are out of your mind. When you start picking papers you see. You start doing things, you become violent. As in you go to where people are, you start fighting people. Maybe that is on the extreme side. But somehow behavior is people will also know. They will know. That there is something off. Something is not right. Something is off. What causes mental illness? Mental illness is caused by different things.  It doesn't have to be hereditary. It is. One of them, the biggest is genetic heredity. You find that if say in your family there is someone, an uncle, an aunt, your grandparents had problems. Noticeable. Sometimes you keep on but people didn't know that it was. Yeah, it is mental. That guy used just to keep to himself. That guy used to not like doing things or dealing with people, didn't love social life.  There is a history in your family. So when you come for cancelling, the first thing is to check the history. So your genes, hereditary factors, those are point number one. Yeah. That in your family lineage, is there a person who ever behaved in a way that people felt it was not right. So that comes number one. Number two could be there is a problem in your brain. In your brain, in that some hormones are not okay. The way your brain is, it is not. That is biological, because it's all about your head and the way it functions. So if it is not functioning well, somehow you will develop this problem. And you have environmental. Environmental maybe you are living in a situation where you are so stressed. You are stressed always. Say, let's talk of GBV, a woman who is in a marriage where she is abused. Or a man is abused. Nowadays both. Both ways. Both ways. You are abused in a relationship. Be it physical, be it emotional, be it any kind of abuse. You can easily, it can easily lead you into mental problems. That you are so stressed that your brain at some point now starts having problems in the environment. Or just living toxic friends, toxic people, toxic family. That can lead to mental problems.  It's good to avoid such environments. Toxic environments. And then we have people who develop these problems because of the way they were brought up. When they were young, maybe they were abused. Something happened, rape, sodomy, or they were exposed to very severe, severe kind of stress or trauma. So they experienced what we call PTSD, post trauma. Yeah, post trauma to disorders. So they started having problems. Because of what you went through as a child. As a child, yeah.  Than you are, yeah. Yes. You can even get stressed by living with a boyfriend who is physical, always abusing you. How can we support people who are okay, before you even get to the support. What are the extremes of mental illness? Are there things that are very, like how do we move from, this is, is there a level of that is very extreme or very little and are both valid? Of course, yes. We have levels and we have different types of of mental illnesses. Like for instance, I don't want to place one mental problem to be higher than the other. But we have cases like schizophrenia, which get to the level we call psychosis whereby now you are not able to operate normally here. So I would maybe place it on a different level. We have depression, we have bipolar, which is actually some kind of depression. But we have stress, the normal stress. We have anxiety to certain levels. We have anxiety that needs medication and we have anxiety maybe that can be dealt with. And we have different ways of dealing with these things depending on how severe a situation is. And sometimes you are just getting into a mental problem that can be sorted. You can either sort it yourself, you can go for psychotherapy, counseling or you can get a medication. So if today I realize that, okay fine, I am stressed, but the way I am feeling, it's not usual stress. What do I do? Or how do I know that there is a problem here that I need to deal with? What do I do? Who do I go to? Number one, you have to be self aware.  So you have to be aware. You have to make sure that you are okay, but you cannot take care of others if you are not okay. If you are not okay. Taking care of yourself. So number one, you have to take care of yourself. Be aware. Know that once you've taken care of yourself, check the symptoms. Like I've said, when you check you have issues with mood, eating habits by the way, you are overeating or you are not having the appetite to eat, sleeping problems, you are oversleeping or you are not sleeping at all, irritability and all those. It is time to check the importance for awareness. People should be aware of what to look at. Now the moment you realize that okay, here I am and I'm having these symptoms, you see, then what next? The next thing is maybe to seek for help. I said psychotherapy, you can go for a counselor. You can go for like young people we are talking to, go to a counselor even in college like you see at Zitec there is the office that deals with that particular problem. Yes. If we notice that maybe you are having a problem people, the other students notice that maybe there is something that you are doing that is not okay or the lecturer has noticed they send you to that particular office. So that is the way it should be done. The people around you should be able to know that. Uyuza sa there is something which is not right and then they help. Okay, yourself you should be able to know that why am I getting so irritable? Why am I getting so angered? Why am I feeling the way I'm feeling? Why am I hearing voices? You know sometimes you can hear voices because you've taken drugs. Yeah. Marijuana, cocaine, they have that effect. Yeah, that effect on them. Which can also lead to mental illness by the way the drugs they can make you have or they can trigger. They can trigger if you have those genes then they trigger you and they are having those mental problems. So it's about yourself. It's about checking yourself. It's about checking your friends. After you've checked yourself, you've checked your friends then you know where to, either to send them to a psychologist where they can be helped. And then they self-care. You have to take care of yourself. I say avoid toxic people. Yeah. Toxic environment and then eat well. Of course, eating well and exercising by the way. It's not like the way nutritionists say that you should eat well and keep fit. No, no, no. It also has a mental impact. Yeah.  It is all about from your physical, physiological and all that. Yes. So how easy is it to get access to a counselor? Because I think these days there are so many people who are depressed. Let's just leave aside the extreme cases. Because people are depressed out here and maybe as students, students can easily access counselors in their schools. So what about people who don't have schools and you need a counselor where do you have somewhere, maybe you can advise people that they can get counselors there? Yes. We do have, apart from schools, these schools nowadays it's mandatory that we must have those officers in the tech. We have our own office work dealing with church. Then the government also has done something, I think there's a toll free number whereby if you just google it, you'll see it. You check and see that there's a place whereby you can just ask for a counselor and it is provided. There's a number that you just dial and you get a counselor.  Never take that young people, never take that lightly.  Yeah, it's a very big red flag. A very big one. So there's a toll free number you call. Kenyatta Hospital has a youth center whereby you can go and you get mental help for free. And maybe at the level of five hospitals, there's always a psychologist placed there for that because of the need that we have now. Mental health is a serious problem. It's a serious problem. Yeah, so how can we create awareness for mental illness so that people can be more aware and be able to take care of themselves and maybe their family and friends who might have a problem? Yeah, awareness. Like now that's, I think that's what we are doing in such forums. And then what we do, like I'll just give an example of where I work. We take that initiative to help even the youth that are not with us out there. Yeah. Just like last week, we had that program at Nyayo Estet. Just go talk to those people, those who have cleared high school, we tell them about mental health, what to look for, to know that you are having a mental health problem and where to seek help. Like to seek help. Yes, so that is the way we can create awareness.  And then maybe in institutions, that's where most young people are to tell them that this is happening. And the government I think is also doing a lot about mental health. Yes, people are realizing it. Yeah, it's very real. Yeah, and unlike the olden days where maybe what we want to say is we are in a rogue or something, like people are more open to knowing that mental illness is real and taking action about it. So I want us to wind up and before we do, maybe if you have a word of advice to the young people who are watching and maybe all the generation talk to them about mental illness and just sum up. Mental health illness is real. Very real. It is your responsibility to take care of yourself and the people around you. If you notice you're having the symptoms I've talked about, just seek help. Seek help before it gets too late. Yes. All right. So thank you so much for coming, Wilkista. We appreciate your time. I'm sure people have learned a few things about mental illness and they are more aware. And just like just as you've said, it is our responsibility to take care of ourselves. Is there any number maybe you can give for someone who wants to reach out for something, for advice, for guidance? If you're comfortable with it. Maybe you can write an email to Wilkista Juma. At ztec.se.ke or you can maybe call me. You can be of assistance or I can maybe send you somewhere. Yeah. If I give my number. 710. Yeah, you can. Kamerastri. 0710. 762476. All right. Thank you so much, Wilkista. We appreciate your time so much. And like I said, we have learned a few things about mental illness. It is serious and you need to watch out for the red flags. Are we together? Take care of yourself. It is your responsibility.  You've already had to wear places you can you can find, you can easily access counselors and sick help. Thank you so much. We are taking a short musical break.


Today in War Propaganda The New York Times has a new article out with the headline cluster weapons US is sending Ukraine often fail to detonate and the subheading the Pentagon's statements indicate that the cluster Munitions that will be sent to Ukraine contain older grenades known to have a failure rate of 14 percent or more If you only read the headline as the majority of people do You will come away with the impression that the news story being reported here is that the US is giving Ukraine weapons that are sometimes defective That sounds like a newsworthy story by itself, and it's the only information provided in the headline If you read the subheading in addition to the headline you would come away with the same impression You could even read the entire first paragraph and the first part of the second and still think you were reading a story about the US sending Ukraine subpar cluster munitions Not until you get to the final sentence of the second paragraph Would you get to the vital piece of information which explains why the world is criticizing the Biden administration for sending Ukraine these weapons quote? Years or even decades later, they can kill adults and children who stumble on them end quote The real story of course isn't that the US has failed to send Ukraine its pre-moment condition cluster bombs The story is that undetonated munitions will kill civilians and keep killing them long after the fighting stops a Correct headline for this report would have been something along the lines of Cluster weapons US is sending Ukraine will kill civilians for years to come But because the New York Times is a US propaganda outlet we get a headline saying oopsie Sometimes the little bommies don't go boom We saw another interesting instance of war propaganda in the mass media on Saturday with two separate articles Advocating NATO membership for Ukraine one in the Washington Post and one in the Guardian in a Washington Post piece titled Only NATO membership can guarantee peace for Ukraine mark the Essen and Stephen B. Gun Argue that once the war is over Ukraine must be added to the controversial Western military alliance They make the absurd claim that almost 75 years after NATO's founding the record is clear NATO doesn't provoke war it guarantees peace Which would certainly come as a surprise to the survivors of disastrous NATO military interventions and nations like Libya and Afghanistan No serious person advocates NATO membership for Ukraine while the current fighting continues right the Essen and B. Gun That would be tantamount to a declaration of war with Russia But it is equally true that after a ceasefire a durable piece cannot be achieved unless that piece is guaranteed by NATO membership This position in the Washington Post that no serious person advocates NATO membership for Ukraine While the current fighting continues was published just hours apart from a Guardian article by war propagandist Simon Tisdahl explicitly advocating NATO membership for Ukraine while the current fighting continues Tisdahl writes the following quote The main objection to this argument was summarized by the former US NATO ambassador Evo Daldar The problem confronting NATO countries is that as long as the fighting continues bringing Ukraine into the alliance is Tantamount to joining the war he warned but there are precedents West Germany gained NATO protection in 1955 even though like Ukraine it was in dispute over occupied sovereign territory held by East Germany a Soviet puppet in similar fashion NATO's defensive umbrella could reasonably be extended to cover the roughly 85 percent of Ukrainian territory Kiev currently controls and quote Tisdahl makes no attempt to address the glaring plot hole in his argument that West Germany was not at war in 1955 Or to explain how placing a NATO umbrella over 85 percent of a nation currently at war would be safeguarded against being drawn into the war Lastly, we've got an article from the Hill titled Bolton hails Biden decision to send cluster bombs to Ukraine as an excellent idea About professional warmonger John Bolton's enthusiastic support for the latest cluster munitions development and To be clear this is not a news story Reporting that John Bolton likes cluster bombs is like reporting that Snoop Dogg likes weed or that Flava Flav is fond of clock necklaces Obviously, he's going to be as enthusiastic about the prospect of children being killed by military explosives as a cartoon mascot for Children's breakfast cereal is for its company's brand of sweetened starch. He's cuckoo for war crimes As we've discussed previously John Bolton's presence in the mass media proves our entire civilization is diseased We shouldn't be looking to such monsters for analysis and expert punditry We should be chasing them out of every town they try to enter with pitchforks and torches The fact that we see his opinion mentioned as valid and relevant any time there's opportunity to kill more human beings with military violence Shows that we are trapped in a madhouse that is run by the craziest among us


This is stock number 11017B. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used Jeep and Jeep Grand Cherokee headquarters. Today we are checking out this super clean 2014 Jeep Grand Cherokee Laredo. This vehicle has a 3.6 liter Pentastar V6 motor. It has been fully safety to and inspected by our service shop has a fresh oil and filter change. All the fluids have been checked and topped off and this Jeep is 100% ready to go. Max Steel Metallic is the color we shoot all of our videos in 1080p 60 frames per second so if you have HD capabilities on your computer tablet or smartphone device turn them on right now because it is definitely your best way to check out the quality and condition of the Jeep before seeing it in person. And if you'd like to check out all the photos on this vehicle in the upper right hand part of your screen is a link to our website click that and check us out there. This one comes with the I believe there's 17 inch painted alloy rims they are and they have Bridgestone Duler HL tires. These are 245 70R 17s and these tires are very new on here. I'd say at least 90% of the tread left maybe even a little bit more. They look like they were just recently put on. Front fender is in excellent condition it does come with the projector lamp headlamps and the projector lamp fog lamps. Front bumper is in excellent condition I didn't see any dense dings or cracks on that. Headlight lenses are nice and clear and the hood is in really nice condition as well. The Laredo package gives you the chrome trimmed grille and Jeep logo. Passengers side front fender no dense or dings on that and the passenger side rim is in excellent shape too. As you go down this side of the vehicle take note of how clean the body is how reflective and mirror like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make a trip down but you're still interested in purchasing the vehicle you can see the vehicle hear the vehicle and have confidence in what you are looking at before you even get here so that when you do get here there are absolutely no surprises. That's why we offer the Summit Auto Fastpass option in the upper right hand part of your screen a link right to our website where you can apply for financing get pre-approved see a payment quote even appraise the trade all from the comfort of your own home so when you get here all you got to do is drive the vehicle love it you'd be all set to go you can still see the little wear knobs or the little wear bar right there from a brand new tire so the like I said these tires are basically new on here very very close to new but back rim no scuffs or scrapes rear quarter looks really good and as we come around to the back of the vehicle rear bumpers in great shape does have a towing package which includes a receiver hitch four pin and seven pin wiring the LED tail lamp running lights and the rear gate is an excellent condition to back storage area is very clean those seats do fold down for extra storage and it does come with a spare tire and jack tools I'll show you how those seats go down in just a second you can see the shocks are doing a nice job holding that rear gate up and as we go down the driver's side just as clean as that passenger side rear quarter looks really good and for full disclosure this back rim is in excellent shape as well down the rest of the side of the Jeep no major dents or dings does have the entering go system the heated power mirrors inside the Laredo package gives you the black cloth interior there are no rips there are no tears on the seats they are in very nice shape you do get a power driver's seat with lumbar weather tech floor mats auto headlamp and tilt and telescopic steering wheel power windows power locks power mirrors and you get that wood grain trim on the door we'll hop inside take a look at the instrument cluster hard to believe that there are whoa take a look at the instrument cluster here you can see that this one has a hundred and twenty two thousand nine hundred and sixty three miles you do get a digital speedometer compass and outside temperature display instrument clusters very nice and clean and you get the leather wrapped steering wheel cruise controls on the right bluetooth and information center controls on the left and this one does have the paddle shifters comes with the am fm and serious xm radio five inch touchscreen and you get dual climate controls right there as well and stability control does have that entering go system there's your key fob with your lock and unlock passenger side format and seat are in really nice shape as well no rips or tears i don't think this jeep's ever been smoked in smells very clean inside the headliner is in nice shape you get map lights up there and uh that's where your speakers are for your bluetooth device we'll take a quick look at the back seats and then we'll check out under the hood back seats are just as clean as the front seats no rips or tears back here does have the latch child safety system for any child car seats you may want to put back here no rips or tears once again and these seats do fold down for extra storage they go down pretty flat which is nice if you have to haul a bunch of extra stuff and then they have this cover so it doesn't nothing falls in between there and they go up nice and easily as well side curtain airbags on the grand Cherokees and you do get child safety locks on the back doors bottoms of the doors all look really good too and like i said for the age and miles on this age and miles on this thing this thing is in excellent shape we'll start it up here you can see there's no check engine lights or any warning lights on there and i would personally like to thank you for checking out the video today and hopefully from this hd video you will have been able to tell just how nice this grand Cherokee is all the way around inside no under the hood we have the award-winning 3.6 liter pentastar v6 motor engine bay is very clean runs very smooth this jeep has been fully safe eat and inspected by our service shop has a fresh oil and filter change all the fluids have been checked and topped off it has four like new brakes on it and this one is 100 ready to go i would highly recommend this vehicle from a quality and condition standpoint considering the age and miles on it and to see more pictures of this jeep or one of our other 450 new and used cars trucks suvs minivans wranglers grand Cherokees Cherokees you name it we got it on our website right there www.summitauto.com full pictures and descriptions of every single vehicle from two locations all at summitauto.com and if you'd like to check out more hd videos you can go to youtube.com slash summit auto number two like subscribe and share on this video and all the videos that you see there in fact in a second you will see a link to subscribe to our youtube channel and you left a link to more jeep grand Cherokee videos like this one on your right if you have not been on our website on the bottom link to this vehicle on our website click those check us out and we're super excited to be offering this ultra clean 2014 jeep grand Cherokee Laredo in maximum steel metallic thanks again for checking out the video


Ukrainian tank crewman said the drones changed the rules of war, while conducting training on November 2 in Zaparizhia region, the tanks, which were used to break through enemy lines now have little chance even of getting to the front line, according to tank battalion's chief sergeant, who uses call sign producer. The use of agile first-person view drones in battle has been one of the most successful of the various low-cost strategies Ukraine has used to defend itself from a full scale. Invasion by Russia, it's much richer and more powerful neighbor however, Moscow has also gradually mirrored and increased its use of these drones, which were originally made for racing by hobbyists and enthusiasts, but are modified to carry explosives to devastating effect. In the cold of the first year, it's your job to carry the drones. Plus, as the rules of war have changed now, now with such columns, where the tanks, BMPs are falling, there is no sense to conduct, because everything is developing, drones, kamikads have already appeared, you are not in a hurry to leave, as you have already declared, and the enemy is raising everything it has to destroy the tanks. As everyone knows, when you see a tank, the enemy is trying to destroy it in the first turn, because it is a very strong weapon, maneuverable, with a powerful armament. And the same with the enemy, when they see us, as we have always been a pilot, we first entered the front line of the enemy, interrupted the defense, it all was done by the tank. That is, now you are already, well, it is unlikely that you will reach this front line. It is necessary to develop a rap, to hear these half-drones, so that it can be applied to normal combat damage. Well, you see, in short, we constantly prepare, we collect our skills, we develop. That is, if there will be a team, conduct what people do, we are ready. That is, everything is in order, it happens. Take the third column, put the whole on the bottom, not on the top, not on the top, but on the bottom. What are you going to do? Here is the third couple of columns on the right. In the middle? No, from the first to the second. Third column.


Good morning, I'm Max Villalobos. I'm the Chief Operating Officer for NoR San Diego Towney. My name is Sam Toda. I'm the Chief Operating Officer for Kaiser Permanente and San Diego for the Xion and San Diego Medical Centers. And we're here to be able to participate in the ICCC as coaches, and we're looking forward to be able to give back to our community, but also to connect with some of our customers and some of these business owners who are looking to expand and grow their business. I agree, Max, and you know, for me as a pharmacist, you know, one of the reasons we got into healthcare is to help people, and this is really an awesome way that Kaiser Permanente can really deliver on their mission in a very transformational way, help to improve the health of the communities that we serve. Absolutely, and that's what we're about, and the 75 business that are here and owners who want to grow their business, who want to expand, who want to make life better for their employees by expanding their business are here, and we're here to support them, and that's why Sam and I want to be coaches to help them and to see how we can do it. It doesn't have to be in healthcare. It's just there are businesses that are right here that we, that live in our community and do business, and we want to be here to help them. Thank you.


He has published articles in several big German magazines, computer magazines, and he's an expert in packet capture and analysis. Jesper will be talking today about the various issues that can arise when sanitizing and anonymizing packet captures and how to deal with them. So please help me welcome Jesper to this talk on sanitizing packet captures, fun and games until someone uses IP version 6 or TCP. Welcome. Thank you. So welcome. I didn't expect so many people in this room because they have not news shows coming up soon. So if you're leaving in the middle of the talk, I'm not going to be disappointed. So just go ahead. Yeah, I'm Jesper. If you want to follow my stuff on Twitter, this is my handle. Okay. This talk is about sanitizing P caps. So packet captures. I do a lot of work reading packet captures. So you probably heard of the tool called Wireshark. I use it every day. And very often I have something that I want to show other people, but there's something in there that I can't let them know like IP addresses and other stuff that may be sensitive. So I need to sanitize them, remove all the critical information so that nobody can see what my IP addresses are, what my MAC addresses are because from the MAC addresses of you, which you probably know, you can deduct the vendor of the device quite often, not always, but in a lot of cases. So it may be important to do that before sharing stuff. Okay. So the first slide that I'm going to show you is going to surprise you because it has nothing to do with P caps. Once upon a time, I did something other than that. I worked on computer games like this one. I didn't write it, but I did the German translation. And also that one. It's like 20 years ago. I came to remembering those times when writing the talk because back then, I had to do something that I hated when sanitizing P caps as well. And that is using an hex editor to edit stuff because it's very complicated to get things right. Back then, in those times, when LucasArts and Westwood published those games, we didn't get any source code because you can imagine LucasArts back then was already very... Well, they're not giving things to you in a way where they think you could do something with it, like compile their game again or something. So they only got us the binaries. So I had to patch the German translation into the English game. Most of you know that most sentences in German, if they are going to be nice, are much longer than the English ones. So we're sitting there in the room translating the game and over thinking like, oh, damn, how am I going to translate this? It's going to be not longer than the English phrase and still sound cool. And that is a big problem. So it costs a lot of nerve to do that. I can show you how that looked like because I got the eye of the beholder binary here. You can see here there are all the strings in there, in the executable, unobfuscated, which was quite... In these times, it's quite surprising. Nobody uses plaintext strings anymore, right? Back then there were. And so we were editing in this all the time, translating the game. And that is something that I never want to do again, but sometimes with pcaps, I had to do it again. And this is what the talk is about, how to get a solution to that kind of problem. These days now, if you're doing computer game translation, of course, you get the resource files with all the translation strings and them and everything. So it's much easier, but back then that was really hard work.  It can be a PC or something special. And it's a file format. It's a binary lock, and that is something quite a number of people doesn't always recognize or understand because a lot of times we get questions about how to read it with a text editor. It doesn't really work. You need to have something to read it, and most people for this kind of thing use Wireshark. A pcap is an old format. It's used a lot still because it's easy to write and easy to read. The much better one is pcap ng. I don't know if you've heard about it, but I can recommend it because you can do much more things with it like putting comments into packets and stuff like that. But still a lot of tools only can do pcap, so we have to still work with it. TCP dump writes it, Wireshark writes it. Well, dumpcap is the tool that writes it, but Wireshark tells dumpcap to write the stuff and snort and everything else. So why sanitization? Yeah, first of all, it's quite similar for editing packets to be able to replay them, which is sometimes necessary to mess with them and play them back to the network and see how a device reacts to it. But it's a little bit different because your focus is not on changing the packets to test something, but to remove sensitive details, like user credentials or network topology.  Device and software version information, because as we all know, if you find a banner from a device that tells you this is Cisco router, something whatever, everybody will Google, is there an exploit for this? And if there's one, you try to attack it, so it may be interesting to remove those. Vulnerable protocol, of course. If you have telnet in your network, I would consider that a vulnerable protocol. But of course, payloads. So if you have something that is sensitive in itself and it's transported over the network, maybe you want to remove it because you don't need it for the analysis or something that you're doing later and then you can strip it. Okay, very often people do something like this. This is actually a screenshot that I have taken from one of the Wireshark Q&A sites. People post these kinds of screenshots of Wireshark and try to remove the sensitive stuff by painting over it. Sometimes it's really funny because you still have the hex decode down here and then you can, if you can read hex, still see everything. So that's also a danger that you have when doing something like this. You may miss something that you need to sanitize, but you didn't, well, see that this is also the same information. Most people never look at the hex in Wireshark, so they don't realize that everything that is in the decode area is also in the hex area. That isn't, so that's okay. And if I'm going to analyze something, somebody shows me a screenshot like this. Very often my answer will be, first of all, nice, but I can't help you with it. Get me a P-CAP. If you can't get me the P-CAP because there's the IP addresses that you don't want me to see, sanitize them. Replace them with something else. Okay, and this is what we're going to talk about. So there's two main groups of people that want to sanitize packet captures. That's, first of all, the network analysts, and a lot of them are, for example, guys working in a company. I had one occurrence where a firewall administrator told this boss, okay, this firewall company wants me to send them captures from what our firewall does so they can debug why it's not doing what it should do. And the boss said, well, we can't do that because there's sensitive information in this network. And they're at a kind of a deadlock, like the database, the firewall vendor says, I can't help you without the P-CAPs. And the customer says, well, I can send you the P-CAPs. So what do we do? Well, you could sanitize them and remove everything that you think is critical. And then hopefully not remove too much because if you remove too much, the firewall vendor will say, well, with this, I can't see what the problem is. So you're always trying to find the right balance between removing stuff so that nobody sees your IP addresses and whatever, but not so much that it is unusable. And sometimes I see people removing so much stuff that it's basically unusable. So you need to find the right amount of sanitization. As a network analyst, you need packets up to the TCP layer because if things go wrong in a network these days, it's most of the time related to how TCP works and what it does. I can see timing issues, retransmissions, packet loss, whatever. And I don't need the payload for it. So removing all of this payload after the TCP header is no big deal. Because a lot of networks have these obscure middle boxes. I don't know if you have seen any of those. These can be things like packet shapers, firewalls, varnexer, raters, all these magic boxes that do funny things with TCP but don't get them quite right all the time. So in that case, you can lose everything above TCP. All the payloads doesn't care. Don't matter. And sometimes you still need stuff like FQDNs, so DNS names, things like this, or URLs, and then things get complicated because then you're on top of TCP, so you're in the stuff that is transported over UDP or TCP, and replacing those can be a big nightmare and I will talk more about why it can be a nightmare. Security analysts or researchers, they usually have other stuff they care about because they don't care about Ethernet, ARP, IPv4, TCP, UDP. Not that much at least. And if you see an ARP-based attack, well, okay, then sanitize the MAC addresses and you can still see the attack going, but from different MAC addresses, it doesn't matter. As you can also see here, I intentionally wrote IPv4 because nobody cares about IPv4 anymore because it's quite stable by now. That doesn't really work for IPv6 because IPv6 is still in a stage where it does crazy things sometimes and it may be interesting to see attacks that are based on IPv6, like extension header chains that you built. I don't know how many of you are using IPv6 already. Quite a few, okay. Not that many, it's say 10% maybe. There's a lot of things in IPv6 that is still problematic, so sometimes you need to see those. And of course, as malware analysts or security analysts, you often need stuff like the FQDNs, URLs, binary payloads, so you can't just remove them. So sometimes the kind of sanitization that you do is different if you're looking at it from a network analysis point of view or from a security researcher point of view. Okay, the challenge, as I already said, is don't remove too much to make it unusable, but remove as much as you need to not give away anything that you want to keep a secret. So you need to find the right amount of, well, replacement or removal, whatever. The second problem that we have is if there's only one packet that you need to change, that's quite simple. You can still do it in a hex editor if you have to because, yeah, it's a lot of work, but it's just one packet. I put out a challenge like half a year ago or a couple of months ago at the Wireshark conference. The packets were in the range of, I don't know, a couple of million, and it was like a two gigabyte file. Editing those, because they were taking it to customer side, it was a real-world problem that I wanted to show as an exercise. So I had to sanitize 600,000 or more packets, and doing that with a hex editor, well, I would be editing to the end of my days, probably, so trying to replace everything that I needed. So for that, you need something else. You can't just do it with an hex editor or something that works well for just one packet. And I will show you a couple of editors that you can use for one packet, but not so much for many. The protocol complexity is another challenge. Most of you have not yet worked or played with IPv6 that much, but IPv6 has a lot of dependencies that can really make things very difficult. I'm going to show you an example of how difficult it can get, and you maybe see, even if you don't know much about IPv6, that there's a lot of things that you need to look at to be able to replace stuff that doesn't fall apart after sanitization, basically. You have protocol dependencies. Again, IPv6 or sometimes ARP and stuff like this depend on each other. So if you replace something in another protocol, you need to keep that replacement consistent in the next protocol. Again, something I will show in IPv6. And then there's something that a German university coined as a term, I think. It's called defensive transformation. Who's ever heard that, defensive transformation? It basically means if you're looking at a network packet and you find some kind of information that you don't know what it is for, drop it, because you cannot keep it. If you keep it, it may expose something sensitive. So defensive transformation means when I look at the network packet, I try to understand everything in the packet and everything that I don't understand, I will not write into the sanitized packet. So I will lose information. But it's better to lose information than to expose stuff that you don't want to be exposed, because very often in the end, you will find out, oh, I still exposed the IP address because it was still in the hex dump or something like this. So defensive transformation is a principle that you should keep in place to avoid mistakes exposing stuff. Thank you. Okay, hex editors. I showed you a hex editor already, so replacing packet content in a hex editor is quite a challenge. Even if you are able to... Well, I have Bill Murray here because it's sort of like a Groundhog Stay task if you do that on a lot of packets. It looks like this.  I use 101 editor for this. So, well, you can go in here and start replacing stuff. But you need to calculate IP addresses into hex values all the time. It doesn't make any kind of sense, not for many IP addresses. You can use search and replace, of course, but very often you will miss stuff. And I want to show you something where you can easily miss stuff, and that is in, for example, the HTTP packet that I have here. If you're replacing by bytes, for example, in the sketch request, you will see here IP addresses up here. They are 32-bit numbers, but the IP address of the X-Forward 4 here, that is ASCII text. So that is something completely different, but it's the same IP address. But one is 32-bits, the other one is much longer, obviously. We can also see that in the decode down here. The IP addresses are somewhere in here, and down here you will see the IP address as text. So you need to replace text and 32-bit numbers, and they need to be the same IP address. So you have to transform them all the time. This is really no fun at all, because it will also change the packet length if you do something like this. And if you change packet length, something really funny will happen. And I can show you that because I already did. You look at this trace there, it looks fine. You have a SYN at the beginning, a FIN-AC at the end, no retransmissions, no packet loss, no warnings from Wireshark Nothing. And I did a replacement of the IP address in the X4.4. And now the trace looks like this. You have a lot of red lines there. They're really small, I will make them bigger for you. It tells me previous segment, not captured, unknown segment. So this is something where a network analyst will get kind of, er, something is wrong here. I have lost packets, there's something missing here. No, there isn't. The only problem, and you can see that up to this packet everything is fine. The problem is that I replaced the IP address in here, which was 192.168 something longer than this, actually seven characters longer, with something shorter. And that means that every sequence number in TCP following this packet will be seven bytes too long. So Wireshark will all be like, I'm missing seven bytes here. There are seven bytes missing. There must be packet loss. And it goes through all the packets because every sequence number after the packet that is shorter or even longer will be off by the amount of bytes that you replaced. So you need to then go into every packet and adjust every sequence number, but only after you did the replacement, not before. So you need to keep like a lookup table, like in which conversation did I please replace in what sequence number, how many bytes, and how much do I need to adjust this. And you can do multiple replacements in one conversation. So you have multiple points of now I need to add seven, now I need to remove 14, now I need to add 25. It's really a nightmare. So this is why TCP very often can be hard to sanitize correctly if you're going into replacing stuff in the payload. This only happens if you're in the TCP payload. It doesn't happen if you change anything in the TCP header. Okay? All right, so this is how you do the menu replacement. There's also something in Wireshark that I don't think many people have seen. Who has used Wireshark before? Oh, most of you. Okay, good. You can do this. You can go into Wireshark. This one is, I hope the correct version. This is 2.1, well it's quite new. I use the legacy version. Legacy means it's GTK based. That's the old one. And in here you can go into Edit, Preferences. And down here there's a checkbox for Enable Packet Editor. And with that you can now go to any packet and say Edit Packet. And now I can go in here and for example change time to live and say, well now it's 63. Okay. And instantly, of course, the checksum is wrong because I changed something, right? So if you're doing replacements in a packet you always need to fix the checksum. Really always? Well sometimes you have packets where the checksum is already bad in the original. So what do we do? Do we fix it in the fixed version? Hopefully not because you kind of remove the symptom that the checksum was wrong from the packet. So you need to keep it bad if it was bad but keep it correct or recalculated if it was correct. So something else that you need to keep in mind like, oh was the checksum okay? Well replace it. Stuff like this. Well this is something you can do with Wireshark but only in the GTK version, not the new QT version. Okay. Then the other thing we have is wire edit. Wire edit is a relatively new tool. You can use it to, well what's my desktop? Oh it can only work with pcap and cap files. It doesn't know pcap and g. So I need to save this as pcap first. I should have kept an example in pcap format but I didn't. Test.pcap. This is just a FICON version. Don't worry there it is. And now you can go in here and say, well I want to edit the packet. Well it's kind of confusing because you think you need to edit something here but down here there's everything in that packet. And now you can say, well I want to change the host and want to write in here www.packetfood.com. Let's say I want to change it to www.lock.packetfood.com. Okay. And the good thing about wire edit is it will automatically fix the checksum. So you don't have to worry about it. You can also add stuff, remove stuff and you will run into the same problem as the sequence number. Okay so that is wire edit. And again if you do the manual stuff you need to have Bill Murray on your side and stay in the time loop because it will take a lot of time to do this. Okay if you do batch editing which means you're looking at replacing stuff in an automated way to a lot of packets, to many packets. There's a couple of things that you need to keep in mind like if you replace an IP address with another IP address you need to keep replacing the same original with the same replacement. You cannot just replace it with anything you want. It needs to be consistent. And there's a couple of problems with that because if you have a lot of IP addresses you need sort of a database to store stuff or you do a hash kind of thing so that you hash the original and use the hash as an output for the new IP address but very often that gives you funny IP addresses. So you can end up with 127.001 as the replacement when the original was 10.something else. You're like really someone's sending stuff from local host? I don't think so.  Bit twisty TCP rewrite are basically command line tools that are used to prepare packets for reinjection into the network so they're basically designed to help you modify packets for replace stuff. So they're not sanitizing tools by trade but you can use them of course also kind of sanitization. Then there's packet anonym, these are the guys with the defensive transformation. Then there's a new project. Basically packet anonym is a Linux tool that is using XML files to do automatic conversions on packets. It's also quite nice because you can pipe stuff from TCP dump directly into packet anonym that will write never the original to disk but only the sanitized stuff which is kind of nice. And you can define how strong the replacement should be if you want to replace the MAC addresses, the IP addresses and everything else. There's pcaplib which from my point of view is not such a good name because I don't know if you know this. Libpcap is the library that reads and writes pcap files and these guys are from China that probably didn't realize. They wrote a paper on packet anonymization and used that kind of name. So if you want to take a look at it they basically used the Wireshark sources to read and write packets in an automatic kind of way. So they have a nice project that hasn't continued since 2012 I think. So most packets sanitization things that you can find on the network are research papers and as soon as people have turned in their research papers the development stops of course. So it's out there, it's open source, go and use it and modify it but it doesn't seem that many people do. Okay and then there's the last one which is called Tres Rengler and that is my tool. So I'm going to show it to you. It's a bit different because it doesn't run on Linux except you use wine because it's written in Delphi which is not a great language. Only Russians use it I'm told. So Tres Rengler is for automated replacement of stuff and I'm going to show you a little demo. What you can do here is, or is it up here? So you add a pcap file or let's say, this is just one, and then you add a anonymization task and then you can tell it, well what do you want replaced? And one of the most important ones is this one telling it to remove everything that you don't recognize. So if Tres Rengler doesn't know how a protocol works please remove it completely. That way everything usually after TCP will be dropped because I cannot parse that many protocols yet that are above UDP or TCP but I'm working on it. So I'm not a research paper guy, I'm continuing my work so it will improve. You can also tell it to truncate after a certain layer or after a certain offset or replace some strings in here but the more important things usually are replacing IP addresses. So you can replace by a list telling it like, well <IP_ADDRESS> replace it by 10.001 and it will do that. For every IP that it finds no matter where it is if it's in an app packet or an IP packet or in a payload it doesn't matter it finds it it will replace it. Or you can go in and say well replace subnets. Replace everything that is in 192.168.00 slash 24 by 10.000 slash 24. Which is good because then all IP addresses from the original net will end up in a new net and not in completely different networks because very often if you randomize stuff everything will end up in different crazy networks and you're like why are these two IP addresses talking to each other? The one is in USA, the other one is in Germany. What are they doing with one hop between them or something? So that doesn't make any sense. It will do a lot of this also automatically if you randomize IP addresses it will keep multicast addresses multicast because that's another problem. If you have a multicast address and you're randomizing it it could end up like a lupic address or a zero address or a private address which is not the same anymore. It's completely different then. Apipa, I don't know if many have heard the term that is the automatic private IP addressing thingy. If you do DHCP but you don't get one 169.254 something everybody has seen us and cursed them. If you have something like this in a trace it's quite interesting because that means DHCP didn't work so for analysts you don't want to replace them and on the other hand they're like randomly generated anyway so they don't post any kind of threat if you expose them. It doesn't make any sense to replace them normally but if you want to you can tell it to. And then documentation IP addresses are a special IP address range that is specifically for documentation so replacing those doesn't make any sense again. There's one for IPv4 or 2 not only IPv6 but few people know this. Okay and then there's something here that is called the private range mode which means I told Tracefrodinger to if you find an IP address that is 192 something or 10.something or 172.something it's already private. Please keep it private because I want to see in the end that it was private and don't change it into a public IP by mistake because then again I have something that it wasn't before. You can also go in and say well randomize it over the full address range or do not randomize it at all and keep all the private IP addresses private because it doesn't matter. Okay similar things you can do for IPv6 for ICMP you can decide which kind of packets you want to remove if you choose to. Then there's ICMPv6 and that is quite interesting and I'll show you Trace why IPv6 is such a big problem. 15, okay this is the last demo I think. If you take a look at this packet which is IPv6 so if you haven't seen IPv6 before now you do this packet is kind of problematic because if you know a bit about IPv6 the destination IP address here ff02 colon colon 1 and so on is a very special multicast address that is created for a search kind of I want to know where my neighbor is which used to be ARP before. ARP doesn't exist anymore in IPv6 for those of you who don't know so use ICMPv6 for this. This IP address is based on that IP address you can tell by looking at the last couple of bytes here you see they are the same so this one and that one if you replace any of them you need to keep the two of them consistent but they're different classes so that is a problem and the other thing which is even worse and by spotting the fffe in here every IPv6 administrator will tell you this this IP address was created from the MAC address so look at the MAC address up there and you will see it again that this here 026EA5 somewhere up there from there the destination is kind of replaced here it's like this so you need to look at the IP address the multicast address and the MAC address and if you replace any of them replace all of them so you need to change the MAC address then the IP address and the other IP address and that is something that Resslinger can do but nobody else so far I've seen which is it was something where I thought this is easy but it was a weekend of coding so it took a lot more time than I thought okay and Treslinger can even do work on crazy stuff like this I don't know if you've ever seen a packet like this yay Ethernet, MPLS, MPLS, Ethernet, IP UDP, GTPU which is a tunneling protocol IP again, TCP and if you want to sanitize this good luck because it's a lot of stuff but I can read all of them in Treslinger and do the sanitization for you and it should work if it doesn't send me an email I fix it okay so Treslinger can be downloaded and that's the last thing I'll show before going to questions if there are any it's downloadable here if you want to I didn't open source it yet but I will I'm still looking at the licenses I already asked you about it which one I'm going to use well I'm going to use probably GPL or something then you can look at the Tres at the Treslinger code also and well all of this already did talking and thanks and questions anyone with questions there are four microphones in the room you can go to the microphones now if not send me an email later that works too or Twitter or whatever yeah there we go right here you thought about the problem with the HTTP analyzing HTTP could you get a little closer to the microphone? sure the problem with anonymizing HTTP we have the IP also in layer 4 or 5, 6 that's not something you can address with packet wrangler not right now I wrote a well basically what Treslinger does it it reads the packet from internet up to the highest level it can pass right now that stops at TCP but I'm working on an HTTP already and then it replaces everything that it finds and reconstructs the packets from top to bottom so basically pulls it apart replace everything puts it back together that's the only way that you can do this and I've started working on the HTTP and I tried to get it done for ccc but I didn't because I didn't have enough time it will be the next thing that I do and then you can do it in Treslinger it's a lot of work because there is the reassembly coming into play most of you know probably what TCP or assembly means that means that you have to recombine all the payloads first because an HTTP request can span across multiple packets there are sometimes very long URLs that go from one packet over 4 or 5 more and you need to reconstruct it first and then replace stuff and things can get longer or shorter then you need to cut it into pieces again but they need to be the same size or they should be so you need to remember where the cuts were and what happens if you have packet loss and something is missing in the middle and it's like uh oh there must be a retransmission somewhere but where is it so you need to here get it here put it in there reconstruct it put it back there when you write the file again so I cannot even read and write stuff sequentially I need to read it try to put it together and then remember where everything was before I read it and write it out like in the same order that I read it so that's why it's a nightmare to work on TCP stuff it's really not easy um well far future maybe but I will do this for one packet stuff already so most HTTP requests are in a single packet unless they're very long and that will be something that I will do in the next couple of weeks probably do we have any questions from the internet um yes there was one question do you also anonymize domain names um right now no I don't but I'm really close to this because I can already read DNS but DNS is another big problem I have one slide on this if you're replacing FQDNs and you have something like testpacketfood.com and you replace it with somethingsecret.com that means that you replace packet food with secret comwithcom and test with something and if you then have abcdefpacketfood.com you need to remember that you replace this with secret this here needs to be replaced with something else so again you need to remember parts of the FQDN you need to pull it apart put it back together it takes a long time to get that right and I haven't gotten there yet but it's one of the next things I have to do because for the HTTP thing to work I need to be able to sanitize the hostname in the get request so that means first I need to be able to sanitize FQDNs that's the first step that I have to do and then I can do the rest with that I'm not there yet too much work at Airbus thanks thank you on the left side right here is there a command line interface not right now the problem with that is that if you look at the replacement parameters in trace wrangler and you see it's a big dialogue here to add all these options as a command line version would make it very long or you need some sort of a parameter file that you give into the program I put a lot of code into the GUI version to be able to make sure that the user doesn't do anything crazy that will mess with my program and that's why I don't have a command line version yet because then I need to sanitize the input first and that is a nightmare in its own as everybody knows right so sanitizing inputs even less fun than writing a GUI which is no fun at all next question with Wireshark you usually try to find a problem as you said networking or whatever and with Wireshark we did a lot of work to actually get it bulletproof to actually do the IP addressing and whatever correctly dissected how often does it happen to you that you actually introduce new problems into the captra file and how easy or how hard it is to actually detect this so if I get you right you mean when I read a pcap and write it again and do something wrong when writing it how often do I put problems in there I mean you're actually trying to troubleshoot something and you try to sanitize the pcap and then you send it to someone and then he try to analyze it okay and then you find something that I introduced by sanitizing it exactly okay yes that is a problem and there's something that I live in constant fear about because if I insert problems into a captra file that hasn't been there before I may lose reputation quite fast because basically I'm more of a problem than helping you so I try to make sure that this doesn't happen the last thing I usually do is when I'm able to read and write packets files I don't sanitize them at all I just read them, deconstruct them and write them back out again if that works and if I get an identical copy I'm relatively sure that I'm okay-ish and then I need to do the replacement and then there's a lot of checking if this is correct the good thing is I'm doing packet analysis for over 10 years now so I'm one of the most feared guys when it comes to Wireshark because I very often am in contact with the core developers and giving them hell about how Wireshark is doing things wrong I can spot stuff going wrong by looking at packets and the first thing I always ask myself is Wireshark wrong or am I wrong and very often it's 50-50 I'm going to ask the internet is there another question coming from the internet no question from the internet okay then we have one right over here thank you yeah it's been I think a decade since I looked at it but do you know about Argos yeah and Ranonymize that stuff I haven't really used it I have to admit the thing is that Argos is I think I've seen it to be web based from the front end kind of thing I have to try to take a look at it but I haven't used it yet okay I think it's mainly command line based but it uses its own capture format and does a lot of analysis itself the problem is that would be if you can you convert it to pcap yes okay then it is okay because what I don't like is somebody is writing an arbitrary protocol nobody else can read and then you want to give it away for somebody who only can read pcap so if you can do that well I have to take a look at it I wanted to write a tool that is fully under my control that I can tell to do everything I like and do not do stuff that I don't like so maybe I'm doing stuff that Argos already can do I have to take a look at it but thank you okay if there are no more questions then as Jasper said you can email him but for now please help me to thank Jasper thank you for the talk today