Hello, our citizens. My name is Chris. I'm a brain education instructor from Roarling Hills, California. Today we're going to focus on chakra healing. So we're going to try to cleanse, purify, and re-envigorate our chakras through kegong. So we'll start by opening up our feet about shoulder width. Try to grab the earth's strong weight with your feet. A little tuck of the tailbone. Find strong legs. First, we're going to become acquainted with all of our chakras. So our first chakra is our root chakra. It's in our perineum area, so I'd like you to squeeze it and then let go. So squeeze and let go. So as we start to bring focus, attention into the space, we start to feel tension, warmth. We've been our focus to our first chakra. Now, to help build a lot of strength, you can hold it and squeeze and hold and hold. This is a good way to help bring our mind, thought energy down, to start to recharge and heal our lower chakras. This is our physical health. Our second chakra, two inches below our belly button. So we're going to take the gentle fist and we're going to start to tap that second chakra. Relax your shoulders. You can turn your head a little bit. Let your body find a little rhythm. So your second chakra is two inches below your belly button and two inches inside. So you need to tap perminum for the vibration to penetrate inside two inches. Really relax your shoulders. Start to bring your focus to that second chakra. If you can keep squeezing, first chakra, that's amazing. Relax the shoulders. First and second chakras have a lot to do with our physical health. Our physical well-being, improving our digestion, improving our immunity. Now we're going to come up to our third chakra. Our third chakra is in our solar plexus area. So we're going to tap a little bit above your belly button, a little bit below your rib cage.  Now this is the bridge between our physical and our emotional. So sometimes when we tap here, there can be some tenderness, some discomfort. There might be some emotions that bubble up. So you want to let what arises arise. Breathe out. So as we try to heal these chakras, you're going to feel some feel too strong, some feel too weak. We're going to try to find that perfect balance in those chakras. Now coming up to our fourth chakra, it's in our heart. So we can tap our chest. Now if the fists feel too strong, you can tap the fingertips. Good. You might tap with your palms. And if you want even more intensity, you can tap pretty strong. But you're tapping over that fourth chakra. So a lot of emotions here surrounding the heart and the chest.  And you might find the urge to make a little sound. It can help clean and purify the energy of emotions very well. So if the sound bubbles up, let it come out. The louder the better, it feels really heavy. It's sticky. Good. Now our fifth chakra is in our throat. So we're going to tap gently, soft tissues. Good. So tapping around your fifth chakra. So you might tap around that throat. Good. Now this is the bridge between our emotional center and our spiritual center. So this is an area of transition here. So sometimes we feel a little stuck in terms of expression. Good. Or everything pours out. So we can find that imbalance in different areas. So we want to clean. So as you're checking in on each chakra, you'll find which ones are happy and which ones may not be as happy. Good. Now we're going to come up to our sixth chakra, which is our forehead, just above your eyebrow. Third eye, sixth chakra. Relax your shoulders. Don't build any tension while we're cleaning. Breathe out with your mouth. So tapping the forehead. And you may find that your forehead might feel a little tender, might feel a little prickly or sensitive. So your hands may start to travel a little bit around the forehead, eyebrows, maybe even over the temples as you're working around this sixth chakra. Good. Breathing out in your mouth, keeping to release. And now the final chakra, our seventh chakra is the crown of our head. So we're going to come all the way up here to the top. Good. This is the connection to the universe. This is the connection out at the top. So relax. This is where we pull in energy from the universe down to the crown. So we want to open up the whole line of all seventh chakras. Good. About 10 more seconds. If you feel strong, you can tap a little partner. You can tap a little gentle. You can shake the head. You can release the tension. However it comes up. Good.  You feel buzzing and tingling from all the tapping. So now we want to take this energy ball between our hands. We're going to connect this energy ball. So as you inhale, let it expand. As you exhale, let it contract, expanding and contracting. So we're going to use this ball of energy, pure fresh energy that we've just created. And we're going to clean and heal our chakras. So we're going to take our energy ball and we're going to pass it through our first chakra, which is in our primate. As we pull it through our body, we're going to pull the energy up. Our back to our second chakra and our lower abdomen and pull it through. And then down. I'm going to turn to the side so you can see. So as I inhale, I'm going to pull the energy up my spine to my second chakra. And as I bring the energy ball through, I clean, I heal that chakra and pushing the energy back down to the first chakra. We'll do one more time here at the second chakra coming up and through the body and down cleaning. Good. Now we're going to come up to the third chakra. We're going to do three passes at each chakra. So coming up to the third chakra, your solar plexus, pull the energy through and then push it down. So feel the energy drawing up your back with the inhale. Coming up to your third chakra, solar plexus and pull it through and pushing down. Letting go, cleaning away all tension. Inhaling up, coming through the body and exhale down. So you'll notice that the breath may start getting longer where you start moving faster as you go. We're coming up to the fourth chakra. Come up to your heart. Pull the energy out, clean the emotions of your heart and exhale down. Inhaling up to your heart and through and down. So you may start to feel the circulation of energy coming up your spine, coming down your front. Now we're coming up to our fifth chakra. So we're going to come up.  So allow your arms to move how it's comfortable. More important is the mind. It's coming up. Feel the energy come up into your fifth chakra and then pulling out, clean, exhale down. One more time, fifth chakra. And now, now our sixth chakra right in the brain, the pineal gland.  And pull, clean all the thoughts, heal the mind. Washing down. You may start to feel a lot of temperature in your body as all the chakras become cleaner, activated. One more time for the sixth chakra. Now we're coming to the seventh chakra. The seventh chakra isn't limited at the crowded head. So we're going to reach up as high as we can. We're going to connect as much to the universal. Reach up as high as you can. And then pull energy down. So connecting all the seven chakras. Feeling them more aligned, more activated, more healthy and vibrant all the way up. Bring down the sky. So we're going to take our hands to the outside. Gathering all this universal energy. And as you pull the energy down, feel your chakras coming through the seventh of your crown. Your sixth in your brain. Your fifth in your throat. Your hand moves. The energy moves through your body. Fourth chakra in your heart. Solar plexus third. Lower dungeon second. In the afternoon. Perennium at your room. Put it two more times. And healing up. Exhale down. Feel each chakra as they pass. Clean fresh energy. Healing each chakra as it passes. Seven. Six. These are physical power. Primary energy for our health and vitality. So gather all the energy down. Let your body sway. Close your eyes if you're comfortable. With each breath. Breathe in through your nose. Feel your second chakra. Exhale through your nose. Squeeze. Scan all seven chakras. If there's one that feels uncomfortable or needs some help. You can put your mind in that chakra. See the beautiful energy healing. Healing. Grab each little wire. Zeroing in on that second chakra. Slowly stop. Take a breath in. Shake out your body a little bit if there's any stress or tension. So through this chakra healing practice. We are looking to activate all the chakras. To purify all the chakras. So that our energy balances. As stable as possible. And that brings health and vitality on a physical. On an emotional. And a spiritual level. So thank you for joining me for this chakra healing. I want to thank you. And if you'd like to experience a full one hour brain education. These contact the body and brain center near you.


Hi and welcome to InterGioTV News from Berlin, diving into the world of innovation and geospatial technology. Over the next three days, more than 15.000 visitors from the global geo-community will gather here under the motto, inspiration for a smarter world. You will meet 560 exhibitors with their innovations and solutions from more than 40 countries and you may listen to almost 300 speakers at the numerous presentations at the InterGio conference and stages. Everything revolves around the importance of geo-data in our modern society. There will be a focus on smart cities, on BIM earth observation, sustainability, modern land management and cartography. And this year, InterGio will also take a special look at the maritime and blue economy as well as earth observation and global monitoring. A new content format called Unmanned Systems will focus on the latest UV technologies and applications. InterGioTV will be reporting for you every day from the heart of the action and you can visit us at any time when we are producing life here in hall 5.2. And traditionally, InterGio is always open the evening before by the organizer, dvw. InterGioTV was on site for you. InterGio 2023 was officially opened on Monday evening in the historical ambience of Berlin's Museum of Natural History. About 150 guests gathered for this significant event. Key figures from politics, science, research, administration, industry and associations were all present. Among them was F.I.G. president, Diane Dumaschi. Rudolf Steiger, the president of dvw, gave the opening remarks for InterGio. This was followed by speeches from Rita Schwarze-Lüer-Sutter, the parliamentary state secretary at the federal ministry of the interior at homeland and Stefan Machulik from Berlin's Senate. A highlight of the evening was a panel discussion on the importance of geo-information. Panelists included Jack Dangermond, founder of Esri, Boris Skoplyak, vice president of Trimble, Kathleen Broder from Hexagon and Barbara Ryan from the World Geospatial Industry Council. After this engaging conversation, guests had the chance to share their views and discuss potential future collaborations at the networking event. InterGio is year number one and thus the most important international congress platform and trade fair for geo-desi, geo-information and land management. As the market leader, it brings together the geo-spatial community and networks it with its user industries and Daniel Katzer is responsible for the management of the InterGio Expo and is looking forward to these three important days. We are looking forward for InterGio 2020, people traveling to Berlin want to network, want to see each other and yeah the whole branch is looking forward for InterGio. We have five halls here in Berlin covering with more than 560 companies, we have three stages with more than 200 speakers, we have a new format about unmanned systems, we are facing themes about smart cities, we have a BIM area here in InterGio, we have a special guest here this year on InterGio, Jack Dangermond, the founder and CEO of Esri and Cooperation and now InterGio is back again, nearly back again like we were facing in 2019 and that is not possible without the huge team behind us and making these happen. So thanks Daniel and of course everyone is looking forward to your visit and to visit InterGio, so is Christiane Salbach from the InterGio organizer DVW who is looking at the highlights for you every day. We look forward to InterGio 2023 in Berlin, we look forward to a high profile conference program. Be there when Jack Dangermond, CEO and founder of Esri, speaks in the opening session. He will tell us about geography and GIS, a platform for sustainability and don't miss the opportunities that Earth observation offers for climate adaption, smart cities, BIM and Geospatial administration. We also look into the future with talks on technology trends, the future of GIS and contributions on data spaces, cloud solutions and services. Enjoy the InterGio conference on Tuesday.  All exhibitors and products as well as the presentations and speakers can be found in the official InterGio app. And of course there is the official InterGio magazine, the InterGio report with great reports and information inside. So see you tomorrow for the keynote speech by Esri founder Jack Dangermond, who is opening the conference today and take a look at the expo and guests we will meet, for example here at InterGio TV in our studio. So see you!


Can we do it again? Can our role play with anybody else? This is what I believe. I'm sharing that with you for nothing.  What are you guys doing this morning? Doing well. Very good. Thanks for having me. You're the homeowner. Ring ring ring. Okay, I'm the homeowner. Yeah. Oh, hello. Hey, Mr. Homeowner. Mrs. Homeowner? Mrs. Homeowner? Is this Mrs. Homeowner? No. Oh, yes, it is. Hey, Mrs. Homeowner. This is Ricky Cruick with Remakes of Orange Beach. How are you doing today? Oh, I'm fine, but do you know what I really want? I got you. Look, I don't want to take up too much of your time. A house around the corner just sold. Didn't have to do anything in the world I could do for you. That's all. Well, that's nice, but you know, I really don't know how to do that. Well, listen, just real quick. Is there an agent you would deal with if you were to do something? Well, we've talked about it, but we're just not ready for it. Okay, well, I'm sure you will be in like maybe five or 10 years. I would love the opportunity to work with you when that day comes. Yeah, you have about five years. Okay, cool. I would love the opportunity to work with you when that day comes. Would it be hard if I just stayed in touch? Yeah, I can. Okay, cool. What's your email?   See, the thing is, is that's probably maybe one or two out of 10. Okay, now be the nice homeowner. See, like, the thing is, is I crushed her, you know what I mean? Like, like she was being the I'm too busy homeowner thing, but I just broke right through and I got to the part where she told me she wants to maybe do something in five years and wants her email address, right? So I crushed that. Let me give you the real one though, that the more realistic one, okay? Can I just tell you one thing? Yeah. I was doing a whole company before that, but this one, maybe I called her and I said, hello, this is Connecticut, I believe it.   Yeah. I'm not thought, okay. Can I tell you why that happened? Why? Because you asked her if she wanted to sell her house. Yeah, I said, I had to give her a thought about it. Right. You asked her. But I think that I had a little bit more to it, but it's something. But that's all she heard. Yeah. Okay? She might have, you might have said stuff, but that's all she heard. That's what's killing the industry. What's the dialogue? I just gave it to you, but let's do it again. You ready? Okay.  But no, I'm gonna be what just like.  I mean, if it's someone elderly lady, no problem. I think the thing is, is your stereotype in age groups to act a certain way on the phone. And that's horrible. That's a horrible way to think. There's so many diversity of people. It's your tone.  It's a real estate agent trying to sell me something. I don't want to be sold. Listen to what I've said. I don't want to take up too much of your time. A house around the corner sold. Didn't ever use anything in the world I could do for you. I just don't have time to talk. Okay, bye. Bye bye. Like business is unlimited. I can't call all the property owners. If somebody is just point blank, does not want to talk to me, and they're going to hang up or say they're kidding. I thought that was a lot of what. It's your tone. Your tone. When you're on the phone, people are going to create walls for people that they don't want to talk to because of your tone. If you call and you have this friendly, inviting voice. But you're asking them if they want to sell their house. That's the disconnect. You see what I'm saying? Is there anything in the world I can do for you? What did you say? That's the dialogue. That's it. You don't say you want to sell our house. They know what you're there for. You said you were at the real estate company. Okay, now it's like, can we do it again? Can I run a play with anybody else? Let me just do it with somebody else so you can see how it actually goes. Ring, ring, ring. Look. Hey, Mr. Homeowner. Hey, how's it going? Hey, I'm doing good. This is Ricky Kruth, Remax of Orange Beach. How are you doing? I'm good, Ricky. Good, man. I'm enjoying the day. Isn't it gorgeous outside? And it is. Cool, well look. I don't want to take it too much of your time, but a house around the corner just sold, and I didn't know if there's anything in the world I could do for you. Um, not right now. We don't work together, but... Cool, cool. Is there an agent you would work with if you were to do something? No, I don't have one. Cool, well look, man. I'm sure at some point in the future, you're going to want to do something. At some point, I would love the opportunity to work with you when that day comes. Would it be hard if I just stayed in touch with you? Yeah, sure. Cool, what's your email address? Boom. That's every single conversation. Go to my YouTube and watch me make live calls. There's like 10 videos of real live calls. You're asking them how they're doing. You're asking them if it's the right person. Like, is this Mr. Johnson? And then you're saying, how are you doing? That's two questions.  Isn't it gorgeous? Or it's raining cats and dogs just trying to stay dry, a nasty out there. Did you enjoy your New Year's?  Whatever. Something non-real estate related. That's three questions in no real estate, right? Now wait, those three questions are designed to get a response to them so you can read them on the phone to see what's going on with them. You know what I mean? You're not just reading a script. You're having a conversation. And then from there, like if I ran into a lady like what you were trying to be and like you are too busy, that's why I didn't talk about the weather or anything the first time we role-played. Because when I get the sense that you are busy, I'm going straight to, okay, so I'm not trying to take it too much of your time, but a house from the corner just sold in if there's anything I could do for you. You know, I just try to throw it in there real quick because I'm trying to respect their time and I'm reading them for what's going on with them at that specific time. See, it's deeper than just a script.  That's the disconnect. You really care.  You're honest. You're professional.  But if you don't line those traits up with how you're communicating, learn how to communicate that to your clients, that's the skill. Like that's what's going to carry you through anything is being able to talk to people and relate to them that you care about them. That you're not there just for a deal. You're not like every other agent. You're not just trying to sell peace of property. You're trying to help them accomplish that bigger goal because their mom died or the kids went to college.  When you operate like this, these people will never use another agent, ever. You are their guy or girl forever and they're going to forever everybody they know to you. And all of a sudden, every person that you talk to that you create this relationship with is worth 10 to 20 deals to you over the life of your career through repeat business referrals and referrals and referrals. And now you're selling 100 properties a year for five years straight.


and grass was created to minimize and fight the great threats great apes are facing and in most in most countries habitat loss and fragmentation is the biggest threat there are many others including poaching and bushmeat diseases such as Ebola conflict and instability and a few more at the request of the Indonesian government and that issue was also discussed at the board meeting in grass two years ago we decided to provide some kind of practical advice to the government once it comes to land use planning and I'm going to present the findings of a study we did last year and we did in collaboration with eCraft, Pan-Eco, Yale, Grid-Arendal and Ian was involved at some stages in that study just as a side product of this eCraft also published a small policy note co-existence of people at Orang Utan is so much more and use some of the data we provided I have a few copies of the study with me and we'll put them on the on the desk later but also you can visit the web page indicated below where you can download the report you will find ebooks, maps, videos post us so it will give you much better idea of what we have been doing last year okay the key topic for us was how can we provide economic incentives to conserve Orang Utan habitat and what we did first is we looked at an overlay of great habitat and carbon and I think it was it came up in one of the previous discussions this morning that we have a high conversion of areas of high biodiversity and of high carbon potential so that was the first step looking to where's the best overlay where's the potential to include high biodiversity areas is there potential for other payment for ecosystem services schemes and finally what are the benefits for communities so we decided to compare two pilot sites the swamp forest on peat in Tripa and the mountain forest in Batang Turun both areas are in Sumatra and we calculate potential income from red plus and other forms of payment for ecosystem services and compared those figures with income from current land use forms including oil palm reduced the major deforestation drivers include and quoted by migrants in ecological plantation expansion and potential development and opportunities include carbon water to save the forest management tourism and on to our forest program and here the major deforestation by by soil mine to the first bar for Batang Turun you see that most of the land has been converted to this dirt forest while we look at the second bar for Tripa almost 50% of land is now in place in converted oil plantations and let's start with the carbon and then we go to the left on there and look at the above ground carbon stocks first on the highest carbon stocks are also areas which are inhabited by the pictures a little bit different when you look at the low carbon stocks because the carbon stocks are very high to the other one comes as a very high on the land as everybody knows and that's where Tripa landscape is but it's a little on mineral soils in the Batang Turun mountain forest and let me now look at the land whose values and again I present the figures from Batang Turun the top bottom you see all times the number of mine comes right in both in both sides however the figures are quite different but I think you also have almost the factor but you still generate more income from an oil plantation on mineral soils you have to be a bit careful with the scale because I had to fix it in mine I wanted to fix it in mine tonight and the scale is different on the top it only goes from 0 to 12 and it's a bottom from 0 to 24 and goes to $1000 but the key message here is on how much carbon money do we need and how much carbon money can we generate to compete with this form of agricultural activity and I had to add a few lines on this because we had to make a few assumptions and we simply decided we are only looking into voluntary carbon markets because we don't know whether and when would be including here whether at all there would be a follow up to the protocol so we only look into the voluntary carbon markets and then we use two scenarios one is a blue one at the bottom where we use a fixed carbon price and then we have a green one where prices for carbon are appreciating over time when you then compare the two graphs you see that in case of a tree plant you can really easily compete with the potential income from oil market development and of course a major reason because there is so much carbon stored below the ground that's different about them too you just come up with all, when you look at the range of potential carbon income it always equals potential income I think our one issue which kept on going through this presentation was what is the cost for a ton of carbon you would need to basically outcomplete oil plant development and again this scenario is quite different from what we thought first oil plant in Europe generates more income and second we have less carbon stored on the other side so I see my figures a bit lower than mine for example you are presented to be calculated 10.8 here is a different ton of carbon what we needed I see before we saw something like 17 you would need to look into the intent of how we calculate it but the key message is the same in TPA it's much easier there's a lot of carbon stored and it's a very important one then I just want to mention this country also has a lot of carbon in Malaysia and the issue whether carbon could help to conserve and maintain little corridors of small scale of forest pockets inside oil plantations all around and I think it would indeed work if the government goes for it to see some forest patches I think in this way going on Malaysia is quite different from the law in Indonesia from a carbon point of view I think it's a very little option to use carbon finances to include some forest intake although it does small numbers so now I want to see how far other because the services can help to generate additional income and he took these figures from the working report from 2009 and when we add all of these environmental services together it could potentially generate something like 3,500 USD per hectare so another key question was where would all that money go to and who would benefit from additional income from a conservation scenario and me again compare a deep forestation of business in areas of conservation scenario and the biggest difference actually is the level of the local community while the local government and the national government would benefit from both scenarios because they would be in the form of taxes and the local community would benefit disproportionately from conservation scenario while in the industry we would benefit less from conservation scenario let me just try to conclude the recommendations the current rate of force on people has made that 3,700 to 11,000 USD per hectare for 25 years period this is higher than that except for all of the environmental impacts except for all of that so coming back to the three-part scenario on people that the situation is different you could potentially generate income in the range of 3,422,000 USD per hectare over 25 years period and this is sufficient to offset the opportunity for the conversion of private forest to environmental impact and other the value of other ecosystem services around 3,700 USD per hectare and this would make the conservation scenario really competitive in comparison towards other alternative land response so now we have to discuss even though on the current level conservation scenario reminded people economically viable the country still wants to develop and increases oil pipeline production and that's one of the key recommendations of the report is that the government should focus further on resource development including the planning expansion of oil pipeline on our current risk-raising land and of course one should take into account all of the social environmental implications and when you take a look at the FCMED and the red areas all of these are areas which are potentially suitable for agricultural activities but they are all sides so they have to run on time so they are very competitive so there is still potential for further development and to reconcile conservation development and I think that's quite important and I just wanted to give you some comparable figures on what you can expect as potential and when we look at the oil pipeline first there is a big difference whether we plant oil pipeline on degraded land or on primary forest land if we compare the figures for oil pipeline with undisturbed forest we basically have a different effect on fire but if we plant oil pipeline on cleared land and degraded land oil pipeline actually can improve the potential for farming stocks and just to leave to the dog the picture FCMED there are no cuts but it's simply 2-4 years up with 8 species many of them live in the areas of high carbon content and presentation with a photo at the top I didn't see much but as you can see it's a long jump and just hope that the oil pipeline can make a long jump and can survive on the next 25 or 30 years I have additional slides on the video currently I didn't put it into this presentation but if the discussion goes more to this I'm more than happy to provide additional information and to leave the figures in how far can use to restart a national transformation process and I think I just thought here's a little bit of time for questions


from Korea to Germany, from Alaska to Puerto Rico. All over the world, the United States Army is on the alert to defend our country, you, the American people, against aggression. This is the big picture. An official television report to the nation from the United States Army. Now to show you part of the big picture, here is Sergeant James Mansfield. This week, the big picture brings you the story of the Army's Military Police Corps. We have selected this subject because many persons are not fully aware of the diversified mission of the Army's Military Policing System. To show you the training of the military policemen and later how it is applied out of the classroom in Korea and other parts of the world, our single-core cameramen have recorded on film this special report from the Provo Marshall General. Everybody knows the job of the MP, the military policeman, to make life miserable for the rest of the Army. At least that's the idea our friend here might have, but then maybe he hasn't been around very much yet. The military policeman has a lot of duties besides keeping his fellow GI out of trouble. He's a combat soldier as well as the policeman of the Army.  And it's his job to handle the prisoners of war. He's responsible for the prevention of pilfering of military supplies. You are as apt to find him running down guerrilla fighters in the Korean hills as riding the highway patrol on the autobahns of Germany. Yes, a lot of knowledge and a lot of training goes into the making of today's MP. Cap Gordon, Georgia, a few miles out of Augusta, is where it all begins, home base for the Military Police Corps. Most of your Army's MPs, scattered around the globe today, once entered this gate as raw recruits. It's here in the Provo Marshal General Center that the military policeman gets his training, both as soldier and guardian of the military law. New recruits come directly from their induction center to Camp Gordon for training as military policemen. And sometimes they wonder why. A soldier, sure, but a military cop. I imagine you're all wondering why you're here. Why you're going to be trained as military policemen. And maybe you don't like the idea of policing your fellow soldiers. Well, for one thing, policing your fellow soldier is mostly helping him. Helping him to stay out of trouble. We've got a slogan in the Corps. Of the troops and for the troops. And we take it to heart.  And then you're going to get eight weeks of training in the duties and techniques of being a military policeman. And when you're through, you're going to find yourself among the best trained, best uniform, sharpest soldiers in the United States Army. And a funny thing, you're going to like it.  That's not an order, it's a prediction. Eight weeks of infantry basic training. Learning to employ the weapons and techniques of the fighting man. And then, training for all the specialized duties of the military policemen. Traffic control is one of the major jobs of the MPs. And they've got to get awfully good at it. Clear, authoritative. It's tough enough to handle traffic at a busy intersection during a peak hour. But if you ever have to keep big troop movements flowing, where the enemy might be dropping shells on a road you're controlling, well, you've got to learn to think and move fast. And that's why the heat's put on the student right in training. It's time for a cool head.  And the hand of experience gets some rolling again. Apprehension of military offenders and suspects is another MP duty. Strongly stressed in the techniques and attitude of the military police is the use of only as much force as is reasonably necessary in making an arrest. But you never take a chance on your suspect packing a concealed weapon. A false move with this method of wall search and an MPs in a position to handle it. The handcuffs. A foolproof way of getting them on without running into trouble. Where there's no question of the intentions of the man to be arrested, the military policeman has learned to take care of him too. Side-Ock? Side-Ock is going to try to stab me downward into the chest. And here's what I'm going to do. Force the knife out of the man's hand. Pick it up. Now here's the way we're going to break it down for you. At the starting position, the knife will be held up in the air. Prepare to stab downward into my chest in this manner. Starting position. Move! At ready one, as he brings the knife downward toward my chest, I block with my left forearm against his wrist. Ready? One. At ready two, I reach my right arm underneath his arm, take a hold of my own hand, lock my elbows together and force him down to the ground, kneeling on his shoulder to make him drop the knife. Again, pick the knife up. Do not let him keep it. Are there any questions? No questions? Find your original positions. Against wooden knives for training purposes instead of cold steel, the ancient and effective techniques of judo are mastered by the military policeman for dealing with the tough customer.  No struggling, no fighting back. The first come along that we're going to show you here today is what we call the hammer lock come along. It works like this. Notice that I keep pressure on his elbow at all times. And the recruit learns how to squeeze them off accurately with the MP's own primary weapon, the .45 automatic. This phase of instruction is a practical exercise on riot control. The general situation. A mob of approximately 600 gathered in front of the governor's palace. When your army is called in for restoring order in civil disturbances, the military police are trained to deal with them. The wedge formation is the formation used to strike into and split up a crowd or mob. Now keep in mind, however, that the platoon wedge is very vulnerable at the flanks. Therefore, we will commit our two support squads to lateral support. And when a riot alert comes in, even a practice one, things happen fast. An important premise in riot control, as with other MP work, is to exert the least force necessary to do the job. A show of strength by a determined looking MP outfit is sometimes sufficient in itself to discourage a civil disturbance. Then there are the formations, each with a special purpose in breaking up a riot, and MP troops are trained to execute them with the precision of a chorus line. The wedge formation, a line of bayonets to keep a mob moving, avoids bloodshed but restores law and order when the MPs are called on for the job. Smoke helps, too. Harmless, but it's some protection against violence if the mob gets rough, and a psychological weapon to discourage the rioters. Tier gas can be used also as a non-harmful persuader to send the crowd home. A course in criminal investigation for specially qualified MPs trains the detectives of the Army's police force. In their final examinations, two man's student teams are called upon to carry through complete investigations of assorted simulated crimes. Each case calls into practice every phase of their classroom training, including crime photography and sketching. Our pair of student detectives here would appear to have a combination murder robbery on their hands. Every shred of evidence, every clue is carefully noted and preserved. And let not our military Sherlock's overlook any possible bet. That bullet will be saved for the ballistics experts to have a look at later. It may identify the killer's gun. Fingerprinting is, of course, a mental subject for the military police investigator. Match the prints left by the killer and its positive identification. You've got your man. The clues leave the student team to a simulated suspect, and they learn how a lie detector might help get the truth from him. Were you born in the United States? Yes. Do you smoke? Yes. Do you know who shot Corporal Smith? No. Did you shoot Corporal Smith? No. The investigators find out that all questions for the lie detector must be short, clear, and require only a yes or no answer to properly evaluate the suspect's responses on the machine. Can you drive a car? Yes. Do you know who broke open the safe? No. Did you break open the safe? No. The inking device on the lie detector chart would indicate symptoms of disturbance in the suspect's mind if this were the real thing and he were lying. Do you know who shot Corporal Smith? No. And so the student detectives get a first-hand knowledge of a modern weapon in the war against crime. At the Criminal Investigation Laboratory, the trainees can become familiar with the very latest equipment for the analysis of evidence. For the testing and examination of materials that might help to solve a crime, the laboratory at Camp Gordon serves all the armed forces as well as lending assistance to civil authorities. Here, the spectrograph burns a minute sample of the material to be examined for possible connection with a crime. Discovery of a tiny portion of a substance may help piece together the story. So sensitive is this device that a study of the photograph spectrum of the colors produced by the burning can actually detect the presence of a material making up only one part per million of the tested sample. Wet chemistry analysis probes into the content too of submitted evidence. May come up with the answer to a crime mystery in the indication of a poison or narcotic. An x-ray diffraction unit, one of the few in the world. This machine delves into the possible criminal significance of a tiny sample of evidence by bombarding it with short-wave to determine its crystal formation. In the ballistics department, bullets are fired from suspected guns to be checked with bullets found at crime scenes. Every firearm writes its own signature on each bullet it fires. In the telltale distinctive grooves and markings, the bullet picks up as it passes through the weapon's barrel. The matching of a bullet used in the commission of a crime with a bullet fired in a ballistics chamber has solved many a killing and other type of crime. A complete fingerprinting laboratory here too with every device for bringing out a print that may point to a criminal with positive identification. A section of the laboratory also devoted to the examination of questioned documents for the comparing of handwriting, typewriter characteristics, checking for invisible writing, and when investigations have to be made on the spot for the military, a mobile criminal investigation laboratory complete with all the necessary equipment will roll out on the job. Yes, when a man completes his training as an MP, those initials spell something different to him than when he showed up as a recruit. Responsibility, pride, knowledge. MOS, Military Occupational Specialty, 1677. Military Policeman. And so, ready for assignment. Ready to answer the next call from whatever spot on the globe it might come. The call for a trained MP. Maybe it's Germany, and one of the many important MP functions there, the highway patrol. This outfit is responsible for the remarkable job of reducing the accident fatality rate on German roads from four times greater than that of the U.S. to less than America's highway death rate. And the operation entails something more than watching out for speed violators and careless drivers. Attention all cars, stolen truck. The profits run high on stolen government property, but the military police are constantly putting practitioners of the trade out of business. In our own country, you see the men wearing the MP brassards on the trains, along with their counterparts of the Navy, the shore patrol. Polite, helpful, but forceful. Checking travel orders, identification. Preventing trouble where possible. Dealing with it sternly, swiftly when it comes. You'll find the MPs on duty at the harbors, the ports of embarkation, at the docks where military supplies and personnel are headed overseas. On guard against pilferage, sabotage, fire, helping to make sure the shipments are going to get where they're needed. And of course, the MPs have been busy in Korea. A tremendous job, traffic control, and complicated with a desperate refugee problem in keeping the roads open for the movement of the men, machines, and supplies of war. The dispossessed, the uprooted, the homeless ones in the wake of war. And at the moment of stern military necessity, these people still must be dealt with in the decent way of a democracy. Refugee control, another job of the military police. And on the job making sure with detection devices that the enemy is not using our humanitarianism to smuggle in weapons behind the line. Road reconnaissance 2, a part of traffic control. A bridge bombed out, a road blocked, and the MPs have to come up fast with the answers on the alternate routes, detours. And so road reconnaissance crews keep constant check on routes, condition of bridges, facilities of every road in the area. Security behind the lines in a combat zone is pretty much up to the military police too. In Korea, it meant a constant alert and plenty of action against roving guerrilla bans. John, site of the Korean troops negotiations and the prisoner exchange, it was the MP who guarded the security of United Nations personnel and documents. Men to be depended upon in a delicate situation to carry on their duties without incident while rubbing elbows with the enemy. The job too of watching out for enemy action in the neutral zone, guarding against the communists taking advantage of the flag of truce. And it's up to the military police to handle the prisoners of war. Besides the responsibility of preventing escape, the MP must see that prisoners are treated in full accord with the provisions laid down by the Geneva Convention. Article 13, prisoners must be protected against violence, intimidation, insults and public curiosity. Article 16, prisoners shall be treated without any adverse distinction based on race, nationality, religious belief or political opinions. Article 19, prisoners shall be evacuated as soon as possible after their capture to camps far enough from the combat zone to be out of danger. Article 26, the basic daily food rations shall be sufficient in quantity, quality and variety to keep prisoners in good health. Article 27, clothing shall be supplied the prisoners in sufficient quantities to make allowance for the climate of the region. No prisoner may be employed on labor of an unhealthy or dangerous nature. Stern vigilance with human decency, the MP way of handling prisoners of war, serious operation, ending party away, military police, the fighting cop, the policeman who storms his way in to take over his beat. He's in with the infantry. And then he gets going on all the special duties, straggler control, prisoner handling. He's the man with the answers and the directions on the beach head. Essential supplies are coming in fast and it's the MP who has to see that a critical bottleneck doesn't develop. Traffic control and there's got to be a map tucked away in an MP's head. He's the authority on routes and installations and his information must be up to the latest shift in the battle line, knowledge of the latest road under fire. Nobody loves a cop, they say, except when you need one. Well, the US soldier around the world has learned that he'll find the MP by his side in time of need. His fellow soldier knows the military policeman as a soldier second to none. He's found the work of the MPs a vital part in the big picture. He's come to know with respect the cross pistol emblem of the military police corps, the fighting police force of your army. That is the story of the army's military policemen here at home and throughout the world. Today's modern MP is a respected member of your army. He is respected for the job he is doing in carrying out so effectively the numerous phases of his mission. The big picture is a weekly television report to the nation on the activities of the army at home and overseas, produced by the Signal Corps Pictorial Center, presented by the US Army in cooperation with this station. You can be an important part of the big picture. You can proudly serve with the best equipped, the best trained, the best fighting team in the world today, the United States Army.


So we're here at the SID display week and who are you? I'm Tara Akavan. I am co-founder and chief technology officer at Iris Tech. It's a startup in display industry. That's how I got involved with SID in the first place. I'm also marketing vice chair at SID. I've been volunteering at SID for a few years now. So what is this startup you're talking about? It's called Iris Tech based in Montreal. Our vision is to bring perception into display industry. Our screens today are built by engineers and the people who are actually doing research on the side effects of being exposed by screens more than eight hours a day and how it affects the children, how it affects their development are actually physiologists and psychologists. So in Iris Tech we have the vision to bring in psychologists and physiologists at the table to make screens healthier, make screens smarter and more readable in different lighting conditions. Healthier, smarter, more readable? So it's a different kind of display. It's not just a display. It is a software that can get into any kind of screen so it will get embedded into an operating system and it adds the smartness to any kind of screen, LCD, OLED or anything to react more dynamically to the environment and to the individual user which is looking at the screen. So maybe the brightness levels will change? Brightness levels will change. The whole content will change. So the whole rendering of the content will change and we will personalize the screen to the viewer. As an example when we age our eyes age with us and we lose the sensitivity to contrast massively, our color perception changes and that is not taking into account in any of the screens. So that's what we do. Is it software? Is it in the driver of the display or just in the OS? It's a software that can get integrated into driver level but now we're integrating it into an operating system level or an app level. It could be like on an Android device maybe. Could be, yeah. So are you launching? Is it launch? What is the stage right now? We do have customers. We are, since I moved from Vienna to Montreal to start this company, it has been three years, four years, sorry, I moved in May 2014 from Vienna University of Technology where I was doing my PhD to Montreal to start this company. And since then we've been involved with Automotive and with Consumer Electronics. So a lot of our customers are from Automotive and we will be in production with Automotive and Consumer Electronics in Q4 this year. So you're vice chair of marketing at the SID and what do you think about the SID? And what do you think about it? So SID is an amazing, very diverse event. So it's the only event that I know which is focused on this place. You can find anything about this place there. And then you can learn about marketing, business, tech, science, exhibition. So it's very diverse. It's actually the booklet if you look at it. It's too much events happening in parallel that there's no way you can cover it all. So that's an amazing thing. For me, I started with publishing papers here a few years ago. I attended the exhibition with my startup. Then I started volunteering and helping with SID because I think what they lack is younger generation and definitely women. It's a very conventional male-oriented society. It's very old, right? It's from the 50s. Exactly. It's very old. And that's why I decided to volunteer. And then we started the Women in Tech last year and this year for the second time to bring that energy and that diversity and hopefully involve younger generation in volunteering and stepping up and getting involved in SID. What was the paper you were publishing when you first joined? Well, we were publishing a few papers every year. This year we are presenting, our team is presenting as well. This year we are presenting a paper on compensation for colorblindness. So it's a solution for screens to help colorblinds to distinguish between colors that they cannot usually see so that they can continue a task like following a map or something. You have a solution? We do have a perceptual solution to compensate for that. So we cannot make them see those colors that they cannot biologically see but we can make it distinguishable enough so that they can continue the task. Maybe contrast something. Like a lot of things I'm not going to get into the IP. Sorry. But how about the Women in Tech you were just moderating? How did that go? I think it went great. Well, I shouldn't be the one who says it went great. People can watch the video online. Definitely. It'll be a link. So I definitely enjoyed it myself. That's what I can say. And there were amazing panelists on the panel. We had cool discussions. We went, I think, 30 minutes over the hour that we had. We had a lot of questions from the audience. I had to actually cut it at the end because we were running so much behind. I think it was an amazing panel and I wish for it to continue. And I wish for everybody to kind of think about diversity, not only for women and men. Every aspect of diversity, background, gender, religion, LGBT, everything. And one amazing thing about it was most of the attendees were men. That's great. And the SID definitely needs to get upgraded because it will make SID better, right? And that means the future displays will be better. Exactly, exactly. Not only displays, the future of the tech. Like everywhere we need diversity because when things are diverse, it's proven that we will get better results. So it's not just for the sake of having women or having LGBT or having different religions on the table. It's the fact that they have different mindset, they have different point of views. And the diversity in discussions always help with innovation, help with changing and help with moving forward with new technologies.


I'm Kevin Mahaffey. This is John Herring and we're going to talk about mobile applications and some of the research we did into them recently. So really quickly, if any of you guys saw our talk last year, we've spoken for the past few years at Def Con and Black Hat about mobile security. Last year we talked about fuzzing and attacking mobile operating systems more at the OS level. We decided to up level a little bit and think about applications. I mean really in the past year it's been amazing. We've seen absolute explosion in adoption of smartphones and more importantly mobile broadband usage. So a big part of this is mobile apps and we said, okay, what's happening in the mobile app ecosystem? Matt, what can we do in the context of security research there? We're going to start with the vulnerability because that's always fun. So for those of you who don't know much about Android, Android has a login subsystem that you can use when you're developing applications. This is just like any other login system, but this one is Android's. Specifically, if you want to read logs that are produced by the system, so there's a kind of a centralized system login framework, you can request the read logs permission and it allows you to access that. So this is the background for what we're going to talk about. And if you're really interested in this sort of vulnerability, 3 p.m. in this room, there's a really good talk you should see as well. So there is a vulnerability in Android where the location manager service, which is the service that the Android system uses to effectively provide your GPS location via cell tower, Wi-Fi, so on and so forth. And what happened was when you retrieved the location, the location manager service dumped your LAC and cell ID, which are the two GSM identifiers that can be used to basically determine where you are into the logs. So what that means is that any application that has the read logs permission can grab those pieces of data outside of it and determine where your application is. And there's a lot of other things we've also seen with respect to applications logging things furiously and disclosing all sorts of fun information. I liken it to dumpster diving on mobile. So really quickly, I'm sure everyone saw on Monday, interesting example, Citibank had an announcement about their iPhone application leaking credentials, banking credentials to parts of the device where in certain circumstances if a malicious application was exploiting the device could grab the banking credentials and there's also a syncing it to your desktop if you synced with iTunes. We've seen a number of examples of issues like this and this really underscores how bad it can be if you're logging information inappropriately. So imagine you're logging banking credentials to some public part of the device. Any application that doesn't request any sort of special permissions other than the read logs can grab that data and then you're your own. So this is an example of a vulnerability we found in the wild. It basically allowed somebody who's reading the logs on your device to hijack and log into your account. Not good. The background on this is a lot of applications log URLs with varying levels of parameterization to the system logs. So for example the top logStem you see is what the Android browser does when you type in a URL so you can effectively see what query was put in there. And the second thing you see is an example of what the vulnerable app that we found in the wild was actually doing. It was effectively logging any URL it retrieved. So some of you will begin to see where the fail happens. So let's imagine a hypothetical application that has a web view embedded in it. So it's a mobile application that effectively is just a web browser. When you start the application it retrieves the login form from the server. The user goes tap, tap, tap, enters their email and password. They click the button. It posts that information over SSL and let's imagine they're using a single sign-on service. So you have this sign-on service that serves the form and validates the credentials. Let's assume that the user entered the correct credentials and the single sign-on service says okay, you're authenticated. Now redirect to the actual application. Single sign-on service says hey, go here. And in order to actually validate the session it adds information in the get query string about your session ID and all these secret tokens. So, you know, good app says, oh, got a redirect. I'm going to go retrieve this sort of thing. And you're logged into your account. You guys see what goes on here? Let's look at what happens in the logs when this happens.  We post and we get our redirect. That's an interesting secret key that we see in the logs. So what could you do bad with this? So imagine a malicious application that effectively is reading the logs on the device and it transmits this get query parameter to a server.  Just to be clear, imagine if your banking credentials are logged. You grab this string, drop it in a browser and you're logged into their bank account. Fun. So, you know, key, key lessons.  Secondarily, web developers, if you're interacting with mobile apps, especially if they're sending URLs between applications on a device, try to pull things out of get query strings, maybe put them as post data or set cookie data so that it's not floating around or at least it's harder for it to float around. So, we found this really bad thing in the wild and we had a couple questions. One, are there any other apps that are vulnerable to this sort of attack? And two, are there any applications in the wild that are actually trying to read the logs and trying to hijack these accounts? I mean, to be clear, the application we found this vulnerability in was a pretty serious application and I could say there's a lot of incentive for people to attack it. So, we asked this question and we, about a few months ago, said, you know, what if we could basically ask questions of every application in the world and get a reasonable answer? So, we built something we call the App Genome Project. Effectively, what the App Genome is? So, basically what we did is we built an engine that allows us to crawl most of the major application environments. So, mainly what we're going to be talking about today is Android and iPhone. So, the Android marketplace in the iPhone app store. We've seen about 300,000 applications, the number's growing really, really quickly. We've deep dived on about 100,000 applications and we've basically taken, we'll talk a little bit more about it, but we've taken this engine that allows us to actually pull down the data and then built in a system that allows us for automated analysis. And we have a system that we can look at, basically metadata application binaries and create a genome, if you will, of applications such that when we say, okay, if this one app has this sort of behavior or has this sort of code in it, what other apps actually have that and we can use that to correlate different types of threats. So, when we understand one type of threat, imagine we can instantly scan 300,000 apps and see what else is exploiting it in the wild. So, this becomes a super powerful security response tool. So, what we're going to talk about today. First, we're going to talk about, you know, why you should think about carrying about mobile apps and then maybe why you should be skeptical about mobile applications. Secondarily, you know, what are our motivations? What's the point? Why are we downloading all these applications? What are we doing? Third, we're going to go into how we built it. I have a little bit under the hood of, you know, it's pretty cool. And we're going to look at what we found. Specifically, I'm going to tell four stories and I think they're pretty good stories. And we're going to talk about how we can use the app genome project in a security response context. So, if a lot of you here are disclosing vulnerabilities, there's a lot of times a big question of when do you disclose publicly? And a lot of times the answer to that question hinges on whether there's exploitation in the wild and we happen to have a giant data set that we can see if things are being exploited in the wild. And then we're going to make some predictions, hopefully. So first, why should you care about mobile applications? So mobile apps obviously are becoming pretty standard use in terms of how people are actually interacting with their mobile devices. I think that we'll see more and more moving to the web over time, but right now it's all about native mobile applications. We've seen a pretty interesting trend where there's huge volumes of people downloading applications. So on average about 22 apps, but there's people who have hundreds of apps on their phone, literally. And the thing that we've noticed with that is most people pay very little attention to what they're actually downloading. So people download apps 10 at a time. Oh, I got a smartphone. That's great. They're not paying attention to the source, to the developer, what's actually happening there. It's just assumed trustworthy, which is not the best assumption to be making. And more and more apps are actually accessing sensitive information. So we talked about examples like bank accounts, location, SMS. And one of the other interesting things we're seeing that Miko Hypenin spoke on at Black Hat is there's premium rate calls and premium rate SMSs. So imagine on a desktop environment how you've monetized an attack. You might steal someone's credit card information. You might turn it into a botnet for spam.  Literally you can send a packet and money goes flying. And that's never been possible before. So we've seen examples of this where malware will have auto dialer mechanisms in it. And they'll sit there at night, call Somalia and ring up a huge, huge cell phone bill for you. It's not cool. So why care about mobile apps? What enables the attacks more easily than ever? So standardized APIs, it's very easy to say, okay, I want to take, I want to grab contact information. I'll call that API and grab that information. It's very scalable in terms of how easy it is to build an attack. And the capabilities are so rich and deep combined with those APIs that it makes it incredibly easy for one to, after you actually have an exploit, grab data. So the incentives like we talked about, there's clearly a monetary incentive and then there's the sensitive information that's also driving those attacks. So the question is, why won't mobile threats matter? We're skeptical dudes. We like skeptical people in general. And we continually hear from people, wow, mobile's never going to be a problem. We've got security handled. First argument, mobile's fragmented, right? Well, just to set context, when we look at the desktop environment, one of the reasons Windows gets exploited so often is because it's a relatively homogenous environment, right? And it's a very large footprint. Well, if you look at how fast mobile device shipments are growing, there's going to be half a billion of these things shipping a year within the next two to three years. There's going to be three Windows. When you think about the size of the iPhone platform, Android platform and something like BlackBerry alone, literally each of those will be the equivalent of Windows. So when you think about the attack surface, yes, they're fragmented. It's like the market just exploded three times. So there's three opportunities to actually get in there. And more importantly, everything is homogenous. So if I have one iPhone exploit, I get to nail every iOS device, iPads, iPhones. Another argument, isn't there a sandbox? The sandbox, that means safe, right? Well, you can piss in the sandbox, right? So we'll show you an example of how this works. And a sandbox is a great step. Don't get me wrong. We think that mobile OSes are pretty forward-thinking in the context of security, but nothing's perfect. And the goal of this talk is to help everyone understand how to take the steps to keep people safe. So for example, the vulnerability we just talked about is an application-level vulnerability. So even though the system is totally safe, an application is leaking credentials, for example, into the system logs. And I think there will be a... there's a lot more vulnerabilities like this where OS does a great job, but applications screw something up and game over. Exactly.  I mean, look at the different types of exploits in the past couple of years. We've seen ranging from SMS bugs like Charlie Miller's SMS bug to attacks against push messaging services and things like the actual App Store itself. And more and more, we're seeing web services associated with mobile devices. So imagine you're loathing through and you nail the web service, which has a direct connection to the mobile device used out as the in-road. So what are our motivations? Why did we go do all this? Ultimately, our goal is to keep people safe. We believe that having good data can help everyone here, everyone who sees the research, make good decisions, whether you're a developer, a network operator, or an IT administrator, understanding what is actually out there as opposed to just kind of speculating it's a good job. Secondarily, we want to identify threats in the wild. Like having a large data set, we can actually go ask very, very probing questions and figure out what's actually going on. Third, understanding platform differences. These two platforms, Android and iPhone, particularly, have very different security models. And if we can understand how that impacts how bad things happen on devices, that allows us to do a really good job or do a much better job than we could otherwise in securing them and preventing things before they get too bad. And the last thing is, we want to understand what apps are actually doing, which is not necessarily the same thing as they say they're doing. And on a mobile device compared to your computer, especially a lot of people in this room, I imagine are inspecting or reverse engineering are doing things on a lot of the apps on their computer. You don't have that ability, in many cases, to do that on your phone. And we want to basically make it so. How do we build it? So a quick architectural overview. We build the distributed crawler that speaks Android and iPhone. And effectively what it does is a piece of software we built that communicates with each app store over its native protocol and interacts with it in the same way you would download something on your device. We tried to run this originally in a single thread and downloaded every mobile app in the world in a single thread. It takes a really, really long time. So try not to do that. So we distributed it out. It made it a lot easier. Secondarily, we're storing everything we're getting so that we can actually look at trends over time. We can do offline analysis. We find a new phone. We can quickly write up something to figure out if anyone in the wild is vulnerable to it or exploiting it. Third is we develop some custom analysis tools because there really aren't too many things that are meant for automated analysis on mobile right now. So we built some things that allow us to ask questions against the dataset in mass. So, like I said, it's a distributed crawler. Essentially, it does the same thing that you would do when you're on an app store. So first, let's imagine you're browsing applications. That's the first step. We're enumerating applications in a given category or in a given set. Second, on Apple, we basically, you would click on an application to retrieve the data. On Android, the side there is you, it actually does that all on the query so it's a little bit more optimized. And the third is once you're on the application page, we download the application. And we do this through a distributed job queue and everyone's happy. So the data store, we are storing all of the application metadata. Specifically, this might be description ratings, version, so on and so forth. And we're actually tracking changes over time. Secondarily, application binaries. This is for free applications. If anyone wants to write me a check to download all the paid applications, I'll be available afterwards and very happy. And yeah, and we're tracking all of this. It's quite a big data set. It's fun. So now that we have all this stuff, what do we do? We have a whole bunch of mobile applications. I can only play so many games of Tetris. So we built some automated analysis tools and we started extracting data to figure out what we're doing here. I'm going to go into detail about specifically what we did on each platform. But generally speaking, we're looking at what things, what APIs and framework constructs on a given platform and app references, what things are implemented inside of the application on Android, what permissions are in the app, and then sometimes we can get strings out of the application if we have specific things we're looking for. So what do we do on Android? So Dalvik is not only a fishing village in Iceland. It's also the VM on Android. It's actually pretty cool. It's similar to a JVM and it has a lot of differences that frankly don't matter to our analysis right now. But it's really optimized for mobile. The application packages for Dalvik are called APKs. They're very, very similar to JARs. And APKs and JARs are basically just special zip files, so they're fairly easy to extract. The main executable in Dalvik is called classes.dex, and so that's one of the main things we're looking at. The other thing of interest in an Android application is called the Android manifest, which is a really kind of proprietary binary encoded XML document that describes the permissions of an application, its components, so on and so forth. Before we kind of dive into what we did for analysis, I think a brief background in what the Android security model is. Specifically, Android has granular permissions for all of its specific capabilities. So up front, Android declares what your app's going to do, and it never goes around that, hopefully. Come at three to have fun. Also important is enforcement is at the process level and the VM level. So if you find an Android VM vulnerability, usually it means absolutely nothing because everything's enforced at the UNIX process level, IPC level, and what your user's permissions are on the actual device, which is really interesting. So what do we do? As I said, Android has permissions. And so one, we looked at package permissions, but simply looking at permissions alone, all that tells you is if an application wants to access data, it doesn't tell you what it actually does. So we also did a deck static analysis, and so one example of a question we could ask is, hey, is this permission requested and is this API referenced? One example of how we can do that for the phone number, we can look at the read phone state permission to retrieve the phone number, and we look for the telephony manager get line warm number API. And with either one of those missing, the application is not likely going to actually access the phone number. Or we can run arbitrary analysis to ask other interesting questions of the data. I think it's important to understand what we can do and what we can't do. For the assumptions right now, we're assuming that applications don't get around the permission model because, for example, if you're rooting the phone, if you're using local privilege escalation exploits, you can run the phone number, most likely. Secondarily, capabilities can be implemented outside of Dalvik, and this is really important to understand because you can bring in native code to Android applications, and you can basically download ARM code from the internet and start executing it. And of course, in static analysis, we're not going to be looking at that, but I think it's important that everyone kind of understands what we're looking at here. So specifically, we're not looking at code download at runtime, we're not looking at encrypted code. So for example, if there's a polymorphic engine that the current static analysis that we're doing doesn't look at that, and we're also not looking at dynamic linkage, so if you're using reflection or any sort of raw IPC calls, so Android has this IPC mechanism called Binder, we're not looking at raw calls there. At some point, we will get there, but we're looking at the vast majority of apps that use the framework as it's built right now. What do we do on iPhone? So iPhone, as a lot of you guys know, uses process-level sandboxing and the app store enforces APIs. Unlike Android, you don't usually have acknowledgement of permissions except for push and location, where there's a user box that says, hey, do you want to allow this for this specific application? What is an iPhone app when you actually download it? Like an APK, it's just a zip file. The application binary is typically in a certain place, and it's an executable format called Moco. Yeah, it's the same executable format as on OS X. The Moco, the header, is a series of load commands, so they specify how the binary is segmented in memory, what frameworks it's linked to at runtime, whether it's encrypted and so on and so forth. There's three segments that we're going to be carrying about today, text, data, and link edit. Text is where the executable code and read-only constants are. Data is where we have the readable data or any sort of things that are initialized that can be mutable, and link edit is all of our dynamic linker fun. If any of you guys are used to reverse engineering portable executable format, the top-level construct is a section, whereas in Moco, the top-level concept is a segment, and a segment has many sections. Totally confusing, but for whatever reason, they decided to change the terminology on this. But one of the big problems is, once we download apps, they're encrypted. So what do we do? I think it's important to look at how the Moco, basically how the Moco is loaded in the kernel. So first, there's basically file segmentation and the text segment is encrypted in memory. So what happens when you load an iPhone app? The kernel effectively decrypts that encrypted segment and maps that into memory. But we don't have keys to decrypt that right now. So if you're interested more in how this loading process works, I think there's a lot of rich research to be done here. This is all open source available right there. So the question is, we're not decrypting the text segment. What can we see? The great thing is we get symbol tables. And almost every binary I've ever seen has very gratuitous symbols in it. So these are all on the linked edit table. They're all plain text. And the other thing we can also see is frameworks. So these are effectively the dynamic libraries. And we can actually see those because those are implemented as Moco load commands. So we can see that all on plain text, too, which is really nice. So what do we do to analyze these apps? First, we're looking at the symbol table, which is defined symbols, the classes and methods you implement in your application. We also look at undefined references. So these are the things you're importing from the platform itself. And then we're looking at Moco load commands. And similar to what we said on Android, we're defining heuristics to say, hey, how do we know if an application accesses a device's contacts? We're looking to a reference to any of the address book APIs on the device. And like Android, we can run arbitrary analysis as well. So to understand what we're looking at and what we're not looking at, we're not decrypting the text section. And because we're not doing that, we can't look at dynamically loaded code. So for example, if you're dynamically importing frameworks or you're bypassing frameworks to access things via private APIs or you're downloading code at runtime, all of these things are probably going to get you rejected from the app store anyway. So it's probably not too impactful, but these are things we're looking at in the future. So if you didn't understand anything I said, here's the summary. We downloaded a whole bunch of Android and iPhone apps. Lots. And we built a whole bunch of analysis tools so we can ask really probing questions of them, you know, against the dataset in mass. Oh, and we don't want to do it manually because I don't have nearly enough Red Bull to go through 100,000 applications. We tried that. So we're going to go through some results and we're going to do this as a series of stories.  So the first story is, in the beginning there was data. So what happened here is when we first got this dataset, we were really excited and we asked a first question of, are there any applications that are accessing contacts on my device that maybe shouldn't be? And we were just like, oh yeah, we're going to find like 10 applications that stick out like a sore thumb. And it turns out that a very large number of applications access contacts on both platforms. And one of the motivations behind this, a lot of the early variants of malware, especially on platforms like Symbian, used SMS and other... Basically, autospread. Exactly, autospread. So SMS, MMS would go through your contact list and spread it either via Bluetooth or via SMS or MMS. So we started going through this data and we found a whole bunch of sound boards. Why does a sound board access my contacts? I'd love it to say, Han Solo, I've got a bad feeling about this whenever John calls me, but why? So we actually... This is the disassembly. It's through a tool called BoxMolly. It's a great set of disassembly tools for Android Dex files. And we found, we have a smoking gun that's accessing the contacts API, but what's the context of all this? Well, it turns out that it accesses contacts to set custom ringers. This is a totally legitimate use case. And the key message here is if you look at an application, it seems weird that it's accessing something and you dig in. A lot of times it's totally legitimate. And if we look at the actual disassembly output, the access to contacts is in a method called assign ringtone to contact. Totally makes sense, right? If I want to add a ringtone to a contact, you should be able to access my contacts. So, what's the lesson? Not all apps that access sensitive data are bad. Just to be clear, not all apps that access sensitive data are bad. Not all apps that access sensitive data are bad. If you take anything away from this talk, please remember that. Story number two. So we said, okay, crushing defeat. We didn't find anything wrong with the soundboard applications. Are there any applications that are using my location for purposes that I don't know about? And what does this say about mobile apps who are in the direction? Nearly 30% of every single mobile app that we saw knows where you are. It's interesting. So, we went through a search. We started looking through Android and iPhone apps that access locations, similar to how we did before. We went through a whole bunch of apps and every single one, nearly that we encountered that didn't seem to have a legitimate use for a location, but that actually accessed your location, had a third-party advertising SDK in it. And this was really interesting. So we dug in a little bit deeper, and here's what we saw. So, one SDK in particular, Quattro Wireless. In the Android emulator, you can simulate the lat-lon. So, of course, 3.1337 is where we are. I think it's somewhere in the middle of the ocean somewhere. And we wire-sharked it. And look what we found. We found an ad request to the Quattro Wireless ad server. And we have a poorly-rounded version of our latitude and longitude sent over to the server. Oh, yeah, and it's plain text HTTP, even better. Yay. So we tried to zoom out a little bit and said, okay, well, this seems like almost every application that we encounter has a third-party SDK in it. Given if an application has a third-party SDK, how likely is it to access location? And we looked at that across some of the largest, you know, the most prevalent SDKs out there. Wow. There's a lot of SDKs that are accessing location. You notice a lot of these numbers are higher than the average for the platform. To put these numbers into context, I think we have to look a little bit deeper into how we analyze things. So, for example, on Android, if a developer brings in an SDK but doesn't request the location permissions, we don't say the app requests location or accesses your location because it can't. It doesn't have access to the APIs. So you notice the Android numbers for the SDKs accessing location were lower. Our analysis takes into this account. So if a developer brings in an SDK that tries to access location but doesn't actually request the location permission, the SDK doesn't get location. And I think it's a big credit to the permission-based model on Android and just having user privacy in mind in developing that. And on the iPhone, it's fairly interesting. An application is only allowed to use location if there's a legitimate, I don't want to say legitimate, if there's a benefit to the user for using it. For example, if Steve likes it. If Steve likes it, yes. So if your app uses location-based information, this actually came out as an app store rule earlier this year. They will actually reject your application if it uses location only for ad-serving purposes, which makes sense. And so we kind of looked at third-party code as a whole, and it's actually surprisingly prevalent in applications. And in one of the messages we have with developers, when you're bringing in code, understand what it's doing, because a lot of times it's closed-source, and there are a lot of novice developers developing mobile applications, and we think this is a great thing because it's so easy, and I don't like wrestling with bad development frameworks, but it also brings people who maybe aren't experiencing development and they just throw in ads to their code without thinking about the data they're collecting. And our message is that understand the data they're gathering about their users, because ultimately users trust developers, and as a developer, you want to be responsible with the data you collect and to notify your users about that data you're collecting. One of the most common things we're seeing is just first-time developers. A lot of developers on Android and iPhone have never written an app before at all in their life in introducing vulnerabilities in terms of poorly written code or just bringing in a third-party SDK. They have no idea really what it does. They have to bring in the functionality and then expose all this other functionality. So one SDK in particular when I tip our hat to them, AdMob, they've actually done a really good job in helping educate their developers on what data they're accessing. So specifically, the AdMob SDK defaults location collection on iPhone to false, and they encourage their developers to think about what the ramifications of gathering location are. I would love all SDKs to run and encourage the developers to think about things this way. So the lesson we learned here is developers don't always know what's in their apps. And we want to encourage people to, if you're developing mobile applications, really look closely at what sort of data you're collecting personally and what sort of data maybe third-party libraries you're bringing in are collecting. Story number three. We found SDKs. We found a soundboard app that turned out to be bad. Are there any things that are just bad stuff to me? We said, okay, let's dial up our heuristics and find applications that are accessing a ton of data. What app accesses every permission? So we found a lot of applications in the market that are called system utilities and that's literally the text and nothing more from a developer called RxS. The application names sound like workout plans, you know, Android 15x, Android 16x. And we see inside a totaling code to mobilespilogs.com. And... Yeah. I don't know about you, whenever I see anything going to that URL I'll get a little scared. So, okay, we dug in. Here's our friend, Box Molly, what happened? Get SMS details. Get contact details. Get URL details. Get call contacts. That's a lot of data. What else has happened? This is mobilespilogs.com. It's a well-known purveyor of mobile applications. And what they do is, in order to install it on somebody's device, so, you know, jealous ex-girlfriend or something to that effect, they basically say, hey, go in the market, search for these kind of cryptic names and install that on somebody's device. And to be clear, you know, this is not something that you are likely going to install yourself. But these things are in the market and they're called system utilities. So if this is on your phone, you don't really have much recourse into knowing what it actually is. On my phone, Nicholas, at Black Hat DC, had a really great talk. He talked about a spy phone application and it gathered a whole bunch of applications, a whole bunch of data on iPhone using allowed APIs. And, you know, the interesting thing about iPhone is, on Android, you see the permissions that an application is accessing. But on iPhone, you get the app where you don't. You can see location and push, but that's about it. I thought the keyboard cache was one of the coolest parts of that research. All right, so the talk's available online. I highly recommend checking it out. And the code's on GitHub, so you can check that out, too. Also, I don't know if any of you guys saw last week, there was a 15-year-old developer, literally a 15-year-old that snuck a flashlight app into the iPhone market with a functional SOX proxy. Effectively, this turned it into a tethering application. This was accepted into the app store and, you know, once the internet found it, Apple removed it. And just to be clear, this is not malicious, in terms of the notion that just because something is curated or looked at, the idea of something not being able to make it in, this is a perfect example, a flashlight app with advanced code and functionality made it through. Potentially millions of people could have downloaded this thing. So the lesson to be learned here is apps aren't always up front about what they do. It's up to the user to kind of understand and to be a savvy consumer about applications. Story number four, the orange wallpaper.  But what about kind of more seemingly innocuous things?  There are actually only a few hundred applications in the Android market that gather this sort of data. And we originally diced this data and said, are there any patterns? And we found that there were two developers that actually had a near majority of the applications in the market that accessed all these capabilities. And so let's dig in. What do we find? These are the applications from these two developers. So guess which one is the most popular? So let's download one of these applications. You know, I want to pimp my phone. So we search for a wallpaper once we've downloaded the app. Select a wallpaper. Phone is pimped. Wait, so why again are the wallpaper applications accessing my phone number, IMSI and IMEI? Okay, so good friend Wireshark and none of you can read this. So, but this is what happened. We installed the wallpaper app. Phonies. Then we saw this HTTP request in the clear being sent to a server. My SIM serial number, my subscriber ID, my phone number, and my voicemail number. In the clear. Wait, why do they need my voicemail number? Oh, and the interesting thing is on some Android phones, you can actually insert your password into the default voicemail number. That's not my actual voicemail number. I'll change it after this talk. So, okay, so let's dig in. We did some disassembly on the application and we actually found that newly all of these applications had the same class. And the great thing about these kind of app genome projects, we can ask this question fairly easily. We don't actually have to go dig in and like manually reverse engineer every application. We just said, oh, yep, they all have this thing in common. So what does this service do? Here's an excerpt from the disassembly of what actually happened. See device ID, get line number, serial number, subscriber ID, voicemail number. These are all the Android APIs that access the data we just saw. So who owns the domain that the data was being sent to? Yeah. But of course, nobody would ever download an application and agree to permissions without looking, right? Nobody's ever done that. Any guesses to how many downloads these applications had? Yeah. And just to be clear, when we look at this app and you can kick to the next slide, the information being collected isn't necessarily malicious, but you have to ask yourself, do users actually understand that when they're downloading a wallpaper application that their phone number, their voicemail number, and potentially their password, their IMEI and IMZ number, which can be used to get course location, recorded? I think not. And this is just a really good example. Our goal here is to help developers understand that even if this isn't malicious, you're potentially compromising the privacy of your users. Think about this. If you're at a coffee shop and you're on a wifi hotspot with your droid, for example, all this information is being sent in the clear. If you did this at DEF CON, your IMZ, all this stuff would be up on the wall of sheep.  And so the claim from the developer is that the phone number was being collected to preserve favorites across devices.  Google is investigating the apps right now. They're taking down from the market until they reach a decision. So it'll be interesting to see what happens with this. So what's the lesson here? Is applications, if they have capabilities, if they request permissions, as a user, you should assume they're actually accessing them. So summary of the lessons we learned today, just so if you guys take something home. First, I really want to underscore that simply if an app accesses sensitive data, it doesn't mean it's bad, right? There are totally legitimate reasons, and actually that's the power of mobile operating system, that we can access the sensitive data. We can have powerful apps. And it's an interesting question as to whether a given access to sensitive data is something you as a user want or not. Secondarily, developers, if you're in the audience, you may not always know what's in your apps. Please pay attention and only put things that you actually want in there. Third, applications, they're not always upfront about what they do, and so one of the goals of the project is to basically extract what applications are actually doing and help users understand what's actually going on under the hood. And third, be careful what you download. Applications, Android is a great example. You can actually see what an application is doing. So just look at that and assume that if an application accesses something that's for a reason, and it's up to you as a user to choose whether you accept that reason or not. Right, so just imagine what's in the wild. So hypothetically, just the power of this project, as Kevin talked about, is we have a vulnerability. We now have the ability to ask a question about all the apps in the marketplace and say, is this code existent in other places? Is this type of capability existent in other places? And being able to instantly find this. So when Kevin and I initially were looking at this stuff, we saw the one wallpaper app, and we said, oh, 50,000 people had downloaded this. This looks interesting. The way we were able to see that it was, what, 76 plus eight apps in total in between 1.1 and 4.6 million downloads was because of the app genome project and the ability to then say, okay, this one piece of data we found, how do we look at all of the data in the mobile app environment? And we think this is going to be the beginning of some really advanced new security response tools. Yeah, I mean, if you ask how you would know how many applications on Windows would access a given vulnerability, it's almost impossible. So we're going to, we're just about finished here. I think it's three things that are really important. Application models are probably going to remove all really bad apps from the market. But as we've seen with a lot of apps we've talked about today, there's context dependence. It's hard to say whether something's good or bad, especially if it looks good today and maybe you get a whole bunch of people to download it and then it turns bad later, for example, if it updates, imagine, easiest way to get malware on a million phones is to release a game for free, get a million people to download it, then update it with some bad code or flip a bit on the server and execute code dynamically. And these are going to be some really interesting problems we have to deal with with app stores. And just to final point, the future of mobile security is not going to be PC-like viruses. It is going to be in this gray area and we're going to be seeing more and more of this. So pay attention to what you download. Developers, be responsible about how you're developing your apps and administrators. Don't feel like you have to ban apps. Just make sure your users know what is happening in the context of their mobile experience. So we want to thank everyone and thanks to Google.