Hi, I'm really happy to be here talking to all of you today. Today I want to talk a little bit about scaling a payments platform. First, a little bit about me. I'm mainly a Rails developer, but I like using Go and Swift as well. I worked at Shopify from 2011 to 2017, where I worked as a developer on product and led teams that handled APIs, payments, and data. In 2017, I decided to leave Shopify, and now I'm a contractor still mostly doing Rails and advising engineering teams. Today, I don't want to talk much about the future of payments or the technology behind it. Instead, I want to talk about the past. I want to talk about some of the challenges we ran into building and scaling payments at Shopify. I want to give you an idea of what led up to some of the payments tools and technology that we have today. You often know the past to understand the present, understanding how a system got into a particular state will help you understand how to evolve it further. To know what needs to change and how to change it, you need to understand how we got here. There are five parts of payments platform that I want to dive into. Integrating payment providers, compliance, scaling a payment system, becoming a payment service provider, and handling fraud. First, let's take a look at what it was like in 2005 when Shopify got started. These days, one of the go-to solutions for accepting credit cards online is Stripe, which didn't exist in 2005. There were payment processors. PayPal existed, but your options were limited and depended a lot on where you and your customers were located or what you were selling. If you had options for a processor, then it could be very challenging to get approved, especially as a new business. You would need bank accounts, financials, tax returns, and personal guarantees. Then you need to get online. Your choices were Yahoo Stores, which wasn't very flexible, or Build and Host the website yourself, which means integrating the payment providers and handling all the risk and security yourself. So that's what things looked like when we got started. And the first thing we needed to deal with was integrating payment processors. So payment processors vary a lot by location. The types of services they allowed, the fees, and all kinds of other things. So it was pretty clear that we were gonna need to support multiple payment processors if Shopify was gonna make it anywhere. There was a lot of variation of what was provided through their APIs. Some support authorized and capture flows. Some only supported purchase. They might support refunds or voids, and they might not. There was also no unified spec for all of this. They all had their own XML definition and different endpoints that you need to interact with make it all happen. Though, as Nathaniel mentioned, early on, we worked out an abstraction that hid all of these APIs and the differences and allowed more to be supported in the future. The Ruby Library Active Merchant was born from this work. Having a single interface for interacting with the payment gateways simplifies the code that needs to call them, especially if you're integrating with a lot of different gateways. Though Active Merchant isn't anything crazy. It provides an abstraction for a credit card and exposes purchase, authorized, capture, and void operations for the gateways. This is a stripped down version of the initial gateway class that everything extends from. But really it's more of a spec than a true object oriented abstraction. It didn't have a definition for those purchase, authorizer, capture methods. Instead it was up to you to just implement them when you were implementing your gateway. So this made it really easy for newcomers to add new providers since they only needed to implement the parts that mattered for their gateway. It also meant the code using Active Merchant need to know a bit about the gateway it was calling which isn't necessarily a bad thing when you're dealing with payments. Active Merchant kind of blew up. It became the library to use when integrating payment providers in Ruby. We had hundreds of contributors and over a hundred integrations were added. Gateway APIs changed a lot over time. So having the community really helped with that. These days, all kinds of businesses leverage Active Merchant to help integrating different payment gateway. Now that we had payment providers integrated and could start accepting money through them, the second thing we needed to deal with was PCI compliance. These days you don't need to think about PCI compliance as much. Freedly, Stripe and many other providers have solutions that mean you don't need to worry about it. We didn't have this luxury. So here's a bit of an overview of what's involved with being PCI compliant. It's super high level and leaves it up to the implementer to figure out exactly what they need to do to meet the requirements for their specific case. Basically it boils down to only storing the card data you really need, encrypting all transmission of cardholder data and protecting any data you do store behind a secure network and restricted access. The trick with PCI compliance is coming up with what is in scope. Any consultant will recommend putting as much of the system as possible into scope because this is a safe advice and will ensure everything is covered. This also increases the cost and complexity of any audits or security testing you might need to do. This will also likely slow down the development of your product due to the extra process that's put in place. This is pretty terrible advice. Instead, what you should do and what we ended up doing is reduce the scope of what needs to be compliant as much as possible.  This allowed us to iterate on Shopify the product very quickly without all the compliance overhead since it wasn't in scope. To do this, we built a separate service to handle the credit card process. This meant that the main Shopify application that most people interact with never sees a credit card. And those millions of lines of code that are not in scope for compliance. Only the credit card processing service would be in scope. Let's take a look at how that works. So first, the user's browser posts a credit card form directly to card proxy over HTTPS. Card proxy then interacts with the processor to authorize or purchase payment. Next, card proxy responds with a redirect to Shopify with a payment token. And now the Shopify server can use that token to do additional operations on the payment through card proxy, such as voiding or refunds. Later, we took this one step further by splitting card proxy into a service that receives the card and another that uses the card. The browser posts the credit card form to card store, a tiny go service that stores the card and memcache. Card store then responds with a redirect to Shopify with the token. Now the Shopify server has the token and can ask card proxy to authorize or purchase using that token. Then card proxy retrieves the card details from card stores memcache and clears that data. Card proxy can then perform the operations with the processor. With this split, we separated the systems that perform the operation with the credit card and the one that receives it. Card proxy can only be reached by the Shopify servers reducing the attack vectors to those systems. When it comes to compliance, focus on reducing scope and isolating what needs to be controlled. Keep controlled systems simple and easy to work with and segregate duties between systems to increase security and reduce the attack vector. Now, the third challenge we ran into was scaling all of it. In 2013, when we really started focusing on scaling this, this is what the platform looked like. With the architecture we had set up, every payment request we made held up an app server process until it was completed because we were making the payment request in line. Normally this was fine, but it wasn't uncommon for some payment gateways to have very long response times, sometimes over five seconds, which meant we could exhaust resources or kill requests and potentially drop successful payments if there were any spikes in request volume. There were two issues we needed to fix. Reduce the app server workload and ensure we didn't lose any payment. When working with money, you should release your infrastructure on item opponent operations as much as possible.  Here's an example of where you might end up with a duplicate payment. The server makes a payment request to card proxy, which makes the request to the payment process. Before the response returns to the server, there's a timeout or some other failure, but the payment went through on the processor. Now the user tries making another payment, which goes through as well, and now they've paid twice. To deal with this, we implemented duplicate detection. We generated UUID on the app side and stored it with the order and included it with the request to card proxy. Card proxy stores the UUID with the transaction before making a request to the payment gateway. If the client disconnects and attempts to transaction again, the same UUID is used so card proxy can check if it already performed that transaction. This helped a lot, but depending on where your failure happens, there's still a possibility that a duplicate payment would occur. Between card proxy and the payment gateway, for example, since many of them didn't support duplicate detection. Instead of spending a huge amount of time and effort tightening the loop for these exceptional cases, we put monitoring and alerting in place and had tools to avoid duplicate transactions automatically. No matter how much effort you put into the resiliency of systems, you're going to have failures. Having tools and automating the recovery from failure is just as important as recovering from failure. It's just as important as preventing the failures. Now that we had some resiliency between Shopify and card proxy, we needed to deal with the slow payment gateways using up our app servers. Remember that in our current architecture, when a user makes a payment, we do the payment gateway request in line from the app server, holding up that user's request as well. To speed this up, we didn't really reduce the workload, but moved where the slower parts were being processed. We have the card store part from before, which remains the same, and we also have the card proxy interaction which remains the same as well, except we move all of it into a background job. This way, the slow part can happen outside the main request and freeze up those app servers to handle other users. When we deployed this, it cut the app server response time in half since we weren't doing all that work in line anymore. An added benefit to having the payment processing and a background job was that we now had more control over how they were processed without impacting the user's experience. We could throttle payment gateways so we didn't overload them or pause processing of a particular gateway if they were down or having issues. When scaling a system, make operations item potent as much as possible so they can be safely retried. Make sure you can recover from failures as well as prevent them. You're not gonna catch everything. Move processes out of the critical path can be a lot easier and cheaper than trying to optimize them. After all of this, payments was still pretty complicated for our merchants. It was especially frustrating to having to send them off to get a payment account, which was pretty tricky for a new merchant just starting out. This is when we started working on Shopify payments, which would turn Shopify into a payment service provider. Up until now, Shopify was mainly focused on being a great storefront and check-in. But there's a lot more to running a business like payment processing, shipping, support, et cetera. Becoming a payment service would mean merchants wouldn't need a separate payment gateway and payment account. Shopify would handle the payment transactions and connect with the merchant's bank account to send the funds directly to them. This is great because it cuts out a big barrier to merchants and a middleman for all those transactions. We started going down this road. We found a bank and payment processor that we could work with. All the interactions would go through Shopify and we could provision and manage the merchant accounts behind the scenes with the payment process. We would also manage refunds, chargebacks, and payouts to the merchant. All of this might sound familiar because this is a lot like what Stripe Connect evolved into. At the same time as specking out everything for Shopify payments, we were also integrating that first version of Stripe Connect into Shopify. At the time, Stripe Connect had two pieces that would help us out on top of being a process. API's to onboard the merchants to Stripe and access to the transaction data. There was no managed accounts, no way to manage payouts. It was pretty bare bones compared to what it can do today. A few months into our PSP project, we pivoted to working with Stripe to white-label their services instead. The big reason for this pivot was it was going to be a lot faster and easier for us with Stripe. They had an API to onboard customers already. Their other APIs were well-designed, easy to use, and provided a lot of what we would need to build our own payments. Looking back, the evolution of all this has been pretty cool to see. We started working on this with Stripe in 2012, and here's how Stripe Connect has changed since then. It's great that we were able to help fake it and grow along with it. It was pretty cool recently when I was working on an iOS app just in my spare time, picking up Stripe Connect again for the first time, and being able to easily integrate payments and Stripe connecting to my back-end server in just a few lines of code. So it's pretty crazy where it's come from what it was initially when we first got started with. Even though we didn't need to build all this ourselves, it wasn't perfect. Sometimes transactions as our payouts didn't add up as we expected because of when it was settled or the data in the APIs, then we couldn't display something as we wanted to. These things were especially important when it came to reporting our own financials. Eventually, we ended up keeping our own record of the transactions we were putting through third parties so that we could spot and handle any disc frequencies that might come up. Using a third party is great, but you need to keep your own records so that you can determine if something went wrong, but they're depending on someone else. The final thing that we need to focus on was fraud. You have a service that is really good at processing credit cards like Shopify is. You're going to be a target for fraud because you're probably also a great way to test if credit cards are valid. And people did a lot of testing for valid credit cards with Shopify. Initially, fraud detection was pretty simple. We had some basic card-coded rules. We depended a lot on what the payment processor told us about the transaction and we blacklisted failed attempts from the same user. The problem is this got it wrong in both directions pretty often. Static rules weren't very accurate in many cases. For example, using a proxy isn't a good indication of fraud these days since lots of people use them day to day. On top of this, the cost of a chargeback or fraud was pushed to the merchant often after the order had been fulfilled. This led to a lot of cross being lost with the merchant. When we started looking into dealing with fraud a little bit more aggressively, we looked at external services detected. But with something like fraud, it really comes down to the data that you have and we had lots of it already. We owned a whole pipeline so we could get to know a lot about what the customer is doing before they completed the charge, completed the purchase. Timing was also great because we were starting to invest more heavily in machine learning. And on top of this, we could make something that we knew would scale along with the rest of the platform. When building this fraud service, we first needed to find the problem and figure out when we needed to detect it. For us, we wanted to run the checks during checkout so that changed some of the data that we might have available and the latency requirements of the service. Next, we needed to find the features and inputs that we could look at to indicate if something was wrong. We needed to make sure that those features were available when we needed them. For example, chargebacks and refunds are a great indicator of fraud, but that data might lag by many months. Then, how do we measure and test it? What's the impact on the user? We wanted to be able to flag as much fraud as possible but we also wanted to reduce the false positives and negatives so the burden of checking our work wasn't put on the merchant. Finally, we could deploy the service and make sure it could handle the throughput that we needed. We also made sure that we could easily update the models as our understanding of fraud evolved. This is a breakdown of the fraud service that we deployed. First, orders in history come into Shopify and eventually propagate it to HDFS, which is our locked-air storage. Using this data, models could be built and tested using Spark. The fraud model could then be pushed to the fraud service which uses the data from the current order and other feature inputs to make a decision. Now, Shopify can ask for a fraud rating during check-in. When the fraud check occurs, all the inputs used are pushed to HDFS via Kafka so training and testing can be done on the same data we saw in production. And if we wanna update our fraud model, we can build a new one with Spark and push it to the fraud service whenever we wanted to. If you build anything related to payments or money, you're gonna need to deal with fraud at some point. If you have lots of data about your payments and who is making them, that can be leveraged to figure out what fraud looks like on your platform. Fraud will change. Your detection needs to be able to change with it. If you're interested in learning more about the fraud service at Shopify, Solmez, one of the directors of engineering, did a great interview that goes into a bit more detail. That's a pretty good picture of some of the things we went through scaling payments at Shopify. We had to deal with integrating multiple payment gateways with different features, but we were able to leverage the open source community to help us out. We talked about how dealing with compliance by reducing what is in scope and isolating those systems helped us to continue moving fast on the main product. We handled scaling the platform by shifting the workloads out of the critical path and making operations repeatable to reduce the impact of failures. We worked with a third party for Shopify payments and tracked the data that was important to us ourselves, so we didn't just depend on their APIs. And finally, we leveraged the huge amount of data we had and machine learning to fight fraud. I hope this gives you a good understanding of the challenges we had and some of the solutions we came up with, so you can use that knowledge to make the next generations of payment product firms easier to build and use. There are still all kinds of problems that need to be solved with payments. Banks are still hard to work with, security and data privacy are huge points of concern, and the availability of machine learning and AI tools is really going to shake all of this up. I'm looking forward to seeing what the next 10 years of payments tech brings up. Thank you.


How many numbers do you have there? Eight. And where did you get eight from over here? Three divided by twenty-four. Twenty-four. Twenty-four divided by thirty? Eight. Okay. You're right. And how many groups do you have here, Brenda? I have two groups. No, how many groups do you have here? Six. How many groups do you have here? What's your divisor? Three. Three. So you have three groups in your tens right now. You're distributing your tens. How many tens do you have in each group? Eight. Eight. So three. Well, actually, can you give me a multiplication sentence to match what you just did? Three times eight. Yes. You have three groups and you put eight discs in each group. So three times eight gives you what? Twenty-four. Twenty-four. Twenty-four. Twenty-four. So just like you said, Janice, three, twenty-four divided by three is eight. And so we know eight times three is twenty-four. Go ahead and model on your multiplication. So that would be eight. So far on the top we have eighteen. So now, now, eight times eight is twenty-four. So twenty-four. So what would you do with the twenty-four? You know that three times eight is twenty-four. So what would you do now if you've distributed all of your tens? Subtract. Subtract. Yes. Go ahead and do that. So twenty-four. Twenty-four. Twenty-four. So there's a difference. Zero. So we still have it. And then we bring down our six because we have our six there. So now we can take six away from six. Where did you get six from, though? Because I distributed six. Well, you've distributed your six ones. So give me a multiplication sentence to match that. Six minus six. Well, a multiplication sentence. So how many groups do you have here? Three groups. And you've distributed your six ones. How many ones in each group? Two. Two. So go ahead and write it down on your long division. Now your multiplication sentence will be what? Three times two. Yes. Three times two.  Six. Six. So that's where you get your six. Don't forget your steps, okay? So six. Now what do you need to do? Subtract. Go ahead. Six. Six. Six. So our answer is one hundred and eighty-two. That's the quotient. You got it. Great job, mathematicians.


Honourable Prime Minister Shnarendra Modiji, Honourable Prime Ministers, members of both delegations, friends from the media, good afternoon. I welcome you all to the press statements following the meeting that has just concluded between the leaders of India and Japan. May I now request Honourable Prime Minister Shnarendra Modiji to make his remarks to the media. Your Excellency, Prime Minister Kishida, both the delegations and friends from the media, good afternoon. First of all, I welcome you all to the press statements following the meeting that has just concluded between the leaders of India and Japan. Last year, Prime Minister Kishida and I met many times, and every time I have felt his positivity and positivity towards the Indian-Japan relations. And that is why today his journey will be very useful to keep the momentum of our mutual co-operation going. Friends, today's meeting is even more special than any other reason. This year, India is taking over G-20, and Japan is taking over G-7. And that is why it is a great opportunity for us to work together with our own partners and allies. Today, I have told Prime Minister Kishida about the G-20 project of India. Our G-20 project is to give voice to the global south's projects. And that is why we have taken on this challenge. Friends, India, Japan, the Special Strategic and Global Partnership, is based on the rule of law on the international level and the international level. It is important for both our countries to strengthen this partnership. In the Indo-Pacific region, peace, prosperity and stability are also important. Today, in our conversation, we have discussed the development of bilateral relations. We have presented the principles of technology, trade, health, and digital cooperation. We have also discussed the importance of the health supply chain in other critical technologies. Last year, in the next five years, in India, 5 trillion yen, i.e. Rs. 3,20,000 crore, was the target of Japanese investment. This is a matter of satisfaction that has been developed in this direction. In 2019, we established India-Japan Industrial Competitiveness Partnership. Inside it, we have increased the competitiveness of the logistics, food processing, MSME, textiles, machinery, and steel industry in the region. Today, we have also participated in the partnership. On the Mumbai-Amdabad high-speed rail, we are rapidly moving forward. I am also happy that we are making 2023 a tourism exchange-verse. For this, we have chosen the theme of Connecting Himalayas with Mount Fuji. Friends, today, Prime Minister Kishita gave me an invitation to the G7 leader summit in May. I thank him with his heart. After a few months, in September, I, Prime Minister Kishita, will meet again in India for the G20 leader summit. This is how our talks and relations have been going on, and India-Japan cooperation continues to touch new heights. With this, I give my thanks to Prime Minister Kishita. Thank you, sir. Now, may I call upon Honorable Prime Minister Japan to deliver his remarks. Since March, I visited India again at Hyderabad House. I am very pleased to have had a good discussion with Prime Minister Modi once again. Also, my gratitude is expressed to Prime Minister Modi as well as to people of India who always extend to us warmest welcome and reception. This year, Japan's sub-presidency of G7 and India G20. As the world is standing at the history's turning point, fought with difficulties, what role Japan and India should play? I wish to discuss this fully with Prime Minister Modi. With this thought in my mind, I came to India. At the meeting, I have explained that at the G7 Hiroshima summit this May, from the two viewpoints of upholding international order based on the rule of law and strengthening partnership with the international community going beyond G7, including the countries from what is called Global South, challenges faced by international community will be taken up. Having conveyed this, I be affirmed with Prime Minister Modi our commitment to strongly uphold international order based on the rule of law. Also, Prime Minister Modi shared his thoughts on various themes in international community, especially in areas of development finance, food security and climate energy. Views concurred to have close cooperation between G7 and G20. We will cooperate toward the success for G7 Hiroshima summit and G20 New Delhi summit. In this context, I formally invited Prime Minister Modi to G7 Hiroshima summit and on the spot, my invitation was immediately accepted. Regarding the strengthening of bilateral relations with India, who is a special strategic global partner, wide range in discussion also took place. In security area, holding of 2nd Japan-India 2 plus 2 meeting last September and implementing Japan-India joint fighter exercise for the very first time in January this year, were welcomed as concrete progress. Economic cooperation with India, which continues to grow rapidly, will not only support further development of India, but also creates significant economic opportunities for Japan. In this regard, we welcome that steady progress is being made towards realizing five trillion yen of public and private investment in financing from Japan to India in five years. That's how I get which Prime Minister Modi and I said in March last year. And we welcome the signing of the aid memoir to confirm our intention. We also welcome the introduction of the aid memoir. And we asked again that we will continue to work on energy and decarbonization. There has been an introduction of 300 billion yen of legal agreement. This will increase our support. And in order to increase the productivity of India, especially in the lower part of India, fiscal 2023 will be the year of Japan-India tourism exchange to promote our exchanges through tourism. I also welcome the renewal of our MOC on Japanese language education. During our working lunch to follow, I hope to have yet another productive discussion on such topics as the Indo-Pacific regional situations. After our working lunch, I will announce my new plan on free and open Indo-Pacific or FOIP at a lecture event hosted by the ICWA. It gives me a great pleasure to be able to unveil my new vision on the soil of India, which is our indispensable partner in realizing FOIP. I am looking forward to welcoming Prime Minister Modi and Hiroshima in May and to once again visiting India on the occasion of G20 New Delhi Summit. I thank you. Thank you, Excellency. That concludes the press statements. Thank you all for joining.


Hello friends welcome to the session we are going to discuss matrices if a equal to matrix 1 1 1 1 1 1 1 1 1 we have to prove that a to the power n equal to 3 to the power n minus 1, 3 to the power n minus 1, 3 to the power n minus 1, 3 to the power n minus 1, 3 to the power n minus 1, 3 to the power n minus 1, 3 to the power n minus 1 and 3 to the power n-1 matrix where n is the element of natural numbers. Now let's start with the solution. In this question you are also going to follow the mathematical induction method. Let me tell you the basic idea. It is in this method we first show that the result is true for n equal to 1 then we assume that the result is true for n equal to k and we prove that it is true for n equal to k plus 1. If the result is true for n equal to k plus 1 then we conclude that the result is true for all natural numbers. Let's start with the solution we are given a equal to matrix 1 1 1 1 1 1 1 1 and we have to show that a n equal to 3 to the power n minus 1 3 to the power n minus 1 3 to the power n minus 1 3 to the power n minus 1 3 to the power n minus 1 3 to the power n minus 1 3 to the power n minus 1 3 to the power n minus 1 and 3 to the power n minus 1 matrix for all n being the element of n. Let's name this as our second equation. Now we'll prove the result for n equal to 1.  This implies a equal to 3 to the power 0 3 to the power 0 3 to the power 0. Similarly for the second row and third row this implies a equal to 1 1 1 1 1 1 1 1 1 1. As we all know that any number to the power 0 equal to 1 so the result is true for n equal to 1. Now for n equal to k we get a to the power k equal to 3 to the power k minus 1 3 to the power k minus 1 3 to the power k minus 1 similarly second row and third row and we name it as our third equation. Now we'll prove the result for n equal to k plus 1 a to the power k plus 1 can be written as a to the power k into a. Now we'll substitute the value of a to the power k from equation number third and value of a from equation number first. This gives us this can be written as 3 into 3 to the power k minus 1 3 into 3 to the power k minus 1 3 into 3 to the power k minus 1 similarly we'll write for the second row and third row this is equal to 3 k minus 1 plus 1 3 to the power k minus 1 plus 1 3 to the power k minus 1 plus 1 similarly for the second row and this is equal to 3 to the power k 3 to the 3 to the power k, 3 to the power k, 3 to the power k, 3 to the power k, 3 to the power k and 3 to the power k matrix. Now we see that the result is true for n equal to k plus 1. Hence the result is true for n equal to k plus 1 and by the principle of mathematical induction the result is true for any natural number in. So hope you understood the solution and enjoyed the session, goodbye and take care.


So we are here with Kyle Hanselvan, Hanselvan. I said it wrong right after you told me how to say it. That's all right. You're a mayor or a connoisseur, a hacker of things, and CEO of Hunter Slabs. And I first discovered when you did some research on Kasea. And so let's talk a little bit about that. You are like, this is one of those things that's important to me and important to a lot of my audience is that, okay, you know a few things, but you don't just know a few things. You've actually done a lot of things.  Those are cool and the validation of institution is important, but let's see a couple other things we have in here. You are DEF CON 20 CTFs competition winner. Is that correct? That is. Yeah, I snagged a black badge out of DEF CON. So that was a pretty cool accomplishment. That's pretty cool. Just a ton of articles, not just the Kasea one on auto runs and playing all that. And that comes from your background of creating them on the offense. Am I correct? Yeah, so I cut my teeth. Unlike a lot that start in defense and grow to offense. I jumped knee deep into offensive security in the early 2000s. So there's a lot of things I'm bad at hacking things is one of the things I'm pretty darn good at. And you spent some time playing hide and seek officially though with the NSA and creating, doing some internal testing with your in government engagements too, correct? Yeah, so all the way from my time in the Air Force. So I got to spend a lot of time in the intelligence community in Air Force. I jumped out and worked directly for the NSA but there's a contractor as well as government employee. And here I am now at Hunter's. So it's been a crazy wild ride. Creating all these persistent threats and everything. And one of the other things that is fascinating to me is I don't like security reachers who think that anything should be a secret. Even in the latest Brian Krebs article, I see people calling it out that all these indicators of compromise are sometimes like wall gardens, like well only I should know this information and it shouldn't be shared. And all these security researchers, you and many others, I'm seeing this bigger trend and I love it. You dump it all out there. This is the debrief on it. And this comes all the way to Casayla. You gave a very good debrief and kudos to Casayla. Like you said in there, you're not blaming them. You're, they had a good response to it as well. But security done through the public eye and published and talked about, or even what we're talking about here to start breaking this down, hugely important to me. Yeah, it's kind of weird having like a shady NSA background where you think a lot of it would be, you know, not transparent, but I think I learned over the years and even at the agency itself, like you see now NSA coming out releasing a lot of some of their internal reverse engineering tools. Yeah. Indicators of compromise where it sure benefits them. But I'm a huge on transparency. Like if you accurately represent a situation, make sure everybody's educated, like it puts it at a level playing field, right? And I never wanted to establish blame. So like you said, I never hold anybody against whether it's their issue or not. Yeah, no, and it's about that levels of transparency. It's one of the reasons that's drawn me to open source over the years too, is being able to see inside the firewall, it was a mystery back when everything was some blob of firmware loaded in a little Linksys box. And I'm like, that doesn't seem right. So this would, you know, got me into firewalls and got me taken apart. Once I'm like open source firewalls, we can start seeing what's inside of them. I can actually watch the package traversing. And of course that leads to discoveries of this shouldn't be traversing. It's always an unexpected like, oh, sometimes you, you wish you could put things back in the box. But yeah, I think overall, there's probably way more victories for transparency than not. Yeah, I mean, there's a lot of people that really wish we wouldn't have poked into things, but at some point, and that's, I'm gonna share it real quick on the screen here, let me pull that up because we're gonna talk about the Kaseya thing real quick. Just, you know, this is from a little while ago, share screen, there we go. So the Kaseya mining pilot, and of course, this is a payload, this is also because Kaseya was, you know, is an MSP tool, so it's loaded, it's an ARM tool that is loaded on a lot of computers, so you have access. And mining payloads are really hot in 2018 back before Bitcoin, oh, I don't know, became a little less valuable. It wasn't about exfiltrating data, it's all about mining and stealing my CPU cycles, you know, that was what all the goals of the hackers were. Kind of is for right now, but it was really hot then. So what was the trigger, how'd you guys find this? Let's kind of talk through it a little bit. Yeah, so you kind of already alluded to like the terrible acronym APT. My job was persistence, right, long-term access at the agency, and so we look at things a little bit different. So at Huntress, it's always about how could somebody make a payload automatically start running. And so for us, while there was a lot going on, all of a sudden we noticed like several thousanders, actually probably about tens of thousands of computers that had scheduled tasks that were just abnormally named, you know, they didn't hide in plain sight as well as they should have. And so for us, we were like, what in the world is this thing, like you're actually on your screen right there. It says, you know, as illustrated, the foothold was established with a single power shell command. When you're looking at this data set, it's funny how some things that are just poorly done for like upsec by the attackers really stand out as an anomaly. So we had no clue is even related to any product or any type of vulnerability. It was just the scale made us realize like, oh no, that was kind of that first indicator of compromise for us. And one of the things I find really interesting is that they pulled from Dropbox. And the reason I say that is being that I do a lot of videos on firewall, people constantly are asked to be like, oh, so Siracada would have caught this. Like they think that the firewall, and I think this is a Hollywood problem, they've breached the firewall as if that's like what really happened. But the reality is you're not gonna block Dropbox at the firewall level. So that's why they use it. They know it would pass through any SIM tools, not gonna see this and really understand that it's a power shell script. It is files being downloaded from Dropbox. That's not suspicious at all. This is one of the reasons I think endpoint protection is absolutely almost in some ways more critical than the firewall because, well, they just, like you said, they didn't do too much obfuscation. They just grabbed something from Dropbox and loaded a power shell script. But a firewall wouldn't have seen that at all. And that's what kills me. Like there's a lot of folks that wanna place the blame game.  I'm not a big fan of that side of the house. So yeah, it's kind of weird how you have to nowadays like attackers are challenged so hard on the process behavior that they've now taken this whole new approach of like, I'm gonna use the legitimate good tools and only with these good tools or good websites am I gonna use them for nefarious purposes to help minimize my time of getting caught. So I think it's both really crappy. I gotta give, you know, actors props for being innovative. But we as obviously the community have gotta do a whole lot to make sure that we're calling these things out, working, you know, vendors quickly reacting, shutting the stuff down like that's the stuff I live for. Yeah, and it's still defense in depth. It's not that I say you don't need the other components, but you need all the components all together and there's just layers and pieces in there. And as we develop all these fancy tools, the next thing that we know happens is the hackers, it's getting harder for them, but they're gonna get better at it. They're gonna do the next thing. And so I find that kind of interesting, but that's where we see this Y-Pro. And Y-Pro, I don't know how we say that one. I heard it on their sales call or they're in the quarterly reading report. At least it sounded like it was Y-Pro. Yeah, and they were using, let me jump back to the screen to hear because they were using the screen connect tool, which is obviously connect-wise tool was a big component of it. And it's not a compromise in screen connect, but it actually caused some confusion because I noticed this is all going on behind the scenes. There's the, before Crubs gets to publish stuff, these companies are sometimes aware, there's NDAs involved because they're trying to investigate. I noticed that our screen connect sessions, and we updated and it solved it, we're getting flagged as malware, which doesn't sound right, but now that they released some of this information and screen connect was one of the tools they had compromised in order to do this, but not compromised it as a upstream vendor attack, but they got into the infrastructure at Y-Pro. Yeah, yeah, so a lot of folks, it was at the downfall sometimes of sharing information like to transparently, you're exactly right. Like that link that says a list of indicators. Oh, it's perfect. Yeah, if you click that folder. So if you take a look at these files, like those exes and DLLs, those are all 100% legitimate software from connect-wise, not vulnerable. It's the legit software. And unfortunately, some folks like knee-jerk reaction was anything that's has these hashes must be malicious, which because BS, it's like once again, like every cop's gun that was made by Beretta must be malicious because a Beretta was used in a shooting. Right, it's silly. I'm looking at it to see if I have the link for my virus totals thing. I uploaded it because ours got flagged and I was like, whoa, why is this out of the blue getting so flagged everywhere? I don't have the link anymore. I sent it to their support people and they're like, oh, you need to do an update, you need to do this. But yeah, it makes you panic at first for me. It just has another MSP, another IT vendor going, why is my tool that something happened that I didn't know about? Well, no, these companies, like you said, these are legit things, but they're using the hashes to go and know they're not. Yeah, yeah, I mean like connect-wise, the software wasn't vulnerable. It wasn't, you know, they literally did nothing wrong but the irony of the whole thing is somebody's knee-jerk reaction caused it to get signature. It also is funny, like what you said about the solution to it was updating the software, right? And you think about that. What type of signature was used? It was probably just a static hash because, think about it, Scream Connect, they didn't rebuild all their features. No. It gave you an update, it was probably a recompiled version that changed the hash, but that was enough to get around. So it was- Yeah, add a space in the code and recompile so the hash changes, all right, now it's fixed. It happens, I mean, not everybody's that way. All most vendors use like, you know, application behavior and stuff like that, heuristics. It makes you scratch your head sometimes when you're like, wait, Scream Connect was getting flagged. I downloaded a new recompiled version the next day and it's no longer getting flagged. Was that because it's now whitelisted? Or is it just because it's a different hash and different, you know? Yeah, now this is, it was kind of funny, I was listening to Steve Gibson's podcast and he's got a new tool out there and he got a new DigiSert signing certificate for compiling and he realized the heuristics flagged it because the cert was too new. It's kind of flagging it.  He went through like a debrief and I'm like, that's fascinating way to get around it but that's also why we've seen companies get their signing certificate, which is obviously something that should never get stolen but I think Komodo had an incident not that long ago where someone was reusing their signing cert or in the case of the ASUS mail where it's an upstream attack to get something with a trusted signing cert to get that mail, the shadow hammer, I believe was the- Yeah, you're exactly right. The ASUS vulnerability where some of the samples were straight up signed with the legit ASUS signing certificate, so. Yeah, so it's still ways to get around and it comes back down to monitoring your endpoints and trying to figure that out, but yeah, that is, oh, this is such a mess here. It's crazy, I didn't realize that folks were using that method to be able to get their software more reputable but you know what's a cool analogy on that is a lot of companies that send email and marketing, what you do is you don't put your new server out there and just start blasting email because you're so new, your reputation is low. So there's an actual legitimate marketing procedure to warm your servers where you send a little bit of email over time to trusted addresses till you get the reputation. That's a crazy idea that you could use a signing certificate the same way, establish your reputation by warming. Yeah, by warming it, by doing all the, recompiling your old software is popular so there's enough samples of that certificate out there with across the love Antivirus products that then you can compile your, like this is, it's interesting to think software developers have to do to be inconvenienced in order to go know we're legitimately a genuinely proper company doing good things, we just want our tools get out there. Yeah, I don't know.  We obviously got a dev team on our house and one of the ways that we've been hoping to see more like security vendors take things more serious is some of the EV or extended validation certificates require a hardware token. And so the benefit of that is like, I think in theory is theoretically if you're a hardware based extended validation token there should be some assumption unless you had a physical security compromise which obviously could still be stolen but a hell of a lot harder to remotely gain access from some foreign country and still somebody's physical certificate. So hopefully there's maybe more of that. I'd love to see that component come in to like helping establish reputation. Yeah, that's actually something he had mentioned was that I was seeing if I could find a picture of it but DigiCert has a little dongle that you plug in for the signing code cert. Actually, I found it real quick, I'll throw it up here but it's kind of cool. I imagine you guys have something similar for signing yours.  So it's not a USB drive but ours is like if you ever seen like a military common access card or anything else. Oh, it's a lot like the chip on your credit card. It's just a white little token that we plug in for ours but we actually use DigiCert as well. I wonder if when we renew if we'll get the new USB dress. Yeah, it's kind of, it's a novel and it's coming back to needing something physical to plug in like you said to get this signed because obviously you never want that stolen. You don't want, once you, because revoking certificates is not as simple as a process as it should be. It's one that's been discussed a lot is how do we revoke companies that have their signing certs stolen? It's not easy. Your system can't continue to trust it for a while even though we have an AV update for it. So it's another component that we just really got to keep that locked down. Oh man, yeah. So that's, I mean, that's actually the easiest way when we were looking at that repro incident that was saying whether that connect-wise software was actually abused or not. There was no clarification right at first. There was, they just said it was, it was seeded I think is what Brian Krebs words were. So we had to really figure out like, was there somebody that modified it, backdoor it? And the easiest way for us was right away of saying like, look, the private key wasn't stolen. Yep, this is still validating against the private key. These DLLs and EXEs that were assigned. So you're right, for a vendor it could add like huge benefit for even like researchers that are doing that due diligence to say like, yeah, sign. And as long as it's not a ASUS supply chain type issue, you know, it's a quick way to validate. Yeah, and hopefully, whenever we do some of these debriefs and I noticed even in a debrief on the WEPRO one Mimi Katz was used and like, how are some of these old tools still getting in there? That just tells me that there's something wrong and that if any of these old tools get by them I'm like, they didn't have something up to date. They're not using or they allow someone to work from home who had something on their computer. Those are all policies that hopefully through more public exposure of these companies and the ways they got in, we have them going, oh yeah, I guess we shouldn't let Bob use his kid and share the Minecraft computer and this. And get on there. But minor issues, right? My minor inconveniences. Yeah, minor and things like that. And the next one was, we started talking about those before and I'll jump over here to that is the Fintime, Trojanized Team Viewer Against Government Targets. So now- Oh yeah, there was the hotness this week, right? Like just a couple of days ago. Couple of days ago and it's back to the same thing. It's Team Viewer is not, it's not like Team Viewer themselves are compromised but Team Viewer is a trusted product for doing screen sharing and remote management in the IT space. So why not use it to infect this? Yeah, it's funny as none of these companies would ever use it and they shouldn't use it. Please if you're watching, don't use this as a marketing technique. But it's almost like a huge compliment that the attackers are so confident in these products working that they actually use it for like their data exfiltration and things along those lines. Like, you know, what better backhanded compliment than people even trust us so much to do their shady things with? Yeah, and it's well crafted here. They have the whole breakdown of how they do the decoy documents, how they get them in there. Marked as top secret. Oh God, that's great. I would open that, right? Why would you not want to see something like that? Yeah, and then this is, once again, this is back to that transparency. This is at a checkpoint and I'll leave a link in the show notes to this. But they're walking through each step of it very transparently so we can understand it. So while anyone who's, you know, writing countermeasures to this can understand how this is working. But this is impressive from the attacker standpoint it's also back to the being careful and the upstream. Whoever provides your IT, you have to trust them because that sounds like where the compromise happened. They took over with TeamViewer and moving on, moved through the system. Is that correct? I'm just not reading some of it. I think both in this one here, the checkpoint issue was used for targeting government customers as well as the WEPRO issue. And there was, I guess, a couple other large IT outsourcers, managed service providers that also were compromised in that same WEPRO style attack. But it was exactly like you said. I'm not necessarily caring about the IT service provider so much or the IT department so much is how do I use that access to get into something more exciting? And I can tell you like, that's a legitimate strategy is to swim upstream. Like why go through the front door that's largely locked and has cameras and barricades and maybe a security guard when you could walk through the side door that, you know, maybe a little less scrutiny or maybe has a little bit more access, right? I mean, MSPs typically have a pretty solid internal security as well. But once you get past it, if you could be that authenticated person, right? It's kind of like putting on the security uniform now. Once you're able to put on the security guard uniform, now people extend you to a level of trust. Well, and it's kind of a mix. I interact with a lot of MSPs in doing some help and non-social projects and unfortunately there's a few of them and I've done everything to be as polite as possible, but we just updated one of them on what they contradict us. They had a bunch of screen connect and they were stuck because it was a Linux server and they didn't understand to update it. They hadn't noted an update in five years. Five years that the server was running on and everything was exposed. No firewall, SSH, everything open, password authentication allowed. Their only answer was, well, we have a strong password and hasn't got cracked yet but I'm like, there's dirty cow. There's like a ton of, there's a long list of vulnerabilities that I based on your kernel version like you are wide open to. And this is where sometimes it gets unfortunate when companies get focused on money. So you really have to be careful because they're like, well, it costs money to expend it. And this is a conversation we got into at the hacking event last night was a guy, his company says, our deal is worth $4 million. It's gonna cost us 2 million to fix it. Which one becomes the priority? Giving the next sale or putting my dev team to work at updating some infrastructure that we know could get popped. Close that sale is what the being counter said. And he's like, well, that's what we did. He was being gracefully, like very quiet about what company actually worked for. But he's like, these are some of the serious problems we have at my company. I'm a DevOps engineer there. And I kind of want to leave and I may, because my name might get tarnished with the downfall when someone does go ahead and do it. Because it was directly related to the Atlassian and Confluence things that they had some major problems out there. And if you're not familiar with those particular products, they can be difficult to update. Would be probably a polite way to say it. Not a nice PC plug there. Yeah, I did my video the other day on it. What happens when, because someone did a nice write up on what happens when you run Confluence as root instead of as its own user. And then you don't update it. And then you have a public facing. And according to Shodan, there's about what 20,000, 22,000 public facing ones. And how many of those are gonna get updated? Yeah, there's a lot of like in software development, obviously I'm biased because that's my background. But a lot of like the continuous integration servers like Jenkins or Hudson and things like that. Similar approach, access to source code running as root. And it's funny every now and then my Twitter feed, I'll see somebody have like new remote code exploit for Jenkins. And it just kind of reiterates that people are still targeting these. Like why not? Yeah, actually I need to switch over to the Twitter feed here. So we got. Yeah, so I still will undo while we were talking. We were sharing about those IOCs. And I remembered I had a Twitter feed on it. So one of those slides actually shows that instance you were discussing earlier of even though legit software sometimes gets flagged, it doesn't like throw any vendor under the bus. But I think it's that one. So far, many of the on disk IOCs will only confirm the presence of legit screen connect digitally signed with a valid screen connect software certificate. But you can see in that picture right below there is two of 70 of the engines were already and that was cutting edge that was like right after those were disclosed by Brian Kredz. You can see that tweet right underneath that picture shows the actual, you know, virus total interface. And you click that image there like showing two of the 70 AV vendors were at least flagging it. And it got up to something like 14 out of 70 I think by the end of the day. Yeah, and that's definitely important. I mean, they have to start because then it kind of comes downstream. Everyone starts flagging it and then we can start finding it. One of the other things about screen connect just for people who may not be familiar with the product. I mean, we use it and it's the back end PowerShell commands. We even use it to install Huntress on some of our machines real quick. We could just, you just issue a command through PowerShell through the back end screen connect like here, make this thing happen with completely no user interaction. You have full system. So you're actually at like ring zero because it running as, you know, full admin even if there's a user with a lesser privilege logged in. Screen connect is awesome for that but it's also what makes it so scary if your instance of screen connect is compromised. It's an excellent, excellent attack factor. Yeah, it's, I mean, it's a double-edged sword, right? Yeah. Those that use a handgun to defend themselves at home are also a terrifying thing for kids. So, you know, you put gun locks on it. You can treat your security tools the same way or your screen connect tools the same way. Yeah, and this is something I've told people like even our screen connect server in the event that I am unavailable and an Apache problem comes out is we actually proxy it through Apache in auto updates. And someone's like, well, what if it breaks? I'm like, I'd rather have it broken than compromised any day of the week. Broken is aggravating. Compromised is, all right guys, we got to get the cybersecurity insurance out. We have to talk about this. How bad is it? What got happened? Those are much, much worse conversation than, hey, screen connect broke. I have backups. I can restore. Those are all fine. Update these things constantly. Make sure auto updates are a savior because humans are bad at remembering to update things. Yeah, yeah, for sure. Even in the, that was probably my favorite thing out of the ASUS live update incident is, gosh, I'm gonna forget who it is. I think it's the publisher behind No Start to Press. Did a Washington Post or maybe New York Times, something along those lines article the following day was like, look, the one takeaway after the ASUS live update or incident is to not disable your live updates. Even in the risk of supply chain and everything else, that software was doing what it was supposed to do, which is the overall risk of making sure you're getting those updates installed in real time. Obviously there's the risk of stability and the risk of supply chain, but the answer sure as heck was not stop using automatic updates. That was huge. I think Bill Pollock, by the way, did that. Yeah, no, and that's a good point. When I talked about it too, some people are like, oh, I just disabled all the updates. I'm like, no, no, no, as a matter of fact, the live update can update to the version that's not compromised. So that's a legit thing because in this was a super, unless your MAC address was one of the 612 MAC addresses on the list, unless you were among there, the payload never activated. So that's very targeted. Internally, by the way, whether you're red team or somebody's shadier like nation state adversary, that's an actual business process. A lot of people don't think about actors like following like legitimate business plan, but stage one of it is to do like target validation. Is this computer valuable enough for me to even care about? So those actors behind it were sophisticated. They realized their time and resources were limited and they used that amazing capability, right? They could have installed ransomware on. Oh, yeah. I think as Bersky said, maybe up to 500,000 or something. Yeah, huge number. ASUS is a massive computer vendor. So this is a massive platform to do things with. Yeah, but they were being surgical. They could have, you know, that code was running, even though the update was only doing the validation, was running on whatever that number was, 500,000 computers. Right. Yeah, they were being surgical and only targeting, you know, 600 and some. Yeah, so they wanted something and until we know a little more detail, if we ever know who those 600 people are, that's gonna answer the question of who wanted it. Yeah, who wanted it in life? Why were you important enough? I'm pretty sure and even when we, like when that happened, we immediately went out, thankfully we're like a big data company, right? So everything we store, even if it's something that's not like persistence, we had information on like every single computer that was running ASUS Live Updater. So on the fly, we actually like notified our customers like, hey, this was probably run on your computer. But the biggest thing that we actually notified of folks was like, you're probably not important enough to be one of the 600. Like, no offense, my mom sometimes had asked me like, Kyle, you work at NSA, are you reading my email? I'm like, mom, no offense. One, you're a US citizen. Two, you're not that important. I don't have the time nor care about what you're doing. I used to work with a guy who's a conspiracy theorist and I'd had enough one day and I just yelled, I was like, Brad, you're just not that important. I'm sorry, the government's not coming for you. And it was around year 2000 because he thought that's when the NSA was gonna come get him. I'm like, why would they come get you? You're not that interesting. You don't want anything. You're actually not even a great tech. You're really going for the, yeah. I had like, if you remember to the 2000, I was working in corporate ID back then and so everyone, we had to do all these compliance things because I worked at the automotive level of whether or not it was Y2K compliant. It was like busy work of stupidity of, if it has a clock in it, we had to put stickers on monitors to say that they were Y2K compliant. It was one of the dumbest things I did in my career because you couldn't convince it until he certified it. I'm like, it doesn't have a clock in it, but did you check it? I'm like, it's a monitor. So we had to put stickers on things we checked. It was, I got it, the phone system's failed the Y2 and they were all like, how do we do the testing? I'm like, I'm gonna change the time. Yeah. Everyone said to me like, well, shouldn't you do more thorough than that? I'm like, I'm gonna change the time to 2K and then I'm gonna roll it back to the correct time and see if it crashed. Yeah, gosh, yeah. Oh, he spent so much time doing that. But anyways, yeah. Sometimes people think they're too important. Unless you're, that's 600, which I don't like the way Kaspersky did it. And I probably did it for attention where you had to put your MAC address in and I gave you a yes or no. But that piece of reverse engineering, their name will lose me, but I did a video specifically on how they, they gave such a great detail of how the reverse engineered and pulled and extracted out salted hashes of MAC addresses. And that was a cool reverse engineering. Yeah, that was skylight cyber to give those guys mad props. Oh yeah. They were awesome. Just like a capture the flag event, right? Trying to reverse engineer and figure it out. Yes, that's actually a good point. You know, I guess there is some privacy there that you wanna respect somebody's privacy. There was also some things like just the same way that people like, you know, misconstrued like RMMs or products from, you know, vendors being malicious. Some people took the wrong approach. They were like, look, if you look at the MAC addresses, there's a high level of Intel MAC addresses. Clearly there must be something with Intel. It's like, no, that's not how this worked. It had nothing to do with Intel and nothing to do with the vendor. They just happened to be running a common product, right? Yeah. And these vendors, I mean, they genuinely want all the products to be secure. They don't want their reputation. And I feel the majority of all these MSP larger ones that I've dealt with, you know, connect wise and solar winds. They, the engineers, I've actually met a few of them. Like they are absolutely want their product to be top secure. They do a good job and everything else. And so that's not where these problems lie. It's sometimes the people who use the tooling. And I try to dig through the back channels of the Weeper one. And I feel, I've gotten two mixed things. And I see people arguing in a couple of the hacker channels. Some say I worked there. Their operational security was not as good as it could have been. And other people said it was good. It depended on what division you worked in. So I want these, I hope they give really good debriefs of exactly how a phishing email got through and what the entire movement was on there. I don't know if you listen to Dark Net Diaries. Oh yeah, oh yeah. I think some of those that they do have like the actual dumps are going through like their incidents are brilliant. Kaspersky, ironically, a lot of people forget that Kaspersky themselves got compromised in like 2016. They called it Dooku too. And it's an amazing like breakdown of all the ways how they got in, how they did the incident response. They owned their incident. And you can say like, oh, Kaspersky, you could have been negligent, but I think they owned it. They just said, look, this could happen to anybody when somebody like this targets. Did you see a particular like Dark Net Diary or incident or not incident, but a podcast or that actually had something like this of, they were calling out or walking through the incident? Not that we throw one yet, but I've gone through like some of the older ones. What was that big oil company? They walked through that one. That was the Ramco. Yeah, Ramco. The audio Ramco. Yeah, that was really good. Did you, out of the latest one I just finished yesterday, which was Jeremy from Marketing. I don't know if you've listened to that one. I haven't. I haven't got on that one. Oh, good red team story. Walking you through a plant, they dropped in to do red teaming. He was Jeremy from Marketing. He wasn't really Jeremy from Marketing, but you know, it was actually, it was a good story that gives you absolute and I love the level of detail that I get into it of walking you through. These are the tools I tried using. This is how I tried to capture their password hashes. This is how I tried to walk through each step of it in depth. And that's something I appreciate greatly because we need more content like that because that's what gets people thinking about it. Oh wow, I'm running that. And I didn't turn on 2FA because you always have to start with the assumption they've reached a perimeter. Even my network is overly complex in some ways because I assume they're already breached everything. Yeah, assume compromise, right? Yeah, assume compromise and work from that threat model makes it harder and then, you know, test. So my friends, I invite them over. They're trusted hackers. They're white hats. You can poke at it while you're here. We record how they got hacked on Fridays or whatever shows we record. I'm like, they're poking away at stuff all the time. Hey, Tom, we found your printer. Oh yeah, I forgot, I hooked something up. And I think because I mean, you have a huge variety of viewers from folks that are getting into security to people that are knee-deep, to folks that are in IT that obviously it's tangential. Even down to students or folks in the C-suite that might just want to come here to be able to learn. I think one of the biggest things that your podcast and videos on YouTube offer is like, it makes these things more relatable, right? And even from like IT folks, I've seen folks that commenting on your videos that are like, look, I never thought that I always treated like my pentesters as an adversary or even pentesters commenting of like, I never thought that if I can make these more relatable and don't get rid of some of the hype, the fear and uncertainty and doubt that can make some of these things more digestible for your viewers. So kudos, dude, by the way. Nobody ever says that to you. And I appreciate that the viewer of your stuff and obviously hanging with you here. But I think that's huge for you to be able to share those resources.  I have a friend who now works for Adafruit Industries who has a degree in psychology. She never picked up programming, starts it.  Her degrees in psychology, she spent years working like the medical profession and she's like, oh, it turns out I really liked Python. I thought it was, I thought computers were scary. Turns out, it took just like two books of coding and now she's actually working for a reputable big company doing this and achieving quite a bit and she's really talented at it. She, I don't know if this year or not because I haven't figured out who's involved. There's a conference coming up in two weeks. We sponsor all the laptops for the Python coding course. But for the last two years, I know she's been the teacher for it. I can't remember if she had a conflict this year or not, but it's all things like we hold these labs, we hold these events. We invite people out to DC 313, which our DefCon meet up here. Just get more people involved. That's the biggest thing. It's how will this get better? Gotcha. So I mean, obviously that's part of the reason why we do these blogs the way we do. Some folks have actually asked of like, do you feel like you're calling a vendor out? And I'm never like, I'm a vendor. I'm telling you right now, from one day, Huntress will have an incident. It's going to happen. We put everything in place. You'd be crazy to say it's not gonna happen. When it does happen, I'd hope that you come out, you say, hey, it happened. This is what we're doing to make sure it doesn't happen. That would be my biggest thing. And I hope that level of transparency, you know, runs through and through. And I think that's probably why I love groups like, you know, the DefCon groups or the Black Hat groups or even the old school 2600 groups. They were all about the like, let's not hide the knowledge. Let's not separate it, right? Let's bring it to the limelight. In 2600s where I got my start, I got all the magazines are all stacked up. But I buy mine in cash from Books of Million, so I don't have to pay for it. And they close every where I combine them in cash. I haven't bought some books in a while. And as I always pay cash for them, so I'm like, oh. Now we're the tinfoil hat conspiracy theorists. Oh yeah, I mean, man, I've been reading those books since high school and that was 90s for me. So, nice, nice. So, all right, we're gonna wrap this up. We'll talk real quick though. So you're easy to find, you usually get hold of on Twitter on the blog on Huntress Labs where you guys are always talking about security search and folks closer where a user of your product are really happy with it. I'm gonna do a separate video talking a little bit about your product and how it uses some people. And you have a free demo, by the way, you can sign up. So if you're curious, you don't have to take either of our words for it. You can actually just start playing with it.  Show me, don't tell me. So, I'll be, and I'm sure the sales people love to talk to you. It's just way easier to kick the tires on anything. Yeah, and that's always an awesome, and that's what of course made it easy for me. I didn't even have like some sales people I had to get through and sign up for this BS. You guys like, yo, here, just find it for your account. I'm like, oh, this was simple. And the deployment was easy and your engineering team has been amazing. They found things. We used them specifically for a cleanup on a new client and because we knew they needed it. And your debriefs you give on how to remove the specific tools from that computer. I'll cover all that a whole separate video. It's impressive. You guys have an excellent product. The human element is what makes it interesting because everyone wants to throw the words AI and all this machine learning automation. At some point, people need to work at these knock teams. Need to do some analysis and actually get involved. So as I understand it, we still haven't created the singularity machine that's harder than us just yet. I don't even want to read about it. SkyNet research, but we're not quite there. Right. Until we're there, we're still gonna be finding payloads in Dropbox. Yeah. It's suspicious. It's a two-shave order. Oh, that was great. So all right. I'll leave links to everywhere you can find about you, Huntress and all that. And thanks for coming on, doing this interview. Man, this has been fun. Yeah, this has been fun. And definitely I'll be commenting and retweeting some of the stuff, especially because these attacks, they only get more persistent. Hopefully security gets better through all this transparency though. Cool. Thanks for having me. This is tons of fun. Oh, last thing. I love what you said before, last time we talked was how companies have safety and they brag about 30 days, 40 days without an OSHA incident or an accident. We need that. Days without incident should be just as much of a bragging. Days when we didn't get fish, days we didn't get edit companies. This is the same thing. You should be proud of your days without that. I love that. Yeah, man. You can probably have a whole video on that type of stuff, but I hope bringing those just to celebrate security, right? Yeah. You know that in your business, hey, we haven't had an incident in 270 days. Like, that's not a reason to get mad, right? That's not a reason to celebrate. And it's not a reason to fire a tech vendor or what? They don't do anything. I haven't had an incident. Almost. Yeah, clearly we get bored. They're doing their job.  Take care, man. Yeah, thank you so much. Cheers. Thanks for watching. If you liked this video, give it a thumbs up. If you wanna subscribe to this channel to see more content, hit that subscribe button and the bell icon, and maybe YouTube will send you a notice when we post. If you wanna hire us for a project that you've seen or discussed in this video, head over to laurancesystems.com where we offer both business IT services and consulting services and are excited to help you with whatever project you wanna throw at us. Also, if you wanna carry on the discussion further, head over to forums.laurancesystems.com where we can keep the conversation going. And if you wanna help the channel out in other ways, we offer affiliate links below, which offer discounts for you and a small cut for us that does help fund this channel. And once again, thanks again for watching this video and see you next time.


Hello and welcome to Daily Debrief, your primer on news from around the world. I'm Swastika and today we'll be talking about the latest Sipri report on global arms sale, developments in US and China and the anniversary of the demolition of a mosque in India. We begin with the global arms trade. 2020 was by all accounts a horrible year for billions of people around the world. But one small section seems to have had a good time, arms traders. The latest report by the Stock Home International Peace Research Institute that is Sipri says that global arms trade rose by 1.3% in 2020, a year when so many countries including leading economies saw a decline in their GDP growth. Now arms trade by the world's top 100 companies in the sector touched $531 billion in the year 2020, making it the sixth consecutive year of growth since 2015. Now to tell us more about this we have with us Abdul. Abdul if you could take us through some of the highlights of the Sipri report. So I think we should start with this what is not there in the report. If you see this is only the aggregate amount of 100 top countries sorry 100 top weapon manufacturers. There are more companies which are involved in the arms trade, arm manufacturing and trade. Their figures are not included in it. So $531 billion is a conservative figure by all means. That is the first thing I wanted to highlight. So that is the second thing is if you see the dominance of US out of 100 companies listed in this report 41 belong to the United States of America alone. And they have more than half of the share of the total amount which comes from the arms trade globally which is $285 billion. So that is the second point I wanted to highlight. The third of course is that the gap between the United States of America and the second largest group of you can say companies or a country which is China which has a share of just 13% US alone has a share of 54% one country. The other major fact about the Sipri report is that among all the arms traders in the world which basically which we saw last year there are there is a strange thing some of the companies have civilian kind of involvement say for example Boeing in US which also produces aircrafts, aeroplanes for civilian use. Their civilian business went down due to the COVID as you rightly pointed out and economic crisis created by the COVID. But their arms trade remained intact. In fact it increased Boeing recorded more than 10% increase in its weapon trade last year. So these are the major factors which basically highlight that the the the governments around the world focus more may have remained adamant on spending so-called security and defense despite the fact that the people needed more spending on other basic needs like health and education and so on and so forth. In the year 2020 health. I also want to ask you who were the buyers in which case? Yeah see if you see most the majority of the trade happened within the state for example the US government is the largest buyer when it comes to the US companies but apart from that there are international buyers also. So say for example the countries in the Middle East or what we call West Asia like Saudi Arabia remains to be one of the largest arms buyers in the world UAE again the same set of countries then countries like India Israel for example has just the it's a small country but the three companies which are listed in top 100 globe in the ship pre-list they had a trade of around 10 billion dollars and majority of this went to they went to India basically Indian companies there surprisingly there are three Indian companies the top 100 list and they have performed really well given the fact that Indian economy contracted more than 7% last year. So you see all these things one major fact about this report is that UK for example which is among all these countries had the highest contraction in terms of GDP growth last year which was around 10% 9.9 10% this UK is now the third largest in terms of countries third individual countries third largest share in the global trade now and most of its weapons are going weapons are going to the the West Asian countries like the war in Yemen for example which basically has is seen as a lucrative business for countries like UK companies based in UK or companies based in states of America. Thank you thank you for that update Abdul our next story is something we have been tracking for a while US-China tensions the United States has formally announced the diplomatic boycott of Beijing winter Olympics which will be held in 2022. The Joe Biden administration claimed that this was to protest China's alleged human rights abuses and atrocities in Zhijiang. A Chinese diplomat said it was a grave distortion of the spirit of the Olympic charter and also pointed out that it was a pretentious act and that new invitation had been extended anyway to any US diplomat. Now to tell us more about this I'm being joined by Anish. Anish if you could tell us Joe Biden and President Xi Jinping had in fact had a virtual meeting earlier earlier on and now there is this talk of the boycott. So how does this play out in terms of US-China relationship it is the is it a usual noise making by USA? Well I like the way that you said noise making because it is obviously an attempt to ruffle the feathers on the part of the United States and it has been kind of doing that with the past year or so even after Biden has come to power the policy has not kind of changed in radically from what Trump was doing when it comes to China you know. So as you said like the virtual meeting happened just last month and there was a joint declaration it was seen as a step forward a small step but a step forward towards thawing of relations but as we see this was kind of reckless because on the part of the United States because as they pointed out diplomats were not given invitation you don't really hear of diplomats attending these events either as in their official capacities. At the same time we need to remember this talk of boycott has been happening for a while now in the United States. Earlier it was the Peng Shua case where we saw what happened where the player was at one point even claimed by many US reporters or even like athletic bodies as to have been disappeared but she did contact the Olympics committee she did contact the tennis federation but none of these cases you actually had you saw the sort of narrative that was built around her issue her case pretty much falling apart when you actually started to when the international media started to get more reports and more details about the matter and at that point there was this whole push towards boycotting Beijing Winter Olympics trying to make a statement of their own that did not work out so Xinjiang which has been kind of like an issue that they have been raking up every now and again was brought up again to do the stunt this sort of diplomatic stunt and it is actually like whatever little headway we had when it came to normalizing I'm not I'm not going to say normalize because it wasn't that tense but it was a very tense-dub relationship considering what happened during the Trump administration so trying to mend those you know bridges did not really is going to be is going to be much more difficult now considering what they did and this will also affect whatever future talks we are going to see between the two countries and this affects everybody it's not just the US and China it affects everybody and that's that's exactly what we saw during the trade was it pretty much affected almost the entire world because of how big they are economically speaking and how much they are you know how significant they are in their respective sectors in fact it does bring me about keeping in line with the US China tension the way in which USA is encircling China it's a dangerous consequence of this tension if you could tell us more about that yeah so we can actually see that sort of escalation which began obviously under the Trump administration being continued by the Biden administration in many ways even though they keep talking about having talks and negotiations there doesn't seem to be any attempt or any serious attempt at the side of the United States to actually make any kind of concession or actually make any gesture that will show that they are serious about going following through the talks or whatever has been agreed in the talks you know one of the things that we can see is the obviously apart from this boycott call is their attempt to have a summit of democracies now which is trying to bring about any almost any other nation that has any kind of political or diplomatic antagonism or tensions with China and that and many of these countries even though they are you know on paper democracies they are pretty much led by right wing or reactionary leaders so this sort of farce that they're trying to make as trying to lead a democratic world is something that hugs back to cold war era policies that we are very familiar with when it came to going against the United States trying to project some of its allies or you know client states as democracies or you know forward looking places because they were not for socialism so this is going to have a significant impact again diplomatically speaking at the same time we have to remember that the and the physical encirclement of China is already there the United States Pacific basis is one of the is among its biggest actually and if you look at it Korea it has a huge base in Korea thousands of troops stationed there has a huge base in Japan troops even weapons like very high-grade weapons and missiles are stationed there and apart from that smaller bases in the Pacific ocean along the South China Sea and this is pretty much already this is something that already exists and this is something that cannot be discounted when we talk about encirclement policies especially when we talk look at a UK US alliance that is being talked about where you know which is a very outright military alliance that is our coalition that is being made up you know of and in this case this sort of diplomatic boycott doesn't really shouldn't really surprise us but it is something that is very disappointing to see because any attempt there were at least attempts by social movements in the United States to try to mend those relations that were strained for a long for a while now and this training can actually we can expect it to continue because the Olympics is coming up in February the players will be there US players are still going to participate it's not like the players are not it is not going to be part of the Olympics coming ceremony but at the same time just this gesture is going to have significant impact and that makes it obvious of how provocative the US is ready to be when it comes to countries like China and not just China but other countries like Russia, Iran and so on. Thank you Inish for those insights and joining us on our show. Moving on to our next story December 6th was the anniversary of the demolition of a mosque the Babri Masjid in India in the year 1992 after decades of controversies and disputes and after a violent mobilization in that year members of various Hindu right-wing organizations destroyed the mosque their claim was the mosque which was built in the 16th century was constructed on top of the site of a temple now in the decades following the demolition a prolonged legal process took place and what eventually happened was that permission was given to build a temple on that disputed site to understand what this demolition meant and where it stands today we have with us news clicks Pranjal to talk to us more about now Pranjal if you could tell us how do you see the legacy of the Babri Masjid demolition? So Swastika it's an interesting question what's the legacy of Babri Masjid demolition you also will have to link it to what is the legacy of the ruling Bhati Janta party and I think both are very interlinked topics so we can come to the legacy of BJP later but what Babri Masjid demolition was it was a attack on the Indian constitution the basic ethos of the constitution which stands for secularism was destroyed on that day when thousands of people gathered in Ayodhya demolished the mosque in presence of police policemen standing there and the ruling the current ruling parties active members were involved in that what we also to understand what followed Babri Masjid demolition Babri Masjid demolition was followed by massive rights all over India before the demolition rights took place after the demolition rights took place thousands of people lost their lives it also laid foundation for Bhati Janta party before the demolition took place BJP was a non-existence force in the country they had very little number of member of parliaments they had no electoral presence what the Babri Masjid demolition and the Yatra that preceded it resulted in establishing BJP as a major opposition force in the country at that time but it also led to a very interesting phenomena it led to division of the society before before 1992 I mean India has been a Hindu dominated nation where Muslims are the minority but it was not so visible before 1992 what BJP did was it brought to fore this entire issue of Hindu and Muslim divide and what it resulted in massive communalization of the society so easily people could identify with either the Ram temple movement or the Babri Masjid then that type of division took place in the society and that what that's what helped the BJP in ensuring that it consolidates its vote ban so after 1992 elections I mean 1992 demolition they got more and more number of seats in UP they were able to form government in 1998 and 1999 so this is what happened this is the legacy in my understanding legacy of Babri Masjid demolition. Pranjal actually it has a far reaching impact in today's India as well because this is the party that is ruling the country and also the rise of the right-wing forces that have happened in this country and many hate crimes that have now emerged if you could tell us more about this keeping in mind the impact of demolition so what's happening right now is that the ruling it's a BJP which is the ruling party right now and they have consolidated their position vis-a-vis the north Indian states north Indian states it was Uttar Pradesh where the demolition took place it was UP which also has the maximum number of seats in the parliament so if you see the agenda of BJP right now it's again and again talking about how a grand Ram temple will be built they don't have any other issue to talk about so they are continuously banking on the demolition and then construction of Ram temple as a as a agenda for their election manifesto each of their leaders are talking about how a grand temple will be built and then what's the other thing they do they attack the minority community saying that it was when the opposition the current opposition samajwadi party when it was in power the and they don't directly refer to them as Muslims they say that people who wore skull caps people who wore lungis ran havoc in the society so this is what they keep referring to as a minority and this continuous eroding the citizenship of a minority is happening by the ruling party in the current sphere right now and interestingly what they're doing right now is also that along with the Babri Masjid demolition their slogan was that Ayodhya is just a glimpse Kashi and Mathura remain what are they doing now they're saying that we will go and we will do we'll construct a similar temple in Mathura so they have not left that issue Babri Masjid might be over Ram temple might be being constructed but they don't have any other issue to talk about and hence their entire focus now has shifted to Mathura well thank you Pranjil for joining us with these details in fact this very state is ranked third in the poverty index in one of the important reports of Niti Ayog in the country and I had one of the maximum number of covid deaths in the second phase you could see the bodies of people lying on lying on the river shores uncovered lying there and there was nobody willing to talk about it one interesting thing that I missed that the 32 key BJP Hindu outfit outfit leaders who were basically accused in the case for let go last year to if I am not on 2020 yes so all of them have been acquitted by the lower court now it will go to the higher court and supreme courts we don't know but basically even in the supreme court judgment that they passed on construction of the temple they said that demolition of that mosque was unconstitutional in nature and criminal in nature so when that supreme court has said that it was criminal in nature somebody would have done it who has done it the court has not given us answers to well thank you for all the details there Pranjil that's all that we have here at daily debrief do keep watching us and do follow us on people's dispatch our stories and our news thank you


Today, we are in Ahangaron village in Bamian province. We are water place a key role in life of people, particularly farmers. In this village, people are suffering from insufficient availability of water for their daily consumption, food production and agriculture, due to use of traditional irrigation system. F.E.U. has rehabilitated 2,550 meters of canal here in Ahangaron village to provide sufficient water for the community people for their agriculture and domestic uses. I am 48 years old. I live in a family of 11 people. I have seven children. I have two children. I work in this village.  In the past, there were a lot of problems in this village. There was a lot of rain. People used to go to the market. There was a lot of rain. When there was a lot of rain, people used to go to the market. Now, Alhamdulillah, there is a lot of rain. The F.E.U. office is 2,500 meters away from the village of Ahangaron. There was a lot of rain, a lot of water. When there was a lot of rain, people used to go to the market. They built their own land. They used to go to the market. They used to go to the market. They used to go to the market. This is very important for humans and animals. If there is no life, it is not for humans, animals, animals. Water is life. Water is food. Leave no one behind.