Nigerian youth have been advised to learn from the success stories and make the most of the opportunities given by experts in the green sector in order to build themselves. This advice was given on the sidelines of a program organized by the inspired youth network in collaboration with the National Youth Council of Nigeria, Ifaqwe Jaya as well as Action Aid Nigeria to commemorate the international youth today. Tim Linde of the SPA, two projects of the IYN Oluwatoyi Adeja concert, the International Youth Day, which has themed green skills for youth towards a sustainable world, aims to empower young people with necessary skills to become chain makers. The Lagos German of the National Youth Council of Nigeria, Lagos Chapter Ola Lekon Oba, flanked by other speakers, advised young people to stay clear from drugs as it will kill their potentials. Okay for me I would say I'm very impressed about how young people have taken advantage of international youth days to celebrate young people because if you compare now from the time past you discover that youth programs have not really been something we could talk about but recently we've been having a lot of youth programs, entrepreneurship, agriculture and in fact we are even personally reviewing the state's policy on young people so I think people are now making statements about celebrating young people and then building their capacity in order to strengthen the economy of Nigeria.  So my thought on young people in recent times is that you need to believe yourself, don't give up. Because one of the ways to get into opportunities is when you belong to an organization, a progressive organization. So by the time you belong to a progressive organization when opportunities come it comes to this organization and also you should be optimistic and believe in yourself. Age doesn't mean you are finished even if you are at the peak of your youthful age then you still have so many opportunities out there. The symposium recognized and celebrated the importance of young people and addressed some of the issues they grew through. It also sought to provide the youth with an understanding of the impact of grinscales and jobs that can reduce unemployment. I think the feedback to young people is the fact that they need to just continue grinding, be intentional and just keep moving. I'm not going to say it's going to be easy but you just have to keep moving. You just have to give up right now. But this is the best time when you are down. This is the best time to keep pushing. My principal Uzman Akambiamzat is doing a role in terms of youth empowerment, in terms of trying to have a seminar for the young people in their direction, career path and all of that. So I think it's not annually we already have been that that happening in the local government right. So this is just for us to celebrate international youth there. 2015 I made up my mind that I was going to leave Nigeria right. In 2015 2016 2017 many of my friends built the most successful technology companies in this country and that is why I'm back home. You know where there are problems there are opportunities. As a young person don't just spend your time and your life complaining about what is bad in your country. Nigeria is about to turn a new leaf. Things about to change. There's a renewed hope right now. There's a new president with super smart with super intelligent position yourself. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Chevy Chevy Chevy Chevy you ready for the day you ready for the day man. It's gonna be a good one.  It's gonna be fun down here. Pardon me westbound Going into Minnesota from Wisconsin to a town called Otsego 29 Once we get there we have those three bobcats we're picking up they're going to three different locations in southern Ontario called the three B's Brantford Brampton and Barry From there. I'm headed to St. Catherine's to pick up some more steel and Headed back home So it's about another week that will be on the road yet. I was really hoping that I could be going home from here, but Such as life. That's trucking At least I'm on my way home in a roundabout way To get my steering aligned soon. I feel like my truck is pulling to the right a little too much very often with the highway it leans to the right towards the shoulder right to Make sure that water runs off the road. So your truck always sometimes pulls to the right But I think it's pulling a little too much. I gotta get that looked at I'll keep an eye on my steer tires to see if they're wearing unevenly So you guys remember a couple weeks ago we were at this flying jay we were talking about how Everybody was just parking in the pumps for their half-hour break and it jams everything up And people like this guy now are coming out the entrance and that jams up the entrance People block the exit because They're lazy That's this truck stop again Doesn't look like it's as bad as it was that time, but there is a lineup Going all the way around these this parking lot again And I guess there isn't really any way to actually use the actual exit if you don't get fuel They almost make it easier to go out the entrance It's probably why everyone does that but that just really makes everything difficult Uh let's get around the corner here and see how long this lineup actually is Looks like a lot of people just want to park That's cool, but that makes everything difficult for everyone else too What is this guy doing now? What are you doing? Why are you honking? What are you what are you honking at?  This is roberts, wisconsin I I would tell you guys avoid this stop if at all possible. I have nowhere else to get fuel on my route right now And I'm I'm below a quarter tank, so I don't have a choice But if you guys have a choice don't stop at flying j and roberts, wisconsin. It is a gong show every time And you're not gonna have fun All right, bud. There you go. There you go. You got it bud. I believe in you I believe in you. You got this backer up bud There you go. There you go Just let me squeak past you. Okay. Don't get mad at me like the other guy did and started honking away I'm just trying to Trying to get some fuel here I still don't understand why that guy was honking That's one thing I can tell you guys don't honk at a truck stop unless if someone's about to hit you And you have to let them know like don't hit me, right? Try not to honk people are sleeping here a lot of drivers work night shift as well And There's no need to wake them all up just because You're a little upset I'm gonna go and uh get in line behind these guys here Whichever one's done first, I guess This flat bed here isn't even fueling. He's one of those guys that just Parked in the pumps and went inside it looks like But transport america here to our right, uh He's fueling at least he's got the hoses in his tanks to make it look like he's fueling Gong show I tell you avoid roberts wisconsin avoid it Very poorly put together very poorly planned out Way too busy I think transport america is about to that there he goes This guy on the left here. I think that's a maverick driver He had maverick on the mudflaps there. He was sitting in his truck there for 15 minutes Before he even started fueling. He was just hanging out Obviously doing his half hour while he's fueling Oh people don't do that especially here Especially at such a busy truck stop. Why why do you do that park in a parking spot? You guys saw it The parking lot wasn't full Well, we made it out of that mess To top it all off when I finally got to the pumps I needed some def fluid and their def pumps aren't working or wait no only like some weren't working Specifically the one that I was at and I wasn't about to go all the way around in that long lineup again Just to get to a different pump where their def works And I went inside and everything was Messed up and dirty and out of stock Wow, I caught you guys at a bad time or you need new management.  Just don't even bother Climb your route to fuel at the next stop Don't even stop in there for a coffee. It's just not worth it. It's gross nothing works It's dirty and you're going to be waiting all day to fuel other than that Having a good day About another a little more than half an hour until we get to our Our not our destination our shipper. We're going to load up these bobcats. Hopefully, uh, it's pretty easy to tie them down I've never hauled them before so I'll have to Learn something new today turn my brain on again Well, it turned out to be quite the workout just tying this thing down So we have four actually First drop there is in brantford And then we got brampton and then those two at the front are going to bury I would like to take this one home. Do you think anyone would mind you think they'd notice? I'd even settle for this one at the front over here Like i'm delivering these to him delivering his excavator And this you think he'd notice if I just brawned the escalator the escalator Excavator and he talked And then just took this home. Let's settle for a t5 95 We just stopped here for our first load check Had to tighten one of the chains already Wasn't really loose. It was just looser than I want it to be So now we go another couple of hours and we'll stop and check it again While keeping our eyes on it in the mirror Just had a rest area. We're still on the east side of minneapolis. Pardon me. I always get this mixed up We're always still on the west side of minneapolis. We got to go east around the city through the city And onward through into wisconsin and we're going all the way around I guess uh down around chicago Not too sure how far i'm going to get today everyone go around chicago and Cross through at sarnia in michigan Well sarnia ontario from port here on michigan All right, so we got some We got some distance ahead of us yet. We got a long way to go And a decent amount of time to get there So let's pull ourselves out of this rest area And go tackle rush hour in minneapolis. Yay My favorite time of day I love going through the big cities at this time Hopefully there's no uh hold-ups or accidents or unnecessary traffic for on the On 94 have the same merge lane that you have to share So the people merging off 694 have to share the merge lane What the people merging on to 694 so you got people Got people in the merge lane trying to speed up and get into traffic And then you got other people in the merge lane trying to slow down and get off and out of traffic It's big kerfluffle every time Not bad this time though at least it's usually a lot worse than that That was an awesome experience First I went to go get my sub from subway italian herb and cheese foot long With toasted Lettuce onion tomato Black olives and ranch dressing And we've got chicken and bacon in there too And here's the thing she gave me extra cheese and I didn't even ask for it She just threw it on there Nice and so uh, they didn't sell a big enough coffee They do sell coffee at subway, but it's only in a tiny cup and I wanted I wanted a real coffee Something that'll get me through the rest of the day And so I had to walk over to the convenience store I went and poured my coffee went to the counter to pay for it and they're like It's okay. You can just go Have a good day I got a free coffee out of it and extra cheese It's my day. I think this is my day That was a nice treat. It doesn't happen all the time But it hasn't happened to me more than once recently Where uh, I go into the truck stop. Why is this all twisted up? I go into the truck stop and uh, just for my coffee, right? And I put the coffee on the counter and more than once recently they've just Let me go and they're like, no, that's that's okay. You don't know what's anything just you can take the coffee and go Because I know coffee doesn't cost them much, but That's still a free coffee. They're giving out So thank you kind people of the world Random anonymous cashier and subway lady made my day And it's really good too and it's perfectly put together. It's not one of those subs where you know, it's like a rookie a newbie Puts together your sandwich and then like rips the bun while she Wraps it up and then when you're trying to eat it. It just falls apart. No, this is just perfect She knows she was doing a bit of a rush So I went to bed last night in black river falls, wisconsin because they have they were supposed to have good flying j premium wi-fi I only got two videos uploaded all night It's weird how different flying jays have different premium wi-fi, but it costs the same wherever you go You still got to pay the same amount of money, but here you can only get two videos done Over 10 hours. I think I was there a little more time I think I was there like closer to 11 hours in total only two got uploaded If I were to upload videos at hope bc flying j I can do two videos in less than an hour Probably less than 45 minutes the same wi-fi or the same company the same cost It's just not consistent at all of their locations So I don't know if they still watch my videos or not. I'm not partnered with them anymore Couldn't really have a good experience with that the last time I partnered with them I still like their stops and their services just just working with them was very difficult Couldn't ever get a hold of anybody I never knew what was going on, but They did hold up their end of the deal. So they didn't break contract or anything It's just I'd be willing to work with them again and give them a second chance. Let's say that They might have just been that their marketing team was just completely disorganized that year and Wasn't communicating Like they did the first year I was partnered with them the first year I was partnered with flying today It was so awesome. Like I had regular emails from them regular contact from them Always checking up on my next video. I have made for them Always giving me feedback on the videos that I did do for them Telling me if they if I could do anything different or if I could do anything better It was great. And then the second year I partnered with them. It was just like dead silence Nothing I had to constantly email them over and over and over and over again for months Before getting a response back and we had a contract. We were supposed to be partnered, but It was very frustrating. But like I said, I forgive them They have great fuel stops, but my my criticism of them right now If they're listening your wi-fi is not consistent at all of your locations not even close Sometimes you're paying like I buy the yearly package, right? So a hundred bucks for the year So I'm paying a hundred bucks For the year you can pay what five or six dollars for an hour or something like that And sometimes you get nothing for it sometimes the free wi-fi inside other locations is better Then the premium wi-fi standing right outside the building in front of their antenna at other at others And I was right close to the building last night. So it was very frustrating for me I have a lot of videos. I want to get uploaded for you guys And I stopped there specifically to use that service and it failed me Black River Falls, Wisconsin I thought maybe there was a lot of people using it So I left it on all all night like eventually it slows down, right? Nobody's using it and in the morning usually other wi-fis Are pretty fast because not many people are using wi-fi in the morning They're usually getting going getting to work getting on the road and still Very very slow So now I got to find wi-fi again somewhere else and try to get these out to you guys Oh the frustrations of a youtuber right a traveling youtuber at that no reliable wi-fi Or at least you're supposed to I pay for reliable wi-fi But sometimes they don't deliver How do you guys feel about that? Do you guys use wi-fi at the truck stops at all? I would encourage you to try out the premium wi-fi the flying j Usually it's uh Pretty decent and some locations. It's awesome But black river falls needs to uh, maybe I don't know update their antennas or Boost their signal. I don't know What do you guys think? When you use the wi-fi at the truck stops, what do you use it for? Do you use it to stream video? Do you use it to uh? Just go on facebook Wander around on youtube for a little bit. Do you I guess that would be the same as streaming video netflix I'm curious Maybe you don't use it at all But I have to end today's video here. Anyways, uh, we have to start tomorrow's I'm in a really big rush. So it's just going to be driving driving driving tomorrow Starting from black river falls, Wisconsin. I want to get all the way into canada I want to cross report here on into sarnia, ontario And that is 10 hours from here. Plus, I would love to be able to stop at the gym If I have time There's a gym I stopped at in what is that again sports creek michigan Same one I stopped at the other two times going past there See what happens. Thanks for watching today. Hit that subscribe button If you like the video hit the like button share it with your friends If you like the chances are some of your friends might like it too We're getting close to our 100,000 subscriber mark. I can't believe it I've been working towards this for for so long and it's getting very exciting that as of filming this we have 90,174 subscribers Less than 10,000 to go And it looks at the current rate like we might even reach 100,000 this summer So, uh, I don't know what I'm going to do to celebrate that but Thank you all for sharing the videos and talking about it to your friends I know a lot of you watch my videos along with other people If you don't have your own own account one way you can help me is create your own account and subscribe to me yourself too Give me an extra little boost towards 100,000, but only if you want to I'll talk to you tomorrow


This lecture is part of an online Galois theory course, and we'll be about how to solve cubics and quartics using radicals. And we're going to do this using a knowledge of Galois theory. So quartic, by the way, means a degree four polynomial. Just as a warm-up, let's have a look at a quadratic. Everybody knows how to find the roots of AX squared plus BX plus C equals zero, let's try and do it using Galois theory. So we know that the root of this polynomial generates an extension of degree two, which whose Galois group is just cyclic of order two. So suppose the roots are alpha and beta. So if sigma is the non-zero element of the Galois group, then sigma alpha equals beta, and sigma beta equals alpha. If you remember, what we'd try and do to solve these is to find an eigenvalue of sigma. Of course, we're assuming we're working over a field that's not a characteristic two. So the eigenvalue is going to be minus one, and the corresponding eigenvector will be alpha minus beta. So we know from the work on Coma theory that alpha minus beta squared, oops, alpha minus beta squared, should be in the field we're working over. Now alpha minus beta squared can be worked out easily. It's a symmetric function of the roots, so you can express it in terms of the coordinates. It turns out to be B squared minus four AC over A squared, the usual discriminant of a quadratic equation of factors of A squared or whatever. We also know that A plus, sorry, alpha plus beta is equal to minus B over A, and from these two equations, you can easily work out alpha and beta, and you get the usual formula for a solution of a quadratic. So the key idea is you look at eigenvectors and eigenvalues of certain elements in the Galois group. So now let's look at cubics, and I'm going to take x cubed plus Bx plus C equals zero. If you're not working over a field of characteristic three, then you can get rid of the coefficient of x squared just by adding something to x. The history of the solution of the cubic is a little bit murky. It appears to be solved by ferro and possibly independently by Tata Aglia, but it's difficult to know exactly what happened because both of these guys kept their work secret. You see, apparently in those days in Italy, the way you got a mathematical job was by challenging some professor to a mathematical duel where you would both give each other problems, and if you lost the duel, you lost your job. So if you could solve a cubic, this gave you an incredibly powerful weapon because you could just pose a lot of cubic equations to your opponent and win any duel. So ferro kept all his work secrets and Tata Aglia apparently told his work to Cardano but swore Cardano to secrecy and then got rather annoyed when Cardano later published a solution which Cardano claimed was ferro's solution or whatever. So it was all rather complicated and everybody ended up in bad terms with everybody else. Anyway, we're going to do it using Galois theory, which of course they didn't have in those days. In fact, they didn't really even have negative numbers. They were really struggling with... This was back in the days when people were still trying to set up algebra and didn't really quite have the concept of the real numbers. So anyway, let's take the roots to be alpha, beta and gamma and the Galois group will be a subgroup of S3, but let's take it to be S3. And S3 has a composition series. We take the identity group and then we have the alternative group A3 and we have the group S3. And this is a group that's cyclic of order 3 and A3 is a normal subgroup of S3 and has the quotient group is order 2. Now the fixed point fields we get from this give us a tower of fields. So we have k is contained in the summer field which is contained in k, alpha, beta and gamma. And you know from Galois theory that what we should do is first work out this mysterious field here by taking the root of something and then take a cube root of something to get to this field. We assume that k contains all the roots of unity we need which are square roots which is automatic and cube roots. So we want to work out what this field is. It's generated by some element fixed by A3 and we want it to be an eigenvector of A3 over S3. So we want S3 over A3 to act on it as minus 1 or rather we want the non-trivial element to act on it as minus 1. We want to think of some polynomial alpha, beta and gamma that's invariant under a cyclic permutation of them but changes sign if you swap alpha and beta. And the obvious thing to try is alpha minus beta, beta minus gamma, gamma minus alpha. So this is more or less the famous discriminant or possibly the square root of the discriminant of the polynomial. So let's call it delta and so we know delta squared is now a symmetric function of alpha, beta and gamma. So it's a polynomial in the coefficients and in fact you can work out the polynomial it turns out to be minus 4b cubed minus 27c squared which you can get after doing a little bit of algebra. So that sort of goes from S3 to A3 but this field here is k of delta which you can take by taking a square root of this expression here. Now to go from here to here we need to take a cube root and we remember how to do this. What we do is we look at the three roots alpha, beta and gamma and we add them up and the sum of them is actually 0 because we had x cubed plus 0x squared plus bx plus c equals 0 and now we take the element y which is going to be alpha plus omega squared beta plus omega gamma and z which is alpha plus omega beta plus omega squared gamma and we know that these are eigenvalues so these eigenvectors of the element sigma with sigma cubed equals 1 so sigma is just the permutation taking alpha to beta to gamma to alpha or possibly the other way round. Now we know from general theory of cummer extensions that y cubed and z cubed must be in k of delta and we can do some algebra and we find y cubed is equal to minus 27c over 2 plus 3 root 3i over 2 delta except that should be a minus sign. So we can work out y and z by taking the cube roots of these and then we can find the root alpha as being y plus c over 3 so that allows you to solve a cubic. So we can give an explicit example just to check this all works. I mean for instance if you take x cubed plus x plus 1 equals 0 we find the minus 4b cubed minus 27c squared is equal to minus 31 so the discriminant delta is the square root of minus 31 and then we find that y is equal to the cube root of let's try and get it right minus 27 over 2 minus 3 root 3 i times root minus 31 over 2 and z is equal to the cube root of minus 27 over 2 minus 3 root 3i plus I guess root minus 31 over 2 and you find y is about minus 0.304 and z is about 0.99 and we find from this that the root alpha is about minus 0.68 and you can actually do this all on a calculator and check that this really is a root of the equation. So that does cubics. Oddly enough degree 4 polynomials are almost easier than cubics or rather the jump in difficulty from quadratics to cubics seems to be more than the jump in difficulty from cubics to quartics. So quartics were solved by this guy Ferrari who was apparently a student of Cardano who shouldn't be confused with Ferro who solved the cubic. I think Ferro and Ferrari both actually mean Smith or something like that in Italian so this is the word for iron. So for degree 4 we have a polynomial which looks like x to the 4 plus ax squared plus bx plus c equals 0 and you remember from Galois theory we have to look at the group s4 and it contains the following chain of subgroups. We have the trivial subgroup and this is contained in the subgroup z over 2z times z over 2z which is contained in a4 of order 12 which is contained in s4 and this quotient is z modulo 2z. This quotient is z modulo 3z and this quotient is z modulo 2z squared. So if you look at the corresponding fields k is contained in something is contained in something is contained in our field k alpha beta gamma delta I guess there are now four roots. So this says that we should first take the square root of something then take a cube root of something then take a bunch of square roots and then we're finished. So let's see how to do this. Well we need to know what this group is. Well this group of order 4 is generated by, consists of the identity together with the products of 2, 2 transpositions. So we want to find generators for this field here and so we want to find eigenvectors for this group. So we want to find eigenvectors for the group z over 2z times z over 2z and that means we want to find vectors that have eigenvalue either 1 or minus 1 under this element and either 1 or minus 1 under that element and that's quite easy to do.  So you see this under the elements 1, 2, 3, 4 this is eigenvalue plus 1 minus 1 minus 1 and under 1, 3, 2, 4 the eigenvalues are minus 1, 1, minus 1 and I guess we could also add the element alpha 1 plus alpha 2 plus alpha 3 plus alpha 4 which is eigenvalues plus 1 and plus 1 but in the special case this would actually be zero so we don't need to worry about it. Anyway you see if we can work out these four expressions we can find alpha 1 and alpha 2 and so on just by linear algebra and alpha 1 is going to be the average of these you just sum these up and divide them by 4 for example so we want to work out what these are well now you just notice that the squares alpha 1 plus alpha 2 minus alpha 3 minus alpha 4 squared and alpha 1 minus alpha 2 plus alpha 3 minus alpha 4 squared and alpha 1 minus alpha 2 minus alpha 3 plus alpha 4 are now going to be permuted by S4 so they are three roots of a cubic with coefficients in K and I'm not going to write out this cubic explicitly because it takes a fair amount of rather messy algebra so what you do is you find this cubic you solve the cubic you can then take the square roots of the three roots of the cubic and do some linear algebra to find the roots of the degree 4 polynomial so you can see reducing degree 4 to degree 3 is actually sort of almost easier than solving a cubic of course you've got to solve a cubic as well so you can see what's going on here that this group here is really S3 which is the Galois group of a cubic so we were sort of going from there getting to a cubic and then the cubic is this bit of the Galois group it's essentially because S3 happens to be a quotient of S4 well you might ask what does the solution actually look like I found a copy of the solution on Wikipedia that I will just show you it sort of starts off like this and then it goes on and on and on and on and on and on and on so you can see why I did not try and write it out explicitly by hand so what's going on is that for degree 4 we know that S4 acts on a set of three elements so we can sort of reduce solving a quartic to solving a cubic and that's because S4 has a subgroup because S4 factors through S3 so it's got a subgroup of index 6 which is group Z2 squared if we try and do the same thing with S5 well S5 is order 120 and we can find a subgroup of order 20 which is the Frobenius group so this means that S5 acts on a set of six elements and when people try to extend the solution of a quartic to the solution of a quintic they discovered that whereas for a quartic you could reduce the equation to one of degree less when you try to solve a quintic you end up having to solve a degree 6 equation which only made things worse of course Arbel and Gower later discovered the reason for this is that the group S5 is not solvable so there's no way to find some clever way of solving it by radicals


Billy, what would you say was the key in this lineup, making Castillo throw as many pitches as he did? Yeah, I mean, just trying to see as many pitches as we could. A lot of guys had some really good at bats the whole night. And yeah, I think he went five, right? He's a really good pitcher. And we were happy to get him out of there. And I'm glad we got the win. I think we have a hit in every game, but once you've been up, the other game you've got to walk. Is this the best stretch? I know you've had chances to play here and there, playing I think every game since you've been here. Is this the best stretch that you feel like you've ever been in? I'm not sure. That's a good question. I'd have to take a look. But yeah, I'm just glad to get on base and help the team any way anyhow. And yeah, just glad we got the win. Do you believe this is a version of what kind of major league hitter you can be now? And if so, why?  And yeah, I mean, if you hit, you'll play. That's what my old man always said. So you got to produce and do well and take it one day at a time. And today is done and get back after tomorrow. Jake said that when you guys were at Triple A, you wouldn't talk about enjoying where you are, enjoying the moment, not sweating low. Am I going to make the majors or not? How impactful were those conversations on you and your mindset at the time? Yeah, I mean, it's a stressful game. It's a hard game too. And just going in and out of it every day, you kind of have to have a positive mindset and always try to find any positive in anything and stay away from the negatives because it can take you down. And I think Jake and I have kind of been through it, just the negative thoughts. And yeah, we were just talking Triple A, just always trying to bring a good attitude, bring a good feel and a good vibe. And hopefully, it helps the team out. How much of the strength that you're on is your positivity and where your head's at? Heck, that's a good question. I'm not sure. I just try to do the best I can and have a positive attitude. And I think it's kind of contagious too, you know? I mean, when people are happy and cheery and all that, I mean, I feel like it kind of spreads a little bit. So you can help out the whole team, hopefully. What did you see from the job that Johnny Brito did tonight? That was awesome. He was getting on the mound throwing strikes, throwing everything for a strike. I think that was really impressive to see. He's a really good pitcher. He's got a lot of talent. The Yankees have always done a really good job at developing pitchers. So I mean, yeah, it was really impressive and a happy form. Deli, what has it been like for you and Jake to not just come up here but contribute and be a big part of this? Yeah, I mean, I'm glad we were able to contribute tonight and help the team. And Jake's a great player. And you know, he's been doing it for a while now. And it's fun to watch and happy form. I'm glad we were able to help us get to win tonight.


ECSU did give in 2018. I tell you, there's no pride like Viking Pride. Over 1800 donors and over $227,000 raised. On behalf of our interim chancellor Dr. Kerry G. Dixon and our faculty, staff, students, alumni, and community, I would like to say thank you for your generosity to Elizabeth City State University. Viking Pride, Viking Pride, Viking Pride. Greetings. On behalf of the Elizabeth City State University Student Government Association, I would like to thank you all for your support of our recent ECSU Day of Giving. On behalf of the staff and student volunteers of the trustee, Kenes and Brenda Wilkins Call Center, thank you for donating to the ECSU Day of Giving. We want to say thank you for your donations on ECSU's Day of Giving. On behalf of the Women's Center team, we are grateful for all you've done. Hi, you guys doing today. My name is Larry A. Peterman. I am with the Office of Admission and Recruitment here at Elizabeth City State University and we would like to thank you for your donation on behalf of ECSU Day of Giving. As a student here at ECSU, I'd like to thank you for your recent donation on ECSU's Day of Giving. On behalf of the ECSU March and Van Sounder class, I would like to say thank you for all of your support on the Day of Giving. On behalf of the Octillary Services staff, we would like to thank you for your contributions during the ECSU Day of Giving. On behalf of the Office of Student Engagement, we would like to thank you for your donation on ECSU's Day of Giving. As a student at ECSU, I'd like to say thank you for your recent donation on ECSU's Day of Giving. On behalf of ECSU Campus Store, we would like to thank you for your donation on ECSU's Day of Giving. On behalf of Academic Affairs, we'd like to say thank you on the recent donation for ECSU's Day of Giving.


Hell yeah, what's up guys, this is CursePipe, my friends call me Banksy. I'm back again guys, today I got some game news, yep game talk, and we got some pretty cool stuff to talk about. We got two guys that are real champions. I'm talking life heroes. We're talking guys that shop at winners because they are winners, but we'll get into those guys a little bit later. The first topic though we're going to talk about is Sony. Yeah, Sony's in the news again, guess what, if you are a PlayStation Plus member, here's the thing, and you remember on December 25th, you are going to get five more days added to your subscription or to your account free. You don't have to do anything, it's just going on. That's their way of apologizing for the hacking fiasco over the holidays. Also you will get a 10% discount on any PlayStation online purchase.  So if you've been saving up for Hello Kitty Adventure Island, now's the time to buy it. Curtis? Okay, topic number two. Yeah, Microsoft's in the news too guys, we've got to go Sony, Microsoft's got to be fair, Microsoft's in the news because a hacker group, H4LT, they call themselves a hacker group, they release some documentation over the holidays that outlines that Microsoft is making some changes to how they allocate resources on their CPU. Now as you probably are aware, the Microsoft Xbox One has eight cores in it, and here's the thing, traditionally two of the cores are reserved for background applications and six of them are made available to game developers. Well, they've decided that Microsoft's all about the games, they've done a complete 180 from when they first launched, but anyways, we'll keep that a joke aside. They're releasing access to the seventh core, in fact they're going to release 50 to 80% of that seventh core. They're going to give that power over to the developers to use to take advantage of. That's good news for all of you people that use Microsoft Xbox One as a gaming console. For those of you that don't, for those of you that are big fans of your Kinect, that was a real good call by Microsoft, yeah man, Microsoft, turn on, honey, make me a sandwich, no maybe not, but whatever, yeah guys, your Kinect's going to probably lose a little bit of juice, but your games are going to look better. In fact there are some people discussing recent multi-platform games, games that have come out on both the PS4 and the Xbox One, and they're saying that the Xbox One games are often as good, or maybe even have performance advantages. I can't say either way, because I haven't tried the same game on both consoles. If you have, please leave a comment below. But long story short, Xbox One looks like it's getting some game juice coming to you. Alright guys, let's get right into the donkeys, eh? Let's talk about those heroes I alluded to at the beginning. Donkey number one! Alright guys, it's tough picking which one of these winners to start with, but we're going to talk about the guy in Palm Beach County. That's where he's from, yeah, over the holidays, he decided that when the networks were down, I don't know if he was a Sony guy or a Microsoft guy, they won't say, I guess they don't want to be partial. But anyways, the network was down, both of them were down, and he decided to call, wait for it, he called 911 going, ah, the network is down! Yeah, because 911 is for that, bro! That's why you call 911, I'm going to talk, oh, Santa's stuck in the chimney, eh, it's okay, light the furnace, or light the fireplace up, but you've got a network outage, well, okay, we'll call 911. Not a smart move, that's not what 911 is for.  Alright guys, I can't make this up, yeah, there's another gaming superhero that sleeps with the helmet and cape on, and this guy, he bought a PlayStation 4, he bought that 20th anniversary edition, looks pretty cool, got to admit it, looks all retro PS1 style, but here's the thing, he bought it I think for a thousand or a couple thousand dollars, I don't know, but that's not good enough, he's decided in his infinite wisdom that he's going to take a sledgehammer to the PS4 20th anniversary, he's going to videotape it, but the only way he will destroy this is if his Kickstarter campaign, I am not making this up, if his Kickstarter campaign for 20,300 dollars gets funded, so if you guys have so much money and you have no idea what to do with it, I recommend you give it to this guy because if he raises only 20 grand, he'll sledgehammer his freaking anniversary PlayStation 4.


All right, everybody. Thank you everybody very much for your patience. I'm Andrew Brand. I'm the director of threat research at Symantec and obviously not as much of a techie as I'd hoped I would be today. So we're going to be talking a little bit about the SSL visibility appliance. And unfortunately, although I have a demo unit here behind this projector, there is no wired internet drop in the crypto and privacy village. So it is on and it is working. It's just not hooked up to anything. We can do a little bit of a demo with it at the end if there's a little bit of time. There are instructions here for like how to do the testing if you really wanted to do the testing, but it's not actually connected to any kind of a live internet service. So while you can connect to it and you can download these certs that I've generated by it, you cannot really use them for anything. So just don't bother. All right, so I'm going to talk a little bit about what the former blue coat now all part of the big happy Symantec family is and the division that I work in. I'm going to talk a little bit about how this gizmo works and what it's meant to do. Also what it can't do. And because I use this in my lab with a lot of different types of devices and a lot of different types of operating systems, I have some experience in what is able to get through there and be decrypted and what the device basically causes everything to kind of choke on. Right, so a lot of what I'm going to show you is going to be UI from the visibility appliance itself which it's not very pretty, but there is also a component of this stack that I work with that's called security analytics and that's more important for me to sort of explain from the beginning because a lot of the packets that I look at come out of SA. So the SSL visibility appliance essentially is this man in the middle decryptor that you would put between your WAN and your LAN and you might use it for sort of two purposes. You might use it to man in the middle internal traffic that's outbound or external traffic that's coming into a service that's got like SSL or TDS on the host. When those packets come through the SSLV it does it if it can do its decryption it will spew them out on a separate port which you can then capture with a span or a tap port and then that stuff gets ingested into security analytics and what that does is records everything indexes all the metadata out of those packets and then re-indexes that index. So the searching is really fast and you get something that's essentially a SIM-like interface but when you drill down to like the nittiest of the nitty gritty you can get down to the packet level you can reconstruct files from various types of applications that have been observed communicating over your network so HTTP email a bunch of different types of protocols can be basically decrypted and then reconstructed into a essentially you can look like you're looking over the shoulder of the machine that was doing the browsing or making the connections. So what SA can do is it basically it can inspect tons and tons of traffic it's meant for high speed sort of enterprise networks sort of as a component of that it uses a lot of storage you can imagine you just do the math on how fast the network is what its typical load is and the number of days of storage you want to be able to go back retrospectively and do analysis on and you can imagine we're talking you know we're in some cases into the PETA and exabyte amount of storage for some applications. I run it on a virtual appliance because my network is relatively slow and with a couple of gigs of packet data plus the metadata I'm usually able to go back three or four months and reconstruct stuff pretty far back. So and I've already talked about what SSL visibility is it's it really is just a it's it's basically custom silicon dedicated to do the math that's involved in SSL decryption. All right so these are the sort of the two ways that we would use SSLV most of the time that I'm using it in my lab I am using it in the sort of outbound inspection sort of variety which is where I've got the thing watching traffic it's inside the land but it's just inside the sort of the perimeter before everything else and everything that goes outbound is going through this thing and when it can be inspected it is inspected and when it causes problems you can basically you can tell it to do one of two things you can either have it reject that connection and basically kill it in which case the application will throw errors if it's obviously not able to complete its communication or you can just tell the box if you identify this this protocol or this particular service or this domain name or these IP ranges you can say just ignore for the purposes of doing inspection these these things that you have set up and then it will ignore that and everything will go through but you won't get the decrypted SSL either all right so when when you first connect into the SSLV the first thing that that you see is that it has its own self-signed cert um obviously because you you know all of these appliances are using SSL and that's pretty normal um the cert looks like that it actually has a common name of SSL uh NG UI um and it's generated the first time you use the app so this is the dashboard of the SSLV um it has a that's the prettiest picture that you're ever going to see in the UI and um all it does it shows you a sort of representation visually of the rack and the ports that are on the front of it and yeah it's the one device that I have in my stack where the ports are on the front everything else is on the back so it's kind of a pain um and it will tell you basically how you're using it um in this case I'm using it in something called active f-line uh active inline FTN mode uh and that is where uh all sessions are basically being intercepted when they can be decrypted it is doing so and when they cannot it it essentially lets them go through on uh without trying to decrypt them uh just to allow things to work um sorry that that's so tiny but this is just a picture of the user interface of the SSLV session log and what's important about this is that it will tell you uh for example what Cypher Suite the device is uh is trying to decrypt um if that type of uh Cypher Suite is supported by the device not all of them are but many of them are um and then whether or not it was able to successfully decrypt it when it uh is not able to decrypt it and the device allows the connection to go through anyway so it still works uh that is called a cut through and and um it's kind of an interesting thing uh the one of the ways that the device works is that you have you know clearly you have one ethernet is for in and one is for out and then there is a second pair of ports it is literally it is a physical loop back where you have to have the tiniest cable in the world and it's just a loop between them and the reason for that is the the device will programmatically decide when something is supposed to go through and it will literally shunt it through this other thing which is just a loop to get it around all of the uh the silicon inside um so to use it you basically generate a cert and the cert is generated essentially the device acts as like a certificate authority so uh it will generate a cert for you you can add all of the you know custom information that you would want into the certificate uh this is not a uh you know a valid cert that you would be able to then put up on your uh your you know HTTPS server so um it is it is literally uh it's only purpose is to do the re-signing um so the the secret key remains within uh the the device and then you can export the uh the sort of the public side of the cert which you can then add into the certificate store of any of your devices and when when that cert is in the cert store the re-signing happens essentially transparently and automatically um there's a huge number of protocols that it supports that's just uh some screenshots of some of the the UI drop downs that show you all the different options that you can have when you generate your cert right and then um you know here's the the exported cert it shows like you can create one like this one that says I call this my defcon certificate and uh it will export it as a PEM or a CRT or CER or DER and then you can you know import it into a variety of different devices. Alright and then here's just the uh the re- uh re-signing authorities are basically like you know you can decide under certain circumstances when such and such Cypher suite is being used use this certificate authority or else use this other one and it's a way of basically you know you can use it for a bunch of different reasons but it's a primarily a way of maintaining the same security level of the traffic on your internal network so you're not basically using a weakened Cypher or something that's easy to crack inside the building because that would be you know talk about crunchy outside and soft and chewy on the inside it would just make things worse for a lot of uh a lot of things. Right and then once you have your um once you have your cert set up and they've been installed on your devices then you have to create rule sets where you basically say under these circumstances you're gonna do the decrypting right and so you go to this rule policies menu go to rule sets and you kind of add in your rule and in this case the rule sets that I've created are you know basically uh look at everything and then if you see these domain names exclude them if you see these IP addresses which happen to be internal devices exclude them if you see these IP addresses that belong to you know Netflix's uh uh you know content management system exclude them because Netflix for some reason doesn't like to have all of their stuff decrypted um and then you know and so on and so forth and then the very last step is do the decryption. Right um so one of the cool features that is in the sort of newer version of this product is that um it pulls down and uh ties in with the categories that that blue code has created for it's uh it's web categorization service that sort of underlies a lot of their other products that um most people know the blue code proxy is is the big enterprise product that a lot of people have and they have these categories where administrators can set up policies where they don't want employees to visit porn sites on the job I mean shocking right but like you might not want to block that and so in this case you can actually use those same categories and you can say uh I want to decrypt everything except stuff that's tied to banking and financial for example and there thereby you can exclude the stuff that would basically make you you know would force you to violate um uh you know PCI DSS standards for example and you know would you accidentally be you know leaking tons of data across your network decrypted that you wouldn't want to to be leaked um so yeah anyway that's and I and the team I work for is the team that creates that and maintains that reputation service there it's called the global information network um once you've done all that then you you just kind of you know pop it in and there's a little UI that says you know plug this into port one and two plug this into port five and six and then everything else the tap is coming out of the other ports right more more little choosers that show you different combinations of things you can do um so one of the things that it can do is also if if the because it's an inline box it's a it's a bump in the wire uh you would imagine that if there were a physical failure like a power outage you your network might go down if this box wasn't turned on so there's this concept of uh fail to network and that that's one of the other reasons why there's that little loop back physical wire in there is that it will it will actually physically click over you'll hear a loud click when the power goes out and then that just means that it acts as a bump in the wire with nothing in between it so your network continues running even though the powers out right here's um some of the rules in the failure modes uh that it can experience and what you can choose to do with it basically you can either choose to reject which means kill the connection or you can tell it to cut through which means let it go and it's not decrypting anything right um and we've already talked about this you saw that graphic so I'm not going to repeat all that um it does not get used in a couple of different circumstances so um last year I gave this talk and and uh it was there's been some misunderstanding about like the purpose of this device and it is not something while it is suitable for enterprise networks where you may have a uh couple to ten thousand machines on a network um at the highest end uh in sort of like anything bigger than that you're going to run into real problems where the CPU load is just going to be too high for the device and it's going to start dropping sessions so this is not a box that you can plug in on your country's WAN connection to the rest of the internet and basically decrypt everything that everyone is doing the other thing that you can't do is you can't decrypt stuff and have it not be really obvious everything that gets decrypted if it doesn't have your CA cert in your cert store is basically going to cause errors to pop up in whatever application you use if you're using the browser you'll see those messages that pop up that say uh there's something hinky about this HTTPS connection uh are you sure you want to connect to it and so um if you don't have that CA cert installed it's going to throw a lot of those errors and and there are going to be devices and and applications that don't connect at all. Um right and that's that's basically what I was saying is that you know none of this stuff is going to work if you don't have the CA cert on it. Um when you do not when you do install CA certs uh on uh laptop there isn't necessarily a warning message to let you know that stuff is going to be decryptable and and in some cases we've seen well they're kind of shoddy uh crimeware uh applications that have tried to convince people to install CA certs onto their uh device so that the uh criminals malware can actually uh decrypt the SSL for the criminal um and other than that I haven't seen a whole lot of criminal use of this type of thing but when you do install the cert in other devices like in Android you get these persistent uh alerts that never go away the entire time the cert is installed. So the only way to get these messages that say things like network may be monitored by an uh you know a known third party uh you're going to see that message until you actually delete those certs completely out of the store. Alright so what's better in the past year? Um I gave a talk similar to this last year and the talk that I gave was about how um how few applications for mobile devices specifically were actually using something called certificate pinning where they they essentially have a CA cert built into the app and if that cert does not match identically to what it's getting you know in terms of the handshake from the server the connection simply doesn't go through and uh a year ago there were a few apps that um essentially were you know very very secure and would never allow that to go through but a lot of other stuff did. Some of the apps that worked last year were um that that securely connected and had pin certs where things like um like the Twitter app like signal the uh SMS replacement app and you know other kinds of security tools that you can imagine would would want to have pin certs um I believe also Facebook uh supported pinning and a few games that do uh uh over HTTPS uh some command and control for the game. Um there's been a lot of improvements over the past year so I I kind of uh I gave a different talk last year uh about a game that I use that is a uh location based game called Ingress and how um it is it has been and is continuing to be heavily abused by people who do man in the middle SSL interception to decrypt all of the command and control stuff and messaging that's in the game and that's being used to essentially louse up that game and cheat and um I'm sad to say that that that app has not improved although um the other game that that same company Niantic makes Pokemon Go in a release that happened sometime in the last fall uh they did start pinning their certs so while it is still possible to man in the middle uh Ingress you cannot man in the middle Pokemon Go to the best of my knowledge unless you do some some hacking of the app itself. Um right and I mentioned that like basically when it's when a specific pin that it's not going to work I mean it's really not going to work and and and a lot of times um the application developers when they when they create these apps that have pins in them uh they're they're doing it so that they can ensure privacy of the connection but they're not necessarily building in the the error uh responses to understand and explain to the end user why the thing isn't connecting it will just say like tweets cannot be received at this time so in some cases you'll get these messages where it says it just couldn't connect and in others it will say it looks like there's SSL interception going on I'm definitely not going to connect but a lot of times the the error messages are pretty confusing. Um so let me show you some of the other stuff that's popped out uh just in doing a little bit of looking at devices so um so what I haven't explained is sort of in in my day job uh I I run this lab it's full of IOT devices it's full of Android phones that are running malware uh at any given time uh I also have bare metal machines virtual machines and some sandboxes that are running malware and the purpose of doing all of this decryption and and recording of network traffic is so that we in the gym team can observe the command and control traffic of malware know where it's talking to how it communicates and write rules for various tools to either be able to uh uh notice when those kinds of connections are happening or to be able to block them by by address or or sometimes uh to narrow it down to like the URI path uh that that a command and control connection will be happening on so um so I do have a demo um that was ready to go on my other laptop and hopefully I if if the person who loaned me their laptop doesn't mind I might connect it to my demo network and see if I can do that at the end um because I there's there is some malware that uses TLS to do its command and control uh one of the the primary ones that I'm seeing right now is a a bot that's that emerged in the last few months called trick bot which is starting to kind of gain traction as a uh a main rat that people are are distributing through a lot of different methods but mainly through spam and through uh uh uh exploit kits and it's a it's an interesting one because it's it's also one of the more sophisticated and modular pieces of malware that I've seen it it basically is a a core engine for the malicious activity uh and it brings down modules from different command and control servers so that it can um uh it can run those modules as DLLs and kind of hook into different features on whatever machine it happens to have infected. So a couple of the weird things that have popped up recently so um like looking in these logs uh I will sometimes just kind of skim through them and there's there's actually a filter thing that will trigger like just show you all the errors that appear in the SSL session logs and so I like to look through those and just see sort of what broke recently and I I wanted to call a few of these out so so just last week I was looking at the you know a couple of these things and I had a machine I had a phone that was attached to one of my uh uh nodes in my network that is being you know go routes through this and the phone was doing some just normal uh activity uh but this error popped up um and it's the one that's highlighted here and it was it was a big log line so I split it in half but basically it's the very end uh you're near the end you can see it says expired so the the cert the cert in this case when this communication happened it allowed the communication to go through um it did not uh it was not able to decrypt it and it did report that the cert uh was expired so I went back in and I looked at you could see that the uh the the origin IP of this was uh 54 208 220 185 so I went into security analytics and I pulled out the undecrypted um flow that contained that session with the SSL stuff and then I used a tool called network miner to just like dump out the uh the cert and take a look at that so when I did that um I found that there was this cert for something called parse dot com and parse is is one of many uh different kinds of sort of mobile uh uh it's instrumentation that developers will install third party instrumentation package that they use to kind of keep track of how their app is behaving and it receives telemetry over HTTPS as well and their cert expired it it's hard to see but it says like it expired on June 29th so so they were still running on an expired cert and and I wasn't able to decrypt it um uh because of that um the uh is one of the other things that I have uh like I like I mentioned a lot of IOT devices and we have a couple of Samsung smart TVs different models uh connected to that network um in general the uh the Samsung is an interesting device because uh it I don't it how many people just show of hands how many people have a Samsung smart TV so just a few but you know more than more than a couple um interesting device it has um its own sort of version of the of an operating system it has its own antivirus built into it as well you can tell the thing to scan for files within the uh the operating system uh uh file system and it uh it has ethernet ports and can connect over a wired or wireless connection and obviously you would then you know connect it to the network and it has you know all your apps for you know Netflix or Hulu or Amazon whatever your video streaming service of choice is um so when you want to watch HBO go you just go into the TV and you pivot over to the streaming service that you want and it launches an app within the TV um and those apps are all downloaded through a cloud service that Samsung operates um the TV also does things like it scans the whole network oh every four times every second for Samsung uh like mobile devices that can connect to the TV um it generates a ton of noise and actually it's I I would say it's one of the reasons why when you buy a smart TV it's always good to connect it to a power strip and when you turn it off turn it off on the power strip so that it's not just sitting there because I've seen my TV stay active for three four hours after you turn it off and it continues scanning looking for like hey is anyone want to connect and like share videos on the screen um so it's pretty obnoxious and and in addition to all of that noise uh the TV itself has authentication with uh a Samsung account that you can set up uh to do technical support and also to save your preferences there's a browser built into the TV so if you want to browse the internet um you can save your bookmarks in your Samsung account and then when you log into your Samsung account on a different TV or a different device basically you can get all that stuff back um so what we've got here is logs from uh the SSLV showing that um the TV was going to a bunch of different websites including uh Samsung cloud solution dot net and Samsung ac acr dot com uh all of these Samsung apps that are in the TV themselves uh with the exception of its wifi connection check uh they all of them basically fail on this because they're using a pin cert that's good because the one that that's connecting to um Samsung acr dot com uh is is connecting to something called log ingestion dot Samsung acr dot com um the the bad news is that um all of those domains have invalid issuers so so there's a cert that was issued to these different TV connection domains that isn't valid and when I pulled them out I looked at them and yeah they're all self signed cert so apparently Samsung operates its own internal certificate authority and they generate these certs for their devices which then get flashed into the firmware for the TVs and the the the mobile phones and everything else and the cert has a you know valid validity up until the end of the year 2043 so I cannot guarantee that your TV will still work in 2044 uh I suspect it will probably fail a lot sooner than that but that that's interesting to me to find out that like the big TV manufacturers are basically issuing self signed certs for for you know the hundreds of thousands of TVs and things that they sell every year um another thing that I was playing with was um uh my son's Nintendo 3DS uh I do occasionally confiscate for like research purposes and play a little bit of Pokemon XY but um besides that um the the device is actually really interesting because it can do uh peer to peer networking over wifi and uh you know so you can play basically uh uh collaborative games together with your buddies um it also has its own built in browser and you can and it will it it kind of uh tries as best it can to generate a mobile version of things like Gmail so you can read your Gmail and stuff through the browser on the 3DS I wouldn't recommend it it's not the best way to read uh your email um and when you go to the browser and you have uh SSL interception on it you can see here it pops up a warning message that asks you to basically bypass the the um security features in the SSL are you sure you want to do this it's essentially the same as what you would get in Chrome um so in the browser of the 3DS you can manually bypass this error message and and I don't know show of hands how many people think ten year olds understand what the context of this kind of a dialogue box is exactly so everybody when your child is a a straight A student from my book that one guy in the back who raised his hand so um so most kids are going to just hit allow because they don't understand what's going to happen and um I believe a lot of adults do that too when they see this kind of a message so you can bypass and you can decrypt the SSL from the browser um what you can't do without doing some serious modifications to the 3DS is you cannot decrypt any of the other HTTPS communications that the device does so among those things uh there is a Nintendo account where you can create your me uh which is a little cartoony character that represents you in all the games uh and you can share your me through your Nintendo account with your buddies so that when they play uh co-op with you the your me shows up on their device their me shows up on your device um so none of that uh me me gallery stuff works uh if you have interception turned on it just can't connect uh the other thing that fails is um uh there is a online store where you can buy the games and uh essentially download them to the device to the SD card or or into the device's memory um this store app is also pinned so that when you have interception turned on you're not going to be able to buy a game and download it um and then the third thing that's kind of an issue is that um all of the domains that are being used for Nintendo um are also invalid issuers so here I've got some of the screen on this one at the very bottom uh it's the C dot shop dot Nintendo Wi-Fi dot net uh has an invalid issuer and then on these two screens there's uh something called uh NASC dot Nintendo Wi-Fi dot net and account dot Nintendo dot net and all of them are are are invalid issuers and again it's um it comes down to Nintendo themselves just like Samsung are operating their own certificate authority and they're basically self signing certs and throwing them into these devices um you have to wonder about these large electronic manufacturers I mean I think that they probably have 50 bucks a year to throw at buying some certs um I would hope that this would change in the future I think right now it's probably being done for convenience sake but it would be nice to see some trust levels in the SSL communications uh and not just self-signed certs because this as we all know that's just asking for trouble uh when you try to do um anything over an intercepted network uh through these pinned apps that are that are built into the 3DS you end up with a message that's very obscure looking and looks like this uh the one on the left that says an error has occurred please try again later when you go and you look up that error code it it tells you that there's um there's a message in that error code that essentially is that the clock is set wrong so you need to check the time and then and then try to reconnect again and that actually comes up a lot when you when you're seeing certificate resigning is that the error is basically the same as if your clock was off and the timing for the cert uh was was wrong um but the but the game developers or the the device manufacturers don't anticipate or assume that people are doing man in the middle decryption on their stuff so they just basically have one error message for the whole that whole type of thing the one thing that does work though is when you do the connection test so so there is a um there's a whole Wi-Fi UI in the 3DS and you can connect to an access point and then it it wants to go off and make sure that it can make a valid connection if it cannot make an HTTP S connection which it tries first it then tries just an HTTP connection to us to a URL that's on Nintendo's website and when that works it basically comes back and says your connection is good but it doesn't tell you that you weren't able to connect over SSL so um yeah it's just in you know another weirdness in a consumer electronics device um another ish invalid issuer problem that I found was with um whisper systems so whisper systems makes the signal app um I'm a user of it and you know I I love mock mock mock mock see Marlin spike right I mean he's been to DEF CON a million times and spoken and he's a great guy and this is a great app um but once again it's it's using a self-generated cert uh to do that communication and um I just would prefer I I don't know how you feel about it I think it would be stronger if more of these companies uh used certs that had some validity that can be uh validated through a uh certificate authority um so here's the whisper systems cert right and it says Windows did not have enough uh information to verify the certificate and at the bottom of the second one it says the the issuer the certificate could not be found and that's basically the same error that the Nintendo one did and the Samsung one did so probably most likely it was a self signature if I if I had my laptop I get open the cert and take a look and see what it was signed with I don't have the screenshot up here um right oh so one of the other thing that uh came out of this is that um so the the there are these third party apps right so you know Netflix and Hulu and all those guys have their own apps they produce them for the Tizen operating system which is the thing that's running in the Samsung TV and then those apps can have their other like third party instrumentation in them so that those app developers can get feedback directly from the TV user uh when something's not working if streaming's not coming through right I mean I you can understand why you know Netflix wants to know what your throughput is and if it's uh if you're uh getting too many artifacts in the video and so there's all this internet um uh instrumentation built into uh the the apps themselves and in this case there was an invalid issuer for uh Netflix's app so there was a self signed cert for Netflix's app and then there was also something called internet at dot TV and that also was a self signed cert so that's whatever that is and I'm not 100% sure what it is because of course I wasn't able to inspect the content of the traffic uh other than to see the cert it was all invalid certs so um so that's problematic um now I was going to jump at this point over to my wireless network and show you the decrypted traffic from TrickBot with it now I will pause for a moment and see if there's any questions and ask if if uh is this your this your laptop right can yeah no can you would you mind coming up here and connecting me to my wireless and so questions yes no no TrickBot is a piece of malware that's created by someone we don't know who that person is and uh and TrickBot is we are decrypting the TrickBot command and control traffic using this technique so the the access point is it's this seven four three e a and uh here I'll introduce you to the process area yeah so did I really catch the the question was uh is the is TrickBot the tool that I'm using and no it is not yes well I wouldn't say that it actually so the question is why does it why is a so why is a self-signed cert less secure than a pin cert is that is that essentially well okay so um let me step back and just reiterate so I wouldn't say that it's more secure that one is not more secure than the other but I think having some certificate validity being issued by a valid CA where it can be checked um and that there's some trust there is better than having a self-signed cert that's not to say that the self signed certs are inherently insecure that there's some problem with them um but but this validity checking only happens when it's been done through a certificate authority I'm sorry hang on one second I want to make sure that I can get online it says it's not connected it's still it's still trying to connect to it it won't until it's connected it's not going to work uh yeah if you don't mind I'm sorry would you would you please repeat your question okay so the question is um so if if they're using a purchased cert instead of a uh a self signed cert um why should I trust the purchased cert more um I don't know it just I like to I like to be able to make sure that it's legit um it's too I think it's too easy to kind of clone an app and modify it and add your own self signed cert in there to kind of pretend to be the app and maybe put it on an app store um having that having that be a valid cert at least gives you the um confidence that when it's talking back to its command and control server that it's it's talking back to a command and control server that has at least um you know proposed to a valid signing authority that they are the real deal right so like if you're using your chase bank app I want to make sure that that cert is valid that it's talking to chase and that it's not just a fake chase bank app that's talking to some other guy does that make sense I mean it doesn't necessarily make it inherently more secure communications but it makes me feel better about using it yes that that is a valid point I will repeat that um so if the app is itself signed by the and the and the code is signed so that you know that the uh the app is is uh reputedly originating with the real developer um that obviates the need for checking the cert and and yeah that's actually a valid point and one that I hadn't considered I I don't so my my focus in this talk was just very very narrowly on the network side of things um and not looking at the the apps themselves um him and then you uh so do I know about Google's uh certificate transparency I I haven't heard the news about it so um I do I do know that um uh Google's certs and the and the way that they do SSL specifically within Chrome they're they're very on the cutting edge of um trying to defeat tools like SSL visibility so they're they were uh some of the earliest adopters of some of the uh really obscure and and hard to decrypt uh protocols that were being used and so um I would say that the when it comes to the team that's doing the development and management of the SSL visibility product 95 percent of their like feature request is oh Google Chrome just added a new like you know certificate you know or new encryption uh rule that they need to be able to decrypt and like suddenly it's not working anymore so like I think four times last year they came out with a new version of Chrome and all of a sudden everything broke in SSLV so then then a new version of SSLV firmware had to be uploaded and you know reinstalled and um and there's a lot of time that we spend trying to bust into Google stuff. Hi go ahead.  I mean essentially what it's doing is um you you have a certificate handshake that comes in and is presented what essentially to the client. The SSLV looks for that handshake. It then it it then takes that certificate for the handshake it pretends that it's the client and does the handshake back to the server but then internally within the SSLV it's it's takes the decrypted traffic re-encrypts it with it's with that cert that it's generated and then sends that up to the client so it's doing this kind of like half to two halves of the whole. Yeah. The decrypted traffic is happening inside of the SSLV box itself so it's it's pretend basically the box pretends to be the client it presents itself as the client as being the client's like originating you know box basically and and so it does the handshaking and then instead of that you know normally that decrypted data would be then you know sent into the browser itself and rendered on the screen instead it shunts that out of a decrypted port on the box and then it will re-encrypt it with the certs that you've created and then send that up to the endpoint that actually made the request in the first place. Yes. Okay so it's a long question and I've got like less than five minutes and I think we're out of time for the demo so I'll just I'll answer this question and then I think we're gonna have to wrap it up. The question was if I if I got it correctly there are a lot of different certificate authority stores in different operating systems and even in say say like a windows you can have there's a certificate authority store for the operating system but if you have Java installed it has its own CA store if you have Firefox installed it has its own separate CA store if you have Thunderbird installed that's a third one if you're Chrome it has a fourth one and believe me I know this because I have to install those CA certs in every one of those stores and it's a giant P.I.T.A. so the question was is there any kind of industry moved to like centralize this and keep those certificate stores up to date and have one place where all that stuff is collected and I think the answer is hell no because they don't want they don't want it that way I think Chrome you know the Chrome developers and Google want their own store because they don't inherently trust the one on the operating system and the same is probably true for I can't speak for the people at Mozilla Foundation but like the reason why Thunderbird has its own store that's separate from the operating system is that they want to make sure that their CA store is accurate and and they're responsible for updating it when you download your updates right that's that store gets updated periodically with different certs or or you know sometimes they get deleted right it's like if you lose trust in woe sign you can go into those CA stores and delete the woe sign cert and then that kind of reduces the trust that you have in woe sign it would be nice for there to be one place where you can just do all that stuff and honestly like it's the biggest difficulty in my daily job of having to work with this stuff is having to put the certs and all those stores especially because I have six certs that I install in every machine so but no I don't think that that's going to be a problem that gets solved anytime soon I'm sorry I wish I wish I could end on a happier note I really want to show you guys the trick bot stuff but you know what I'll just pitch it as a talk for next year are there any other are there any other questions oh yeah go ahead so free and open source man in the middle stuff since yeah so um I know that some exist I've never used them I I know that we're not the only we're not the only commercial and we're not the only like free product that that does this right and that there are products out there that can do this and there's also uh you know I think uh semantics antivirus and Kaspersky's antivirus also can intercept SSL so that they can check the reputation on URLs that you visit when you're when you're using your computer um but I I'm sorry I don't have a good answer for like what's a good all free alternative for this if you find one though come and get my card and at the end of the talk and let me know what it is because I'd like to play with it and see what we can do with it uh it's called SSL visibility and if anybody wants to come it's running behind the screen here so if anyone wants to see it I'll have it out in the hallway afterwards all right yeah I think I think we're out of time so oh is it do we have time for one more okay yeah okay right okay so that's a really good the question is um this because this thing is so critical on a network um screwing it up could really mess up your network so how do what do we do to kind of mitigate that and and reduce the the attack surface of the device so um one of the things that we do wow one of the things that we do is um there there's a uh there's an administrative interface that can be uh connected to a completely different VLAN or a different different segment of the network um and and that basically can be in like a secured part of the network uh the security analytics box as well like it will tap the the active part of the network but it's not necessarily connected to that active part of the network and so when you when you have an administrative interface that's got a separate ethernet jack you can put it on something else that's like a much more secured and tight tightened down segment of the network it doesn't even have to be connected to the internet can just be used for administrative interface um so that that's basically how we do it um the the bump in the wire itself that the SSLV represents like there's there's nothing that that is uh and I shouldn't say this like definitively but I am 99 percent sure that there's nothing that can be interfaced with over that like through part of the network so alright I'm getting the hook so thanks everybody for coming I appreciate your patience


For more videos on people's struggles, please subscribe to our YouTube channel. The civic military right-wing US-backed coup d'etat against the democratically elected Bolivian president Evo Morales, which installed a fascist and racist dictatorship of the right-wing usurper Haneane Agnes, completed a month on December 10. Morales, who is now in Argentina after being granted asylum by the new Argentinian president Alberto Fernandez, condemned the de facto government for committing innumerable human rights violations. Protests against Morales began the day after the general elections on October 20. The final results showed that he had obtained over 10 percent more votes than his closest rival Carlos Mesa, which was necessary for victory. However, the opposition refused to accept the results and began violent mobilizations demanding his resignation. On November 10, President Morales and Vice President Alvaro Garcia-Linera resigned after the army-backed right-wing opposition coup against the constitutional government of the movement toward socialism or MAS. On November 11, due to serious threats to their physical integrity and safety and the escalation of violence and intimidation, Morales and Garcia-Linera were forced to leave the country and seek asylum in Mexico at the time. On November 12, in a session of Congress that met without quorum, right-wing legislator Agnes declared herself interim president of Bolivia. After resuming power, the de facto government of Agnes unleashed an unprecedented level of repression against Morales' supporter, who have been protesting the coup in the streets. It also intensified selective prosecution of political and social leaders to the extent that arrest warrants were issued against several MAS deputies and senators who opposed the coup. The coup-supporting police force and armed forces have been brutally repressing the multitudinous mobilizations with tear gas, firearms, beating up and arresting protesters and carrying out violent house raids. The highest points of state terrorism were witnesses in the massacres in which nine anti-group protesters in Sacaba in Cochabamba and six in Sencata in El Alto were killed by the security forces and hundreds were gravely injured. The discriminatory and authoritarian stance of the de facto government became further evident when it passed the supreme decree number 4078, which exempted the member of armed forces from criminal liability on the same day of the massacre in Cochabamba. In addition, the interim government tried to impede the communication about what was happening in the country. The local press was censored and foreign governments were harassed and attacked. The Inter-American Commission on Human Rights or the IACHR and other international human rights defenders verified that Agnes's government commuted a number of human rights violations post-coup. On December 11, the IACHR issued a report on its observation visit to Bolivia between November 22 and November 25, following the invitation from the de facto government. In its report, the IACHR expressed utmost concern about human rights violation in the aftermath of the coup and also highlighted the climate of violence characterized by polarization, hostility and hatred based on discrimination, intolerance and racism. The organization cited several examples of excessive use of force in the joint operations of the military and police force. According to the data recorded by the IACHR, 36 people were killed and more than 800 were injured during military and police operations. Referring to the supreme decree number 4078, the IACHR said that the security officials involved in the acts of violence cannot be protected by any type of amnesty or exemption. The organization recommended the de facto government to respect the right to protest, guarantee the right to freedom of expression, make use of force according to international standards, suspend the mass deployment of armed police forces, seize repression of social protest and arbitrage detention of those who participate in the protest among other advisers. In addition to making recommendation with respect to human rights, the commission requested that an independent international investigation be carried out on the events recorded in the country after the coup. Last week, the delegation of Argentine human rights defenders, social leaders and lawyers that traveled to Bolivia with the objective to observe the human rights situation in the country following the coup also denounced a series of human rights violation by the de facto government. The delegation in its preliminary report based on evidence and testimonies gathered during their two-day stay in Bolivia confirmed the complicity of Agnes's government in the massacres perpetrated in Sakava and Sincata. The delegation also said it had evidence of the explicit support of foreign governments in the coup. The dictatorial government explicitly confirmed this by restoring relations with the United States and Israel suspended more than a decade ago and manifesting a new alignment in terms of international politics. In addition, the visa requirement for American and Israeli citizens has also been eliminated. Morales had earlier invited the Organization of American States to conduct an audit. The OAS's preliminary report called for fresh elections. Following this, Morales called for new general elections hours before he had to resign. However, after the coup, the OAS responsible for auditing the election was unable to demonstrate any significant irregularities. The information entered with the counting and computing of words cannot be verified according to them because of the burning of ballots in the region of Benin set the OAS in its final report. Besides, the word fraud didn't appear even once in the final report. In addition, through a document, more than 100 economists and statistics experts from different universities in the US, Spain, Argentina, India, Brazil, Canada and other countries ruled out any possibility of fraud in the presidential elections and criticized the actions of the OAS. However, to legitimize itself, the dictatorial government of Agnes took advantage of the leadership vacuum in MAS after Morales' exile to get the parliament to annul the election on October 20 and called for new elections in the first quarter of 2020. It also managed to ban Evo Morales and Alvaro Garcia-Linera as candidates. In this context, last weekend the MAS held a national assembly in the city of Cochabamba where Morales was appointed as the campaign leader of the MAS for these elections.