Thank you all for being here for our latest update on COVID-19, commonly known as coronavirus. The state, nation and world learn more about this new virus every single day. And public health officials and governments across the country are working to put what we learn into action because our top priority is to protect our people. While most, more than 80 percent, who get this virus experience mild to moderate symptoms, we know some people, especially older Vermonters and those with serious health conditions like heart or lung disease and diabetes, are at higher risk of becoming very sick. The best information we currently have from the experts concludes that slowing it down in preventing as many cases as possible is the best way to make sure the most vulnerable, the very ill and the elderly, get the care they need, which in many cases will include hospitalization when they need it. But more directly, this is more about protecting the vulnerable. And while many will either not get it or see mild symptoms, we all have to do our part to slow it down to protect the ill and older Vermonters who are at risk. This is the lesson from other countries like China and Italy, where efforts to slow the spread were not implemented early enough and now we see them struggling. So today, we're going to enact mitigation measures that will help slow the spread, which means better health outcomes for those who get this virus. While Vermont only has two known cases at this time, we know it's just a matter of time before there are many more. I want Vermonters to know how very fortunate we are to have so many incredibly talented and hardworking people in the Department of Health and Vermont Emergency Management, as well as first responders and health care providers across the state who have been working very hard to prepare for and respond to this virus, and it will continue to serve as well. But as more information becomes available about how important community mitigation strategies are to slowing this, we must take more action to protect the ill and elderly. Every single one of us has an incredibly important role to play in this. We're all in this together. We're going to act together, and we're going to get through this together. That's why today I declared a state of emergency, and through these emergency powers, I'm implementing several additional mitigation strategies, which will be in effect until April 15th, though that could be shortened or extended based on what we experience on the ground. Again, it's important to keep in mind this strategy is focused on protecting our most vulnerable, which based on science and data means the elderly and the very ill. Specifically, these actions are designed to prevent and control outbreaks, protect those at greatest risks, minimize the risks of the public, maintain the health and safety of our monitors, and to limit the strain on our health care system and to slow the spread of infection in our communities. First, to protect our older Vermonters, I've ordered long term care facilities to restrict visitor access with exceptions for family visiting kids and terminally ill loved ones. I know this will be very difficult for everyone involved, but we also know the residents of these facilities and those seeking care at our hospitals are most at risk, and we must take short term measures to protect them. Second, room for single space for social or recreational events. Now, I understand the destruction this will cause, as well as the economic impacts, but we've seen its effectiveness in other countries, and we must do our part. Third, to limit and protect state employees and their communities, I've suspended all non-essential out-of-state travel for state business by state employees. The Secretary of Administration and Commissioner of Human Resources are also directed to encourage and facilitate more employees to work from home over the next month, and we encourage employers across the state to do the same, if possible. My executive order also outlines additional steps to support the Health Department's work, including providing resources for the Department of Public Safety to assist with their contact tracing and investigative efforts, directing the Department of Financial Regulation to analyze demographic information in order to know the potential impacts on our population, workforce, and economy, and more. Additional steps and details are outlined in the executive order, and while I know many are concerned about our pre-K through 12 schools, in close consultation with our team, especially our healthcare team, we have determined that closing schools at this point is not seen as effective, at least not yet. We believe keeping them in schools, rather than at home alone, or with their parents or grandparents who are at risk, is the best approach at this time. However, this is something the Department of Health, Emergency Management, and the Agents of Education are closely monitoring and reevaluating every day, and we will not hesitate to act if the risks change, as the result schools and parents should be preparing for this possibility. In closing, I want to thank this group and their teams behind me, as well as those across state and local government, and in our healthcare system, who are working long hours with a fierce commitment to serving and protecting Vermonters. I also, again, want to thank members of the press for the calm clarity you've helped us communicate to Vermonters. Your professionalism is greatly appreciated and much needed in these times. Finally, and most importantly, I want to thank all Vermonters for their understanding, cooperation, and action to help protect and support their own families, as well as care for their neighbors. Because stopping this virus is about protecting the very sick and elderly from its effects. As I've outlined, this is going to require some unique and, yes, disruptive measures, and we need everyone's help to make them as successful as possible. My fellow Vermonters, I know many are concerned and even scared. I also know some will think this is not enough and others will think this is far too much. Please know every decision I make will be informed by the best science and the best experts we have available, and we are truly blessed to have some of the best professionals working with us. I also want to make this very clear. We are going to get through this together. We will be united in our commitment to protect the very ill and elderly from this virus, and this will unite us in our actions. We will work together as a community to defeat it in the short term, so we emerge stronger and more resilient for the long term. There is no doubt these are difficult steps that for a few weeks or possibly months will change what we do in our daily lives. And I also need you to know there may be more that may be necessary, but the compassion and commitment of our people and communities will see us through. We have to rise above frustrations and fear. We can't focus on how this may set us back because what it's really about is about who we are as Vermonters and how we're going to lead our state forward. Here's the bottom line. It's not in our DNA to turn our backs on the most vulnerable. We're going to face it, fight it, and we're going to win. And just like after Irene, we're all going to do our part to help each other at this time of need to show our children how the calm, compassionate determination of Vermonters in our communities can meet any challenge. So with that, I'm now going to turn this over to Dr. Levine to share the latest and what we're seeing in Vermont as well as what we know about this virus. Dr. Levine. Thank you, Governor. And I also would like to thank the members of the Vermont media. In addition to your usual good work, you've been a sexual conduit of this important public health messaging to Vermonters. I know what you've heard today and over the past several weeks can be frankly overwhelming. I'd like to in the next few moments give you a brief status update, tell a little more about the virus and some of the rationale from a public health standpoint for what you've just heard. As of earlier today, we still have only two cases. We are monitoring well over 200 Vermonters, a number that is going to increase significantly related to our second case and to the fact that the CDC has added to its recommendations for travelers returning to the US. As of this week, people returning from most of Europe will be asked to stay home for 14 days and monitor their own health and report their travel to the health department. These are the same directions we've been giving the people coming from other areas with widespread sustained transmission of COVID-19, including China, Iran and South Korea. You can find the full list on our website, healthvermont.gov. To date, we've completed monitoring for almost 100 Vermonters. Prior to today, we had tested almost 140 Vermonters in 10 days. We're anticipating an additional 100 plus test results today. Based upon the experience of many other states and some of our joining states, we fully expect this number to increase. I'll tell you just one or two things we don't know so much about with this virus. How infectious is someone who has no symptoms? How infectious is someone and for how long does it last after their illness? But there are very important things that we do know. As I've said many times, 80% of those who contract this virus will have mild to moderate illness. The incubation period from the time one contracts with someone who has the virus is four to seven days. It can, though, be up to 14. Transmissibility is thought to be one person has the ability to infect two others. And then they, of course, have that same ability, which is why it's so important early on to try to contain the virus. The case fatality rate is 1%. Much more than seasonal flu, which is 0.1%. But much less than the human race's prior experience with novel coronaviruses like SARS or MERS. And that 1% is an average. The case fatality rate is far more skewed toward the elderly and the chronically ill, those with underlying predisposing conditions that we're always telling you about. And we know the young are markedly less likely to show signs of infection. And that's why the focus of the strategy the governor has outlined is so directed to protecting our most vulnerable populations. We also know that the virus is transmitted by respiratory droplets and the distance is about six feet. And that is why, as you'll hear, social distancing strategies can become so important. We don't know how long the virus can persist on a surface on something that's not alive. It's thought to be anywhere from seconds to minutes to maybe an hour. The public health and our state's response to this outbreak is a matter of using what data we have, anticipating what the future may hold, and the timing of our approaches. And if you think about it, our goals are quite straightforward. Protect the most vulnerable. Protect as many people as possible from getting infected, knowing that many still will, as this is truly a novel virus for the human race. And prevent the healthcare system from becoming overwhelmed so it can deliver the best possible care to those in need and still retain a robust healthcare workforce. So I'm going to illustrate this with a picture because I think it's worth a thousand words. And it'll speak about the measures the governor has addressed to help flatten this curve of potential spread of virus in Vermont. I'm a little tall for this. Just for everyone's frame of reference, this axis is number of cases and the horizontal axis is time. And for the sake of this discussion, the amount of time doesn't matter. We can call it weeks, we can call it months. If we look at the experience of earlier countries, when the virus took hold in the population, it had a very rapid expansion through the population. I'll call this a spike in the number of cases. Very dramatic rise and seemingly as dramatic a fall after a period of time. If I could use our colleagues in Italy as an example, and they actually want me to use them as an example because they want the world to learn from their experience, this was a period of perhaps 10 days or two weeks, very rapid in northern Italy. Our goal is to prevent such a rapid spike because this dotted horizontal line illustrates the capacity of our healthcare system to deal with this infection. If you overwhelm the capacity of the healthcare system, you run into problems with the healthcare workforce, with hospital beds, with ICU beds, with ventilators, everything. So as the term has been used, we want to flatten the curve. And that is this blue curve here. All of the measures that the governor has described are called mitigation measures. We are following in Vermont a parallel course, a mitigation in containers. Containment is the work of all of the public health personnel following the Vermonters I've described and instructing others about what to do when they return from travel, etc. Mitigation are all the strategies you've just heard about how this may impact our daily lives in the coming weeks. It's believed that with these mitigation strategies, in effect, you flatten that curve, you may prolong the duration of the virus and the population, but the healthcare system can take care of everybody and not be extraordinarily stressed in an acute period of time. That's the whole purpose of what you've been hearing about, protecting as many people as possible over time. So what every one of us can do and what we will do in our individual actions will certainly matter when it comes to your health and the health of your loved ones, and especially how much we can limit the spread of germs and the impact of this pandemic in Vermont. It's important that everyone stay very informed of this fast-moving situation and take personal responsibility for following the Vermont and CDC recommendations and guidance. And as you've just heard, we're asking everyone to strictly follow new guidance and restrictions, which you can find regularly updated at the healthvermont.gov website. You've heard about hospitals and long-term care facility visitation policies. And obviously no one wants to introduce an infection in those settings. And I think intuitively, Vermonters understand that they shouldn't be attending those places in a state of illness and that the less interaction the public has, the more likely we will have healthy populations that don't have a virus introduced. We want to help the individuals who are housed in these long-term care settings in hospitals as well as the staff and workers. You've heard a lot about lab testing lately. And in order to identify people who are most at risk of illness, we're prioritizing lab testing. We've prioritized it for people with symptoms of disease, which we've told you include fever, cough, and shortness of breath as the most common symptoms. And we've encouraged individuals with those symptoms to call their health care provider not to physically go to their office unless instructed to do so. And we've avoided testing people who do not have COVID-19 symptoms. On the horizon in the very near future, the health care lab that has been doing all of the assays will be augmented by other labs who have been provided permission and certification to do this kind of testing as well. This is all very important work for what we call surveillance, so we can actually figure out where on this curve we are at a point in time and when certain strategies may need to be expanded. The government has provided you with a lot of information about what in public health terms we call social distancing. Social distancing measures include these cancellations of mass gatherings, adjustments to the way we work. We all know how disruptive these things can be from our normal day-to-day life. It seems that the most controversial public health recommendations surround considerations for school closures, and I'd like to spend a moment on that topic. I'll say from the outset, we, like all other states, do rely heavily on the recommendations of the Centers for Disease Control, as well as the available science, the reports from other countries' experiences, and consultation with school health experts. And speaking of school closure, that should be viewed as part of a broader suite of community mitigation strategies, useful at a time when there is significant community spread of infection. Meaning person-to-person spread without other risk factors. I'll be frank, much of this relies on mathematical modeling data, but it's not believed that very early in an outbreak, two-week short-duration closures can have an impact on the curve that I've shown you, or on medical outcomes. The advice is to time such closures slightly later in community spread, but before that spike in the curve would occur, and that a longer than two-week closure might be important at that time to be effective. Obviously, a longer closure would have significant implications for student academic support, for school-based meals and other services, and we must take into consideration something the Governor mentioned, the really undesired or unanticipated consequences of initiating school closures early, such as removing a family member from their ability to generate income and be part of the workforce so that they can care for their children or having grandparents care for children and they being the vulnerable population becoming ill from the virus. Thank you all for your attention. I'd like to now introduce our Commissioner for the Department of Disability, Aging and Independent Living, Monica Hutt. Good evening, everyone. What we know is that the population served by the Department of Disabilities, Aging and Independent Living, both older Vermonters and Vermonters with Disabilities who may have underlying health conditions are at higher risk for the COVID-19 infection. As the Department of Health has articulated so clearly, our primary goal is to slow the spread of COVID-19 and ensure that our health care systems can keep up with the demands for care to ensure the best outcomes for all Vermonters. Our focus at Dale remains on prevention. Because of the enhanced risk to those populations receiving long-term care, the Governor has announced through this executive order an approach to limit the risk and exposure to the virus for those more vulnerable populations. By restricting visitors to long-term care facilities, carefully screening all individuals entering those facilities and promoting strong prevention measures within facilities, we're doing all we can to keep vulnerable Vermonters and the staff that care for them safe. We realize that this response could be very distressing to family members and acknowledge that it may create some hardship. Please note that by doing this, we are prioritizing the health and safety of the people that you love. Dale has been working in lockstep with VDH in terms of guidance for long-term care, screening and recommended protocols. Communication is critical to ensuring that facilities and entities serving vulnerable Vermonters have the information they need to provide good care, make good decisions and adjust their practices according to the most up-to-date information and direction. We at Dale are pushing out all the information we receive from VDH and the Centers for Disease Control to all our long-term care providers. It's important to remember that in addition to facilities, we have vulnerable Vermonters receiving critical services in their own homes and communities across the state. It's important that all those providers that are offering services to vulnerable Vermonters have the information they need to keep themselves and others safe. So in addition to long-term care facilities, those networks receiving information from Dale include our designated agencies, area agencies on aging, home health agencies, adult day programs, senior centers and meal sites. We are particularly grateful to the Health Department for all their work and for access to their expertise. Dr. Levine made himself available for a Q&A call with our long-term care facilities this week and we'll be having the same kind of call with home health providers next week. We're posting the Q&A information on our website. We have a Dale staff person in the Health Operations Center starting on Monday full-time to represent the needs of older Vermonters and Vermonters with disabilities. Additionally, we're working diligently to answer questions as they come up. As information changes and strategies evolve, we're available to field calls and respond to questions even if we need to consult with others to get the best information possible. In response to questions and concerns from our provider community, we're updating information and developing new guidance regularly. As we develop new guidance, it's available to all on that website. We are committed 100% to doing everything we can to ensure the health and safety of our most vulnerable Vermonters. We ask that everybody in Vermont join us in this effort. If you're sick, stay home. Forgo in-person visits to friends and family members who may be vulnerable. Call or FaceTime them. Follow basic precautions and encourage others to do so. By taking personal responsibility for your actions, you can keep yourself safe and keep vulnerable Vermonters safe. Finally, I want to express my sincere gratitude to the thousands of long-term care staff and community providers on the ground right now taking care of our most vulnerable populations. They are doing extraordinary, critical work, and I can't express enough my admiration for their no-nonsense common-sense approach to getting the job done and serving Vermonters. And now I'd like to introduce and ask to come forward Director Erika Borneman from Vermont Emergency Management. Good evening. The State Emergency Operations Center was activated on Wednesday at the direction of Governor Scott to work closely with the Department of Health Operations Center to coordinate the response to what is now the COVID-19 pandemic. That work has involved the implementation of community mitigation measures just like these that we are announcing tonight. These new measures have built into our operations and we are working with agencies to ensure questions are answered about that implementation. We are also working to communicate the details of the executive order to the public in a simple and effective way that's easy for everyone to understand. We communicated with emergency management directors and local officials today and will continue to do so as these are implemented. We also are in regular communications with the first responders throughout Vermont and will continue to do so as well. The State Emergency Operations Center will be activated throughout the weekend and until further notice to ensure these questions are answered and provide further guidance as necessary. We continue to urge Vermonters to work with their local officials and emergency services and emergency management directors now and in the coming days and we will continue to work to support them and provide assistance from the spectrum of state government. Thank you. At this point we'd be happy to try and answer any questions you might have. You mentioned something about the second positive information. It's like a lot of information was going to come out in that case. Can you explain that a little bit? I wasn't saying information. I was saying the amount of contact tracing and the increase in the number of individuals in Vermont that we will be working closely with. I mean because of contact with vision check. Yes, in that vein of thinking. We are very confident that everyone will hear to this. I know we're a small community in Vermont and we're hopeful that they'll take this as a measure to protect us in the long run. I'm not sure there'll be sanctions but we will provide the opportunity to educate them as to the policy and then hope they do the right thing. And you said this applies to non-essential social and recreational gatherings. Is there going to be a more specific definition of what exactly that would include? Well any gatherings with 250 people or more. Sure. What about like base lodges in this area? Well again you know yeah it would apply to them as well. We are hoping that they will again produce some strategies that might provide for that social isolation maybe on their lifts and so forth. For instance they wouldn't have to put four on a quad. They could put two. They could limit the number of people getting on the lift. I think there are strategies that could be put into place and we're hoping that they will comply and help us with this. How do you define breaks involved? Let me ask my question please. There are many other settings cafeterias in which more than 250 students will be present at one time. Is there any guidance being given to schools about that sort of thing? Well again we're basing everything on the science and we're trying to determine how we can best help the most vulnerable, the aging population. And we believe this is the right strategy. Obviously this is different work settings and so forth are different than recreational events and social gatherings. So a school is not considered a a social gathering point, a non-essential social gathering point. Could you say young people are not serious illness but they may well because of that the ideal carriers. Is that taken into consideration? Absolutely everything is taken into consideration. That's why I had said this could change. We don't know how long this strategy will be implemented. We will take this day by day and as Dr. Levine had said if we do this too early it might not be helpful. And so and as well I mean we have to consider the kids themselves and where they're going not everyone has a home to go to. Some their their most the best environment for them is the school and that's where they get the most attention, that's where they get fed and that's where they get the most social interaction with their peers. Otherwise they go home they could possibly go home to no one and that wouldn't be a good situation either. So we have to balance this out and again understand that we're flexible, we're going to watch the data, we're going to work with the superintendents and communities and to underscore if in the executive order as well the school districts themselves can close their schools. We will work with them if they feel it's necessary. We may see that there's an outbreak in a certain area where we may need to close the schools and if a parent decides that they are no longer comfortable with their child being in the school we are providing for them to take them out of school without any repercussions to the student and provide for any instruction we can at that point. So we want to make sure that we're doing all we can to help them. At what point would the administration step in and say schools or schools in this area of the state have to close? How serious would the outbreak have to come? Well I'm not sure. I mean again we'll rely on the data and the science and we're monitoring that daily as you know. Some of the tracing that we're doing will lead us to that possibly. But again it's a very fluid situation and we'll be prepared to act in a very quick fashion if it appears that it'd be beneficial to do so. Commissioner, you mentioned mathematical modeling. Is there any mathematical modeling that forecasks the projection rate of the model? You know it's interesting because we have an aging demographic. I've talked about this a lot. I'm fearful that with our aging demographic that we may be more vulnerable than other states and that's why I put these measures into place. Why I've asked the Labor Department as well as the Department of Financial Regulation, the commissioners involved to do some modeling for us and let's do let's take the data and see where we're going with this. So we're fully prepared. Don't have that data at my disposal at this point. I know they've been working on it and whether they have it now or not I'm not sure but I haven't seen it yet. As the CDC provided any state level forecasting related to compression rates? No. What's the capacity of our hospital system to treat serious cases? How many ICU beds do we have? How many are occupied right now? I mean what's the capacity of this case? Yeah again you might be able to somebody else might be the answer I'd be able to answer this but but there's some of the questions so some of the questions that I had as well we want to collect as much data as we can. Secretary Smith? Today we have 236 available beds that we could do surge capacity add another 50 onto that surge capacity to to around roughly around 283 beds that's with no mitigation strategy for example doubling up size no calling in other hospitals from out of state using other hospitals just the capacity that we have today those beds are empty right now. We probably have the update data as of now. Today we are testing at least 110 individual patients and those results are on the precipice of being reported out and I said we've already tested in the short week to week and a half that the state could do testing because we were allowed to by the CDC we've tested 140 the majority of which are negative and in addition there were five Vermonters tested by New Hampshire related to the Dartmouth-Hitchcock episode and positive case they had there and all five Vermonters were negative. You said that you've set in your remarks that in China and Italy the response was too slow and that helped to spread. I've heard on multiple occasions that basically the U.S. is on Italy's track the two weeks behind Italy. Does that mean that we have been too slow? Not necessarily just Vermonters but the whole country? Yeah I think in some respects we have to be honest with ourselves so we are learning more every day and we probably should have advanced earlier than this but I again I would say Vermont this might be a little bit unique we've had only two positive cases at this point in time and and so it hasn't hit us yet but it's only a matter of time before it does and we feel we're positioning ourselves well to to mitigate this in the future. I'm going to have our commissioner of labor come forward Mike Harrington I thought it was important I mean obviously this could be a burden if we're asking people to stay home for 14 days or there have loved ones or family that where they have to take care of them so we wanted to find a way to to accommodate them we think we found a way with the legislature's help and Commissioner Harrington if you could respond. Sure thank you Governor so I'll have you repeat the question just so I make sure I answer all parts. There's a component of this executive order that authorizes some new allowances for the UI fund for workers who affected by COVID-19 Can you isolate exactly what's going to be allowed now that was not previously mentioned? Yeah so right now the the biggest change or the biggest piece of information is that people who are impacted by this and told to self-isolate or to quarantine they will be eligible for benefits and so we will see that we will treat that as a temporarily temporary layoff and that for that isolation period they'll be eligible for benefits that is the biggest piece right now that we will be putting into place over the weekend and for next week. How long does the state of emergency go from effect the census right and next week I believe it is we start door-to-door. Yeah that's a great question and I don't have the answer to that at this point in time but we'll have to contemplate that as we move forward obviously the census is important but we don't want to put people at risk either. What is your response to Trump's emergency declaration today? Do you think it goes far enough and how do we expect it to help us in terms of funding? Yeah unfortunately I did not see his address I did hear that there was a declaration I think he made it at three or four o'clock but that's all I know about it. I will say I've been in contact with Congressman Welch he would hope to be here tonight to actually talk about the economic passage or economic package that they had hoped to pass today. He texts me before I came down and said he was not coming they were on standby they had not made a deal at this point but he hoped that it was going to be something that would be obviously positive for Vermont in our country so I'm hoping as well that they come through some agreement for the welfare of US citizens. It's been expanded in terms of the original CDC guidance was only hospitalized patients and we took that restriction away from the get-go and allowed people who are thinking they have the condition but are in their home and not requiring hospitalization to be tested. I have to say that public health one of its major core duties is surveillance so that we know where we are on that curve and our ability to do that is going to be very much expanded you know in the next several days based on our testing capacity based on capacity that gets expanded into the private sector and our major medical center can then perform as well so I believe we'll have a lot more data and again be very nimble with that data and be able to tell do we have regional expansion do we have statewide expansion are we holding steady whatever the case and make the decisions we need to make. Right it's not been expanded to someone who has no symptoms and I would make the we as a country rather than you single out the state because that's that's been the biggest criticism of the country at this point in time as you point out you don't want to have situations like happened in Italy happen here and I think we're sort of at that pivot point right now where we can try to intervene in the testing protocol as well as in our knowledge about cases in the state and make better decisions. Would it be wise to expand the testing protocol to include people in senior homes people who work in senior homes other highly at risk people out of Washington state and major focus of an outbreak. Right I don't think we would do just blind testing though of places that have no reported cases no reported illness I'd rather us be more strategic in that matter but I do believe we have plenty of people who don't have symptoms who have had an exposure history and I think we should continue to focus on that population because that population may be the canary in the mind so to speak that will help us understand how rapidly or not rapidly this virus may take hold within our borders or within the country in general. The availability of tests has not prevented us from testing appropriate people and I think just the fact that 110 are being tested today is testimony to that that far surpasses any day that we've had yet to date. We've made sure to make this a clinical judgment of the clinician that the patient has been connected with so I can't speak to what would happen at that juncture. No I think it's objectivity to be honest I think physician armed with the knowledge of what their patient is complaining about what they know about their patient's history and what they know about their risk factor history for this virus provides tremendous objectivity and we rely on their clinical judgment in that case. The only way it has is if people have absolutely zero symptoms. But I mean if you had significantly more capacity to test people tomorrow would you begin testing more people than you are right now? I don't believe the 110 involves a lot of people who were denied the opportunity to be tested today. The question is if you had significantly more testing capacity would you be tested? We would be testing people who we judged were appropriate for testing just like we are now. They are presenting to the health care system as opposed to the health department and we are relying on the clinical judgment of the clinician with our guidance. If people can be symptomatic for four or 14 days before they start to exhibit symptoms if they exhibit symptoms then waiting until they are sick seems to be understood. You know I've thought a lot about this as well and we never know when we become infected. We could test someone every single day and they could still get infected the next day with one doorknob let's say or coming in contact with someone who has it. So it would be it would stress the system. We have to again prioritize. We don't have an unlimited number of tests. If we did maybe we would test more but we don't and we have to be honest about that that we have we're doing all we can at this point in time. We're monitoring the number of tests we have available. We're hoping to to get more in the future. We've heard from the federal government that they're producing more. So we want to make sure that we keep up with what we're doing today first. But there are some talks about private companies coming forward with accelerated tests and if they can do that and we can get them in Vermont I'm sure that some people would like to rule that out in terms of whether they have it or not. But again I would stress that that could change from day to day. Any data points yet that you could look to that will allow you to be able to quantify the effect on Vermont? Well again we're that's what I've tasked our Department of Financial Regulation measure P check with trying to work with others labor and tax and so forth to try and determine what this is going to mean to us because we know if we can get the numbers and the data and it's just math at that point and at least have an idea but I don't know at this point we just talked about this about 8.30 or 9 last night at a meeting and tasked them with that at that point so I don't think we've come to any conclusions but we hope to very soon and that way we can go and make the case of the the federal delegation about what our needs what we think our needs would be which might be typical of others or maybe maybe not but but we'll come up with something that that makes sense. As it relates to financial resources being put toward COVID-19 it looks like the only thing in this emergency order just based on a brief scan is reallocation of resources at EPS that was this with contract tracing at the Department of Health. Are there any other new spending or reallocation measures that you are planning as part of this? Yeah we're going to have to reassess daily I mean we're we're keeping track we did get some some money federal money as well that's been passed on to us here in Vermont but we know that's not going to be enough so we have to continue to assess the need but we're okay right now and again working with the the legislature they've they've been willing to to do whatever they can to help and assist along the way so between the federal delegation and the legislative delegation we'll figure this out but we have to have the math first we have to figure out what our needs are before we move forward but so I used to say that we know this will grow and this is going to have an effect on our economy here in Vermont. We're hearing about the shortage of personal protective equipment for health care providers masks gloves that sort of thing I guess where are stockpiles right now sort of number-wise and what's being done on that. So the state emergency operations center has been working closely with the health operations center to inventory our statewide cash of masks and personal protective equipment so we do have an understanding of that the department of health has also submitted an additional request to the the strategic national stockpile for additional PPE and we're still waiting to hear about the timing on the delivery of that and still working on the the prioritization of that personal protective equipment. I don't have the numbers in front of me because that that's coming pretty quickly. Well again we'll continue to reassess as time moves on that's why it's critical we do all we can first to put into place mitigation efforts but we know it could impact our workforce we already have a shortage in our workforce and certainly amongst our staff and and so forth we have we have continuity continuity of operations plans in place for every department and agency so we'll we'll put those into place and enact upon them as necessary. That would be a hospital. No. Dr. Brum said said there has been no change. Yeah the hoarding that I'm seeing in the panic that's ensuing is concerning to me and I think we all have to to think about what our real needs are. If you look out you know we we hear a lot of people wanting to stockpile and there's certain products I don't understand why they're stockpiling but they are. If we look out over what your needs are over the next three to four weeks that's all you need to have at your disposal at this point in time. We have a very compassionate state and we come together and give when when it's needed and and I would hope the Vermonters would would not try to stockpile things they don't need that others do need. So let's keep in mind there will one community and but I am concerned about that but I've been told that they will be restocking and there are more products coming but this isn't you know this is unusual or this is not uncommon across the country we're seeing it everywhere. Yeah I mean we've Suzanne might be able to talk about this Secretary Young but we're asking that they work with the agency's departments to put together a plan and and move forward on this would you be the little elaborate on this. Sure Governor at your direction we have worked with the Department of Human Resources to put two things in place today. One is a ban on non-essential out-of-state travel and the other is to encourage teleworking we already have a telework policy for the state of Vermont employees what we are hoping to do is be a little more generous with that be a little more aggressive with that so we can start to lower the volume of of state employees and some of our office buildings to the extent that we can so we are putting out some telework guidelines and working with our human resource managers in our cabinet to encourage that as an option. Well I don't think you know with all due respect that they're any more special than any other Vermonter and I know that they might be at risk but there are others that are at risk as well and and no one that I know of asked for a test or was experiencing any of the conditions that would warrant a test. I'm sharing your evaluation or specialness but they are a unique group and that they are dispersed to all parts of the state from a central location that's known to be an incubator of disease. Regardless of their specialness isn't that a concern? Again I'm not sure that I've heard of anyone that had experienced any of the conditions or symptoms that would warrant a test and if they had they could have come forward and we would have tested. Lawmakers are of course working on a package of bills which would be short-term economic fix for COVID-19. I guess what's the role of your administration sort of in those talks and how are you working with lawmakers? Yeah we're trying to work hand in hand with them obviously they want to help and we would like their expertise we may need them in certain cases but we're waiting again for the economic package from the federal government what this means with their declaration if they're successful with the house and I'm not sure about the senate at that point but I'm not sure what their economic package is either. At this point in time we are okay certainly we're fluid we are our budget is good we're still getting revenue in we're fine it's much like consider this like Irene when when Irene hit we were able to take advantage of a lot of federal money in the months and years to come I would imagine that this is like our Irene and we'll be able to to make it through initially but we'll need some federal help in the in the coming months but I don't want to do anything legislatively that would would hurt in terms of the federal package yeah it may be all the above certainly we would we would be heavily involved in that we would have to prepare for that but we have the ability to do so being your your last press conference on Sunday now we're Friday I know it'll take time for some of this data to come in but how is the process in terms of transparency I've got to work between the administration the health department letting the public know about yeah I'm sure you've been to healthvermont.gov gives up to date information every single day and that's that's been distributed on a daily basis that's your best resource at this point in time if you have any questions about that any Vermonter should go to that website because it answers a lot of questions and it gives all the up-to-date information that we would have but if there's more information you need obviously you also we're just a phone call away is there a need for more frequent briefings as needed I would say as needed we will provide them so just as the data comes in it will be put out it already is yeah it has been for quite some time earlier you mentioned that we might be turning to private companies to sort of administer some of these tests or go to the results what sort of vetting are these companies yeah I this is on a on a federal level and I know that there are some large companies that I think in New York I've heard that there are companies that are coming forward they'd have to be approved by the CDC or someone FDA and before they're put into use but I've heard of them I don't have any details about them anything else you can offer with that Dr. Bromstead offered earlier that the Mayo Clinic is going to be contracted with the Medical Center to provide testing and they appear to have capacity meaning sufficient testing materials kits reagents etc to do the testing so we'll have at these two sites then the public health lab and the medical center have you basically done depending on or following the guidance of the federal government yeah so as I said the minute we were allowed to do testing we said restricting that to the only hospitalized population doesn't really allow us to do our public health surveillance function and get a handle on where is this virus in our population so we changed that immediately so I don't want to say the federal guidance is poor because the federal guidance has been excellent from the CDC however we've been able to be independent as well and come to strategic decisions that make sense for the state actually we work very closely with a lot of people at UVM and I'm at the point now where I'm having once-to-twice weekly phone calls with many kinds of audiences which include many people who are quite knowledgeable Secretary Smith sure there has there's been great focus with the Vermont prisons including the various issues dealing with supplies and social distancing for example today we've instituted video visitation to make sure that that the people that are coming to our prisons are segregated from our prison population we also are as you probably know when a prisoner is comes into our custody there is a screening process that's take takes place now that screening process has been expanded to include the questions dealing with COVID-19 as we move forward we've also increased our supply chain in terms of days on hand in terms of food medical supplies other supplies in in there as well and we've been having daily conference calls with the commissioner as well his superintendents on anything else that we can do as we move forward to not just state agencies not just public entities like schools but also other places where the public gathers I had I had the same thought when I started seeing all the empty shelves on on the news and so I was concerned I've asked what this this declaration the state declaration emergency declaration would do whether that would free up any resources from let's say any federal institutions that might have stockpiles of certain products so I haven't received the answer back on that but I've asked the question understanding the upper years partially to try to make sure the health care system doesn't get overwhelmed has there been any thought put to what would happen if hospitals do start to fill up any you know places to put additional patients or additional numbers yeah I and I will let others speak to this but there is a emergency plan that can be implemented if that happens and and probably dr brosek could really speak to this being from a being from a hospital but all the hospitals have medical surge plans and a part of that is things like canceling elective surgeries and non-essential procedures to make room for more critical patients and it's really the medical surge system in the state is a tiered surge approach where hospitals have plans for surge within their walls or even without their walls and then there are other surge sites in a real catastrophic event that we would have to bring in some additional assistance to run but there are sites identified for that as well thanks that's a great answer what I'll add is there's another piece of this for us and that's the people capacity to take care of anybody that needs our services so we've done a lot of work to make sure that we have alternative staffing plans that we can have sharing of staff among the hospitals and I just heard today that normally for our physicians they go three deep for an on-call schedule so that if the first two people go down you've got a third we've gone four deep so we're really obviously taking this incredibly seriously and working with the with the state to make sure that we have the capacity obviously the best thing is is Dr. Labine and the governor have said to make sure that we blunt that that curve so we've got a course in travel recommendations from from Europe but what about from areas within the U.S. that have higher cases of COVID-19 in Florida New York Pennsylvania is there any sort of recommendation there well certainly what we're doing with the non-essential travel for state employees is something to keep that in mind and recognize that there may be some coming in from other states it's not just from other countries or where people have been before they get to the other states so that's why we implemented that that procedure and and we're hoping that businesses will follow suit as well because anything we can do to reduce and restrict this will be better off in the long run yeah it's a great question I mean we're seeing it in the United States thus far as well there are some states who have no who don't have any cases that we know of and many that have had outbreaks so we'll probably won't know why until much less later right now it's just to really take care of the problem at the end in doing the travel self-quarantining from people traveling from back from Europe that's based on President Trump's action yes I mean it's in the Centers for Disease Control using data tells us that doesn't include that was the president's decision I don't know that for a fact I have to look at the map because his the president's directive had to do with travel to the countries um we use is travelers coming home or he enacted the travel ban it was the partial travel ban for the entire continent except for Great Britain um is your quarantine asking people to self-quarantine 14 days after coming back from Europe is that based on the president's so direction we are anytime someone is now coming back from Europe we are notified through a special CDC program called epi x that that traveler is about to arrive in Vermont so we can initiate conversation with them and understand what their needs are and what they should do in terms of their day-to-day existence so we're relying on that totally to know that they've arrived here and what to do so I'm presuming what we're getting is science-based because it's on the CDC's program it's not politically biased information which gets back to his question which is you know travelers who come back to Vermont from Washington state or Florida maybe a higher risk than travelers coming back from France um but we're not doing anything about people flying back from Seattle correct as a country I'll uh I'll take one more question yeah I just wanted to check uh our neighbor to the north um Quebec also just amongst the state of emergency there I was just curious if being such a fourth trade partner as well as a lot of um traffic in between Vermont and Quebec has there been contact with the Quebec foreign minister? I I have not uh had any contact with them at this point All right I have no idea it's nothing that I've heard anything about okay thank you very much appreciate you all coming in thank you


And it turns out that when you're doing spellcheck, it would really help if you check all the files. So sorry about the introducing thing. Oh well. Okay, so we're going to talk about a lot of stuff. One of the most important things that we wanted to highlight is a new way that we are keeping track of connection state as we're talking to remote systems. So that's what the Scatter Connect is all about. And you'll see that in detail. In fact, that's the first thing that we're going to hit off. Then we're going to talk a little bit about the tool that we're releasing today. We actually have released it previously, but this new version has somewhere around 25,000 lines of code change. So it's definitely different. And then we're going to demonstrate some of what it can do. So I'm Robert Lee. I do stuff with a couple of companies. And this is Jack, and we also have Anthony here in the audience. We've been working really hard on this stuff, so hopefully you'll be able to appreciate some of what we've been working on. Okay, so nice and simple. You've all seen a TCP 3-way handshake before. The concept is simple. You're trying to initiate a connection.  You expect a SIN act if it's open. You acknowledge it, and then your connection is open. It's actually two one-way connections, but whatever. I'm not sure if you can see this, but I'll visually walk you through what's happening here. The very first process, the master control on the far left is what's going to keep track of all the state connections. In this particular example, we are doing a TCP port 80 full connection with a remote host. That's the one on the far right with the little globe thing. What happens is the master control tells the first sender, the one on the very top, that we are trying to connect to that remote network. And then the sender will actually create a packet spoofing its source IP address to come from the receiver. If you can see it, the receiver machine is the one on the far bottom. When the remote host, the <IP_ADDRESS> receives that SIN packet, it responds to the SIN packet based on the IP address that it thought it came from. So that's how the receiver receives it. Once the receiver receives the SIN act, it sends the meta information back to the master control thread, who then schedules an acknowledgement to be sent through an immediate sender. So that's the one in the middle. So the acknowledgement is then sent back to <IP_ADDRESS> and the three-way handshake is complete. Now I know this looks pretty crazy and you're probably asking yourself right now, why would you do it this way? And I'm glad you asked that question. We'll answer that later. But the important part here is that you understand that at this point we have taken the TCP IP stack and moved it out of kernel space and essentially into user land space. And we've made it so that you can have a three-way handshake amongst a cluster of machines. But to the end machine on the right-hand side, it's all a normal connection to him. Once his handshake is complete, we can also then send arbitrary payload-specific stuff. So if you wanted to do a get request or any arbitrary payload can be sent at that point. Important stuff. Okay, so I just explained all this, but I'll go through it one more time just for clarity. The first process again is the unicorn scan main thread. The second process is the sender, that's unison. That's the one that actually symbols the packets. And again, we have the concept of batch sender and immediate sender. The batch sender, it turns out, is the one that you give large work units to. So you can say, I want to scan this slash 16 network and I'm looking to do these ports. And you tell it what speed to do it, et cetera, et cetera. So it just goes out and sends a bazillion send packets. The listener process, the one on the bottom, unilisten, is the one that's collecting all the information that comes back to it and sending all the metadata back to the main unicorn scan thread. And then the immediate mode is the one that completes the three-way handshake. They're not actually threads, by the way, they're actually processes. We just call them threads. Because we're silly like that. Okay, cool. I've talked about all this. Is that part clear at all? All right, cool. We did it twice. Now we're going to talk about some problems that we were banging our heads against. By the way, all we do with the companies is we do a lot of security testing. Really big networks. And we've been eating a lot of dirt with tools that didn't do what we needed to do. So that's basically why we did this. But one of the first problems that we ran into is the whole UDP thing. Just to summarize, when you're doing UDP scanning traditionally, you're sending a UDP probe with a blank datagram and you're hoping that the machine on the other side will send you an ICMP packet. So if the ports close, you'll know. And you basically, the ones that you don't get the message back from, you assume that it's open. The problem is it turns out people are actually using firewalls. And so when you're doing testing from a remote perspective, if you can't get on the ICMP message coming back to you, then it's kind of a useless process. That's one of the problems. The other problem is you can't go really fast, even with the machine sitting next to you and there's no filtering going on, because ICMP messages are rate limited.  So what we ended up doing as a quick and dirty workaround is we were taking the individual programs like Big or SNMP Walk, and we were scripting it to send the actual client probes.  But we'll come back to that. Another problem we had with our TCP scanning is that it was a large effort to do what we really wanted to do, which is actually talk to the service, the service that we wanted to interact with. So, you know, typically if you're scanning like a slash 8, you have to, you know, just based on the resource limitations on your side alone, usually you'll have to do a send scan first and keep track of which ports are open. And then on the open ports, you can go back and actually do a banner grab. And then, you know, as a third step, you can start interacting with the remote service. You can use, you know, AMAP or manual testing or whatever. But that's, it's difficult, especially if you're testing a dynamic network that's really large because by the time you're done with your first pass, things have changed. Because it turns out that these networks are getting really big, especially now that we're starting to move into IPv6 stuff. But the tools that we're using today are not really useful if you're testing 65,000 to 4 billion machines at a time. And even if you were playing with set and knock with the text output, it's really overwhelming. Really overwhelming. Okay, so more problems that we have with, you know, any vulnerability scanner that we've played with is that they take their, the probes that they do don't really share the information in a way that makes a lot of sense. So, you know, one of our favorite examples to make fun of is the situation where some sort of device in the middle is altering the TCP IP stack enough to where your operating system probe comes back and says, hey, it's an Amiga Miami OS machine.  But anyhow, then the second probe that actually connects to TCP Port 80 and does a banner grab will show you that it's an IIS-5 machine.   So, you know, that's fine. If you're testing one machine, you can go through the false positives and figure out what's really going on. But imagine doing this times four billion machines. Not really useful. So to be useful in the future, these modules are going to need to share the information more intelligently. So more problems that we're having is with the timing. In order to more efficiently use the resources that you have available to you, we need to be able to control how fast we're sending. And, you know, I'll give you the two examples in the open source space. We have, you know, the ScanRan tool that provided a minus B option for bandwidth. But, you know, I probably just haven't played with it enough. But in my experience, anything over like 5K to 10K, I was noticing a lot of packet loss and it also became bursty. And so it didn't really work out. Mostly because of the way that the sleep timer was working and the get time of day counter was working.  But even in insane mode, it doesn't scale to high speeds. And there's a lot of parallelization going on there that's kind of tricking you into thinking that it's doing more than it is. But the timing of how fast you can go is still greatly affected by the machines that you're probing. To ScanRan's, or Nmap's credit, rather, we actually got Nmap to send out more packets per second than we did to ScanRan. Oh, just some raw numbers real quick. With our tool at this point on a standard copper gigabit card, we're successful at sending over 160,000 packets per second reliably. And we're working with some FPGA people to get that in the 500,000 to million packet per second range. But we're still working on that. That's pie in the sky at this point. But from an average laptop, you can expect anywhere from 17,000 to 70,000 packets per second being pretty reliable to send. But you're still going to want to break it up into different processes and I'll show you why. Some more mindset. Okay, so now we've told you about some problems. What are we going to do to solve these problems? Well, from the get-go, we were designing this with scalability in mind. I talked about efficient use of resources and I'm going to give you a bus analogy. Basically, I watched Sesame Street as a kid and they were trying to pollute our minds with this political message that buses are better than Ferraris because they're more efficient. But in the example, they had 100 kids on the left and 100 kids on the right and they had like three small sports cars ferreting people from one site to another site. They gave them like a 20-minute head start and then they had the other 100 kids all jump a one bus and just go. Let me break it down technically now. When you use an individual machine, there's only so fast that you can reliably send and receive packets. So even if you could get in-map or scan-ran to go at 70,000 packets per second, you're not going to have any room left to receive messages. And so you're going to have to throw that back to something more reasonable around the 35,000, 30,000 packet per second range if you actually want to get the messages to come back to you. So that's not going to be an efficient use of even a single machine, but with scalability in mind, we know that we need to be able to have one logical working scanning system that can scale beyond the limitations of any single resource, any single machine. So it's not the same as just going faster. I quoted some really ridiculous packet per second rates from a single machine, but obviously if you go that fast to any network that we're playing with today, you're going to obliterate it.  By the way, funny, if any Juniper people are listening, I don't get that protection that completely dices your CPU is... Well, I don't understand that at all. Anyhow, moving on. Okay, accuracy. If you're collecting a lot of information and it's a lot of invalid information, then you're wasting your time. This is my problem with those log aggregation systems where you have the garbage-in-garbage-out model. If you can't trust the information, it's kind of worthless. One of the problems that we have with a lot of tools is they try to be smarter than is programmically possible. Basically, I think tools should introduce stimulus and record response to let the humans analyze. Computers are good at doing the tedious automated parts. Humans are good at thinking, and we shouldn't really mix the two more than we have to. Flexibility. At this point with this framework, and you'll see examples of this, any stimulus that you want to introduce to the remote side. Currently, we support TCP and UDP, but we're going to support ICMP and pretty much anything else that you can do over IP. And then, depending on which contracts happen, we're also going to support a lot of other protocols. But if you have the hardware and you need to write something to the hardware, we're going to be able to support it in the future. And then security. It should go without saying, but it doesn't really. We tried to put some formal thought into this, and we actually selected one of the IDS protection profiles from the common criteria to build our implementation of the scanner against. And we also provide a sample security policy for use with SD Linux. And yeah, that was at least in the design phase when we considered that. We don't actually have the entire protection profile implemented, but we designed it so that we could when we actually release one. And obviously, with an open source tool, we don't have $5 million to formally go through the process. But if anyone here wants to sponsor that, we would love it. Cool. All right. Yeah, so what does it do? Right. People have been calling it a port scanner, and we're hopeful that after today they'll see that it's more than that. But currently, it can do TCP and UDP port scanning. It can do stateless banner grabbing active remote OS application, blah, blah, blah. It can do stuff. And some more interesting things is that instead of just sending a non-protocol-specific probe, we actually can send the same thing that a normal client would do. So let's say that you're trying to find DNS servers. Instead of just sending a blank datagram to UDP port 53, we support a number of different payloads out of the default config file. One of them can ask it for local hosts. One of them can do a chaos, you know, if you're talking about a buying server and you're trying to find what version it is. But now we're doing just-in-time processing to where you can stuff things in there that you need to calculate on the fly. So for like Dan Bernstein's DNS server, we put one in there that will ask it for the IP address that you're talking to. So it can stuff the IP that it's talking to in there on the fly. But any other thing that you need to calculate right before creating the packet that also works. And then for TCP, it's going to become more important nowadays as well because a lot of the networks that we're testing have those things that complete the three-way handshake on behalf of the devices that are behind it. And so you're going to find situations where every single port on every single IP on the remote network come back as open. And you need to be able to send protocol-specific payloads so you can figure out which ones are tricking you. Then one of the other things that we put in there is a metamorphic shellcode encoder to make it so that when you are delivering other types of payloads, then you can make it so that they are not easily fingerprintable. So not only is the knob sled metamorphic, but the encoder itself is as well. And so basically there's nothing to write a signature for at this point. We'll see. Okay, and then we also can log to PCAP files and everything we do. And I just can't stress this enough. Everything we're doing from this point forward has hooks to talk to relational databases on the back end because you cannot process this amount of data without one. Okay, so now I'm going to pass the mic over to Jack. All right, how are we doing, everyone? Are we falling asleep yet? I guess not. Okay, well, there's three processes. I guess it's pretty obvious what they do. Hopefully we're going to talk about them. Hopefully we're going to actually leave some time for some demos that we want to do. Okay, one of the things that's different is that we try and use, it's kind of a trivial algorithm, to actually carry information inside the sequence number, but the important part is that it's not one way. So in other words, if we used MD5 and then locked off part of it, that would be one way. So we can't do that because we actually need to do TCP connections. The problem is that we can actually have the sequence number send back a question to the master thread to figure out if that's correct or not. So we actually have to do that with a trivial algorithm. Anyway, and then the scatter connect is we basically send out the send packets, and then we gather on the send acts that we get back and act the connection and actually do whatever it is that the scanners can figure to do. Well, this is actually kind of long and drawn out. What do I have, like, 20 minutes left? Half hour? Okay. Well, I'll go through this. It's actually 30 steps to a symbol send scan. So basically, obviously, the user would invoke the scanner from the command line. It actually reads the configuration file first, and then the actual command line arguments are parsed at that point so that you can override the configuration file.  Anyways, the master process actually opens up binary modules through whatever facilities on the system. We actually use the LTDL interface now, so it's a bit more portable, and we actually have autocomf, too, which is pretty ugly. Anyways, the master process figures out whether or not you want it to run in a clustered mode, which is a command line argument, anyways. This is actually for a local scan, so we're just assuming that the master thread is actually going to fork children. And then it actually records some information about them, and it actually uses the IPC ghost through a Unix domain socket, so it's actually a little bit faster than it used to be. And then it actually uses signals to synchronize, which I believe is actually causing us problems portability-wise, so one of the problems with this release is that on certain machines, the signals disappear. And if we actually use reliable signals, it's not portable, so we might actually have to change that a bit, anyways. And then, actually, the important part is is that we can't make the assumption we know what the other processes do, because we don't know if we're in cluster mode. If we're in cluster mode, alls we know is an IP address and a port, and we don't know if it's going to send or listen. So we actually... That's an important piece right there. You don't have to have 16 machines to port scan one machine. You can do it all from one machine. You can't scale if you need to. Right. Okay. Anyways, they connect up and send some information. It's actually the listener that contains a lot of useful information early on, because it's the guy who has the IP address that matters. So actually, during that handshake, it sends the information back. Anyways. And then everyone syncs up with a ready message. And then the master actually does something called stirring, which actually would be doing the work unit allocation. And we actually have some stuff to do that, but it's kind of specific to us. I think in the general code, we actually don't have anything useful when it stirs, but if you actually had a big cluster and you wanted to actually distribute the send packets amongst like geographical areas, that's where you would put the code to do that so that you would actually have the shortest amount of hops between each sender. Okay. Anyways. Right. Then the listener fires up, and then we send the sender a batch work unit, which basically means it's not going to get interrupted. So hopefully, or if it's a batch sender anyways, we don't want to interrupt him. We don't want him to have to pull the IPC channel because it slows him down. Okay. And then the master just goes into a loop and when the sender finishes, it sends a work done, and then we actually check to see if it has more work, and if not, it just goes into a time-out state, but all, meanwhile, any important things that are happening, such as TCP connections, it'll actually respond to those wallets in its time-out state or actually throughout the entire scan. And then actually the master tells the sender and listener to quit and then the scan's done. Right. Okay. So the important part about all that nonsense is that a general stack that's inside of a kernel normally knows the remote target that it's going to talk to a remote host and port, but we don't. So we actually don't have that model. It's completely incompatible. So we actually just kind of redid some of the decisions inside the stack so that it would better fit a model where we don't know that information, which is the scatter stuff. Anyways, right. Okay. One of the important things is a lot of stacks will use like a hash table, but we can't actually do that because we don't actually know who's going to talk to us. A good example is if we scan a network that actually syn-acts packets, it'll fill up our state table, and if there's nothing behind that device, we'll have a bunch of dead entries in our connection table, and we'll probably guess the size of the hash table wrong by doing that.  We actually have to pick a data structure that responds better to unpredictable things like that, like a binary tree. Anyways. So, right. The point is that we can only have constant time lookups if we actually have a good guess of how many things we're going to talk to which we don't. So, obviously, we can't do that. And even though generally we won't fill the table, we don't really know what's going to happen. So, that's right. Anyways, even if we did have a hash table that was big enough, and this is just obviously for IP version 4, it would be quite a bit of RAM, actually, just to store the connection entries, not even the data. So, that's obviously not very realistic. It's just for the keys, anyway. Yeah, and, right, like I said, the reason why that's important is because as time goes on, we see more and more devices to compensate for, like, high-latency networks that will answer part of the three-way handshake to kind of offload that and keep the connection open for the high-latency device or improve the performance, or DDoS protection, or some obfuscated thing that people do to try and improve security, which I'm sure that works real well. Anyway. Yeah, so one of the design goals is we need to be able to withstand this sort of network because we're testing them. Anyway. Okay, yeah, and, right, I already said this, we use a red-black tree. One of the possible improvements that we're thinking of doing is actually most of the time that's probably an unnecessary data structure, we could probably use just a hash table and have constant time. So actually what we want to do is actually switch on the fly. If we actually pass a threshold and our table load goes too high, we can actually dump it and turn it into a binary tree on the fly and put most frequently used cash in front of that. I think it says it in here anyway. Not most recently used, by the way, because that would be a lot of connections closing. We actually need the top talkers, so you actually want it frequent, not recent. Okay. Anyway, here's some numbers about why we chose the algorithms that we did. And the point was, we're just trying to prove that our measurements are somewhat valid, we actually inline some assembly in here, you can see it here, or we actually read the timestamp counter on a Pentium CPU, and then we're actually going to overload our table and see what the performance numbers look like. And these numbers actually indicate clock ticks, and you can see here with the various load factors that our chained hash table turns quickly into a bunch of link lists and our red-black tree does not, which should not be much of a surprise anyways. But what's interesting about this actually is the amount of load that it took for the CPU to actually get a really expensive lookup, which is mainly due to the, I suppose, large cache on the CPU, I'm not really sure, but I figured at least that after a load of maybe four that it would start dropping off, but it actually took somewhere around 30 for the performance to just go really badly. So, right, I just, actually, I talked about that before, whoops. Right, but yeah, reset acts, obviously, we don't want to cache, and those are always going to be the most recent. So if we're going to do anything to improve the performance, we can't do that. We actually have to calculate how often certain connections are being used and cache those instead. Right. Okay, so here's some examples from the payload configuration stuff. It's just ASCII text. But we try to make it so that you could copy and paste stuff from like C and put it into the configuration file. But anyway, here's some example stuff. Obviously, UDP is a UDP payload. If you don't get that, then I guess this is not going to make any sense. And then the destination port is actually next, and then the source port being negative one is just a wild card to say whatever. And then one is interesting, that's a payload group. One of the things that you can do is you can chain include files together or configuration files together. So you can actually have a bunch of different things that are meant for different sorts of environments. Like, for example, if you want to scan for like Windows Trojans, which are pretty popular, you probably want to put them in their own payload group. And then you can just use the minus big G and then the numeric option for that payload group to kind of make that a little bit easier to do. And actually, we have now TCP payloads, which we didn't have before. And it's not still a real socket. It's kind of a trigger response mechanism, but we try and do some TCP stuff. But it turns out it's real hard because we actually emulate the operating system we're appearing to come from. So our stat code is non-trivial, unfortunately. But for right now, you can definitely do this sort of thing and test for example open relays. Anyway, and here's some screenshots. Can you guys even see what that says? No. I'm going to explain it. This is a module written in C that's actually a HTTP module. And it just does a head request. And it's probably like, I don't know, what is it, 47 lines apparently. But that's what it looks like. Okay, this is actually running a, I don't know, was this, yeah, this was actually a cluster that was connect scanning against yahoo.com on port 80. Yeah, and you can see that at the end here it's got some TCP statistics, which are interesting, but for each host you can actually see a banner. Now that's probably not terribly exciting. Here's probably some better contrast for you so you can understand why we did some of the things that we did. This is actually a screenshot of scanning a website. And it actually comes back and just says that those things are open. But we, and it took eight seconds or something too. But we can actually do the same thing and finish it in four seconds. I guess this really isn't erased. But the idea is, is if you see here you can see like five open ports coming back which is identical to what we saw before. But during the actual SIN scan we actually did the connection and grabbed the banner without actually initiating another connection. And we actually can tell what port really is open at high rates. Okay. Here we go. I can do these live, actually. We have internet. Would you rather see live demos? Because these things are kind of hard to read. Let's do some live stuff. Hang on. So what you see here is this first screen. Location is Casio 3. That's our master thread. Four is our... What is that? That is the listener. It's listening on the IP address that we're going to be sending from. This one's number five. This is actually the sender. So just to see what that is. I'm just making sure that they're live and well. And they appear to be. We're all here. Let me look inside this file real quick. Well, unfortunately, no. Maybe. Yeah. We'll try, but no. All bets are off if everything breaks. It's your fault. I assume that's better. You have to forgive me. We're pretty hard on our laptops and some of our keys are missing. Okay, so this first one, this is my command for me. Minus E, PGSQLDB just says for the output module, go ahead and dump everything to a database. I'm specifying the source IP to come from, although in cluster mode you don't really need to do that. Minus V means a little bit more verbose. W6 means emulate the Linux TCP-IP stack properties, mostly because that's the one that we've spent the most time with to make sure that the connect mode stuff is reliable. The minus Z is where we specify our drones. Right now, IPC channel is not protected. Normally if you're in a sensitive environment or an environment that has any type of malice you would want to protect that over an encrypted channel of some sort. I would have to recommend IPsec for that. Right. Actually tested that, it works pretty well. Minus big L5 is how long to wait after the batch sending is done. Minus little r9000 means we're going to send it at around 9000 packets per second. We actually go a little bit lower than whatever you specify, but we want to exceed 9000 packets per second. The <IP_ADDRESS> slash 16 just means go to that CIDR block and do 161 for the port, the desk port. Minus MU is UDP mode, and then minus big I is for patient people like me so you can see the data right away. Right. Of course you don't actually want to use minus big I to scan that matters because it's going to block on the master thread to write to the terminal which is fairly silly. And it's not doing what I want so I'm confused. It's the font man. There you go. Okay. So now these are some SNMP public community string version 1 machines that are responding. As you see we're doing a slash 16 network and we're done sending and we're just waiting the 5 second time out and then it's going to process the results and it will spit it back here pretty soon. We're actually I think repeating the scan three times so if you're wondering why it's just sitting there now it's actually sending different SNMP payloads to try and get everyone XOR. It's pretty ugly actually. We're actually trying to figure out a better algorithm that will favor randomizing more significant beds first but I actually haven't had time to get around to that just kind of XORs the random word. So that was a slash 16 for SNMP with multiple payloads but those are absolutely open because we sent a public community string request and it sent us back responses. The TTL is wrapping over thanks to our insane font size but if it wasn't you would be able to see the time to live value of the packet that's coming back to you so you can quickly as you're looking through it you can spot Windows Unix versus routing infrastructure but all of that went back to a database that we may be able to show you but I don't want to run out of time because we had some really cool fireworks at the end so more demo this one is SNTP this one's actually going to look for open relay servers in the same block and now we're actually doing three way handshakes with all those guys and we are using the SNTP port 25 we're absolutely connecting to them on port 25 and sending enough of a payload to elicit well basically what I did is I said coming from an e-mail address that I control sending to another e-mail address that I control and that way I can get bounces back telling me that I was a bad person or I can actually get the e-mail that I sent but then either way I still get the banner that we just talked to so if nothing else I know I now have version information in my database so I can search through and say show me all the send mail boxes one thing that's important too is that he had the immediate mode on but he was doing TCP connections so all the immediate things that needed to happen right away got stalled so some of the TCP connections will actually kind of fail it makes for a better demo but you wouldn't do that in production so we're going to connect to TCP port 80 and just hit all the people that are listening on port 80 and we'll do a get request against them okay so that was a pretty simple get request here that was a really small range let's look at that that's just a slash 30 that's yahoo with a slash 30 so piece of cake right okay see what else we had here oh I wanted to show you what was in the slide sorry this is end map with port 78 through 82 against dietsecurity.com all ports come back open which is what we expect because we have a stupid device in the middle that protects us from DDoS but here's with the unicorn scan where we can actually numerate what the protocol behind it looks like so you see here that even though the other ones came back as open in your database you can do a pretty simple select statement to throw away the garbage properties and sometimes you'll even get better information about the stack properties itself because once you get sent to the right application behind it there's going to be telltale signs that you're talking to a different device than the one that actually included through a handshake for you it's pretty easy at this point where you can actually it's kind of like the UDP situation all over again in the UDP again now we're sending real protocol payloads as opposed to just counting on ICP messages but now in TCP land we're actually sending real protocol information so we can get away from these devices that just synac everything now I think this is yeah this is just showing that we can do multiple payloads on one like 50 or so different different payloads we've got some DNS servers we've got some SNMP servers court 2367 don't know what that is 137 yeah all these are coming back to us now and I guess this is just showing off you know what it looks like to do multiple payloads so that was the easy stuff now comes the tricky part so hang on okay so I'm going to talk about what we're going to do now and hopefully it won't break because I was still writing code for it last night anyway what we do is we do basically a TCP connect scan and on port 80 and there's actually a CGI script that has a really dumb coding error in it we actually had some other stuff that we're going to do but political climate kind of got ugly so yeah we were going to release some fun stuff but unfortunately nobody wants to hear that sort of thing these days so we actually just reuse some other stuff we had but basically it does a three-way handshake and it actually generates the XOR encoder on the fly which is metamorphic and it actually does a two-stage exploit one of the problems that I had though was that I didn't have enough time to write the two-stage net BSD assembly so I cheated and used someone else's stuff and it doesn't work so that just goes to show me okay so right we generate a metamorphic first stage and we send the payload what we're supposed to want to do here is a patchy hands all the CGI scripts are writable file the script are on two that's the error logs so the first thing that we do in our shellcode is we truncate that we create a socket and connect back to a second stage server and we send it some information about the platform that we've just or the process that we've just compromised and we actually just send back a 32-bit word saying what predefined constant that was so and then the shellcode server sends back the length of the payload that we're going to send in the second stage and it does memap and opens up an anonymous memory region it affix address and it loads hacked binary into that area and jumps to the beginning of the file which then and I mentioned that the elf is hacked because we actually overwrote the first part of the elf header with some assembly to jump to the entry point so but the important point is that the second stage is written and see it's similar to the impurity stuff actually anyway and then we transfer control to the second stage code by jumping to the elf or entry point yeah so this is the part where I do it and it doesn't break okay this is the netBSD box okay as you can see this shellcode doesn't work so the only thing we can do is just look at port 4444 this is the second stage server and then we actually have two of these clients one of them actually uses end curses so it opens up new windows every time you get a shell it's kind of neat but we're having some terminal issues and we can't figure out end curses it's kind of above us so we don't have that yet what he's going to show you is the t-speed dump so you can see that it really is working and we're being told to hurry up so you've got like five seconds okay so here it goes hopefully it won't crash huh okay so we first have to grab an IP address that's not attached to the kernel as you can see some stuff went by here so connected to port 80 it sent our payload yeah so you can see here that the second stage shellcode server got it connected back it sent back the word that said it was this particular one was linux x86 the important part about that demo though is that after it got it connected to two different hosts and after it got the syn act back it did operating system detection and it sent a platform specific exploit to it on the fly it knew how to generate a platform specific exploit on the fly so that was actually pretty cool unfortunately we don't have time to explain in more detail but if you're interested come find us and you can actually watch DVDs and ASCII which was the entire point of doing that


Hi, I'm John Fellowes, Planning Minister here with the City of Columbia. And I'm Lee Deforth, the City of Columbia's Comprehensive Planner. Today we'd like to talk to you a little bit about Columbia Compass in Vision 2036, the process for updating the City's Comprehensive Plan. So, what is a Comprehensive Plan anyway, and why do we need one? Let's call it a COMP plan for short. Local governments develop COMP plans because by doing so, they establish a long-range vision for their community. That vision helps determine policy, program, and infrastructure goals for the local government to tackle in the coming years. In South Carolina, we are required to update our plans at least every 10 years through a formal process. So, why aren't we just calling it Columbia's 10-year COMP plan instead of Columbia Compass in Vision 2036? Well, as we're getting ready to celebrate 250 years of Columbia in 2036, we thought it would be a helpful image. Surveyors use compasses to lay out the original grid of the city, and a compass can also serve as a tool to help us navigate our future. And the InVision relates it back to Council's strategic planning process, which is a short-term plan. Exactly. South Carolina also requires that Comprehensive Plans include nine elements. Population is about demographics, who we are as a city, how we will grow, age, and diversify. By identifying and better understanding our natural resources, such as the quality of our waterways and our urban tree canopy, we can better understand how to conserve, protect, or improve upon them in the years to come. With land use, we talk about how the city looks at density, scale, and context, what types of uses are appropriate, and why. Transportation is about mobility. Mobility of people, whether they are in their cars, on the sidewalk, on the bus, on a bike, or hauling freight. How we navigate our city helps define how Columbia looks and feels. The housing element examines the market for rental and owned housing. It considers different sizes and types of housing, and what gaps we should work to fill as a community. We all rely on community facilities, from utilities and emergency services, to parks and educational facilities. How we plan for these services over the next ten years is vital to the heartbeat of Columbia. Columbia is a city steeped in culture from historic structures and fine arts to engaged artists and art educators. The Amplifly Columbia planning process will help define the cultural resource element. When we talk about economic development, we are talking about how we can encourage a diverse, resilient, and vibrant economy, which not only attracts employers, but also employees. Is there any one element more important than the other? Well, we recognize that these elements are all interrelated. For example, making our city more walkable and inviting to residents and visitors could fall under transportation, economic development, land use, housing, you name it. And access to community facilities like parks and schools could both determine the market for housing and economic development opportunities. So we should just think of these elements as chapters in a book then. What about priority investment? If the elements are chapters that tell the story of our vision for Columbia, priority investment would be the conclusion. It is the element that helps the city choose and move forward those programs, policies, and projects that help us realize our vision for Columbia. Let's talk a little bit about this process moving forward. Sure, the project team has already started with research and reaching out to folks, but there will be three sets of opportunities for in-person public input during the planning process and will also have opportunities to engage through surveys, et cetera, in between meetings. The October meetings are the first set of meetings and where we hope to better understand your vision for Columbia. We'll hold another set of public meetings in early 2019 where we bring back preliminary recommendations and ask for your input. Then we put pen to paper and develop a draft. Once the draft is ready, we expect to have a third set of public meetings in late spring of 2019. There is also a formal process for the plan to be adopted by the city. After the third set of public meetings, the city's planning commission will review and make a recommendation of the plan to council. Council will then hold a public hearing before voting to adopt the plan. So what do we want from you? We want you to help us define our shared vision for Columbia. You can do this a number of ways. We'll be holding public meetings. There will be online surveys. You can follow our website and social media accounts. And we're happy to come talk to your neighborhood or organization. Just get in touch with us at Columbia Compass at columbiasc.gov.