Before we move into the inner circle, and I think you probably on your name tag it says which is who's doing what right now Could we just do one quick thing? It's gonna help me. We all change seats and then we have some new people So could we just go around and say your name? So that the people who are new to the room get an opportunity to hear everyone's name as well So I'm David Dower. Oh Yeah, we're just passing I'm Robert Duffley I'm Catherine Botchall Elizabeth Dowd Lisa D'Amour Jamie Galune Chantal Bilodeau JD Stokely, I use the pronouns they and them Marta Kern Jessica Schwartz Joy Shadada, she her hers Roberta Leviteau Adjul Sun Cicada Alyssa Schmidt Lanny Fu Xavier Cortada Allison Carey, she her hers She her hers Georgina Escobar Elena Eagleshield Peter Santoscano, he him his April Merlot, she her hers My name is MJ Halberstadt. I use he him his Annalisa Diaz, she her hers Cheryl Sleen Robert Davies Julia Levine, she her hers Teddy Roger, she her hers Yuna Chowdhury, she her hers Lydia Fort, she her hers Grisha Coleman, she her hers Kyoko Yoshida, she her hers Abhishek Majumdar Okay, so if the third circle folks could join me here and if we could get the microphones So for the people who weren't here yesterday just a quick reminder of what we're doing the the goal of this circle is to talk to each other about the prompt that Has been handed out for this This particular circle will let the people on the outer circle listen So this is actually just a conversation between this group the people who are on the outer circle the job is to actively listen and as you're listening Catch the things that occur to you that need to be spoken and if they don't get spoken in the circle bring them up when We break out into the larger circle also note for yourself any Particular emotions that are stirred by what you're hearing those are also going to be gifts to the Conversation when we break into the outer circle and in this inner circle similar thing to follow just follow the conversation The thread and as it comes to you What what's the next offering into the conversation all of us have history all of us have Experience in some aspect of this work. What's the next contribution that needs to be made for an active Conversation and a fulfilling conversation to the prompt that can then break out and serve the larger conversation So it's actually fairly simple, but Important that we keep this conversation in this in the center for the outer circle to do its work. Okay So I think I want to start following up Elizabeth with your Reflection this morning and what you just asked us to do. Does anyone have in this circle a particular Place to begin with what is radical to you? Something you feel like you'd like to just Toss into the center. We're talking in this circle about thinking radically. We're looking at what we could do together The people in this room and the people in this particular circle could do together that we might not be able to do on our own And we're thinking about it as a radical a Radical endeavor so what does that mean to you? Good morning everyone. I Was thinking about this just had curly thinking And I'm my point you will start in the hour yesterday conversation and I would like to Bring Six points here to that by what I am thinking. It's radically thinking First one We all are here Theater people, but I don't believe that it's theater as we know now as these Theatre with dramaturgy the theater theater rooms Audiences, etc. Is the way to think about Crime may change. I don't think really that the theater we know is a way The other point it's I think We need to to change The theater and I think we need to act more Activistically in in a way more we do more art and activism And in this way, we need to work with Communities, I think it's very important with the people in the streets in parks in their house in their neighborhood and I think it also we need to forget work to abandoned see Theatre that you work Without performance, I think we need to think only in performing arts Not more in theater as usual, but performing arts. This is the idea of performance and I think we need to to do that Working studying discussing a little bit more about the historic to behavior discussion a concept and We shall we study to find a community-based the performance structured in On price principles of twice the behaved behavior. I think this is the best way people have Archivist behavior behavior in the everyday and I think in this Exactly point. We can find something with climate change and we in that came We can And force or start or Having a discussion with the people to Think about Sustainability, I think we are thinking too much in in climate change and we are forgetting the sustainability and Sustainability it's very important because sustainability is not only about climate It's not about only about environmental and it's not only about rainforests and so on it's about social justice and Without thinking about the social justice we cannot think about climate change, okay, and I Think we need to start Tomorrow be more Transdisciplinary we are we are too much disciplinary we are theater people and we are trying to discuss climate change in a The other way of thinking we need to be more transdisciplinary we need to truth to bring more effort and to make more strong strong Good culture of peace we we don't have a culture of peace and I don't I don't see a Way to go out of this situation that we are having with this work culture that we have and I think you we need to To valorize a little bit more the self-determination of the people of the person of everyone And I think you we need to finally Have some ideas about what to do with the environmental and so what to do with the ecology What to do with the our our our footprint our human footprint and I Think we shall need to Rethink The way we live we live in cities are your own way of life You are with your own way of life. It's a big problem. And I I think it's The way to think you have to cut it. Okay. Well, there's a lot of prompts there Anyone feel they need to jump. Okay, let's go Lydia and then you know Thank you very much Incredibly eloquently spoken as well Cannot agree with you more about how theater needs to change I think One thing that struck me was the question that happened from someone on Twitter who was asking about what is the role of designer and You know instinctually my thought was like Of course, we cannot do this as separate artists in whatever our disciplines might be and that you know, there's a pet peeve of mine and thinking that Directors kind of let people go and do what they do and then come back together And so I'm often going well if I did that with actors, then what would you say about me? All right, if I just said, okay, we're having rehearsal go do your thing and I'll come back in five minutes I don't think that designers are That's how I should work with them. So I don't think that that's how we should work with Anyone we all need to be working together and in communities to be able to change what we think there has to be a revolution in how we Practice theater there has to be a revolution in how we teach theater There has to be a revolution in the way that we think And I also really really really appreciated what you said about sustainability as a way of thinking Because it encompasses so much more and is so much broader than when we think of just Climate change because sustainability could be sustainability of on so many levels, right? and What is that future that we want to sustain? I mean the way that we live today? Cannot continue on any means by on any level The way that I took a shower and got here and came in eight and sat and all of that will be radically different maybe in just by the time I'm 85 Christ Sorry Fundamentally a culture of peace We speak a same language there and I Think that we've been conditioned to think of ourselves On the top of everybody's food chain or everybody's important list But how we can embrace a culture of peace that includes all of our kin plants animals inert objects The universe is a whole I Want to ask before we go to you know Does anyone So does anyone disagree With any of the prompts that have been laid out In this first is there's someone who has a I'm not sure that we all believe that or I'm not sure that that's the direction Because we'll get very fast into group mind about something and that will get lost if there's a if there's an actual disagreement anyone have a Counter or a concern about what was laid out. Yeah Just a reminder that we're using the mic so that the third circle that the people can hear us on Online, so I don't know if this is really a disagreement so much as it is just like a mental What are we talking about right now thing that's happening for me because I just don't like is is Changing theater really a revolution. I mean like really really fundamentally like if we're talking about a political revolution like That's an that we're talking about a government like policy giant ass changes and What the hell is changing the theater the American regional theater if that's what we're talking about I don't know if we're talking about the American regional theater Are we talking about changing the structure of the American regional theater is I don't know Is that what this conversation is and are we characterizing that as a revolution? Yeah, because I don't actually think that that's a revolution It's a change Which I believe needs to happen like I'm on board with that But I don't I don't know that using the words revolution and radical is really helpful in terms of like if we're really interested in climate justice globally I Don't think talking about changing the American regional theater is really a solution So let me let me pull a little harder on it. So it sounds as though You're actually in agreement with the prompts that were laid out You're less in agreement with the idea that the regional theater is the priority place to look to to radicalize Yeah, I think so it and it's To be clear, I think we should change the American regional theater We can all stipulate stipulate to that as well Yeah, but I don't know that that's my priority in terms of like climate justice globally I don't think the American regional theater is gonna change the world. Jay. She you're having a lot of nodding You want to add anything into that as she said you she said for you, okay good go so you know here Oh, okay, uh-huh Lydia Lydia point of clarification that yeah, that's it. I don't mean that I mean all of Theater in every way that it is practiced great So April right, so I think my my initial response was the The tools that come from theater practice are tools that can be used for radical and Revolutionary ends and in order to liberate the tools of theater for such purposes some of the attachments Around American regional theater need to be let go mm-hmm So if we're in a place where there are a couple of kind of agreements here How What what ideas are bubbling in you for how to get closer to what you just laid out? That may either include this Question of how much is it a priority of the regional theater or theater? Practice as we know it or just depart entirely from theater as the question what things might be Might we be able to imagine or do? Together that we can't do on our own unit. Did you have a place to begin with that prompt? I know it's a big one so you and you were coming in later So if you want to get back to where you were first, I think Part of what I wanted to say does relate to your last question it and it was a response to I Felt very inspired by What I heard underneath your six points, which was a kind of invitation to be much more expansive in our Approach to the work we do whether in whichever theater that might be and I've been invested in Another kind of expansiveness Which is this move from You know around the topic of climate the move from thematics to ideology that was to stop thinking of it just as a topic and to start thinking of climate more as a as a Framework as a context as a perspective and to stop thinking of climate change Exclusively and to think of you know as this crisis, but to think of It as an as an opportunity as an opening And you know what is it an opening to to it's an opportunity to think of our species ourselves in new ways And I mean that that can be as Expansive as you know as one is willing to to make it and are there some new ways that are already in your practice or on your Mind as you sit here right now Well, I think one of the things is to While it's it's about the future and it's about dreaming and Xavier said yesterday something that you know, I love this formulation of we want to build a better human being And that that's lovely and but then I also began to worry that it's part of this You know merely a risk stick You know, we're going to just keep doing things and and fixing things and inventing new things Whereas maybe a huge part of this is also Looking back and understanding how we went wrong and What are the ways in which we are being kind of bad human beings? and For me that has been about really committing to an analysis of the systems that have got us to this place of You know devastation in social injustice and all these things and it's about The book I often refer to which is very influential on to me was Amitav Ghosh's book the great derangement in which he argues that The the condition we are experiencing now this new climate regime can be thought of as a kind of madness that has been Gradually growing in us been grown on us over the last three four hundred years that Modernity was a kind of delusion that was produced in us And the core of that delusion was to believe that we don't live on this earth that we are not part of this Earth we're not it's it's the subjects and it's creatures, but we're somehow it's controllers and that madness Has infiltrated, you know all aspects of our lives to the point where you know we live as if we're living on Mars Rather than on this very planet earth So to me this is the opportunity to return to earth to become earthlings again okay, and and The question is what are all the ways we can do that and I don't think there's any area including regional theater Which is you know off-limits for that renewal Great Grisha, I'm gonna pull on you for a second because you weren't part of the conversation yesterday I assumed that neither of you were listening to it online. You were in transit okay, so Because you had this prompt on the way in you right you kind of had seen this I believe the schedule of what we were gonna be talking about great So what was on your mind as you were in transit yesterday about thinking radically and what that might mean Irrespective of the conversation from yesterday Get both of you a chance. I was thinking they're something simple idea that the foundation of a Big problem of modernity or a big Confusion has to do with ownership like owning things owning Land actually and so when Elizabeth and I were talking last night. I Had just I was just recounting some anecdotes about Like I don't know being shocked when I see what I'm I was in Arizona and Driving past signs that you know have signposts that say oh this place I Can't remember the place, but the set hum humboldt Dewey or something like that Established in 1912 and I thought No, it wasn't It wasn't founded at that time like this place was here way before Humboldt or Dewey was there and so I think there's like a very like basic and initial confusion Assumption for human beings that has to do with Ownership like owning things I Especially this idea of property because I mean objects. It's okay. It's more easy to think about owning them, but place Like the metaphor of land to body is very strong for me a similar kind of unconscious non-verbal Entities your your your body, you know before you start talking and or so land and and and body seems like they have a lot in common to me or for us and So the link from landing From owning place to owning people is strong, you know, I mean the idea like where did that idea come from? Like how in the world would anybody think that you could and so the same kind of madness Like it stems from an idea that you could own a thing or own a place or own a person so yeah That's what I was thinking. That's a radical idea, but I don't think this I Don't I didn't really want to say it because I don't really think that this group Can address that I mean, I don't know how this group could address that, but I think that's a big issue One last thing Ursula Le Guin the futurist she wrote a beautiful Story called the dispossessed and in the dispossessed they don't own stuff and I thought well what whatever whatever It's what I thought. Oh, yeah, that's actually the more I think on it the more I think that that's a radical move Yeah, I want to encourage you and everyone else to In this conversation to bring the things that don't seem practical Can this group actually address this we don't know that's what the working groups will be for but what might We tackle what might the context be that we're in that we would like to change Let's throw it in and see what happens. You have a response to that Yes, I couldn't agree more with what you were saying about ownership All of you there's but I disagree about what we in this group can do about it a little bit just because what you're talking about and the why it seems radical is because you know all of the behaviors choices actions Societies that we make come from this From our values what we value what we want to create in the world what we think is important and those come from views Like what you just described this these basic views that one can owned land or others This ownership view is so key and yet. It's not true It's not true. And so If it's possible to shift people's views towards what is actually true I mean when you think about it, do we even own our own lives? Do I own this life? Did I create it or am I in it because I came from Where I came direct from teaching a dharma and meditation retreat in the wilderness of New Mexico Where it's clear you're in immersed in nature where There's no ownership, but there's but to draw the distinction between ownership and responsibility You know like are taking care of one's body ones health ones life ones world ones fellow beings, you know what I mean and I think that because we're talking about a everything come everything will sort of What I've seen in my own life in the transitions in my own life is as these views these underlying views have shifted to be more an Alignment with reality the design of things that the choices to be made and the actions to be done come Very organically and naturally out of that and the way in sustainability as a View and a philosophy comes very naturally out of the reality that we are all interconnected We are all interdependent That and and then there's the compassion piece which is we care about what happens to others and we want to reduce harm And so on and so it's always seemed to me for a while that my work as a storyteller as an artist Which is the work of changing perspectives I am changing perspectives as I'm writing pieces and people and those who are viewing and experiencing the pieces on the streets I do site-specific theater and so I'm hoping that their views and perspectives are shifted a little bit, you know so that those They it rekindles their innate values what we're talking about our innate values that we all already have and that are blocked by these sort of Delusive values of the culture so how to refine them again or it's like a process of revelation And I think that story can be so Integral in helping to shift perspective to move that to open up that possibility for people Do you know that's why I feel like we all have a role here in the work we do as culture makers To create the culture of that you know those values to model it to open up the possibility for it Okay, thank you Very quick intervention. Yeah, just as as With the hope that that's one way to shift perspective when you say that you in New Mexico you were immersed in nature I want to propose that we're immersed in nature right now here. We are always immersed in nature And this idea that nature is only that green stuff our way Is is one of the one of the modes of our derangement. We are always in it Yeah, I just wanted that so this idea of story and part of my thinking around being radical is Radically transforming our relationship to story and who's telling whose story how our story is told And being accountable to the fact that oftentimes what is happening right now in Climate in all sorts of places is particularly people with privilege Are able to access the resources and they're able to be the ones to tell the stories of others So for me radical transformation would look like the people who are the most impacted telling their own stories Visioning the future they want being given access to the resources that they need To transform their realities because the people know what they need the people know their own solutions And right now we live in a society that certain people have all the resources certain people have all the access And there are gatekeepers and there are gatekeepers probably in this room outside this room that in order for that transformation to happen They have to let go of that power and there has to be a you know total kind of reconciliation process something needs to happen where The idea of abundance and true abundance and the idea that there is enough You know econ 101 the like anecdote I tell of you know econ 101 back in college The fundamental idea of scarcity. I was raised as a communist my name means victory for the plow right like I was not raised with the mentality that You know of the the invisible hand and so when you bring that to econ 101 professor He's like i'm like what if there is enough no there is not enough What if there is enough so if we start to really I mean it is deep it is deep To really start to manifest abundance in your body in your mind in your spirit in your action like it it record like we operate from this You know scarcity model this competitive model this so true collaboration is impossible unless you really manifest abundance in your in your body In your mind and I don't believe that that is something that we pay in that we say the words But we we do a lot of thinking About being radical and we don't do enough acting radically And we don't do enough actual solidarity work where we those of us who might have some power and privilege I'm blessed right now to have some privilege of resources and all I'm doing right now is figuring out how to get that resources Out the door not I don't need it. I don't want it. I'm okay right now How do you do that and the people are not right now? Really truly willing to give up their power Elizabeth i'm gonna call on you in a second just to be um Julia right yeah Because you're connecting to something that Elizabeth you said yesterday about the commons And and I about a return to the return the resources to the commons and I wonder if you would think about how to Contribute more around that Into the circle as well. So Julia you got a thought. Yes. Yeah, I really want to echo and weave into Everything that's being said and going on in this manifesting abundance and how to I'm really thinking about like the practical steps to Work outside of the established institutions and those gatekeepers to to manifest the people's power the people's voices. So I'm like really Yeah ready to to think about those ways to do that. But while also Um dismantling the damage that those institutions will continue to do if they stay as they are So kind of this two-fold like building alternative worlds and possibilities and access and abundance for people who are already on the margins while also Um undoing the work and damage that has been done by institutions and I'm thinking about and have been Considering an exercise from the goat island performance group that is about performing an impossible task and impossible is relative and contextual but I Think about this idea of the impossible in terms of this Culture building undoing Processes of oppression and systems that keep people fragmented as an impossible task in and of itself but then also on the dreaming and Creating and collaborating together as artists. What are the impossible tasks that we want to See in performance on the streets as performance art. What are those impossible tasks? I think a lot about I was thinking About radical thinking in terms of revolutionary thinking And I'm also thinking about it in terms of how to challenge my own sense of being right and being Correct about my political positioning Because I think we can agree on a political agenda and to say okay, we're going to be radical We're going to do this thing to move the needle on x issue But it also occurs to me that it I would like to invite each of us as an individual to think What are each of us willing to change to get what we say we want and that our habits of mind As artists who presume to be the radical thinkers always and to presume to be the ones that are hip and down for revolution and um Leading a movement in many ways Um, and like those are my people and so I I own that too Um, that I would challenge us at this time when we say oh, this changes everything or this is our opportunity I would say well really what are you individually willing to change and challenge about your About the power you're holding about The gait you may be guarding or about who you're willing to collaborate with And that's going to be very different for everybody who's sitting in this circle all of these circles And um, and I and I and I was really Excited about this idea of power Excited because I think that Knowing learning how to step into your real power is It's a craft. It's a skill and it's something that you relearn and power is not bad Um The kinds of power that we're really skilled at using and wielding I think are as divisive often in this in this societal construct in this madness that we live in And it's kind of the only trick I know Like I haven't been I've been trained in the other way of the other kind of power and I maybe Maybe the place that I feel like I've gotten a taste of it is in the theater For lack of a better phrasing the theater right where you're like, oh, we're gonna um I mean granted the theater has all these hierarchical structures and And um shortcomings right as a as a construct, but it's when I felt like oh, this is the world I want to live in We're we just made this thing and it's it's really awesome So I don't know. I guess I guess I'm throwing out that this idea of like what is power and What is the power that we want to be holding? and and sharing and Maybe to I wanted to say one other thing about So there's a there's a lot of assumptions around how to do our work and one of the assumptions that I I'm going to challenge myself with is um That we think experts are the ones that have to be included in finding the the solutions and I'm going to say that Um Sometimes the people that are not the experts come up with the most innovative ideas and to be really open to hearing um Whatever newbies or Whatever youth or however you want to categorize somebody who's not an expert Um, and the last thing I'll say about um, just the commons to bring it back I think the commons is a place where you have to share power You don't get to control everything you have to um, if you do a show in the park There may be some people playing A loud game next to you and they're not really there for your show Um, but they get to use that park too And maybe they'll be like hey, what's going on over there? Or maybe not and so that's uh, that's kind of a check On and our work as artists and the control that we have and um and commons being a place of like real democratic use In and like metaphorically and physically Haven't heard from you yet. What's on your head? well, I've been um I've been thinking they the idea of like looking Well, there's two things like one the importance of understanding the journey From our past away. We're here to in this present moment um and having to wrestle with this kind of complexity of climate change and sustainability which is integrating even a broader spectrum of challenges and injustices and um And we've talked a lot about some of the really big um Relationships in our society that have our sort of the power structures that are getting us to this point And I think and then we've also been thinking about the possible, you know, where is it that we What kind of world are we trying to create what type of relationships would we like with one another with one another? And I think the theater and the arts when I is an ecology of itself and And it's almost if you if we think about how could we model ourselves? Because I think someone was talking a bit about the importance of role modeling And seeing that possibility and kind of going through those um That process and that discussion is really important and it gives one agency and empowers people to move the needle and um and one I think does hope that by the process of doing and really interrogating That current work of practice and how we work together the work the um how we Connect with the communities. I mean, I think what I've really Appreciated and hearing over the last day is Is being able to go in to you know It can't be as you said that this expert these other people We are our own experts our own truth makers and understand our people and constituents But I also think it's really important that we become we are uncomfortable as well And we we go into new places and learn and understand the perspectives of others Especially we are to tackle the kind of inequality That is happening You know around this climate change issue and and And therefore I do think As um cultural makers just we just have to um implement, you know, just just Uh undertake small steps, but actually I see when you take that step it it Cascade into a much bigger Systems change and it does take a little time, you know to kind of really question How we work But I think the radical to me I was thinking this morning as what is radical And it can be really disruptive change. I think disruptive change is necessary But actually how do you get to a more disruptive change of the system is by Locating yourself and understanding The system that you're in and working in a collaborative way And I think that's the biggest challenge probably, you know for us to think this afternoon. How are how might we in this group Think of a way that we could work together. Yeah, so I'm going to ask people to reflect on that What is the Magic of this group? What is the the latent power of this particular group of people That we might Not have seen before we got in the room together. Is there anybody who's who's got a Sense of what we might do together That wasn't Present before we got in the room is that it doesn't have to be But there is some question as to what what can we do together and That we're going to wrestle with this afternoon. Julia. You have a thought Thank you so in terms of What potential we have together that we didn't have before we all got in this room together I think I was talking to Georgina last night and we were talking about how quickly this group of people got into um those juicy Intensive conversations about Okay, so there the power structures we've called those into question, but then the work of Validation that's been going on in this room. I think and hearing People's different perspectives, but that we're sharing The system of values. I think is really exciting and so Yeah, taking the next step from this validation and agreement with challenges here and there to Plan I think I want to follow up on that the word validation I've also for me, I was talking to I think Marta about My experiences, you know In many years have been often to be Either introducing ecology to theater people or theater to the ecology people and it's just so extraordinarily Wonderful for me to be In a room with people who care about both those things and are deeply immersed in both those things That's just an extraordinary experience and and so I also want besides talking about power And challenging and challenging ourselves. I also want to give a word for gentleness and validation and Kind of savoring The fact that so many of us have now kind of committed to Thinking these two systems together the environment and you know art theater making I always mentioned books the the most recent book that's been extremely Important for me in my teaching and writing Is it's just a title of it is so brilliant. It's called the arts of living on a damaged planet And it's a co-edited book with many articles But it in that very title offers this orientation Towards acknowledging The reality of our condition But also Opening up the questions about you know, what will be what will be these new arts? That this damaged world calls for and these acts of repair that that our arts can contribute to so One thing is is common And you know One thing is common here, and I think we'll get into more of it on the outer circle But I also want to call out that we should Have a post it for folks. There's a resource list that's building my websites individuals books That's been named throughout the the two days That we could just even collect here as a thing that didn't exist. Yeah I'm having like a multifaceted complicated response. So I'm just going to name that on one hand. I'm like, yes, great. We're all in this room together We're validating each other awesome. That feels awesome. Yay On the other hand, I'm like, so what like we came to this room And we're all going to pat each other on the back for like being theater people and like we're invested in the environment. Yay like What what the world is dying like people are dying bodies are being coerced Like that this is a problem And and we're going to sit here and pat each other on the back. I'm not okay with that So so but on the other hand like yes, I am. Do you know what like? Yeah, I'm saying like I'm having a complicated response because I'm feeling the sort of like The the collectivity in this room, but I'm also like, but what are we actually doing? um So on that on that mindset, I wonder if there are people in this room who are positioned like, okay Here's my radical idea. I don't know if it's actually radical, but I'm just going to say it What if We in this room could create a call out to the american regional theater or Like universities that have theater departments that are invested that have endowments That are invested in fossil fuels What if we find a way of calling the american theater regional nonprofit theater or whatever context we're working in If there are people who are invested in fossil fuels Can we call the the arts community to divest from fossil fuel interest? Maybe it's not just regional theaters. Maybe it's like all arts, but I don't know like Depending on what context we're all working in is there a way in this group that we can craft like a policy something To call the arts to divest from our complicity in extractive relationships Great We are going to go ahead and open this to the circle, which I can also feel is having complicated and interesting responses So let's go get some of those in the mix too. Okay I'll just tell a little story about my grandmother on the way elizabeth My grandmother used to always say Don't be an expert experts are just people who used to spurt So it was always about continue spurting don't sit back and The x All right, so people This question about radical What can we do together that we can't do individually? What can we do together that we couldn't have done before we came into the room? what Your own responses to this conversation as well as to the writing the reflection that elizabeth had us do this morning rob you had a Like Offering and then georgiana, please and then xavier and Wait, thank you I think just to respond To what you were saying about the padding on the back and all that stuff. Um The way I understand the comments is really simple. It's kind of like a potluck, you know, and so It's really that's the first day, right? It's just coming to the potluck with your like guacamole and your like tostadas and like Saying hey, thanks for Thanks for that People might not eat it. It might not be like the the flavor of the month. It's but it's really just about Action can't happen in the void. So I think in just the the validation is the first step obviously of just saying Hey, we're here. We're from We're starting from a place of gratitude So that We can all bring our talents to their best shape because we're all different and we all have different talents We all have different Perspectives and I think what we can do together that we can't do individually is actually trigger each other's Strengths to bring them to the top instead of commuting instead of forming one thought and fighting behind it I think it's about propelling each Individual talents to to go towards the common goals. So identifying really those goals Uh are key, you know, like you were saying do we divest do we talk about divestment? And I think that's what the small groups will do is like try to form action-based Um goals that we can say I'll stand behind that I want that or like I want the the sustainable theater model where You know this happens or whatever. So I I just I I want to give us hope that the next two days just from like fast experience I think that It is supposed to start that way and that's kind of how it's happening And and the point is that it doesn't end with that just like pan the back great have have a good life chow Like it's actually about where do we move from here? And that's just the the opening. So that's all I wanted to bring We'll go to rob and then Xavier and then aposhek and then robert Well, so uh, I'll start with saying that I was really so pleased joules when you um brought up the notion that it's so much more than climate change And um this notion of the broader notion of sustainability Eisenhower had a great quote and I'm paraphrasing slightly but it was you know If a problem is too big to be solved make it bigger And the idea is you're not bringing enough into the Conversation and of course I was having this conversation last night The the science is such that it tells us if we can fix climate change tomorrow We're still in essentially the same pickle It's part it is an emergent phenomenon that From which there are a number of existential threats emerging our impact on the biosphere Our dramatic fundamental reshifting of the way that the earth system the living system is functioning is Changing and only partly from climate change in fact not even mostly from climate change and the science on this is dramatic It's also about the way we live as humans of course and Um which is completely unsustainable forget about climate change And it's unsustainable on a scale of one to four decades And so when lydia brought this up that everything will radically change It's not do we change or not it will and So to tie that back into the theater discussion what i'm as someone who exists on the periphery of theater and mainly in science I'm also really fascinated by this discussion about what is theater And so I asked that question to myself and in this context i'll say that theater Is where we try on different scenarios. It's where we We explore different Experiences and ways of being we can watch it performed on the stage. We do it in our minds, right? I should have said this I should have said that I live out this. What if I do that? To me theater is what allows us to explore those things And in that sense then in this conversation of radical things will change radically they must Theater I think what has to offer Here is the chance to de-radicalize the radical it's where we get to As a society try on different ways of existing in different ways of being and of course this is why Governments of the past have been so eager to control theaters. You don't if you're in power You don't want people trying on a different way of being And and and to no longer think of what might seem as a radical change as radical But as inevitable or as logical I think this is what you all offer us is this chance to de-radicalize the seemingly radical and allow us to envision What actually must be and not just the dystopic part But the part where it could really be so tremendously better and we could be addressing the social justice issues that in concert with the environmental issues as It must happen great all right Xavier Thank you. I mean that thank you the Last hour of my life has been one of the most prolific hours. I've had in a very long time Sitting here. I've created four or five art pieces just by listening I mean I mean that it's it's uh It may sound futile. It may sound like what the hell are we doing here? But what we're doing is we're we're inspiring one another So I came here and even yesterday I was saying well, let's get pragmatic. What are we doing? What are we doing together? How do we we are doing it? We're actually nurturing one another right here so um That's pretty radical Right that we can feed one another and then grow our own practices and of course we're developing relationships We're going to go out and do things collaboratively But don't dismiss what just happened here today.  So thank you Great, and lani. Do you mind taking the mic? There's I can see So i'm going to go to avoshek and robert and then come to you. Okay, so so Let that bubble up Yeah, uh, thank you for that very very important conversation. I think um I was just thinking that if you're talking about big systemic changes Uh, essentially we are talking about I think dismantling of Uh, the idea of capitalism And the idea of nationalism And these two ideas have contributed enormously To the the industrial complex which has led us to this particular place Uh, and this is visible. I think in many parts of the world I mean in tibet you go to the higher regions. You can see lakes being dammed because of a certain kind of Ideology looking for a certain kind of progress And it's fascinating that the two countries Which have made the most capitalist growth One of them is china, which is communist and the other is singapore in the last decade, which is actually a dictatorship um, and the question is how do we If we have to challenge that our theater Needs to move out of capitalism. It has to reject capitalism at a very fundamental place in terms of ownership and such various ideas Also in terms of uh, you know speaking of theater as an effective thing or not I was just really moved by what you were saying because I remember two or three years ago I was threatened by a hindu right wing group. Um, they issued a death threat Uh for a play that I had done which was about ecological philosophy And this is after they had already shot down Two writers in the one year before that so the family was very worried. It was all over the papers and this and that So what I'm just trying to say is that The risk is very real in many places Uh, and I think, uh, it's not about being brave. It's about being together That perhaps we are we can be Concretely radical if we have gone to a place where the system hates us enough to want to kill us If it doesn't want to do that at least I can speak for some places in the world Uh, maybe we are not being a problem large enough And potentially many of our theater projects that we are doing they could be big or small It needs us to collaborate with each other Who are not in the same delusions As we have in our own places We have to collaborate with unknown people. We have to collaborate outside of nationalism I think to be able to think differently Yeah, great So we go it's someone does see a hand go over there just the yeah, sherry Um, thank you. Uh, I'm really interested in this question of What we're doing when we validate or interrogate each other's work around This idea of radicality and in my thinking I'm Straying a little bit outside my traditional area of Practice and I'm thinking a lot about mushrooms. Um, which I very personally know very little about but I've been really inspired lately by Uh, the anthropologist on alone helped sing Extraordinary book the mushroom at the end of the world if anybody knows it. It's an ethnography of the matzatake mushroom and the, um amazing supply chains that transport it from forests in the pacific northwest to markets in japan and around the world and What I in my ignorance of of mycology have learned in reading this book is that what I think of as a mushroom is really just The tip of the iceberg. It's the fruiting body of an almost invisible network of subterranean filaments And what I can't help thinking of in this conversation is that You know rhythms of marketing and development so often require that we focus only on the the fruiting body that is hunted and sold and consumed but what this weekend is such a beautiful opportunity to do is kind of Think about those underground networks and and really question the delicate symbiosis that cause them to fruit in the first place And the the most striking fact from that book is that scientists have Failed to make These networks and labs fruit at all. Um, so I'm really valuing um this chance to be part of this network Uh, then we'll go to lani you yeah, um, yeah, I I I have to I have one kind of Frustration to share and then two other thoughts and forgive me. I suddenly became very caffeinated. So my heart is kind of pounding right now Sorry if this is messy so, um The frustration that I share or that I want to share is that I uh, so my friend was telling me the other day about this Wonder, you know, they were they were like, oh this I found this wonderful, um thing Where you can go online and there's this company that is um is brand lists You can go we can break out of buying things that are branded and you can go online and you can order anything you want And none of them have a brand I was like what That is a brand. What are you talking about? They're like you go online and everything is like style, you know, everything is in the same font There's a certain color There's you know, there's like a thing and I'm like this is so frustrating to me because I feel like What what oppressive systems do and what oppressive systems do so well and I so appreciate you bringing up The need to break out of our capitalist system It's so insidious because what it does really well is that it it oppresses you and then it offers you paths of resistance That feed into that oppression. So I think that and and like that's the reason why non You know like gondies non violent resistance was so powerful at the time because of course what the colonial power wanted Was for you to take up arms and fight back because they can they can suppress that right? But if you go like what I'm looking for right now and I don't have an answer to it Is what is the thing outside of the system that's not feeding it more that we can do that's radical That's not in the language that's already present Um, how can we you know like I I don't know I have I have lots of thoughts about it, but I don't know the answer to it and I'm sure Brilliant people in this room have answers to it. I'd love to hear um So that's a frustration that I have I have a a thought um I want oh I wanted to say that I really appreciate the idea of uh julia bringing up the idea of the impossible I love uh We work a lot with the impossible question in our work and and I know that people In lots of different um mediums and forms work with the idea of the impossible and I love that idea because I think it it says that it what it says to me is that the work is never done There's never a moment where you've achieved it or achieved something and I think that's something that's Really powerful for me and for all of us to um think about the last thing I want to say is that um Uh, uh, what what was it? Oh in terms of what we can all do together that we can't do alone um, I think that uh This challenge of being more expansive than we are Is a wonderful challenge and I think that in order for us to kind of properly be people in the world and to care for Each other and to create just systems. We actually do have to be more than More than ourselves And so that and in a way that we and and we already are like the modernity is kind of demands us to be more than we are I walk around with Half my brain in my pocket all day, you know, like I think that that's we already are we already are um, uh Just because of the just because of the circumstances of the world as they are now We are so expansive and so I think that like I Thinking of all of us and whoever else is connected to this this network as one organism And the fact that we come from so many different places and work with so many different Um people and have a deep we all have a deep reach in our own communities And then thinking about that as being connected to our Like these are all fingers that we have and how can we really? You know, I don't again. I don't have an answer. That's like this brilliant Thing, but I want us to think about how we can be deeply locally rooted um While connected to each other in a in a way that is Uh, I don't know that is actually connected Um, whatever that looks like, okay. I'm gonna jump out of line for one second Marta Um, you have um A lot on your mind um Thank you, Lenny. That was really great I'm sort of my brain is also It's like no, I don't know can't even describe what's happening to it right now. Yeah, that was great stuff happening One of the things I've been thinking about is is is really how can we think more ecosystemically and move from um what I Was nursed by what you are saying so much is is a thing, but you know, sometimes I think about I don't I'm not An academic really and I don't know I don't have the language I have the feelings a lot of what I see And one of the things that I see that's really a problem is the is A difference between what I call the the the particulate the particulates and the relationals meaning And this isn't correct. This is just a feeling but it seems like in the western world where it's like if you had let's say A weaving for example of threads And it seems like the western world is really good at seeing the place where the lines cross And and there's like a particulate view And we're really good at scopes We have microscopes and telescopes and stethoscopes and all these different things that create a circle Around that crossing and we can go very deep And we study very very deeply and that's why we're um We're really good at um, well, I won't say that part But but we're really good at studying a subject very deeply But and then there are the relationals and those are folks who often and correct me I could be I'm very wrong in a lot of ways. It's a lot of eastern thinking and a lot of Indigenous thinking and it's relational thinking It's so that it's as if the the particulates are really look good at foregrounding that cross Um and going deep and the relationals are very good at looking at the relationships Among all those particulate parts, but it's the actual relationship. That's the foreground One time I got to be in Dharamsala where the Dalai Lama's lives and has a there's a Tibetan medicine Museum there and there was a wonderful female doctor and I asked her so in my brash very young way So what's better eastern medicine or western medicine? And she said well, it depends depends on if you have time or not And what kind of problem it is if if it's a basically an engineering problem where something is broken Then western medicine is far superior or if you know that I don't know your heart is stabbed or whatever You know you have to have an engineering problem you have to fix it and in western medicine is fabulous If you have time and you actually want to cure something Eastern medicine is much better because it looks at the body as an entire system And how everything relates to everything else I guess what I'm trying to and why I was so appreciate what you're saying is because it's not an yes It's not an either or it's a both and where we are right now is We really need to be able to think about the systems that we're in and how we all affect Each other and the world and how we are going to shift from this extraordinary Western way of thinking that has been fabulous. I mean we have cell phones guys We can barely live without them, right? But that has come up with these incredible inventions But at the same time so many other things have been broken And have been forgotten in the process and that that we have to now heal So much and so that's why I keep thinking about how can we And I don't have the answer, but how can we look at what we are doing here as a system? As an organic system as a as a biogeochemical system and figure out what part we each play In that system of theater production or ecology or whatever it is And if we're going to do what the iching says about making energetic progress to the good How do we see ourselves in that system of where we are eventually hoping to heal the earth and create Extraordinary theater Of lots of different kinds along the way So that's what I'm trying to think about Okay, thank you Cheryl Once again talking about shifts of view and how do we accomplish these shifts of view and how are we in this room? You know as creative people and theater makers uniquely positioned to help Catalyze that And that's what I was thinking about, you know, well one one little shift of view which happened in our little group there I think it was umma una who said was to de radicalize the radical to make normal the radical Yes, because that's what it seems like it is it's like reframing even the way we're looking at is it it's only the What we're all talking about moving towards is the same Sanity and it only seems radical because we live in this insane system And so that is really on our side in terms of movement and change and transition We are going in the direction of sanity. So that's good and And uh, and I think that we can trust that well, okay. I'm going to come back to that So some some common areas. What can we do together? Some common areas. I thought of that we share As artists is in theater makers is that we have access to And trust in the brilliance of creativity And that it's a process that creativity is a process Which is inclusive and responsive to conditions unfolding And that we trust it. We all are very experienced in trusting that process. I mean, I have to say that one of the One of the things I've really the biggest things I've learned as a creative artist is going from a sort of a an individual Generative this is my idea you guys all come in and let's help realize my idea sort of attitude to how how Much pain that caused me and everyone else to make Work from that point of view and how much joy my shifting into inclusivity and we're all, you know We're basically making this together and let's engage everyone's creative process here collectively in the community how Inspiring refreshing how that what was made was so much more Impactful and um and then the process of getting there was just so great in comparison So it's just like a shout out for how the creative process wants to be inclusive Mm-hmm And then it has and then also with our creative when we're as as Makers of art we We have aspiration But we hold the outcomes lightly Because we have responsibility works in response to changing conditions and circumstances, which means that we can sort of deploy our creativity In ways that work for each of us in our communities and i'm really looking forward to seeing how in our smaller groups That comes up with some concrete ideas like what you were saying is like well what works for me is and then Yeah, I just I think that I trust and I feel really good to be in a Sane group of people. Thank you. Thank you Alyssa, do you have the I feel like i'm on that Non-human animal on the merry-go-round that like doesn't look like it belongs on the the merry-go-round Never mind. Yeah. Yeah, I got it going up and now say more I wanted to come back to what Jayisha said about the importance of thinking about who's telling who's story and privilege and Before that I think Cheryl talked about drawing the distinction between ownership and responsibility and before that Is it Grisha? You talked about the problem of ownership and then that comes back to something you said yesterday about like people not Wanting to go to shows that are free actually like ironically and how Important it's it is to actually think about the distinction between ownership and responsibility as makers of the art And that to a certain degree we can In the room kind of fests up, you know, how many of us We all feel the responsibility, I think But only very few of us have ownership over stories that I think will catalyze behavior change among a broad audience Relative to climate change. Does that make sense? Like we we haven't all had the experiences I'm thinking of like the visual way that we visual and kinesthetic way We organized ourselves in the room about a personal relationship to climate change or whether we live somewhere rural or urban So I think we've already started to visualize Marta those That system in that way and I think we could do a line It's kind of binary, but like ownership and responsibility and kind of see Where we lie Anecdotally, I used to with my students in workshop Urged them slash require them to reach out to a scientist Who is working in the field of an issue that they were interested in And just last year I shifted to them reaching out to someone in an indigenous community and it caused one really big shift It moved from this idea of I need to go get something from somebody who owns something like owns knowledge or data To Inserting themselves in a complicit or at least humble way into inquiry. So for example one student Shared a question that she had emailed to somebody and it was what have I taken from you So Somebody was talking about this earlier. I don't remember whom but about It released a little bit to rob what you said about like trying on different scenarios. What if I did this? What if I did that? How do we get people to? Not just be interested in in those questions that are happening in the minds of like so-called others or you know People you've never met and will never meet but actually then Take that responsibility back on yourself And say wow they're pressed to ask questions of themselves try on different scenarios that I will never have to So in other words like move beyond the enchantment that theater can offer and the immersion Into the motivation for behavior change Great. We're um just about at the end and I'm just going to pull one more person so that we get a lot of voices And Allison do you mind if I pull you in? I'm over here Yeah, that's why I'm pulling pull that thought into the middle please Allison carry, please What am I supposed to say just where were you?  You can see different times that it's been held And manipulated and and and the things that have done to it. And so that's honestly where I was Mm-hmm. All right, so Allison and I thanks to the blessed Doris Duke Foundation got to go to the un climate conference recently which was Um, you know, that's the one where the Paris agreement was was created in Paris We got to go to Morocco to Marrakesh, which is incredible and There are so many stories in what's really happening about climate change right now that And Robert, I'd love to talk to you later about but you know that scientists, you know, they don't They're not supposed to talk about their emotions or about, you know, the politics or the very much or the Policy leaders aren't supposed to really reveal things and I guess what I'm sort of blabbing about is that One of the things that we're trying to figure out or I'm trying to figure out is, you know Can we insert artists into these situations of real life and death drama that's happening right now That whoever was talking about, you know, the second behaving the second. How does that thing go that Modeling the behavior and you know all that kind of stuff like I mean, it's real and but we don't have we're not privy To those conversations often and how can those real life non-sda non-sucky didactic art Real life experiences, you know, can be then translated to people so that that they can be It can be visceral can feel it. You can see all the God, what are the threads of them of the mushrooms that are underneath that are my scene? No, my cilia right right of all that stuff that's really happening that then to percolate up You know, I'm sorry. That was a little departure, but I just was so inspired by Allison because because Allison and others brought Story circles to that gathering that were at the united nations that were so unbelievably powerful It was so amazing and you know, that's a little infiltration of theater into context that we know you not necessarily think of Sorry for that digression. So we're going to go ahead and do the break Right, jaymie and tell us where we're going next. Yes. So Before we go to break, can we give david dower who has been our shipper through the past and three inner circles a round of applause Thank you david So we are going to take a 10 minute break


So this is the discovery and execution of entirely new classes of web attacks in order to meet your girlfriend. So before we begin, a little bit about me. I'm a security researcher. Narcissistic vulnerability pimp is what they're calling them these days, right? I do not do security professionally. I do it for fun, like most of you guys or some of you guys. I'm known for the SAMI worm, the worm on MySpace a couple of years ago. I co-founded Phonality, an IPPVX company. If you're familiar with Tricksbox, we developed that. And I love Lady Gaga, but I love Kesha too. It's kind of in between. I'm not sure. You're probably wondering, like, why haven't I heard of this guy or hasn't this guy done he's done nothing for a couple of years. Why is that? They didn't let me touch computers. It's true. It's true. A few years ago, I was raided by the Secret Service, electronic crimes task force. They came into my home. They took all of my computers, well, my laptop. They took my phone. They took any CDs, DVDs. They took my Xbox. Yeah. Yeah. I dealt with court, literally could not touch computers. I was banned for life. A couple of years later, I fought and I fought. And I am now back. Rob's touch computers, all right. But I'm not allowed on MySpace. All right. So what are we going to talk about today? Talk about the web. Why the web? Honestly, you know, I got bored of the web a couple of years ago. You know, it's really cool. There's so much you can do with it. But security is so much broader, right? There's so much cool stuff going on here at DEF CON, just in security in general, right? You have reverse engineering. You have network security. You do have web application security. There's hardware hacking, all this cool stuff. Some people have even made ATMs dispense cash. You probably haven't heard about that. It's a really cool new thing that they're talking about. But the web is actually really cool in another way. Everyone has a web browser. If you get a computer and you have an operating system, you have a web browser. So it's like the one piece of software that allows me to deliver code to you and for you to execute it. It is basically code delivery mechanism that I can attack anyone, anyone. Everyone has the Internet today. It's kind of like when the App Store came out for the iPhone, right? At that point, you could deliver any sort of content that you wanted. Of course, Apple bans malicious content and fortunately they give us freedom from porn. So the web browser is just like that except no one's guarding it. There's no one checking to make sure that your site's not malicious. I mean, obviously there are companies that are doing this in software that's working on this. But for a long time there hasn't been. So this is my home page. It's probably for many of you. Anna Ferris. She's amazing. I'm in love with her. So I was checking out, you know, just pictures of girls on a social network as I typically do before I get in a lot of trouble. And I found her and I think, man, she's amazing, you know. She's the kind of girl I want to get to know. So I'm looking at her profile, looking through her pictures. I can't really see too much. She's not my friend. Thought about that for a second. And then I saw, oh man, you know, I should message her. But then I saw she's in a relationship, not an open relationship. It's not complicated. She's in a relationship. So I'm like, who is this guy and how am I going to best him? So I look into him a little bit. All right. So this guy, he's a certified information security specialist professional, yeah, chief executive officer of SEC theory, co-author of XSS exploits, oh no, author of detecting malice, co-developer of clickjacking, really cool technology with the really awesome Jeremiah Grossman, runs hackers.org and slackers.org if you guys have ever been there.  It's pretty impressive resume. A man who needs no introduction, Robert R. Snake Hansen, this guy. So here's the problem. I want to attack this guy. We all know we can attack random people on the web. You have a little bit of malicious content on there and you'll get some sort of hit rate and if you get enough visitors, you will be attacking random people. But I want to do a targeted attack to someone who is secure, someone like you people who understand security, who are probably running with a lot of technology to help secure yourself. So how do we do it? How do I attack him? You don't. You do not attack that person. You attack him directly. Ooh, that's what I'm trying to attack. Come on guys, come on. So he's on Facebook. Facebook is an awesome website. It's a social network. It's the cool one these days. Now if we go to Facebook, we'll see something in the URL bar. Index.php. I know what you're thinking. It's FIP. It's not. It's PHP. I looked it up. It's a computer language, typically used for the web. It's an extremely common web language. I'm sure all of you have at least heard of it. Many of you I'm sure program in it. It's great because it's extremely common. So it's well understood. The code is open source. You can all go and look at it and see what's going on in there. It has extremely, it basically has very good session management that everyone uses. Every single person who does PHP and uses sessions typically uses the built-in session management. If you're using frameworks like Coke, CakePHP, or Kohana, or Codeigniter, or any of those other things, they're also using this session management. So PHP sessions, what are they? They're basically a random string that's generated. It's passed either in the URL or cookies. So what are cookies? Yeah. It's my second favorite. A cookie is basically a persistent piece of text that remains with your browser. I'm sure all of you are familiar with it. This contains data, typically it will contain a session data. Session data is basically a random string so that when you go to any page on that website, it can identify you with other information the server has stored locally. So when you go to Facebook and you log in with a username and password, they provide you a random string that is assigned to that username.  So it authenticates you. So let's try to attack a session. Let's look at PHP session code. So WinStore. So we pull up session.c. This is the function session start. This is what creates a session in PHP. Basically what happens is it creates your random string right here in the snippet of code in this sp per nef. It's looking at a couple of things. It's looking at the IP address of the person authenticating or getting this session. It looks at the epoch, which is basically a time from January 1, 1970, the number of seconds. It's looking at the microseconds that that person acquired the cookie and it's looking at a random, just a random number that's created. So if we take all of that, that's 160 bits of entropy. We're going to get a little deep here just for a little bit. So 160 bits is a lot if I were to brute force it. Let's say I wanted to become our snake on Facebook. What I would do is I would brute force this session, that random string, but 160 bits, that's a lot. Now, bits can be a little confusing. We'll just do a really quick primer. You know, 64 bits is not double 32 bits. Every time you add a bit, you're doubling. So just a quick primer, what we can do is a little trick for every 10 bits. You can add three zeros. So 10 bits is a thousand, 20 bits a million, 30 bits a billion. Also if you can just remember the 10 bits, zero through nine equals one, two, four, eight, 16, 32, 64, one, two, eight, two, six, five, 12, you can take that number to figure out what you want. So 25 bits, we know five is 32, and the 20 bits, right, is six zeros. So 32 million in that scenario. So 160 bits is essentially 10 to the 48. If we could brute force at 100 trillion values per second, it would take 900 quadrillion eons to brute force. I didn't even know what an eon was. I had to look it up. It's 500 million years. It's a lot. Brittany knows. So again, 160 bits, we're not going to brute force this. It doesn't matter how fast of a computer you have. So let's take a look at this a little bit closer. Well, microseconds isn't really 32 bits. They're only million microseconds per second. Well, a million, if we remember, is only 20 bits, right, because they're six zeros. So we actually just reduced, without doing anything, the 160 bits. And we reduced 12 bits and got it down to 148 bits, which doesn't help us. That's a lot. So let's take a little closer look. If you're familiar with Facebook, it has chat. When you go online, or when someone logs in and you look in the chat window, you actually see that person come online. How is that happening? That's happening with Ajax. Your client is continuously checking with Facebook to see, is someone else logging in, is someone going offline, just to understand, get an updated status. Well, if you use something like live HTTP headers or a packet interface or something, you can see the HTTP request going back and forth. And you can recreate those if you'd like. And what you can do is you can just send that request, is there anyone new online, every single second. As you're sending it every second, one of these times, our sync is going to go on because he wants to check if anyone poked him. The cool thing about this is that if you see here in the red, the date in red is sent from the server. The server sends us their local time. Our local time doesn't help us too much because we don't really know the difference between our local time and the server's local time. That local time helped create that cookie, if you recall. So that 32 bits, if we are checking every second, we can now reduce that 32 bits as soon as our sync comes online. Just by watching that every second, we've got a program to do that. We see him come online. We take that date, convert it to epoch. We just reduced 32 bits. We've now reduced the 160 bits by 44 bits down to 116 bits. That's awesome. It's still a lot. Let's go further. So he comes online. We can send him a message. Well, why not send him to my blog, NAMB.LA, NAMBLA. So you send him there, and then what you do is you just track the IP address. Don't worry, there's no XSS. There's nothing on there. If he's running NoScript or something that's protecting him, there's nothing malicious on my website. So he goes there. Nothing happens to his browser. He sees a really cool blog post about how I did a DEF CON talk and everyone loved it. And what we do is we track the Apache logs and we see his IP address. There's another 32 bits of that cookie. So we're now down to 84 bits from 160. We're basically half, well, it's not really half, okay, bits. So confusing. All right. So anything left here that we don't know, we don't know 20 bits of the microseconds. And we're not going to guess that. There's no way we're accurately going to guess the microsecond that someone logged in on a remote system. You might be able to if you tried really hard, if you got a system really close and you timed things really accurately, but it's not worth it. So the only other thing left here is this random LCG value, 64 bits. What is this? An LCG is a linear congruential generator. It's a pseudo-random number generator. They've been studying for years. It came out like, I don't know, 25 years ago or something. It's older than I am. If they're really well studied and they're really well understood, you can actually look up information on how to reverse them. The LCG use here is actually two LCGs that are combined. So it's a little bit harder and I don't know that good at math. So I didn't understand it too well, but I looked over the code anyway. Now as soon as the LCG or the random number generator is called, it's seeded. The seed basically provides the actual random data that provides every single random number from here on out. Now the seed is critical to the randomness of the PRNG. So let's take a look at the seed function here, this LCG seed at the bottom side of the screen. What you'll see is we do a get time, there's two parts of the seed and it's 64 bits. It's 64 bits of entropy and every random number is also 64 bits. It's split into two, called S1 and S2, they're each 32 bits long. Now S1, if you can see, is this thing called TV seconds, XORed by the ones complement of TVU seconds. What that is is that's the epoch, as soon as it's seeded, XORed with the ones complement of the microseconds that the PRNG was seeded. S2 is the process ID. So let's just take a look at S1 a little bit more. That's 32 bits of entropy we're looking at right now. The interesting thing about this is the microseconds, the seconds that the PHP was seeded was probably when the web server started. We don't necessarily know when that happened, but we can potentially make an estimate. We could also send thousands and thousands of requests to a web server to get it to reset and to figure out when it started. One of the issues is we won't know which requests caused that restart, but we can make an assumption that it happened in the last hour if we send enough requests. Now what they do to make this harder to guess is they XORed with the microseconds. There's no way we're going to know the microsecond that the web server started. But they're XORing the most variable data of the epoch with the most variable data microseconds. The fixed data like what year, what month, what week it started remains the same. Basically it's being XORed, the fixed data remains fixed. So we end up with 12 bits that we can guess. If we know within a 12-day period of when PHP started, and again if we don't we can send enough requests to get that. The other 20 bits is just microseconds XORed with the other variable data of epoch. We don't know that. Whatever. That's 20 bits. We've just reduced 12 bits of entropy in the random number generator. So let's look at S2. Process ID. Get process ID. That's 32 bits of entropy. Well process IDs on Linux are only 15 bits long. So immediately you reduce 17 bits. And if you can execute PHP through any function, if you can acquire, if you can execute a program like PS, if you can hit an Apache server info page or something like that, you get the entire 32 bits. We've now reduced the 64 bits down to 20 bits in the PRNG. We are now at a total of 40 bits of entropy from 160 bit seed. I'm sorry, from 160 bit cookie for every cookie in PHP. That's awesome. But wait, there's more. We can take, normally you think, all right, well we have 20 bits and 20 bits, so that's 40 bits. Well we can actually calculate the PRNG, the LCG value, the 20 bits that we didn't know, separately. Separately means we calculate that 20 bits and then the other 20 bits, that's only 21 bits. We can calculate, with a time memory trade off and code I created on your DEF CON CDs, we can calculate that 20 bits in a matter of seconds, seconds. That reduces the other 20 bits and now we're at exactly 20 bits, the 20 bits of entropy from the microseconds that the user authenticated their cookie. That's a million cookies. On average, we'll be able to log in as in with 500,000 requests, which we can easily do in a day. So I've done it. I've become our snake. So what can we do at this point? Well first let's understand, how do we fix this? Make sure you're running a later version of PHP. Entropy is, I sent this over to PHP and they quickly released the patch. They added some more entropy. Or create your own session values. Use your own randomness. One of the great things about PHP is that it's very fast. It's meant to be fast. So they don't want to, it's also OS, it's cross compatible. So they don't do too much that's very system level. They're not going to access DevU random because that's not on Windows, for example. Create your own session values. Or seed your own random number generator. You don't need to understand crypto. Just use a strong seed that your system comes with. If you're running on Linux or VSD or something like that, use DevU random for your seed. Don't use a process ID. The attack is difficult to execute. It's much easier on social networks where I spend most of my time, unfortunately. One thing to note, Facebook is actually not vulnerable. This is not an attack on Facebook. If you're familiar, Facebook has created their own version of PHP called HipHop. Some sort of mash of PHP, turns into compiled C++, supposed to be much faster. I love Facebook. If you go on there, if you could just plant some crops for me in my farm, I'd appreciate it. So at this point, what do we do? I'm logged in as our snake. How am I going to meet this girl? She's happily boyfriended? I don't know what the word is. So using his cookie, I can now message her as him. So what do I say? Well, here's the thing. Why don't I send her to a malicious URL? Nambla. We're going to attack her network now. So this is your network. This is your network on drugs. We're going to learn a little bit about a network and a NAT here. This is a NAT. So a NAT, what it is, is basically a system that allows you to run multiple systems behind one public IP in a nutshell. All of your computers behind the NAT will typically run on private IP space. This allows you to, typically, your cable modem will only provide one IP address. They use a router which contains NAT software. And that will allow all of your system, all your network devices to run behind the NAT. It also is somewhat of a firewall. It prevents people from accessing services and ports that you have running on your computer whether you know it or not.  Well, let's talk about something that some of you may have heard recently called cross protocol scripting, XPS. The cool thing about this is HTTP servers can run on any port. This means the browser will allow you to communicate to other HTTP servers on any port. But HTTP is a new line-based protocol. What that means is each line has some data rather than some weird, let's say, XML formatted data or a binary stream of some sort. But there are other protocols that are also new line-based. So what we can do is we can actually communicate with a different new line-based protocol like IRC. IRC is a great place. It's good people. So this is what an IRC connection looks like, just so you can tell really quickly. I tell that to a reputable server like FNET. I log in. I basically say my name is Sammy. I respond to a ping request that they have one and then I join a channel and I find out where I can get WinNuke. It doesn't work anymore. So if anyone has a version that works, please send it to me. This is how we do an IRC client on the web. What's interesting about this is I create a malicious page that has this code running on the page. You visit my malicious web page. Now your client connects to the IRC server. Your web browser thinks it's an HTTP server and what it does is it sends the HTTP request with the post data of my IRC data. Now the IRC server says, well, I don't understand this HTTP request. I don't understand this line, line, line, line. Oh, I understand this. I understand join pound hackers. I know what that means. I'll interpret that. I'll just ignore all your other stuff. And at this point you're getting, I'm making your IP address connect to the IRC server. Now this can be used for SMTP, for example. Spammers have actually been using this for years and years and it hasn't been really well known, but they've been basically making people's browsers become spam servers. You visit a page and without you ever seeing on the back end there's a form that's connecting to an HTTP server on port 25 and auto submitting that form and then basically you're now sending Viagra spam. While you're going to Viagra site, I don't know, but that's what they have on the back. So this is what an HTTP post looks like. You see basically all the HTTP headers that your browser is sending and then you see the IRC data. Again, the IRC server ignores the data it doesn't understand until it hits the data it understands. So I'm going to bring this up. I'm going to talk about something called NAT pinning. Yes. NAT pinning. It's like XPS over times 9,000. So what is NAT pinning? Well, here's the thing. Your web browser was confused. It thought it was communicating with an HTTP server, but it was communicating with an IRC server. So NAT pinning takes this one step further and basically it makes the router also confused and thinks that it's communicating with a different protocol. So now your router thinks it's communicating with IRC, your browser thinks it's communicating with HTTP, and they start doing different things. What can we do with this? Well, let's take a look at a malicious server. That was supposed to say HP. I don't know what happened.  Now, if you're familiar with IRC, there's something called a DCC. It's basically how porn is sent over IRC. It's great. It's a great protocol. Basically what a DCC is, it's a direct client connection. So when you communicate with an IRC server and you're chatting with all the other really cool people, you say, you know what, I want to send you this file. So connect directly to me. I don't want the server to, you know, there's no point of the server bridging this file or this chat. So we'll connect directly. The way that works is you send a message to the person and you say, hey, I want you to connect back to me on this IP address, on this port. Now, years ago, Routers didn't understand this message. There was just another, it was just TCP traffic. And what would happen is if you didn't have that port opened or forwarded to yourself, then the connection would never establish. People complain, you know, this broke all sorts of things. It broke IRC, DCC, it broke FTP, it broke SIP. So Routers got smart. They started developing software that would actually watch the traffic, look for messages like this, the private message, Sammy, you know, DCC, chat me. And if they saw that message, then they would say, oh, a client on my network is trying to get a file sent. So I'll port forward that port back to them.  I actually want this person to connect back to me. But you can visit my malicious website and your browser sent this data. Well, what if I put that DCC message in the browser, in the JavaScript submit? I can, now you visit my website. The website submits that malicious form to just some random server. And it says, I want you to connect to me on port 22. And port 80, and port 4 for 3, and 25, and 21, and 23.  That's it. The browser has no idea what's going on. It's just filling out its request. And I am attacking you on every single port. Here's the code. It's also on your CD. Have fun. So this is really cool. Now, once the XPS stuff basically became big, the browser started working on blocking certain ports. They said, you know what? You shouldn't be communicating on port 6667.  Choose a different port. So they started blocking ports. Now, the interesting thing about ports is their 16 bits is the size of a TCP or UDP port. Now, if the browser says, I'm not going to allow connections on port 667, does this port match 6667? No. Just overflow it. So if you add another bit, and you add 65,536 to it, you get this bigger number, right, 72,203. Your browser says, oh, that's not 6667. This will go fine. It gets sent to the TCP stack, which then shortens it. And now you have 6667. I did not think of this. It was actually the respectable security group, Goat C security, that came up with this. Very good people. Very awesome, very awesome. So at this point, Anna has clicked on my link. Wow. And now I've attacked her ports. So what did she have open? Well, a lot of OSX systems have a web server running by default. She was working on her website. So cute. So I connected back to her port 80 and saw she was making her own website about Team Jacob from Twilight. I love Twilight. Now I know how to get her. I'm just going to win her over. Here's the thing. I'm actually on Team Edward, but I'm not going to tell her that. So when I see her, I'm going to say, I'm on Team Jacob. So how do you stop NAT pinning? Well, there are so many ways that you want to have multiple layers. So you want to strict firewall, try to make it as strict as possible if you can. If you don't expect people using IRC on your network, block it off entirely.  You can actually turn off UPNP and other protocols that allow this type of thing to happen. Client side run up-to-date browsers. WebKit was vulnerable to the port overflow. I believe they're resolved now. Other browsers might still be vulnerable, I'm not sure. Make sure you're running up-to-date browsers. Use NoScript if you're using Firefox. That'll block all sorts of types of things. When I released NAT pinning, NoScript a day later added protection in. Run a local firewall if you can, like little snitch. I mean, really, we all understand security is not just one level of security. You basically have to use multiple layers of protection, like I would with Anna. So at this point, I know what she's into. I know how to win her over, I think.  I'm going to say, you know what? This guy, Sammy, he's a really good friend of mine, he's going to come over and take care of you. Check out his Twitter on Nambla, slash Twitter. So now, the moment you've all been waiting for, triple X, SS. This is awesome. This is actually really awesome. We're going to be talking about geolocation via triple X, SS. So how does this work? Anna visits my malicious site. She then, triple X, SS scans her local network to figure out what kind of router she's running. This is very simple. Here's one example. There's a million ways to do it. Basically, I have iframes on a bunch of different URLs that are known router locations on your local network. I can't access that, but because her browser is on my site, it's now her network that's accessing it. So she's accessing <IP_ADDRESS> addresses. If any of those addresses work, an onload occurs, which says, oh, I detected a bulk in router. Oh, I detected a Verizon Fios router. And now we know what kind of router she's on. After that, we could log in with default credentials. No one changes their credentials on the router. They're like, who's going to connect? Hey, you need to have a really strong, let's assume you're running WPA, and the only way to connect is either knowing the WPA password or by getting physical access. So who's going to be able to access those internal IP addresses? Well, I can. So can you? So make sure you change your credentials when you have a router at home that has an HTTP-based authentication system. This is not necessary for this attack in many cases. But here's a way to log in to, I believe this is a bulk in router. There's actually a nice list of XSS, CSRF, and default passwords for every major router that you can find online. So in a visit to the site, we figure out the router type. We log in if we have to, which in many cases we don't. And then we XSS the router. And we load remote JavaScript. All right. So what's the JavaScript do? The JavaScript then uses Ajax and connects to another page on the router and acquires the MAC address of the router. All right. Well, who cares? It's a MAC address. What's the big deal? So briefly, what is a MAC address? It's basically every network device on your network has a MAC address, kind of like an IP address. It's in hardware. It can't change unless you're spoofing it. And it's how everything communicates with each other on your land. So why the MAC address? Why do we want to acquire it? What's so interesting about it? I'll take you through the steps. Just bring it. Open your browser. Type www.bing.com in the URL bar. When the search box comes up, type in Google and hit enter. So why Google? Oh, yeah. Because they know everything. Really. So some of you may be familiar with this. If you remember Aaron Andrews, the peephole video that came out. Google. Google Street View. Actually, peephole.google.com, I think. So this is a Street View car. Many, some of you may have seen it. Some of you, lots of you probably know what it is. It's the car. It's the one guy who drives around America taking pictures. He drives down every single street. This is going to be the worst job. Now, we understand Street View is really cool. You can go onto Google Maps and you can see all the different streets, the people flashing the cameras, marriage proposals, all sorts of awesome stuff. What you may have not known is that they're collecting data. Now, recently there was this big thing about Google collecting unencrypted Wi-Fi data. Well, this has nothing to do with that. I assume they don't have any of that Wi-Fi data, which they've already deleted in a lot of places. They're still collecting other, right, they're still collecting other Wi-Fi data. So what are they collecting? Well, as they're driving around, not only are they taking pictures, not only are they mapping GPS coordinates, but they're also looking at just Wi-Fi packets in general. Not the data portion. They're looking at the headers. Now, what's interesting about the headers? It contains MAC addresses, a hardware MAC address of your router. The same device that we acquired, the MAC address that we acquired just with our triple XSS. Alright, so why is that interesting? Well, at Wi-Fi you can detect strength. As they're driving down, they're actually detecting my network at home, Mojito's Mo Problems, if you ever see it.  It must be close.  It gets to its maximum, say, 85 out of 100, and then it starts to basically go down. Well, they've just triangulated my position. They're actually not only are they going on that street, but they're going on every other street around it. And now they're getting even more accurate data. And I may see it actually goes up to strength 95 on the street parallel to mine. Now they know that I'm actually closer to that street than I am the other one that was at 85 strength. They are literally triangulating your network. It doesn't matter if you're encrypted. It doesn't matter if you're using WEP, WPA, WPA2. The packets are flying and the MAC address is in there, unencrypted. So, how do we use this to our advantage? Well, Firefox has this cool feature that very few people know about called Location Services. It's really cool. What happens is JavaScript will execute. You can go to a website and JavaScript will execute and it will say Firefox understands this and says, oh, I better collect the MAC address of my gateway and send it to Google and find out where I am. Well, they're smart. They said, you know what? We probably shouldn't do that by default, even though we'd like to. So what we're going to do is we're going to ask the user. We're going to have a little box come up that says, do you want to share your location with this website? They want to do it. You can't take it over with click jacking. I haven't really found any way to basically hack it in Firefox. Other browsers don't have support for it yet. I believe a developer build of Chrome does. So how is this interesting? We can't really access it. They visit our malicious website, but we don't want them to see that and they're not going to click it. Well, Firefox is making an HTTPS connection to Google and asking them for this information. Well, why don't we make that connection? I can write a program on the back end, so when you visit my website, I use triple XSS to acquire your MAC address and then I send it back to my little program running in the background that's not running on your browser anymore. I then connect to Google. I send your MAC address in this post request and it sends back your location, your coordinates. Jack Bauer level triangulation. Now, just to understand how accurate is this, this is an actual router I have exploited and I knew the address beforehand because Anna was there. So I went over there and I did a Google Maps request and I said, you know, take these coordinates and drive me to the location, the address. Let's see how far it was. Driving directions, 30 feet. I looked over the router. It was 30 feet away. Seriously, that's what it said, 30 feet. That's how accurate the coordinates are. I mean, it's on that router that I was exploiting. I think Zuckerberg said it best. Privacy is dead. Thank you.