Good afternoon ladies and gentlemen welcome to the January or February feels like January feels cold The first Friday forum for the month of February I'd like to thank all number one all of you for being here today I'd also like to thank our sponsor purveyor health for continuing to support first Friday forums and without further ado We'll introduce today's speaker. Mr. Brian Doudna Executive director of the Sheboygan County Economic Development Corporation. Mr. Doudna First of all, thank you, and I want to just give compliments. He actually got the last name right my in my one of my communities I worked in Forge County for a decade and it took four years before my board chair got that name right at our annual meetings So just want to say thanks for the invite today. I'm not going to talk a lot about economic development itself I'm going to really talk about what the EDC and how we're transforming the organization and what our next three years the Strategic direction we're going and how we can start collaborating and engaging the community more and more as Part of our economic development strategy So the theme up here is really setting the course and you're going to see the scope of work for our Strategy and we're going to do a deep dive and it's a couple of those categories a Little background about myself as you can tell I'm probably not that young anymore So I've been pretty much around the state I started out in La Crosse as in the Sparta La Crosse area as a main street manager went up to Rhineland in Managua ran a county wide EDC up there Very similar to what we have here Then down to Stevens Point Plover ran their county wide chamber economic development corporation actually ran their W2 agency Also, we were their job center manager Let's just and we had a for-profit corporation that actually built buildings as well so very very diverse Project over there and then a decade in Eau Claire County running a county wide EDC there and then for family reasons I needed to get to Madison so actually was the first full-time director of the Wisconsin Economic Development Association and At that trade association think of a statewide chamber for all the economic development professionals in the state We actually train people on economic development. So it gave them a search certification Educational programs, but we also lobbied on public policy And now this is a hundred twenty days as of today start October 5th, and so I'm happy to be here and I truly want to have a decade here Hopefully I can have a decade here and Enjoy a lifetime With you all in the future. I just bring up a study that I was a volunteer project manager For at the state level called to be bold study. This was when governor Doyle was Transitioning out he wasn't running for re-election with that study actually was the one that helped form Transform Department of Commerce into what is now the Wisconsin Economic Development Corporation Just to tell you how we do engagement. We actually had six candidates for governor endorse that strategy Okay, and governor Walker won the election and then he formed WDC But the strategy was endorsed by Democrats and Republicans and but governor Walker made it his own and drove that strategy and my sports loyalties Are there for your future reference But before I get into our overall strategy if you don't know when you should talk to an economic development corporation I just want to give you these top seven questions and we're actually working with financial institutions to get that out to all their customers so that During this unique time in our history and in our economy that we can get as much technical assistance out to companies as Possible, but if you can say you're adding new production space Or equipment adding new staff or technology And or adding a new product line or exporting a new product Those are the types of things that you should be reaching out to us because all those questions if you answer with yes to one of them That's where we can start looking at providing technical assistance on how you can navigate those waters That might be new to you the thing that about an economic development corporation is Companies may do expansions once or twice in their life cycle in their life in a decade or more I can have development corporations should be managing expansions for companies five to seven times a year So we should be your concierge to helping you grow little Information about the numbers. I just want to give credit to Ray York in our on our staff at the Small Business Development Center Staffing, but also all the financial institutions and Probably too small for you. Deidre has this and she can share the presentation for you but you can start looking at the amount of Investment from all the grants that were have been made available through the PPP The SBA this WDC etc. So when you start looking at it, I mean It's very large numbers. So key factor here is then with a new round of Stimulus, I would just want to make sure that any local finding a local Business is really reaching out to their financial institution making sure that if they're eligible for PPP I'm sure that's already been handled, but the new round of stimulus also provides for SBA loans from February through September Where you do a 7a type loan for even working capital type You should be able to get three months of principal interest is my understanding depending on the industry sectors You might get more Where the SBA actually is paying that so that is a in a form of grant that really is not taking into consideration When we start looking at these activities But mission critical right now is making sure that our companies have working capital to be successful if they're being Having a distressful year and a half The one thing that we're doing at the EDC and I want to just give credit to the mayor for bringing this to my attention is we Actually took some of our operating budget with we normally have an annual meeting and we converted our annual meeting budget to a resiliency grant To support local businesses. So if somebody's trying to get online online sales things of that nature Ddra just got an application that you can she can share with your her members Where we have dollars to do search engine optimization and or online sales is a match But what we want to do is make sure we're not trying to change who your provider is but we want to make sure that We don't know how long it's going to get back to before Customers get back to normal shopping patterns. So search engine optimization We think is mission critical and for all businesses and when you start looking at how much we've converted to online sales in the last six months So now our engagement process we are Launching four different cohorts and really it's going to be five but four that we are really focus in on long term as part of our ecosystem of building a Stronger economic development Collaboration in the county One is on talent acquisition and that's what the human resources and I want to just say we had a meeting on the 28th and I will just say it went a lot better that I thought it would so that's very exciting But we have we have proposals and what we want to do is These cohorts give us the voice of the customer So EDC staff might have thoughts on hey, this is what we need to do This is the direction But we need feedback from the market to tell us exactly how we should implement and how we need to pivot to be successful in this community in this county so we're also looking at launching an in-house training department cohort in March and Had initial meetings with some of the in-house training departments We have a first meeting of the banking community Back in December and that will be continuing to move forward and then we have a whole innovation strategy that we just adopted in January But we'll start working on that Probably in the second quarter as you can imagine 120 days and we're already doing cohort launches. So we're trying to stagger those for capacity November 6th, we had a strategic direction or strategic planning session the four key outcomes from that would be We need to increase the just total number of bodies in the county that are working age Our unemployment rate is low our net in migration. Actually, I thank God we have people having more kids than deaths But otherwise in migration is a negative number and I shabuagan County and that's The one number when I moved here I was shocked that you had a negative and in migration of people relocating to this market and That has to change and that's going to be really tied to our talent acquisition strategy Expand the diversity equity and inclusion efforts Talent attraction and development and then housing affordability And we'll get into the terminology of what housing affordability is But very definitely if we bring in more talent and more people We already have a tight housing market. How do we we need to expand more housing units? I'm not talking multifamily. We're talking now single family We have very definitely and I know the city is doing a housing study and we'll be looking at that Information to say, how do we navigate moving forward? So November 6 November 18th the board adopted this these statements And I just highlighted a few points of interest Encourage private sector investment Everything the EDC has done on spurring growth and investment. We will continue to do. Okay From helping with Applications and I think we'll probably do more on helping with applications for the employers and actually filling out a follow-up report So that my strategy is once I get you in the program I'm going to make sure you can complete the program and fill out the paperwork and you have technical assistance because From my perspective, I got you in that mess or in that red tape. I'm going to make sure you can fill out the red tape okay, but It also benefits the company to have a more effective cost effective expansion second is train the diverse and stable workforce as well as attract and retain when you're at two or three percent of employment, I mean You're going to have People moving from one company to the next we need to start looking at how do we increase the skill sets? Baseline of everyone in the county so that as they transition between different companies They are successful and our companies are not having to continually reinvest in baseline training Great place to live and work and play again, we have to change the net in migration to make sure that Everybody knows The reason I moved here is I know I want to live here and I hope to retire here. Okay. This is a unique Community unique County you have caring companies and you have caring communities. You don't find that everywhere in the country Everywhere in Wisconsin So I mean this is a unique market Inclusive community growth and then also Provide resources and expertise and the other thing that as a number that has popped out to me is We are the rated number one if you look at stats America. It's an economic development administration does rankings We're ranked number one in the country as a MSA metropolitan statistical area for large employers per 10,000 Workforce so for the size of our workforce. We have the highest percentage of large employers anywhere else in the nation that's Pretty good. And when you look at poverty levels and everything of that nature our companies invest in our people the scary part for me was Small business growth. We're at 360 or 362 out of 380 So we have a lot of people working for those companies But we don't have that economic churn that start up excitement to get going on the innovation side And that's what we're going to do on the innovation strategy moving forward and I would say give credit to the city on the whole innovation strategy and thought process So statement one just to give you a little deep dive on what we're going to be working at commission studies on housing and retail The city already was doing the housing study. So thank you city for helping us get that first one done We will look at doing retail But I would say we're going to wait until probably the third or fourth quarter until we get a better sense of how Everything is transitioning With the economy on everything Convenient cohort for housing once we have the housing study done is our intent to bring developers financial institutions Local governments together and I will say legislators will probably invite you as well To start really hammering out the details of how do we get? affordable single-family housing and when I mean affordable of 2008 price tag on $178,000 home, and I saw this number. So it's not exact. So I apologize But 170,000 home in 2008 2000 Time frame is around 220,000 today because of construction materials cost of land all those things We have to skip back to how do we manage that and that goes from policies on the state level from TIF and how we use TIF for housing To how we have zoning codes that match up with the needs of affordable housing Transportation I would just note that our commuting patterns for the county 86% of the residents in the county live and work in the county and we have great employers What's shocking to me is we get sort of six percent coming from Mads walk Two percent coming from Fond du Lac and the other you can do the numbers. We have two percent around Sheboygan County needs to be a destination for employment and we are and so we just need to get that word out more than we Have but transit daycare all those barriers to people getting to work Needs to be a part of our strategy and statement one to get that More people 25 to 44 living and working in Sheboygan County And we're going to update our website. So that's more internal for us any questions All right statement number two and this is again retain train in a workforce and attract We have really We had a partnership and what we have a partnership. Sorry about the phrase in there We have a partnership with the Chamber for someplace better. I would just say someplace better needs a complete revamp I view someplace better And I think the board and now I hopefully think the art the human resources director that's our closing website as in People are getting an offer or they are truly thinking about relocating and that's where they're going to get All the information of what's their budget? What's the cost of housing all that and the calculators to make informed decisions? Right now. It's a good quality of life piece. It's Good, but it is not making helping people make critical life-changing decisions and that's what that website has to be about It also has to say Whether you're in the amenity is in Sheboygan County or surrounding Like an hour from here the lifestyle that you can have here is amazing and That's why it is someplace better. And so right now. It's on the edge, but we need to really enhance that talent relationship management Anybody with a connection to Sheboygan County whether they grew up here and left when they were in a elementary school or left in college or they Had a family where I had to relocate to Madison to take care of family. We want to maintain that relationship That is mission critical to us as employers in the county and as an economic development strategy regardless of pay scale Okay, regardless of pay scale and Skill sets things of that nature Talent recruiter online sales kit. We'll talk a little bit about that and the last thing is Employers education exchange. How can we collaborate better on talent and skill development? And so we have had conversations with some of the educational institutions and we're truly looking at Now how we can align our employers on some of those strategies So our first proposals that were given to the HR cohort for feedback was a recruitment response kit and talent community and then the revamp of someplace better Sales kit the way I phrase it is an online tool We'll have up to 50 companies being able to use the same license As you can imagine, I think there's probably 50 companies out there recruiting talent whether it's regionally or Nationally or globally To get people relocate here and they're all responding to similar questions of hey I'm a single parent. How do we where do I find my? The community for my child that's in middle school or whatever We want to make sure that as Companies learn and I'll respond that the people that do a lot of recruiting on a day-to-day basis I Share their expertise and collaborate with the companies that might only recruit four times a year for positions a year So that those templates for emails is actually going to be a collaboration of those 50 companies I call it the Disney script for Sheboygan County So you think of your should boy your Disney experience you have scripts We're going to start doing that by lifestyle by age age of kids all those types of different communities that Will have built that sense of belonging so that people can envision that they can live and work here and have the best time of their life here And of course we'll be referring that back to The someplace better website Our website is going to be completely revamped tied to those responses going to talent Okay, so if somebody is getting an email from one of the recruiters and by the way Not all the recruiters live and work in Sheboygan County So the what happens on with sales kit is you might have a recruiter in Chicago They email. Hey, this is the question that this person. We're trying to recruit here here What that has and then they ask the HR director then they HR director kind of starts talking about Who they what they think their best answer is and then they respond We need to that bottleneck has to be modified and we think sales kit will do that But that will then get us to Those questions and how we respond to those questions will directly feed into the content of someplace better So that this content of someplace better is truly tied to the deliverables that talent want Okay company we keep Right now there's a job feed from indeed and a couple other sources into someplace better I think that's the disservice to the companies that we keep here We have locally owned companies that are global in nature and or regional in nature But they're locally owned and they're committed to the community. That's our selling point Okay, so we will be making a true emphasis on showing the local Commitment and local brands that our companies have and So they'll still have job their access to the career pages things of that nature, but we are not going to have a job board where the one I always I'll just say the day I made the decision. We were going to have a job board. It was the day I saw Amazon hiring in random lake. I Just didn't think that was the type of job we wanted on someplace better. I think it's Amazon That's not our goal Comparison tools again going back to how and what will make you want to live and work in and how do you make family or life choices? And it's going to be tied to topics and locations So easy one is a paycheck calculator if you're moving from one part of the state to another or Different states across the border coming from Illinois coming into Wisconsin. That's an easy calculator But again, we can do that for many different factors from housing rental units things of that nature in the new content I'm going to Go to is really social media let fed We have amazing amenities here and it can be tied to how the different people Engage in the environment that we have the different activities from the art center to the museums To the storybook garden story is it storybook garden park or Thank you. Sorry. I'm still learning So we want to do social media feeds and have The people of Sheboygan sell it So at the January 28th meeting Employee resource groups. Those are groups within larger companies that are tied to areas of interest We have engaged them to start Sharing and or having intentional collisions with activities that are interest of that population in the community and so that we can start having Continuously new content going into someplace better when we talk about the talent community, we will have a Monthly newsletter that goes out to talent that are part of the talent community tied to every level of job being created throughout the county and Again making sure that they are whether it's now or six months or two years from now We continually to send the message that this is the place for them to be the talent community Sorry gentle has started a talent community. They have a form over there. I know the chamber. They're the BEP committee as talked about a talent community and This is the audience that would be getting the newsletter and I just want to state from our meeting on the 28th to now We're going to be adding hourly Trying to figure out an hourly production staff Strategy specifically for the talent community and how it works but also I've already directed our Marketing staff to start developing a campaign. We were looking at a fall build out of campaigns But now we will start looking at a spring build out of a campaign tied to hourly and again that regional Brand employer of choice throughout this region. So haven't figured out this what we're going to do there yet But based on the feedback We want to be able to do that So again build out in 21 design campaigns in the fall, but we're going to do an hourly We're coming up with an hourly strategy in the spring and full implementation in 2022 And I would just note since we have legislators here, I would just note that WDC in the governor's budget Previous years there was a special allocation for talent recruitment into the state in the five to six million range That is zeroed out in this the governor's budget as from the agency So WDC is putting zero toward talent recruitment. I would just say if you look at our needs in the county Talent recruitment and building our brand is mission critical. So just a concern that At the local level as of right now, this is entirely on us and we have to take ownership of it Okay, there's tools that the state has to invested in over the years And we can access those tools and make that happen here, but truly it's on us to make it happen Statement number four is Tied to business resiliency and inclusion The resiliency grants and again, we're doing business retention where we'll do the normal Face-to-face, but we're also trying to work through the financial institutions to get to anybody that is being impacted by COVID From the hospitality standpoint thing in other sectors So We're doing electronic surveys now where it's those ten questions I showed you earlier and if the answer yes to any of them There's an appointment virtual or in person depending on the comfort of the company on the far right-hand side I would just note that I will have a business plan contest For the first time I believe in the county And it will be tied to really looking at gaps in services or Products that have been identified by the customer base and that could be by the employee resource groups It could be tied to what we're hearing from the HR directors All of those things come into play because at the end of the day remember the four things we're about is game more people here getting them working and trained and be able to be employed and So diversity and inclusion and then the whole affordability of housing all those pillars are going to be part of The focus we're going to be asking anybody can submit a business concept business strategy But we're also going to be saying how are you going to help us resolve our problems or barriers for growth in the county as Part of this and right we've allocated only 10,000 But I anticipate that Well, I've been directed by the board and I offered this that we will be approaching financial institutions and others for foundations, etc to do a Community re-investment act type investments so that our goal is that we can have three award winners and we actually can provide a Stipend for housing so that they truly can focus in on the business And not where they get their next paycheck to make their family whole and then the county revolving loan fund that was adopted by the county board in December we will be looking at relaunching the county revolving loan fund in First meeting will probably be in March And then the eligible activities and things of that nature will be part of it Again, I talked about that already You've seen the questions. I've asked so you just a reminder This is why you call Chad or myself or any economic development related Person in the county It's really tied to those those are natural activities and business really don't understand When they can access our services so take advantage of it in our capital formation So the first step was to really do the business resiliency grant really trying to deal with coven But over the next two years, we do anticipate creating funds tied to provisional patents prototype fund and Customer feedback we have to get that startup economy going and That is the goal of the board that our innovation strategy was adopted in In January, I want to say 18th. It just seems 18th always seems to come out but so The board adopted our action plans in December innovation strategy in January so and My board chair actually mentioned that after we adopted that he got the most emails he had seen Just because of the presentation and the direction we were going and they were positive thumbs up comments The other thing I would just note is we also will be very definitely be looking at how we connect to equity so equity should not be an issue in this market, but we want to make sure that it's Aligned with the needs of the entrepreneur and that we do this as effectively and Painlessly for both the customer the entrepreneur and the investor So our financing needs In statement number five of five strategies and this is really tied to our innovation strategy Again engagement network is the surge. You've heard that Nick O'Brien has been working that virtually for the last six to nine months But that is trying to make sure again that people that are entrepreneurial or creatives in mindset Have a place that they feel comfortable to share ideas and start commiserating or Hey, I have this problem. How did you get around this problem? And so in the last week, we've had a couple calls at the EDC About this is a product and we've started to try to identify. What's their path pathway forward? Ford company is having challenges as many might be in this economy Launch of a seed accelerator Internet of things in the small business development center again, I mentioned earlier that we aren't rated very high on National level from an MSA for small business. However When Sheboygan County invests in a small business It's capital intensive They they have good investors and they have people backing them So from 2015 to 2019 our startups our small businesses had 47 million dollars invested in In capital formation ranked number one county in the state We just need to start having more of those activities because right now again, those are Some projects are seven million dollar investments So we I think last year we had 15 million dollars in investment one project with seven So we need more of that and we need to build that spirit but I want to just stress that we have I think as good of Infrastructure in the county already to support that growth that I've seen in other markets. I Think where York does an excellent job with our small business programming But the small business plan contest that I mentioned earlier will be under the small business efforts as well as some of the other activities, but These are all the services that you can get from the EDC SC EDC That Ray can has access again. That's a partnership between the SC EDC and UW GB And so that we can actually access resources of the University to help support our businesses at the local level our local innovation community programming See the accelerator does everybody know what accelerator is probably not a Seat accelerator is basically we want to have five to six companies that are equity ready or We are trying to get them equity ready so that we're looking at Then we would provide a ten thousand dollar basically startup fund and Then they would be trying to we would try to get their business model and product Designed so that they would be equity ready for at least a 500,000 to more investment So it's really trying to in a eight eight session timeframe over three to four months we're trying to get from good concept to solid concept with Value proposition minimal viable product to go to market and get investment Engagement models again making sure that we get anybody that is from arts to Innovators within companies. We want them to be part of this community And know that their efforts and risk-taking is supported We'll do pitch competitions. We'll do hackathons Maker fair with the library. We're going to be partnering at the left city and the library We'll be partnering on that and also student-run businesses, whether at the high school or the university level and In 2022, I would say same thing But we're going to try to do co two cohorts and just to give you a sense of the accelerator model We were looking at buying it off the shelf It's a million-dollar investment by the EDC if we would buy it from somebody else So we are needing to build our own and work with corporate talent within the county to make this happen Okay, there are companies that have that skill set here And we are going to try to work with them to make sure that we have a world-class accelerator That I can complete compete globally our internet of things. So probably two years ago You have a local resident that I came with a proposal to start something called the Wisconsin associate internet of things council or like a statewide trade association For people that are trying to make their products smart Using the internet. So whether that's in the health care Etc. Across the board Right now they have 36 I think 36 members, but you can start seeing some of the corporate members that are there that come to Sheboygan as The Internet of Things is home here So right now the EDC is working with the internet Council Internet of Things Council and actually exploring Curriculum on certifications that we can bring to this market to make sure that we retain that leadership statewide So that companies when they start thinking about smart technologies they consider Sheboygan Sheboygan County our resiliency grant Again $500 for search engine optimization Search engine optimization and if they need a e-commerce solution added to that will go up to a thousand We only have a thirty thousand dollar budget. So it's if you know somebody that is in dire need Very definitely get that out we Financial institutions should have this already. If not just talk to me afterwards And I sent that out to all the chambers today Throughout the county. Yeah, I know Chad has that for the city as well It's a one-page application We want the money out to support businesses So we need your help to get the word out and make sure that the businesses are that can really That need it can access it Reminder if you haven't been invited to a cohort We are about engagement about collaboration Across the board across industry sectors Whether it's production staff to professional staff Everybody's part of this the county and part of our community questions, I had 16 seconds left Repeat Sure I was I haven't looked at it in the last month or two, but I believe it would be in the low 3% Angela probably knows that off that. Nope. I would say in the low 3% Arrange, you know, as long as I bring up unemployment. I just want to reiterate this For housing. I just at the state level Anything you can do I know the Wisconsin Economic Development Association, which I kind of have some loyalty to There's two policies that I think really could help communities on affordable housing One is currently in TIF law You have one year at the end of a TIF when you're about to close it where you can use that toward affordable housing The proposal that we have right now is to extend that to three years so that we truly can make a difference on Making investments and getting affordable housing there and the other policy of change would be right now the Most that housing can be as part of a TIF is 35% We would ask that that just be upped a little bit so that I think the proposal was 60 But anything above 35% would just be a benefit so that the communities have more flexibility to do what Because the construction costs development costs are just continuing going through the sky and it's impossible to pencil it out For a hundred seventy thousand dollar home, and so that's critical for Economic development and affordable housing for us to hit target Other questions, yes And earlier in your presentation talked about Creating an environment that you know people we've got great things in Sheboyin County And obviously the quality of life and all the variety of things that people can do is they're going to be a Kind of a push I mean pregnancies are going down reproduction is going down How are we going to transplant enough people to Wisconsin and Sheboyin County and You know specifically to be able to fill some of these jobs that You know are already filled but a lot of companies are looking at hey, you know once the economy gets rolling again We're gonna be adding more jobs and expansion So the question was really how do we How do we continue how are we going to get more people here as the aging of the population? Occurs throughout the state and in the county Without a doubt we're gonna have to do a marketing campaign and that's where WDC was doing that at the state level and They were focused on very specific targets such as the veterans things of that need people like that but we will be doing a Ongoing campaign, but the key thing from my perspective is That our tools have to be able to be used by local companies in their marketing Because we don't have a big enough budget To put a dent in the thousands of people that we need in to fill jobs over the next decade So we need to leverage their budgets in their recruiters and make sure that we as a community and the county through someplace better can close that deal for them because And that's from a talent perspective Trying to recruit production workers and convincing them to relocate Actually, I think that's not as it's a tough proposition because traditionally production workers won't relocate But when you start looking at the type of companies that we have here that are family owned They're not a number in a corporation necessarily in a fortune 500 company That's the type of stuff that we have to do locally here and sell that in someplace better Because then they won't they'll get that sense of community that is truly at least from my perspective and four months on the job is What differentiates Sheboygan County and this market? Yes, mayor People who grew up at Sheboygan and have left for one reason or another and I think that there's some heartstrings that tug on people once in a while to come back to the community that they grew up in So their kids can be raised here and also sometimes as your parents say you need to be there to help them out But how do you plan on? orchestrating this strategy Well, that's still a work in progress. So the question was is I'm getting people with connections to Sheboygan County to come back. How do we plan to implement that? And it again that strategy is something that we're going to be building over time over the summer and into the fall and be working with our Employers and their recruiting strategists and saying how does it work for you? But at the end of the day, I would anticipate some very simple stuff of working with the municipalities maybe having inserts in the tax bills or Doing a postcard at Christmas time or holidays Making sure that people that have Grain kids. Well, maybe they get the newsletter so that they can forward it on so that the kids can start adding on incrementally the the talent community It's hard for me to determine the size of the talent community in year one, but I guess I will just say Over a three to four year period that better be over 10,000 people That at some point in their life, they want to get back maybe it's not right the time because their kids are still Being thought about or they haven't found their mate yet or whatever the boomerang effect at least when I was in Eau Claire We ran a similar program in Eau Claire and was typically for Eau Claire to Minneapolis It was Around 28 29 is when we could start seeing people come back and the challenge in that market in Eau Claire was We didn't have enough positions for people that were fresh out of college So you needed two to three years experience to get Certain types of jobs in that market That's some of the things that we're going to try to analyze over the first six months of 2021 is really looking at what type of jobs and Certifications etc that employers hire and where are the skill sets tied to that so that reverse searches for partners or spouses that if They have somebody that has an offer, but they don't know if their partner can get a job That should be an easy short list for that partner to say hey, we have four companies Old, Wisconsin could be one of them How do I and make sure that they have the ability to connect Sheboygan County is a small County if we can't talk to each other and really collaborate on that Then we're gonna have a tough time accomplishing the goal of Changing that net in migration and building the labor pool that all of our employers need Otherwise the scary thing for me is if we don't increase the population Expansions will happen elsewhere Yeah, well There's a network But but that but that means again for productions people are they gonna ask that question or not and so I agree I agree. I agree. We need to make that online so that they get that comfort level Immediately that has to be the part of the experience of someplace better on the website because if they If they have a hesitancy at all We're turning them off to the county and to the employers in this market So we have to be proactive and make it as user-friendly as possible So that again, we've always put our best foot forward our companies do it's time for us to do that from a community Development perspective Yep, thank you mayor other questions, I was I was just gonna say you're gonna get like five minutes left Thank you Thank You Brian for for enlightening us today appreciate it a couple of quick announcements number one the gala chamber gala Has only 30 seats left. So if you want to spot the chamber gala, you need to register and register soon The next first Friday forum will be March 5th and will be featuring mayoral candidates So we down to two by then so mayoral candidates next month I know one of them is in the audience today hoping to hoping to be there too I don't know if we got two or we just have the one today Anyway, so extremely limited attendance for that so capacity so for capacity So we'll have you register early for that as well Also, lastly want to say thank you to our sponsor purveya health and thank you to the else club for hosting this wonderful meal today Thank you all. See you next month


about to witness an epic Tarot Magnus reaction. Ah, what's happening Magnusite? So, Mar-Vell has released a new Age of Ultron extended promo striking for 2015. You know I'm ready to get this in. Let's do it. The volume is up on this chunk. They're striking alright for both of us. I've seen doing that. I've seen doing that. The hell? Okay, so we got some ant-man. Y'all seen my ant-man reactions. You won't recognize that. Uh-huh. Y'all, that was hot. I hope I didn't bend you on it. I didn't bend you on it. I came down with a vengeance when I did that. You know what I'm saying? That was good. That was good. I'm ready for this movie already. Let's get there. What may subscribers? Boo! Subscribe!


We counter command grabs out here. Let's go How's it going everybody dotted away here back with some more Dragon Ball fighters this time playing a mix on our main team with Krillin Bardock and Jiren. Let's be honest. I think Jiren is top top tier now It is really good. By the way, I mean, that's pretty much a that's pretty much a yamcha cyst anyway Jiren ape is pretty much yamcha a just a little slower and also It has more distance so you can use it in different ways But I think even even if you don't agree with that It's still a crazy good assist by any measure Let me see if I can get a bit of a knock down here. Maybe with some EX rocks now the rocks didn't do much Nice guard cancel key blast like a hit by him proly assist. We reflect those But it didn't really matter.  I Love this character it oh I couldn't get the counter out in time. Nice. Oh, it didn't get the re-jump though But he got the reset grab on me and I oh We take those. Oh, yeah, we got to take those and that was risky He missed the grab it that still try to get a little something after that was greedy Let me get that level three for the hard knockdown. So obviously I love Jiren on this team man He is so much fun, especially with the um The buff to his counter is just ridiculous dude It's not that's not what makes him so good It's a combination of a lot of things, but it does really help I know a lot of people were trying to undersell or oversell the counter But it's probably somewhere in the middle. It is good. It's not ridiculously broken But it is so much more versatile And I think it really allows Jiren to have an easy out to a lot of situations, especially considering it is um Also slightly harder to vanish out of than his previous duration. Oh Level three why I didn't do it Is this where we spark? Yeah, this is where we spark. There's no need to get Help me Jiren. Oh Jiren. Y'all should want to stop that. He probably wouldn't have but I got a I got Jiren's the type to get motivated by stuff like that. No Jiren help Maybe I just needed to genuinely ask for help. Oh I was hoping the side of me would hit me man That's okay, we'll be all right. Oh, maybe we won't be all right damage Napa's crazy. Good. I like Napa. Are you command grabs in 2020 I take the We counter command grabs out here. Let's go All right, don't block low. Yup I knew something about Jiren man. People just don't want to block low I think we kill here by the way because these two level ones are strong when put together Destructo disc. Oh, that was a lot not even fun. That wasn't even that great of a combo But now we have a three character or two character advantage. Sorry. That's it. It's over. It's gotta be over It's gotta be over now. I mean, what do you do after this? Do you level three? I guess I Fumble the bag, but that's okay. We pick it back up. We're running. We're running with it Bag has been secured once again. I'm gonna have to go EX rocks Dragon rush that Little too slow.  I know we have a lot of health But I don't sleep on this character not anymore not after not after the great Napa TOD of 2020 What I got to do like that. I knew it was over for me I would never trust Napa again, but we do take those gonna get the first win here Even though it was honestly, it was kind of close It was a lot closer than I would have preferred it to be all three of our characters were leaking. Oh It's actually been a little while since I recorded so I forgot about I forgot that we can only go first to two Arksis, please at least buff into first the three. I'm desperate. I wanted a limited rematch back But at this point I'll take anything nice challenge. I definitely Tried to throw out way too many crouching lights there I'm down taking just in case each no, no, no, no. He's gonna reset me. I had to spark there I was I was gonna get reset Alternatively you could also just have good defense, but that ain't me Please respected that you tried to get me with a cyberman you little cheater He I was wondering why he was being so patient on defense and then I saw that little I Saw the Simon kind of like sneak by I Can't believe this man tried to get me with that. No, no now. We're playing a different game rock Bro, please that set up is born made for oh We were supposed to get a killer. Oh Beautiful the beans gonna do it for us. I don't know if we're gonna be able to oh, we're gonna have to spend the bar here I don't know why I'm buying so much time. It's just gonna make it harder for me to in the end But one bar still gonna get it done.  Did he spark after that? So you know what? I'm actually gonna say that was somewhat worth Trust that's fine Step back we take those all right. I'm feeling really confident right now. I am feeling really good about this Look at that man the Jiren assist the range you can get off of it is not bad at all I gotta learn. I gotta get even like my Jiren is I'm okay with my Jiren I definitely think as of right now I can play him and it's fine, but There's definitely a higher ceiling for me out there. There's I mean Poor curling dude, there's definitely a higher a higher Jiren ceiling if you would like to get to that level Like right there. I'm bad He's gonna back that I might not be able to ride any amusement parks rides, but sometimes this small height is a blessing Let's go. Oh, I didn't block dude. I'm I don't care that was so See this is why Krillin is good if Broly's good That means Krillin's good because I'm just countering Broly's out here. You've got it You've got to give Krillin his respect. I don't know if there's gonna kill Nice, I didn't think I'd be able to go back out in a bar doc. I was kind of I was kind of waiting I was like, I don't know if I want to let me switch out. Let me just oh Oh no Sorry, but that's a that's a no that's a no for me and now we zone. Oh No, okay. Well zoning kind of ended. I got I got too greedy. I was going for another counter I wanted another gotcha moment That's probably my weakest part about Jiren is that I'm so addicted to going for the counters that I will throw a lot Of way, I will do it as many times The range on that was insane great conversion But I got to take these I'm bad at the game about it video games. Give me that. Oh, no. He's just gonna keep yanking me out of the air Please just for one key blast dude Yeah, beautiful. Oh, that was such a risk dude I thought he was gonna follow me with that jumping too heavy If you don't know that button for Broly basically just means he falls down feet first and I've never been able to 2-H that I Missed it every time but regardless of that We do take the set and now we can move on to our next game with whoever that opponent might be well We are back and we actually found the exact same opponent, which is pretty cool. I See normally this wouldn't even be a big deal a third match with the same guy But Arxes has decided that this means a lot more to me now. Oh the bean does hit. I was hoping he block it Never mind. This is beautiful. I love it here forget everything else. I said, you know, why not just why not? Why not just throw all of this out?   Give me what I want.  I Want that blue life give it to me. I'm sparking dude. I'm literally sparking out No resets, I don't like him Damn, I have to take this kill.  I'm gonna grab Dragorosh. Oh Come on. I could feel that you wanted to do it. Don't even lie. It's a you did it. Give me the blue life Boom key blast. Oh that works for me. Oh Finish finish. Ah, so that did not work for me actually that that would be so I guess it's not a key blast But that would be so sick Little jealous, aren't we a little jealous? I'm gonna hit you with your own Broly tech something into level three That's a very Broly move. You're gonna do it, too It didn't kill so that was not a Broly move But in a different life that should why is you know what why is Jiren's level three not? Let me stop. I don't want Jiren to get more buffed But I feel like Jiren's level three should be Broly level three like in terms of damage. Ow. I love the counters Beautiful This character is sick. I want it all Look, I wonder if I could have command. I wonder if I could have countered that I actually don't know how it works with 60 if it works with if it works with Broly I assume it works with a I'm not gonna get smashed on that. I didn't think that would it Man, I wanted to see that counter so bad. All right, whatever We are safe there so we can block Looking for the command grab we jump it Just enough range on the down medium and we are going to take this I think let me stop But I think it's guaranteed that we do take this here It is game one goes to us with a dominant performance from Jiren I kind of shut up near the end because I was let's be honest I was a little worried about folding over to Android 16, but the boys got it done Jiren can rest easy See he brought it back for the final game screen Thanks so much That was crazy the first how that game started was ridiculous.  All right, you stop me You stopped me, but can you stop a beam? I love just stuffing that it's really hard for Dappen to get in So I guess it doesn't make that too much easier when a not spark dragon rush Oh, what a mistake by me. It looks like we're gonna get a kill. So to be honest I guess I don't mind too much, but oh, what a mistake Does this kill? No, it didn't we'll use another bar.  Oh Wow, I thought that was bad. I definitely saw Jiren go away and in my mind I just couldn't come to accept that fact. I was like, well, he'll come back. He'll do the assist All right, I respect it To us you got to respect it right back you have to respect it That one was a fake and I don't even think I intentionally did that to be honest Yeah, it was more of just a luck a luck thing Jiren level three. We're gonna waste all that sparking time and now I want to put you in the mix. What do you do? Well Not much against Jiren. It turns up. I didn't even have to use a bar. That was great considering I don't think I did that combo correctly. We take those Beautiful and look at the corner carry on this guy We're in there love another level three. I'm really worried. He's gonna level three. So I'm actually not gonna get to I'm not gonna get To overzealous. I'm worried about his level three. So we're just gonna go in. Yep Yep. Yep. Yeah, I wish I could say I didn't know I wish I could say it wasn't something on my mind I'm just gonna punch. We're gonna beat this guy with a counter. Come on. It doesn't get better than this character I love this character Hey play my alien sound effect. I don't even know what that is, but it works dude. It works for the character I gotta get out of here guys.  I can't tell you how much I love this team Obviously missing Yamcha is a bit of a disappointment, but Jiren is just so much fun Thank you guys so much for watching Let me know your favorite moment down below in the comment section and let me know your thoughts on Jiren in terms of How strong he's in the game. Do you also think he stopped here or do you think he's somewhere in the middle? I would love to hear your thoughts on that down below in the comment section while you're down there Make sure to like button and subscribe to the channel to stay up to date on all things fighting games and Dragon Ball fighters other than that I have been Dr. Doha, and I will see you in the next one


We are a Charlie Company first of the 138th Infantry Battalion. We were actually the main effort for the battalion. Our mission was to essentially stop the enemy from advancing forward. Tonight's engagement, we were holding our fortified position here. We've been in this position of fortifying it for the last two days. And tonight we were hit by a very large opposition force. All of the fighting holes, my guy is dug by hand. The goal was to set up an ambush where we could draw their armored vehicles into a kill zone directly in front of our position. And we were on the tow carrier there at the base of the trees. Well the enemy thought we were on top of the hill and we ended up killing three tanks before we eventually got spotted by our third pack blast. I mean we held them off as long as possible. Took down three of the enemy tanks. We lasted a long time in the delaying effort. Communication tonight was fantastic. Right at the last second we got reinforcements from Alpha and Bravo Company. We had never worked with these guys before, ever. It was dark, we couldn't even see each other's faces, but yet everyone communicated fantastic. Just the coordination, the communication, and just the breakdown of chain of command was probably the best I've ever seen when you throw in guys that had never worked together before. That was outstanding. I'm super proud of them. I could not be prouder of my soldiers tonight. Not just my platoon, but all the guys that were out there on the line with us. It was second platoon, guys from Alpha Company, guys from Bravo Company. I've been an NCO for 11 years and I can honestly say I don't think I've ever been this proud of my soldiers.


So for the very last talk of this evening after learning how to break into intercoms We're gonna learn a huge number of ways in which you can break into ATMs We got here Olga and Alexei. They are part of the penetration testing team at Casper's collab and They will tell us more about this. Thank you So most of you use bank cards to buy something in shops and malls and other places But sometimes you need cash. For example, when you go to the lounge and want to buy some chunk and You need to go to ATM and You look around and search for skimmers for hidden cameras for some fake pinpads or some other stuff from bad guys and If is everything okay, you will insert your bank card into ATM enter your pin enter amount of money and What do you can see? ATM say that there is no money for a long time From Bankside, it is this ATM is full of money That's because some lucky hacker Maybe right now Jacked all money from this ATM And if he was really lucky He obtained quarter quarter million euros and that's because ATM this ATM is not ideal So today we would like to tell you about ideal situation when ATM is secure with several level of protection and Time to say hello I am Olga Kochitova and he is my colleague Alexei Osipov. We are from Kaspersky Lab We get our knowledge from ATM and post security assessment penetration testing forensic investigation and other funny activities But first of all, let me give you several words about ATM in general just for your understanding You might be familiar with various type of ATMs For example cash in or cash out ATMs or even recycling systems It might be a standalone ATMs or through the wall ATMs, but it should be noticed that there are Several ATM vendors around the world They just Take small parts small hardware units produced by various manufacturer and put it together into the box and call it So it's just a Lego for big vendors for big men's So the top box of ATM called service zone or cabinet There are PC that just usual PC card reader pin pad and so on the bottom box of ATM called safe There are some financial devices such as dispenser to eject money or note acceptor to insert money and so on All hardware units connected to PC through serial or USB ports the main main Software is a Microsoft Windows based operating system and the most case when ATM run on Windows XP Despite the fact that Microsoft stopped to support this operating system almost three years ago There are also Main ATM software which provide graphic user interface to interact with customers or with service engineers other part of this software is a Piece of software to communicate with processing center to interact with bank networks and The last one part is device control systems There are also some security Software such as antiviruses integrity control systems or videos reliance, but there are also and often some very creepy software and very needless software and Sometimes this software gives attacker unlimited control to this ATM What about devices devices are unclear there are some strange microcontrollers with real-time operating system and Usually guys who love it the pro very sad about it On the slide you can see a small schema of ATM and it is not complex and very linear It should be easy to implement secure communication Generally, no data from hardware units needed inside ATM And only requested by so-called processing center That make decision to give or not to give money other components should just relay data wrapping it in additional Security layers like onion in tor networks To get to data or money one should uncover all layers or Be very near to money In Wonderland all ATMs are secure and let's see how The lowest level is closest to money and very important to protect Money contained in the cassettes and In Wonderland cassettes are themselves secure. No one can get money from them without any special permissions They are not only physically secure, but also logically secure if someone will try to eject money It will be evident and very hard Nonetheless if someone will steal the cassettes It will be easy to trace them and if someone Will try to open the cassette money will be destroyed for example on the slide you can see money destroyed with hot glue In extreme case even if cassettes is open and the money are not destroyed Bank can trace banknotes by different means for example by using sequential numbers on the banknotes and they can be traced like in the movies and Not only cash is the goal for criminals They also hunt for card data But in ideal world card data can't be stolen There is no static data to be copied and as for dynamic data It uses a challenge response schema that protects against relay attacks and in this case that data cannot be stolen But it was only in Wonderland because since bank card contains Mcstripe It can't be intercepted and the MV is not a panacea Until there are places and even countries That don't use the MV chips there is always possibility to withdraw money knowing only Mcstripe Even then there is possibility for online relay attack you insert card and some ATMs But money is dispensed from another ATMs As for cassettes, they are not so secure Most of cassettes have all mechanics to eject notes outside of cassettes So it is possible for attackers to get cash by using only screwdriver And if money was stolen it is hard to trace them because it is still hard task to Mark them and to know where they are used So let's up to level one. It's a hardware units level And as I already mentioned attacker Can get quarter million euros From each ATM. I think it's enough amount This amount of money is enough for a couple of chunk for everyone and typical dispenser consists of four cash cassettes and one cassettes for ejected notes. There are also Many sensors, leds and mechanisms which withdraw money. Some of them eject money from cassettes Other ones presented to the customer Other ones check size of banknotes and so on So it looks like firmware should be very complex The other interesting device is card reader which used to Read Mcstripe and also used to communicate with chip to conduct financial transactions And to check biometric data contained on the on chip regarding much on card technologies This device also should communicate with other units Such as pin pad for offline notification and biometric devices for biometric authentication Pin code is used together with Card data for client authentication. It is the most secure element Because of different standards PCI, EMV and other standards provide the bottom line That pin patch should comply too But not anyone knows that there are two modes of operation secure and open Secure is secure mode is used for pin code and open mode is used for other inputs. For example, when you enter amount of money Biometric authentication gains popularity because of increased security There are different kind of recognition such as iris, fingerprints, face and so on Such features uniquely identify user. So it is considered if they are presented to ATM such user considered good Such features can be revoked or changed Our only processing center Can send comments to hardware units and hardware units and the decade with processing center But sometimes authentication guarantees integrity of comments, but data should be also protected with encryption In ideal situation this data is only needed in processing center Because firmware controls hardware units. It should not be easy modifiable, but it was another lie Unfortunately only so-called sensitive comments are undeticated. For example dispense, but not present if we speak about dispenser Rumor has it that pin pad encrypts all data that comes from it, but it Encrypts only pin code, but not data and active man in the middle attack can change one comment with another Good thing is that pin codes is encrypted in such a way that data Can be decrypted only in processing center. Why it is not done for other hardware units? It's a question. I don't know It's for firmware modification firmware is often Stored on the ATM hard drive as a hex file and Actually, it's not that hard to add some piece of code to existing firmware to create hidden backdoor It will react on sequence of the money dispense if you are speaking about dispenser PCIe standards create baseline for card data security, but these standards are not enforced and easily bypassed by banks Also, there are no such standards for biometric devices And I think it's strange because you can easily change your pin code or you your bank cards But you cannot change your iris or your finger And additionally, there are many systems which use biometric indication such as Passports visas and so on It means that if you lost the biometric data, you might as well lost your identity and Thank you so much these guys who build this wall Okay, we have spoken about hardware units, but all these hardware units should be somehow connected to the PC computer to the processing center and so Often it's just ordinary comports or USB devices But it's often forgotten that USB. It's also a bus and there are different Researchers that you can easily Google that connect some device to some port of the USB USB hub and obtain all the data that is transmitted over the other lines and Often banks unfortunately say, okay, we have USB connections No one ever can sniff this data transmitted and so on but unfortunately, it's not the case Some older ATMs use so-called SDC bus it's eras 485 with Common line and every device on this bus can send comment to another device and often it is used by malicious guys who understand how it works and unfortunately ATM vendors and banks weren't prepared for this situation Discommunication lines Also should be considered Vulnerable and also should be encrypted and In ideal situation in Wonderland these communications are encrypted the data that is transmitted isn't encrypted It's actually easy to know to create and there are even some startups which protect USB buses from Hardware tags that protect communication between them, but unfortunately Unfortunately, they also don't understand how these devices work and Sometimes it's only a security by obscurity and Doesn't create any new protections a new security to protect the devices that are connected to where USB bus and so on We often heard that tampering with the cables with the wires is very hard and no one can do it and And you you will see in the Future slides that the bad guys are already there and here's small presentation What can do some device that is connected to the USB of the Dispenser, okay, so here is our testbed our ATMs lab and here is our attacker who Maybe bought key from the internet or from it from an insider Attacker bypass the first level of security is a physical level and Disconnect USB cable USB dispensers cable from the ATM computer and Connects it to a specially crafted device in our case It starts very pie with a piece of code and the Wi-Fi don't lend the battery Now we can see that dispenser is in the red box and It's on offline, but it still works attacker send Dispense comments just using their smartphone to Raspberry Pi through Wi-Fi and Wi-Fi send these comments to dispenser directly and it means that By past all security measures which implemented on the ATM computer So only a couple of minutes and our attacker As you can understand this attack might be repeat for many many times Until ATM became empty Okay, we spoke about USB devices and their connections but obviously there are operating system that controls such devices with Different software different software means as Olga already mentioned. There are It's a windows based operating system often it's windows XP and we often heard from the bank that they I think Half of the year ago some bank told us we finally finally managed to move from windows XP to windows 7 Come on guys. It's windows 10 already and so and you're a bit late a bit There are service providers that are generally represent communication with the devices in the ATM machine they are not the drivers the use of pace and Communication is done by leap USB library and Actually, if you connect it much if you install on the ATM Linus operating system all the devices will be presented as Leap USB devices so with their their names so with what they do and Actually, you can send any comment to it as you already seen in the previous video and This service providers are created by manufacturers and As Olga said, it's a Lego that they combine different devices from different vendors So there is a middleware that intercommunicates from application that actually displays information about amount of money this crappy Spam with the different new credit cards and so on on the ATM machine It communicates with Express manager. It provides interpret Interpreter it provides communication between the software and the service providers. So any Any person can create their own software That doesn't know anything about ATM machine, but knows the interface of communication and Windows application is just a graphical user interface. It doesn't do anything. It just Gathers information from the user from the devices and sent to And send the processing center, but unfortunately, it's an ideal situation an ideal station There is they're only proxies. They don't Do anything they don't understand what is going on. They just doing what they told from the processing center They start secure communication. But as you have seen in the video, there is no secure communication with the some devices like dispenser I didn't know why This application has minimal interface. It doesn't provide any features any Additional technical information about the ATM machine about the communications, but unfortunately All ATM vendors all banks are lazy. They don't want to spend money to create different Images of operating system different software to use only in technical means they implement everything in one application and Say, okay, we are not secure on the right slide of them On the right side of the slide you can see to can that is With us for many many years. It was based on XFS and banks already say, okay We know everything about malware if we will shift From the XFS manager from the communication. We will be 100% safe But unfortunately on the left-hand side, you can see Another malware that intercepts communication with from service providers that just give us all information that are already there without any intercommunication with XFS manager and Unfortunately in Wonderland it ends a secure but in real situation it ends are very vulnerable because every Piece of software in the slide of windows application system or XFS manager service providers can issue one comment to Eject money to get the information about your credit card to get pin codes by when the middling access to the pin pad and so on and Unfortunately, we have seen such cases There are different bad guys who already attacked different banks With such target they install sniffing like wire shark or USB pick up They intercept all the data that is transmitted between Host computer and card reader. They get get all information about your credit card the very same information that is used for your transaction in clear text and Send it to every through a server in the internet because ATMs are generally connected to internet Unfortunately, it's a problem and If you even go to the ATM machine Watch for different schemers different cameras and so on it won't help you because your data is transmitted internally in the operating operating system to the processing center and so on and unfortunately We've seen such malware that don't use general utilities. They use access to service providers and Olga will show you example of such a malware So here is our video again This is backdoor Schemer Which we investigated with our colleagues from great department several months ago. This malware activated by using special cards Now we can see the window To enter the special password Also attacker can enter number of Comments for example to dispense money and Also attacker can enter the number of cassette to dispense money from one more it was a real malware which is Widely spread around the world and Every example was targeted for various country and You should understand if you are attentive enough that When hacker Inserted the cards inside of ATM. It was returned immediately No data was saved on the ATM host computer It was intercepted just before the logging system even understand that something happened to the Cartreader then intercept it intercept all the data that is inserted in the pin pad and There is no evidence no no nothing for to investigate and often banks got Won't won't understand how to actually happened and unfortunately in many cases There's no even video surveillance to understand What they did and how it is done Okay, but we were speaking about window spreading system about Cartreader about USB devices But actually how hard to get into the ATM machine to access these interface devices to Send comments and so Sometimes banks Very very protected. There are even some ATMs inside the trucks with the Policemen so nearby We're often here that in Europe It's not the case because all ATMs are through the wall ATMs and they're physically secure We often hear that they are still in concrete sandwich with different protections against a physical attacks There are different alarm systems and no one can do anything in Five minutes and get all the money Operating systems is just a platform. It doesn't do anything. There is always protected by windows XP with MS 08067 That it can be attacked from anywhere in the network It has robust updates. Yeah, you know XP and different integrity controls the last measure to protect the Software on the ATM machine to protect that there's nothing nothing more than already on ATM But ATMs are intercommunicated with at least processing center and ATM management system Often it is very easy to for security special for network specialists Sorry to connect all ATMs in the single network. What why not? They all in the same broadcast domain They see each other, but it's completely safe. Nothing will happen They're just sending communication customization data to the processing center and Nothing will happen. But unfortunately physical access is much much more easier than they suspect this guy with Drill went to the ATM machine made a hole in it and Get access to the interface cables. It's a real footage and all the money in this ATM was lost by the bank and Unfortunately, there is no alarm because no one actually opened ATM machine and they say okay No one opened no alarm That's fine But in many cases, they're even laser. We have Modems near the ATM machines. We have for example on the left bottom side of the screen Open ATM because okay, the duct tape is okay We have seen we see through the wall ATM with all the communications outside of it and easy access to the inside of the Building whereas ATMs situated and so on USB devices and other other stuff because Opening ATM going inside of it with the keyboard and something something else. It's actually very hard to do on the level five we have people because Every system is actually communicating with people and some engineers should do different stuff with it And when we showed you the schema of ATM, it's actually was a lie because schema is much bigger We have different office computers. We have administrators. We have different online banking. We have Processing center. We have different databases From the point of view of a tester. It's a huge system that can be affected on many many levels for example ordinary phishing we have administrator accounts and often these administrators are not trusted for managing office computers and There are different departments for example for ATM machines for office computers and so on and in this case ATM administrators are often not so competent and don't know everything about their systems as Already said that there are different ATMs in different locations sometimes they are connected with 2g network because it's very cheap and very secure because When some security specialist in bank opened the Specification on on the GSM network. They see okay. There is encryption Okay, then all communications are safe But unfortunately as you have seen in your mobile phones on the Congress you see the network the good network that you connect you can connect with your device and Send data send calls and so on actually Your connections with 2g networks can be intercepted and what we've seen much Much more often that ATMs are connected to the small network that there are all ATMs Seeing each other. There are different There is a domain controller for these particular ATMs that can send updates to different to all ATMs in this network and It's not a scary thing that when you speak about a couple of ATMs and so on But unfortunately, there are hundreds of ATMs in some banks that can be Attacked with just one button installing the group policy to install for example malware and disable antivirus and And it's often forgotten that actually ATM It's not a box. It's often an entry point and Attacker can affect only one ATM to Get the data inside of network and for example RPS buffering. I don't know Olga and the last point from our test bed attacker discovered some ATM network with wrong settings and Got physical access to internet cable He disconnects internet cable from ATM and Connects Raspberry Pi again to ATM networks network This Raspberry Pi consists of a piece of code with Rugby processing center which emulates the real one Now all ATMs in this network are under control of attackers and Friends of this attacker can come to ATM to all ATMs and do something look looks like regional transactions and and They can use any pins any cards and they can Change the cassette to withdraw money from and of course they get money And now attacker Returns to ATMs to remove this very important device And leaves no physical evidence of this attack, but please don't use these ways to get money to chunk Or for other reason And actually what you have seen in these videos It's a real problem because so when we hear okay five minutes and the security guys will get to ATM with alarm system, but unfortunately all these videos are less than two minutes to install the Hardware to install software and to get to ATM and with to withdraw money It's often forgotten that unfortunately computers are real fast and People are not well There's no conclusion from our presentation because Consecurity of the ATMs are like this guy They are trying to protect some pieces of the network of ATMs they Shift from ATMs to they give the ATMs to some third party and only List them and so on and they hear from the internet. Okay There is to can then we'll install the Antivirus on the on the ATMs. Okay, there are black box attacks Then we install the hardware inside of our ATMs Okay, there are something else and they will install something else actually it's a cat-and-mouse game and What we shown you it's low hanging fruits that can be easily accessed by criminals and already accessed by criminals and often we don't hear about such cases because Banks are very discreet about their problems and they don't even share these problems with other banks It's often a problem because in many countries some bank is affected for example with black box attacks it will say we have no problems and Another bank in the same country will affect with the very same attacks and they are not prepared for this ATM vendors often are Not so fast to implement security mechanisms to implement their Their hardware to protect their the banks and often they say We don't have a problem. We already sold you your ATM and They don't want to invest any money Into protection and when they stand them but unfortunately in many cases architecture is bad and you should feel bad about it We know that Many vendors I think all of them Already tried to create newer versions of the ATMs win with newer operating system with newer hardware We want to ask them Please do it more open not open source do it more open to security specialists to banks Because many times the vendor create problem But often very often bank also create a problem because they don't want to implement all features that are already there and often there are some problems can be managed with updates with Configurational options with passwords or come on and There is small list very easy to understand if First comment or third comment to return anything about your ATM machine. You are screwed if second comment returns Anything that looks like error the main team viewer and other software that you don't know what what is doing. You are screwed You spy shark ways and use be pick up on the ATM machine just install it Press the button and accept all the traffic and see Do you see the car data in the traffic because it's a real problem? It's not that hard to intercept USB communications not only with software means on the computer But also with hardware means For example bigel The hardware to insert data on the USB bus costs only 500 euros, I think or dollars and Quater million is In one ATM machine what we want to see only on not Tor Obviously, but only on protection for different levels of communication. We have chain of failure with Any part of the ATM Infrastructure that can send one comment to ATM machine and get money from it to get that can get the card data from it and so on Understand that unfortunately security is a process and there is always a lowest bidder who create the security in the ATMs or any other device. We know that you you have different Means to create money, but you always have means to lose money by Allowing lowest bidder to create your security Actually be excellent to each other Vendors should spoke to banks banks should spoke to vendors Unfortunately for the ordinary customers we're all screwed because Software sniffer is completely in deceptible from our point of view and if you go to ATM machine Be aware that your credit card data can be stolen with all the security measures and security mechanisms that you Can do by yourself. So it's actually problem of the bank and if you have a problem with for example with skimming And some transaction Was get with your credit card. It's not always your problem. It's maybe a problem with the bank We want to thank different guys some of them here some of them Unfortunately not here and to help us with our research with reverse engineering with I think dispenser for example It's a real pain in the ass and Have fun. Stay safe. Thank you Questions may raise the signal Yo, go we got a question from the internet. Yeah, there are but it's quite not quite in here Yo, can you just go out quietly? Thanks. So first question from the internet is you quietly Oh The internet wants to know that well, you've said there are some default open ports on the ATMs. Which ones would that be? We don't know yet We can disclose this information because Unfortunately, we have we see the ATMs in Shodom. We see ATMs with Masked and this information can lead to a large amount of fraud against the ATMs So we can disclose them. Sorry Hello So just I want to add one note It's not always the problem of the bank itself It's more sometimes. It's more really the problem of the vendor of the ATM and the part of like like as you said it it's a normal PC what's inside the ATMs and If the bank want to now to upgrade to Windows 7 or Windows 10 or whatever that The hardware does not support it. So You can basically change it to off the shelf PC, but the vendor says we will know We'll don't Support that or we'll give no warranty if you change it yourself And they asked for just normal PC a lot a lot of money and the bank of course would say no It's too much for me and we keep it at XP. Yes, unfortunately. We know about this situation, but We also understand that there is 10 years or 15 years or 12 20 years that ATM was working and this was working fine and banks say okay I want to make it secure without any additional investment. Unfortunately, it won't help. Yes, we know that there are different problems in the operating system, but there are also Different problems in the software that is run on this operating system so it's actually a very fuzzy situation and We can't say that someone is more wrong or more right in this situation. We should all combine our Expertise our money actually and create much better atm's In course of many many years maybe but I think The sooner the better Thank you Have a question here On the red. Why do you think the ATM vendors don't invest more into Linux based atm's? I mean they could they could do that Yes, they can do that, but The answer is legacy code. They Already invested large amount of money into the XFS because it's not XFS. It's Microsoft extension for financial services, so it's actually very Tired windows, but we already know that some vendors already shifting from the windows to Linux based operating system, but and we want to see it in the we will see it in the nearest future So I think the station will change Sometimes maybe Guys your research is amazing And I really appreciate the work you're doing I'd like to know given the prevalence of all the rise in Bitcoin atm's and the fact that most of the software for bit Or some of the software for Bitcoin atm's is open source. Have you done any research on that? Or are you planning on doing any research on that? Unfortunately, we haven't seen this atm's with our hands. So unfortunately, no, we haven't managed to see them and we would like to Get in touch with the Bitcoin atm's, but unfortunately, they're so rare and So it's not worth it, unfortunately for now. Thank you Thank you for the interesting presentation some of the Attacks that you presented require a lot of Internal knowledge for example the one Where the attacker? Includes on the network. Where do the attackers get all this knowledge about the architecture and infrastructure Unfortunately, it's not that hard because there are all Windows based again and general penetration test is Accessing the domain controller with the highest privileges and it's actually not the very very different from taking the atm machines and obviously there are different engineers in the bank who have different technical information who have different software different test software that can be stolen and Sometimes they even share this information to the large amount of people For example by uploading the project on the github and you can download software from the atm Just like open source and some Yes, so in terms of the atm management systems I'd like to ask if you had a look at like if I serve and Software that's like big vendors used to manage like big atm networks If I serve or even like a trend that's some atm networks you see in even in Europe They start having systems to manage the advertisements in the loading screens and so on you do any sort of research on that as well unfortunately know because There are different large systems to manage atm machines, but there are always lazy People lazy administrators who install additional remote control systems devices and even device. Yes, so unfortunately now It's a fun area. Thank you Thanks again for the amazing presentation I was wondering if you had cases where the security was better than what you presented and Especially when the serial buses communication had any any encryption at all Yes, obviously there are different atm's different vendors different banks and we show new extreme cases and We can say that any atm Actually vulnerable to at least one vulnerability that we have shown you from the management system from the network just network without any internal knowledge from the physical access from the Usb access, but there is no atm that has all the vulnerabilities in it. So we have seen Secure atm's but not very secure. Thank you Okay, the internet wants to know How easy would it be to get an atm into a kind of out-of-service mode that is not really really easy to fix So basically how hard is it to dust atm? With Razor or to cut the cable. It's very easy, but Denial of service in atm's if I understood the question correctly It's a bit out of scope of our presentation because we we as the attacker as the Protection tester we want money from atm, but not to disable it Any more questions?  Yes, so we made presentations about atm security for quite a while I think you can see the this presentations in our Twitter's There are different possibilities like just to gmodem 3 gmodem 4 gmodems ordinary as on net cables We have even seen x25 and telephone networks that are communicating with the processing center I don't know for which purpose. Yes, there are different additional security mechanisms like VPN clients hardware hardware and software for example some device installed inside of atm machine and connect From the atm to VPN client and VPN client to the alter network But the big problem is This particular device for example hardware device you have seen in our presentation that is outside of atm and some hacker can disconnect the internet cable and access this atm machine and More important by disconnecting the internet cable and connecting to the VPN client. You can connect to the network of atm machines So and many of you maybe have seen atm machines with ordinary windows Window that showed oh, I can connect to the VPN server. So they use everything and there is no No identical atm in different banks okay, and I have one final question from the internet and That is would it be possible to Make the atm accept your own cassette with like your cash Maybe the question was about cash in device that accept the bank note inside it That is not original. It's not legitimate. There are some there are such attacks and Obviously if answering the question about the cassette the responsibility to Deal with the security guys who exchange cassettes and install for example cassette with just a blank paper, but it's very rare and They are easily gotten by policeman policeman There is a question over there. Yeah, is there any different operating system installed in the atm linux for example? Yes, there is os2 operating system for example in America The red even DOS based as for Linux. I haven't seen any but I think there are there are but the most Often case it's Windows XP still still alive Okay, thank you very much. Thank you